added album to photos, renamed gallery view

wired new locations into gui, fuse acceptance with new permission based mounts
cargo fmt
2026-11-03 16:41:26 +01:00 · 2026-07-31 20:31:25 +02:00 · 2026-07-31 19:37:12 +02:00 · 2026-07-31 10:18:30 +02:00 · 2026-07-31 10:15:13 +02:00 · 2026-07-31 09:46:51 +02:00
78 changed files with 25936 additions and 6154 deletions
@@ -0,0 +1,59 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  rust:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install native dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            pkg-config \
+            libfuse3-dev \
+            libgtk-4-dev \
+            libadwaita-1-dev \
+            libwebkitgtk-6.0-dev \
+            libsecret-1-dev \
+            libdbus-1-dev
+
+      - name: Install minimum supported Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: '1.96'
+          components: rustfmt, clippy
+
+      - uses: swatinem/rust-cache@v2
+
+      - name: Formatting
+        run: cargo fmt --all -- --check
+
+      - name: Lints
+        run: cargo clippy --workspace --all-targets -- -D warnings
+
+      - name: Unit tests
+        run: cargo test --workspace --locked
+
+      - name: Account-free filesystem acceptance
+        run: scripts/fuse-acceptance.sh --offline-only
+
+      - name: Acceptance runner safety guard
+        run: |
+          if scripts/fuse-acceptance.sh /tmp >acceptance.out 2>&1; then
+            echo "runner unexpectedly accepted a non-FUSE path"
+            exit 1
+          fi
+          grep -q "refusing primary non-FUSE path" acceptance.out
+
+  # Real Proton credentials and /dev/fuse deliberately do not run on pull
+  # requests. Follow docs/TESTING.md on a dedicated test-account runner.
@@ -13,6 +13,7 @@ jobs:
  build-release:
    name: Build and Release
    runs-on: ubuntu-24.04
+    environment: 'rpm signing'

    steps:
      - name: Checkout repository
@@ -35,11 +36,29 @@ jobs:
      - name: Set up Rust
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
-          toolchain: stable
+          toolchain: '1.96'
+          components: rustfmt, clippy

      - name: Cache Cargo target
        uses: swatinem/rust-cache@v2

+      - name: Verify tag and manifest versions
+        if: startsWith(github.ref, 'refs/tags/')
+        shell: bash
+        run: |
+          tag_version="${GITHUB_REF_NAME#v}"
+          manifest_version="$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -n1)"
+          pkgbuild_version="$(sed -n 's/^pkgver=//p' packaging/PKGBUILD | head -n1)"
+          test "$tag_version" = "$manifest_version"
+          test "$tag_version" = "$pkgbuild_version"
+
+      - name: Release quality gates
+        run: |
+          cargo fmt --all -- --check
+          cargo clippy --workspace --all-targets -- -D warnings
+          cargo test --workspace --locked
+          scripts/fuse-acceptance.sh --offline-only
+
      - name: Build release binaries
        run: |
          cargo build --release --locked
@@ -76,6 +95,8 @@ jobs:
          mkdir -p deb/usr/share/applications
          mkdir -p deb/usr/share/icons/hicolor/scalable/apps
          mkdir -p deb/usr/share/licenses/proton-drive-linux
+          mkdir -p deb/usr/lib/systemd/user
+          mkdir -p deb/etc/xdg/autostart

          # Copy binaries
          cp target/release/pdfs deb/usr/bin/
@@ -85,7 +106,9 @@ jobs:

          # Copy desktop integration files
          cp packaging/io.narl.proton-drive-linux.desktop deb/usr/share/applications/
+          cp packaging/io.narl.proton-drive-linux-tray.desktop deb/etc/xdg/autostart/
          cp packaging/io.narl.proton-drive-linux.svg deb/usr/share/icons/hicolor/scalable/apps/
+          cp packaging/proton-drive.service deb/usr/lib/systemd/user/
          cp LICENSE deb/usr/share/licenses/proton-drive-linux/

          # Calculate Installed-Size in KB for the control file
@@ -132,6 +155,26 @@ jobs:
          # Copy built RPM to root directory
          cp rpmbuild/RPMS/x86_64/*.rpm .

+      - name: Sign Fedora package (.rpm)
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+          GPG_KEY_NAME: ${{ secrets.GPG_KEY_NAME }}
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+        run: |
+          if [ -n "$GPG_PRIVATE_KEY" ] && [ -n "$GPG_KEY_NAME" ]; then
+            echo "$GPG_PRIVATE_KEY" | gpg --batch --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" --import
+            
+            cat <<EOF > ~/.rpmmacros
+          %_signature gpg
+          %_gpg_name ${GPG_KEY_NAME}
+          %__gpg_sign_cmd %{__gpg} gpg --batch --verbose --no-armor --pinentry-mode loopback --passphrase %{_gpg_passphrase} --no-secmem-warning -u "%{_gpg_name}" -sbo %{__signature_filename} --digest-algo sha256 %{__plaintext_filename}
+          EOF
+          
+            rpm --addsign --define "_gpg_passphrase $GPG_PASSPHRASE" *.rpm
+          else
+            echo "Skipping RPM signing: GPG_PRIVATE_KEY or GPG_KEY_NAME secret is not set."
+          fi
+

      - name: Upload Workflow Artifacts
        uses: actions/upload-artifact@v4
@@ -378,7 +378,7 @@ checksum = "ae36dc4177970ef04fde5178d3e2429882def40e57a451f919c098f72baa6cec"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.0",
+ "syn 3.0.3",
 ]

 [[package]]
@@ -663,9 +663,9 @@ checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"

 [[package]]
 name = "bytemuck"
-version = "1.25.1"
+version = "1.25.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6aedf8ae72766347502cf3cb4f41cf5e9cc37d28bee90f1fdaaae15f9cf9424"
+checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797"

 [[package]]
 name = "byteorder"
@@ -747,9 +747,9 @@ dependencies = [

 [[package]]
 name = "cc"
-version = "1.3.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c89588d05638b5b4594a3348a2d6c20277e43a7f5c5202b05cc56888475a47b8"
+checksum = "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9"
 dependencies = [
 "find-msvc-tools",
 "jobserver",
@@ -856,9 +856,9 @@ dependencies = [

 [[package]]
 name = "clap"
-version = "4.6.2"
+version = "4.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd059f9da4f5c36b3787f65d38ccaab1cc315f07b01f89abc8359ee6a8205011"
+checksum = "d91e0c145792ef73a6ad36d27c75ac09f1832222a3c209689d90f534685ee5b7"
 dependencies = [
 "clap_builder",
 "clap_derive",
@@ -878,14 +878,14 @@ dependencies = [

 [[package]]
 name = "clap_derive"
-version = "4.6.1"
+version = "4.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
+checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
 dependencies = [
 "heck",
 "proc-macro2",
 "quote",
- "syn 2.0.119",
+ "syn 3.0.3",
 ]

 [[package]]
@@ -1479,9 +1479,9 @@ dependencies = [

 [[package]]
 name = "either"
-version = "1.16.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
+checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"

 [[package]]
 name = "elliptic-curve"
@@ -1568,7 +1568,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
 "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -2359,9 +2359,9 @@ dependencies = [

 [[package]]
 name = "hyper"
-version = "1.10.1"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
+checksum = "d22053281f852e11534f5198498373cbb59295120a20771d90f7ed1897490a72"
 dependencies = [
 "atomic-waker",
 "bytes",
@@ -2559,9 +2559,9 @@ dependencies = [

 [[package]]
 name = "ignore"
-version = "0.4.30"
+version = "0.4.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b009b6744c1445efd7244084e25e498636412effb6760b55067553baa925cc7"
+checksum = "7f8a7b8211e695a1d0cd91cace480d4d0bd57667ab10277cc412c5f7f4884f83"
 dependencies = [
 "crossbeam-deque",
 "globset",
@@ -2916,9 +2916,9 @@ checksum = "34b357333733e8260735ba5894eb928c02ecc69c78715f01a8019e7fa7f2db4c"

 [[package]]
 name = "libc"
-version = "0.2.186"
+version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"

 [[package]]
 name = "libdbus-sys"
@@ -3203,7 +3203,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -3518,10 +3518,10 @@ checksum = "35fb2e5f958ec131621fdd531e9fc186ed768cbe395337403ae56c17a74c68ec"

 [[package]]
 name = "pdfs-cli"
-version = "0.7.0"
+version = "1.3.0"
 dependencies = [
 "anyhow",
- "clap 4.6.2",
+ "clap 4.6.4",
 "pdfs-core",
 "pdfs-fuse",
 "rpassword",
@@ -3533,11 +3533,12 @@ dependencies = [

 [[package]]
 name = "pdfs-core"
-version = "0.7.0"
+version = "1.3.0"
 dependencies = [
 "directories",
 "ignore",
 "keyring",
+ "libc",
 "parking_lot",
 "proton-drive-rs",
 "proton-sdk",
@@ -3552,7 +3553,7 @@ dependencies = [

 [[package]]
 name = "pdfs-fuse"
-version = "0.7.0"
+version = "1.3.0"
 dependencies = [
 "fuser",
 "image",
@@ -3568,7 +3569,7 @@ dependencies = [

 [[package]]
 name = "pdfs-gui"
-version = "0.7.0"
+version = "1.3.0"
 dependencies = [
 "anyhow",
 "async-channel",
@@ -3829,9 +3830,9 @@ dependencies = [

 [[package]]
 name = "proton-drive-rs"
-version = "0.1.11"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a76197ffe7c9588c0bc1fa38a51e8aa8642b10e81ec16272d4962bd60525920"
+checksum = "06f6b2b3aaaf90cd3eab823e3c13a4ff784693f183f7fde97f865378c4d3e0bd"
 dependencies = [
 "async-trait",
 "base64",
@@ -3856,9 +3857,9 @@ dependencies = [

 [[package]]
 name = "proton-sdk"
-version = "0.1.11"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "805df5ff2805e0e935ac7f5a237482231208a706d8c6ab3dd91157ae2e95c9f6"
+checksum = "1037a17f8951cf3ade40a8d2a8230720caf6136383eecc7d61e89636e229793e"
 dependencies = [
 "aes-gcm 0.11.0",
 "async-trait",
@@ -4213,7 +4214,7 @@ checksum = "2c9283685feec7d69af75fb0e858d5e7378f33fe4fc699383b2916ab9273e03c"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.0",
+ "syn 3.0.3",
 ]

 [[package]]
@@ -4400,7 +4401,7 @@ dependencies = [
 "errno",
 "libc",
 "linux-raw-sys",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -4431,9 +4432,9 @@ dependencies = [

 [[package]]
 name = "rustls-pki-types"
-version = "1.15.0"
+version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "764899a24af3980067ee14bc143654f297b22eaebfe3c7b6b211920a5a59b046"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
 dependencies = [
 "web-time",
 "zeroize",
@@ -4457,7 +4458,7 @@ dependencies = [
 "security-framework",
 "security-framework-sys",
 "webpki-root-certs",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -4598,14 +4599,14 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.0",
+ "syn 3.0.3",
 ]

 [[package]]
 name = "serde_json"
-version = "1.0.150"
+version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
 "itoa",
 "memchr",
@@ -4622,7 +4623,7 @@ checksum = "8d3b1629de253c70a0508c3899572da79ca359fdab27c7920ff00406df418906"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.0",
+ "syn 3.0.3",
 ]

 [[package]]
@@ -4783,18 +4784,18 @@ checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"

 [[package]]
 name = "snafu"
-version = "0.9.1"
+version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1a012328be2e3f5d5f6f3218147ca02588cea4cb865e876849ab6debcf36522"
+checksum = "e45cb604038abb7b926b679887b3226d8d0f23874b66623625a0454be425a4b7"
 dependencies = [
 "snafu-derive",
 ]

 [[package]]
 name = "snafu-derive"
-version = "0.9.1"
+version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f103c50866b8743da9429b8a581d81a27c2d3a9c4ac7df8f8571c1dd7896eda"
+checksum = "287f59010008f0d7cf5e3b03196d666c1acc46c8d3e9cf34c28a1a7157601e72"
 dependencies = [
 "heck",
 "proc-macro2",
@@ -4897,9 +4898,9 @@ dependencies = [

 [[package]]
 name = "syn"
-version = "3.0.0"
+version = "3.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2fac314a64dc9a36e61a9eb4261a5e9bbfbc922b27e518af97bc32b926cf967"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -4961,7 +4962,7 @@ dependencies = [
 "getrandom 0.4.3",
 "once_cell",
 "rustix",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -5010,7 +5011,7 @@ checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.0",
+ "syn 3.0.3",
 ]

 [[package]]
@@ -5063,9 +5064,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"

 [[package]]
 name = "tokio"
-version = "1.53.0"
+version = "1.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d988bcd52dbe076d3d46903332f58c912b87a2c49b1428419a5845154762ffee"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
 dependencies = [
 "bytes",
 "libc",
@@ -5100,9 +5101,9 @@ dependencies = [

 [[package]]
 name = "tokio-util"
-version = "0.7.18"
+version = "0.7.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
 dependencies = [
 "bytes",
 "futures-core",
@@ -5627,7 +5628,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -6137,18 +6138,18 @@ dependencies = [

 [[package]]
 name = "zerocopy"
-version = "0.8.54"
+version = "0.8.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7cbbc0a705a0fd05cc3676525980d2bf5a9bc4adac6d6475209a7887cf59d19"
+checksum = "b5a105cd7b140f6eeec8acff2ea38135d3cab283ada58540f629fe51e46696eb"
 dependencies = [
 "zerocopy-derive",
 ]

 [[package]]
 name = "zerocopy-derive"
-version = "0.8.54"
+version = "0.8.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2e817b7b52d0c7358d3246da9d69935ebb18116b2b102b4230dac079b4862f5"
+checksum = "0fe976fb70c78cd64cccfe3a6fc142244e8a77b70959b30faf9d0ac37ee228eb"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -3,15 +3,15 @@ resolver = "2"
 members = ["crates/pdfs-core", "crates/pdfs-fuse", "crates/pdfs-cli", "crates/pdfs-gui"]

 [workspace.package]
-version = "0.7.0"
+version = "1.3.0"
 edition = "2024"
 license = "MIT"
 authors = ["Nils Pukropp <contact@narl.io>"]
 rust-version = "1.96"

 [workspace.dependencies]
-proton-sdk = { version = "0.1" }
-proton-drive-rs = { version = "0.1" }
+proton-sdk = { version = "0.3.2" }
+proton-drive-rs = { version = "0.3.2" }

 # Internal crates.
 pdfs-core = { path = "crates/pdfs-core" }
@@ -6,13 +6,24 @@ A fast, unofficial Proton Drive client for Linux. This client features an advanc

 - **Files-on-Demand (FUSE)**: Mount your Proton Drive as a virtual filesystem where files are downloaded only when opened, utilizing smart block-level caching and disk-backed writes.
 - **Command-Line Interface (CLI)**: Manage your drive, authenticate, and monitor sync status directly from the terminal.
- **Non-Blocking GTK4 Desktop App**: Browse files, manage pins, and configure options through a modern, native GUI with a fully non-blocking asynchronous main loop.
+- **Non-Blocking GTK4 Desktop App**: Browse files, manage pins, configure options, and monitor active transfers through a modern, native GUI with a fully non-blocking asynchronous main loop.
+- **Shared Links & Invites**: Browse files shared with you by other users, and view/manage your own public shared links directly in the GUI.
+- **Local Backup (Computers)**: Sync and back up local directories (like Downloads, Documents, Pictures, etc.) directly to your Proton Drive account.
+- **Locations**: One page (and `pdfs locations`) listing every place Proton Drive occupies on this machine — the main mount plus each backed-up folder — with its mode, sync state, and whether it is read-only. Switching a folder between a full local copy and on-demand happens here.
 - **System Tray Integration**: Background indicator for status monitoring, quick actions, and fast sync controls.
- **Fuzzy Search Launcher Prompt (HUD)**: A Google Drive-style search launcher (`pdfs-prompt`) for finding and opening files or folders instantly, ideal for binding to a system-wide hotkey.
+- **Unified Search Launcher (HUD)**: A resident Google Drive-style launcher (`pdfs-prompt`) that searches Proton Drive and local files together, ranks the best matches, tolerates abbreviations and typos, and is ideal for a system-wide hotkey.
 - **Secure Credential Storage**: Integrates with the system Secret Service (GNOME Keyring, KWallet, etc.) with smart in-memory credential caching to avoid UI thread blockages.
 - **Proton Photos Support**: Access your Proton Photos timeline, view thumbnails, and download backed-up media natively (available in the GUI as a navigation tab and via the CLI).
+- **Photo Albums**: Browse your albums — including the ones shared with you — from the Albums view of the Photos page, or with `pdfs albums` / `pdfs album <uid>`. Album contents open in the same gallery as the timeline.
 - **Human Verification (CAPTCHA) Recovery**: Detects sign-in gates (VPN/new IP challenges) and launches an embedded `WebKitWebView` dialog to safely complete the challenge, transparently retrying authentication with the earned token.
 - **Selective Sync (`.pdfsignore`)**: Keep build trees, dependency directories, and editor leftovers out of synced folders using gitignore-style rules.
+- **Data-Safe Offline Writes**: Durable scratch/staging files and a transactional pending queue preserve acknowledged writes across network failures and restarts.
+
+## Quick Search and Media Opening
+
+`pdfs-prompt` searches Drive metadata and the local home-directory index in one request. Results are ranked together rather than split by source. Matching is case-insensitive and supports exact names, prefixes, parent paths, multiple terms, punctuation-separated words, ordered abbreviations, common typos, and adjacent transpositions.
+
+The prompt stays resident after its first launch, so invoking the shortcut again reuses and resets the existing window. Drive folders open from the mount. Audio and video results also open through FUSE, allowing media players to seek and request ranges without downloading the entire file first; ordinary Drive files are materialized into the local cache before opening.

 ## Selective Sync (`.pdfsignore`)

@@ -92,6 +103,11 @@ For the local metadata database and content cache:
 the database while it runs, so it is a deliberate operation rather than
 something the daemon does on a timer.

+Before a release, run the real-kernel acceptance suite against a dedicated test
+account and mount. See [`docs/TESTING.md`](docs/TESTING.md); it includes optional
+two-mount convergence checks and confines destructive operations to a fresh
+test directory.
+
 ## Scripting (`--json`)

 Query commands accept a global `--json` flag and emit machine-readable output:
@@ -124,6 +140,19 @@ The client includes several optimizations designed for high efficiency, a low me
 - **Disk-Backed Writes**: Large file writes are staged on disk in temporary scratch files (rather than fully buffered in RAM) and track modified byte intervals. Only the unedited remote segments are fetched at commit time, keeping memory usage minimal.
 - **Non-Blocking GTK4 Loop**: To prevent UI freezes, all synchronous D-Bus credential checks, control socket requests, and cache usage calculations are offloaded to background worker threads or fetched asynchronously.
 - **Flicker-Free UI Rendering**: The GTK4 application performs differential rendering of the pins list, only modifying list rows when the list content changes, preserving the user's scroll position and widget focus.
+- **Durable Staging**: Scratch metadata and staged writes are synced and atomically published before an upload is acknowledged locally. Rapid revisions supersede pending work transactionally.
+
+## Filesystem Safety
+
+Version 1.0 strengthens the boundaries around local-only data and destructive reconciliation:
+
+- Truncate composes with queued revisions, preserving the authoritative prefix and correct zero-filled growth.
+- Combined move-and-rename operations are queued durably and tolerate partially completed remote state.
+- Session tombstones prevent successfully unlinked entries from reappearing through eventually consistent listings.
+- Names are valid UTF-8 and no longer than Linux's 255-byte component limit.
+- Incomplete mirror scans are non-destructive, and total-wipe protection covers every non-empty baseline.
+- Failed conflict preservation, local deletion, or staging publication does not settle a new baseline or discard the only local copy.
+- State, cache, and config directories must be real, current-user-owned `0700` directories; control sockets are `0600`.


 ## Screenshots
@@ -136,11 +165,16 @@ The client includes several optimizations designed for high efficiency, a low me
    <td align="center" width="50%"><img src="images/files.png" alt="Files Browser" width="100%"><br><sub><b>Files Browser</b></sub></td>
  </tr>
  <tr>
-    <td align="center" width="50%"><img src="images/photos.png" alt="Photos Timeline" width="100%"><br><sub><b>Photos Timeline</b></sub></td>
-    <td align="center" width="50%"><img src="images/prompt.png" alt="Search Launcher Prompt" width="100%"><br><sub><b>Search Launcher Prompt</b></sub></td>
+    <td align="center" width="50%"><img src="images/shared.png" alt="Shared Links" width="100%"><br><sub><b>Shared Links</b></sub></td>
+    <td align="center" width="50%"><img src="images/shared_with_me.png" alt="Shared with me" width="100%"><br><sub><b>Shared with me</b></sub></td>
  </tr>
  <tr>
-    <td align="center" colspan="2"><img src="images/settings.png" alt="Settings" width="50%"><br><sub><b>Settings</b></sub></td>
+    <td align="center" width="50%"><img src="images/computers.png" alt="Local Backups (Computers)" width="100%"><br><sub><b>Local Backups (Computers)</b></sub></td>
+    <td align="center" width="50%"><img src="images/photos.png" alt="Photos Timeline" width="100%"><br><sub><b>Photos Timeline</b></sub></td>
+  </tr>
+  <tr>
+    <td align="center" width="50%"><img src="images/prompt.png" alt="Search Launcher Prompt" width="100%"><br><sub><b>Search Launcher Prompt</b></sub></td>
+    <td align="center" width="50%"><img src="images/settings.png" alt="Settings" width="100%"><br><sub><b>Settings</b></sub></td>
  </tr>
 </table>

@@ -246,15 +280,18 @@ This project has a GitHub Actions CI workflow configured under `.github/workflow
 1. **Triggers**: 
   - Pushing a git tag matching `v*` (e.g. `git tag v0.1.0 && git push origin v0.1.0`).
   - Manual runs via the **Actions** tab in GitHub (**workflow_dispatch**).
-2. **Build Process**:
+2. **Quality Gates and Build Process**:
+   - For tagged builds, verifies that the tag, workspace version, and `packaging/PKGBUILD` version agree.
+   - Runs `cargo fmt`, Clippy with warnings denied, the locked workspace test suite, and the account-free FUSE acceptance contract.
   - Spawns an Ubuntu runner and installs GTK4, Libadwaita, FUSE3, and Secret Service packages.
   - Sets up the Rust compiler and caches build targets to speed up runs.
   - Compiles the workspace members in release mode.
 3. **Artifact Packaging**:
   - Generates a `.tar.gz` containing the raw binaries (`pdfs`, `pdfs-app`, `pdfs-tray`, `pdfs-prompt`).
-   - Packs them into a Debian package (`.deb`).
+   - Packs them into Debian (`.deb`) and Fedora (`.rpm`) packages.
+   - Includes the systemd user service and tray autostart entry in the Debian package.
 4. **Publishing**:
-   - Creates a GitHub Release matching the pushed tag and uploads the `.deb` and `.tar.gz` packages as release assets.
+   - Creates a GitHub Release matching the pushed tag and uploads the `.deb`, `.rpm`, and `.tar.gz` packages as release assets.
   - For manual runs, compiles and exposes the packages as workflow run artifacts for testing.

 ---
@@ -1,7 +1,9 @@
 //! `pdfs` — command-line front-end for the Proton Drive Linux client.

 use std::collections::HashMap;
+use std::fs::OpenOptions;
 use std::io::Write;
+use std::os::unix::fs::FileTypeExt;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;

@@ -11,7 +13,7 @@ use pdfs_core::auth;
 use pdfs_core::cache::ContentCache;
 use pdfs_core::config::AppDirs;
 use pdfs_core::control::{
-    ErrorKind, RefreshScope, Request as CtlRequest, Response as CtlResponse,
+    ErrorKind, MountKind, RefreshScope, Request as CtlRequest, Response as CtlResponse,
    RestoreItem as CtlRestoreItem, ShareEntryKind, SyncPhase, pending_summary,
 };
 use pdfs_core::db::Db;
@@ -26,7 +28,7 @@ struct Cli {
    /// Emit machine-readable JSON instead of formatted text.
    ///
    /// Applies to the query commands (`status`, `ls`, `pins`, `sync list`,
-    /// `devices list`, `transfers`, `activity`, `cache inspect`). Commands that
+    /// `devices list`, `locations`, `transfers`, `activity`, `cache inspect`). Commands that
    /// perform an action keep their human output — a script that needs to know
    /// whether one succeeded has the exit code.
    #[arg(long, global = true)]
@@ -103,6 +105,8 @@ enum Command {
    Logout,
    /// Show account login state, and mount status if a daemon is running.
    Status,
+    /// List every local Proton Drive location.
+    Locations,
    /// Mount Proton Drive at the given (or default) path. Blocks until unmounted.
    Mount {
        /// Mountpoint; defaults to ~/ProtonDrive.
@@ -141,6 +145,19 @@ enum Command {
        #[arg(long, default_value_t = 0)]
        offset: usize,
    },
+    /// List the photo albums (including ones shared with this account).
+    Albums,
+    /// List the photos in one album (newest capture first).
+    Album {
+        /// Album node uid in `volume~link` form (from `pdfs albums`).
+        uid: String,
+        /// Max photos to list.
+        #[arg(long, default_value_t = 50)]
+        limit: usize,
+        /// Skip this many photos from the start of the album.
+        #[arg(long, default_value_t = 0)]
+        offset: usize,
+    },
    /// Download a photo by uid (`volume~link`) and print its cached path.
    OpenPhoto {
        /// Photo node uid in `volume~link` form (from `pdfs photos`).
@@ -505,6 +522,7 @@ fn main() -> Result<()> {
        Command::Login { username } => cmd_login(username),
        Command::Logout => cmd_logout(),
        Command::Status => cmd_status(),
+        Command::Locations => cmd_locations(),
        Command::Mount { mountpoint } => cmd_mount(mountpoint),
        Command::Daemon { mountpoint } => cmd_daemon(mountpoint),
        Command::Pin { path } => cmd_pin(path),
@@ -512,6 +530,8 @@ fn main() -> Result<()> {
        Command::Pins => cmd_pins(),
        Command::Ls { path } => cmd_ls(path),
        Command::Photos { limit, offset } => cmd_photos(limit, offset),
+        Command::Albums => cmd_albums(),
+        Command::Album { uid, limit, offset } => cmd_album(uid, limit, offset),
        Command::OpenPhoto { uid } => cmd_open_photo(uid),
        Command::Search { query, limit } => cmd_search(query, limit),
        Command::Rename { path, new_name } => cmd_rename(path, new_name),
@@ -900,7 +920,15 @@ fn cmd_shared_with_me(uid: Option<String>) -> Result<()> {
        CtlResponse::Entries { entries } => {
            for e in entries {
                let kind = if e.is_dir { "d" } else { "-" };
-                println!("{kind} {:>12}  {}  [{}]", e.size, e.name, e.uid);
+                // My role decides whether this is writable at all, so it is
+                // printed whenever the API reported one; an empty role prints
+                // nothing rather than a guess.
+                let role = if e.role.is_empty() {
+                    String::new()
+                } else {
+                    format!("  ({})", e.role)
+                };
+                println!("{kind} {:>12}  {}{role}  [{}]", e.size, e.name, e.uid);
            }
        }
        CtlResponse::Error { message, kind } => bail!("{}", cli_error(kind, &message)),
@@ -1000,6 +1028,7 @@ fn activity_verb(kind: pdfs_core::control::ActivityKind) -> &'static str {
        Share => "share",
        PublicLink => "link",
        Unshare => "unshare",
+        Conflict => "conflict",
    }
 }

@@ -1198,6 +1227,45 @@ fn cmd_status() -> Result<()> {
    Ok(())
 }

+fn cmd_locations() -> Result<()> {
+    let response = control_request(CtlRequest::ListLocations)?;
+    if emit_json(&response)? {
+        return Ok(());
+    }
+    match response {
+        CtlResponse::Locations { items } if items.is_empty() => {
+            println!("No Proton Drive locations.");
+        }
+        CtlResponse::Locations { items } => {
+            for location in items {
+                let kind = match &location.kind {
+                    MountKind::MyFiles => "My Files".to_string(),
+                    MountKind::Device { sync_folder_id } => {
+                        format!("Device folder {sync_folder_id}")
+                    }
+                    MountKind::Shared { .. } => "Shared folder".to_string(),
+                };
+                let mode = match location.pending_mode {
+                    Some(pending) => format!("{} -> {pending}", location.mode),
+                    None => location.mode.to_string(),
+                };
+                let mounted = if location.mounted {
+                    "mounted"
+                } else {
+                    "not mounted"
+                };
+                println!(
+                    "{kind}: {} ({mode}, {}, {}, {mounted})",
+                    location.local_path, location.access, location.state
+                );
+            }
+        }
+        CtlResponse::Error { message, kind } => bail!("{}", cli_error(kind, &message)),
+        other => bail!("unexpected response: {other:?}"),
+    }
+    Ok(())
+}
+
 fn cmd_mount(mountpoint: Option<PathBuf>) -> Result<()> {
    mount_once(mountpoint)?;
    Ok(())
@@ -1288,7 +1356,10 @@ fn mount_once(mountpoint: Option<PathBuf>) -> Result<pdfs_fuse::MountOutcome> {
        cache,
        &control_socket,
        db,
-        username,
+        pdfs_fuse::MountOptions {
+            username,
+            sweep_mode: config.resolved_conflict_sweep(),
+        },
    );

    // Clean unmount check (as a best-effort final backup).
@@ -1429,24 +1500,52 @@ fn cmd_photos(limit: usize, offset: usize) -> Result<()> {
            println!("This account has no photos volume.")
        }
        CtlResponse::Photos { items, .. } if items.is_empty() => println!("No photos."),
-        CtlResponse::Photos { items, .. } => {
-            // The timeline reply only carries thumbnails already in the cache, so
-            // pull the rest of the page's in one batch to print a path per photo.
-            let uids: Vec<String> = items.iter().map(|p| p.uid.clone()).collect();
-            let thumbs: HashMap<String, Option<String>> =
-                match control_request(CtlRequest::PhotoThumbs { uids })? {
-                    CtlResponse::Thumbs { items } => {
-                        items.into_iter().map(|t| (t.uid, t.path)).collect()
-                    }
-                    _ => HashMap::new(),
+        CtlResponse::Photos { items, .. } => print_photo_page(items)?,
+        CtlResponse::Error { message, kind } => bail!("{}", cli_error(kind, &message)),
+        other => bail!("unexpected response: {other:?}"),
+    }
+    Ok(())
+}
+
+/// Print one page of photos as `capture-time  uid  thumbnail-path`.
+///
+/// A timeline or album reply only carries thumbnails already in the cache, so
+/// the rest of the page's are pulled in one batch rather than left blank.
+fn print_photo_page(items: Vec<pdfs_core::control::PhotoItem>) -> Result<()> {
+    let uids: Vec<String> = items.iter().map(|p| p.uid.clone()).collect();
+    let thumbs: HashMap<String, Option<String>> =
+        match control_request(CtlRequest::PhotoThumbs { uids })? {
+            CtlResponse::Thumbs { items } => items.into_iter().map(|t| (t.uid, t.path)).collect(),
+            _ => HashMap::new(),
+        };
+    for p in items {
+        let thumb = thumbs
+            .get(&p.uid)
+            .and_then(|p| p.as_deref())
+            .or(p.thumb_path.as_deref())
+            .unwrap_or("(no thumbnail)");
+        println!("{}  {}  {thumb}", p.capture_time, p.uid);
+    }
+    Ok(())
+}
+
+fn cmd_albums() -> Result<()> {
+    match control_request(CtlRequest::PhotoAlbums)? {
+        CtlResponse::Albums {
+            available: false, ..
+        } => println!("This account has no photos volume."),
+        CtlResponse::Albums { items, .. } if items.is_empty() => println!("No albums."),
+        CtlResponse::Albums { items, .. } => {
+            for album in items {
+                let shared = if album.shared {
+                    " (shared with me)"
+                } else {
+                    ""
                };
-            for p in items {
-                let thumb = thumbs
-                    .get(&p.uid)
-                    .and_then(|p| p.as_deref())
-                    .or(p.thumb_path.as_deref())
-                    .unwrap_or("(no thumbnail)");
-                println!("{}  {}  {thumb}", p.capture_time, p.uid);
+                println!(
+                    "{:>6}  {}  {}{shared}",
+                    album.photo_count, album.uid, album.name
+                );
            }
        }
        CtlResponse::Error { message, kind } => bail!("{}", cli_error(kind, &message)),
@@ -1455,6 +1554,16 @@ fn cmd_photos(limit: usize, offset: usize) -> Result<()> {
    Ok(())
 }

+fn cmd_album(uid: String, limit: usize, offset: usize) -> Result<()> {
+    match control_request(CtlRequest::AlbumPhotos { uid, offset, limit })? {
+        CtlResponse::Photos { items, .. } if items.is_empty() => println!("No photos."),
+        CtlResponse::Photos { items, .. } => print_photo_page(items)?,
+        CtlResponse::Error { message, kind } => bail!("{}", cli_error(kind, &message)),
+        other => bail!("unexpected response: {other:?}"),
+    }
+    Ok(())
+}
+
 fn cmd_open_photo(uid: String) -> Result<()> {
    match control_request(CtlRequest::OpenPhoto { uid })? {
        CtlResponse::FilePath { path } => println!("{path}"),
@@ -1740,16 +1849,95 @@ fn cmd_cache_inspect(deep: bool) -> Result<()> {
    }
 }

-/// One line of the `diagnose` report.
-fn check(label: &str, ok: bool, detail: impl AsRef<str>) -> bool {
-    let mark = if ok { "ok  " } else { "FAIL" };
-    let detail = detail.as_ref();
-    if detail.is_empty() {
-        println!("[{mark}] {label}");
-    } else {
-        println!("[{mark}] {label}: {detail}");
+#[derive(Default)]
+struct DiagnoseReport {
+    warnings: usize,
+    failures: usize,
+}
+
+impl DiagnoseReport {
+    fn finding(&mut self, level: DiagnoseLevel, label: &str, detail: impl AsRef<str>) {
+        let mark = match level {
+            DiagnoseLevel::Ok => "ok  ",
+            DiagnoseLevel::Warn => {
+                self.warnings += 1;
+                "WARN"
+            }
+            DiagnoseLevel::Fail => {
+                self.failures += 1;
+                "FAIL"
+            }
+        };
+        let detail = detail.as_ref();
+        if detail.is_empty() {
+            println!("[{mark}] {label}");
+        } else {
+            println!("[{mark}] {label}: {detail}");
+        }
    }
-    ok
+
+    fn check(&mut self, label: &str, ok: bool, detail: impl AsRef<str>) {
+        self.finding(
+            if ok {
+                DiagnoseLevel::Ok
+            } else {
+                DiagnoseLevel::Fail
+            },
+            label,
+            detail,
+        );
+    }
+}
+
+#[derive(Clone, Copy)]
+enum DiagnoseLevel {
+    Ok,
+    Warn,
+    Fail,
+}
+
+fn executable_on_path(name: &str) -> bool {
+    std::env::var_os("PATH").is_some_and(|paths| {
+        std::env::split_paths(&paths)
+            .any(|dir| std::fs::metadata(dir.join(name)).is_ok_and(|m| m.is_file()))
+    })
+}
+
+fn mounted_fs_type(path: &Path) -> Option<String> {
+    let wanted = path.canonicalize().ok()?;
+    let mounts = std::fs::read_to_string("/proc/self/mountinfo").ok()?;
+    mounts
+        .lines()
+        .filter_map(|line| {
+            let fields: Vec<_> = line.split_whitespace().collect();
+            let separator = fields.iter().position(|field| *field == "-")?;
+            let encoded = *fields.get(4)?;
+            let decoded = encoded.replace("\\040", " ").replace("\\011", "\t");
+            let mountpoint = PathBuf::from(decoded);
+            if mountpoint.canonicalize().ok()? == wanted {
+                Some(fields.get(separator + 1)?.to_string())
+            } else {
+                None
+            }
+        })
+        .next()
+}
+
+/// Create, sync, and remove a new file without ever replacing an existing one.
+fn writable_probe(dir: &Path) -> std::io::Result<()> {
+    let name = format!(".pdfs-diagnose-probe-{}", std::process::id());
+    let path = dir.join(name);
+    let mut file = OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .open(&path)?;
+    let result = (|| {
+        file.write_all(b"probe")?;
+        file.sync_all()
+    })();
+    drop(file);
+    let remove = std::fs::remove_file(path);
+    result.and(remove)
 }

 /// Self-check the installation, reporting each finding and exiting non-zero if
@@ -1759,58 +1947,80 @@ fn check(label: &str, ok: bool, detail: impl AsRef<str>) -> bool {
 /// situation a user runs this in. A missing daemon is reported as a finding,
 /// not an error that aborts the rest of the report.
 fn cmd_diagnose() -> Result<()> {
-    let mut all_ok = true;
+    let mut report = DiagnoseReport::default();

    let dirs = AppDirs::new().context("resolve application directories")?;
    let config = dirs.load_config();

    println!("Paths");
    let state = dirs.state_dir();
-    all_ok &= check(
+    report.check(
        "  state dir",
        state.is_dir(),
        format!("{}", state.display()),
    );
    let cache_dir = dirs.cache_dir();
-    all_ok &= check(
+    report.check(
        "  cache dir",
        cache_dir.is_dir(),
        format!("{}", cache_dir.display()),
    );
    // Writability is checked by actually writing: permission bits do not
    // account for a full disk, a read-only remount, or an immutable flag.
-    let probe = state.join(".pdfs-diagnose-probe");
-    let writable = std::fs::write(&probe, b"probe").is_ok();
-    let _ = std::fs::remove_file(&probe);
-    all_ok &= check("  state dir writable", writable, "");
+    match writable_probe(&state) {
+        Ok(()) => report.finding(
+            DiagnoseLevel::Ok,
+            "  state dir writable",
+            "write and fsync succeeded",
+        ),
+        Err(e) => report.finding(DiagnoseLevel::Fail, "  state dir writable", e.to_string()),
+    }

    let db_path = dirs.db_path();
    let db_size = std::fs::metadata(&db_path).map(|m| m.len()).unwrap_or(0);
-    all_ok &= check(
+    report.check(
        "  database",
        db_path.is_file(),
        format!("{} ({})", db_path.display(), human_bytes(db_size)),
    );

+    println!("\nFUSE");
+    let fuse = Path::new("/dev/fuse");
+    report.check("  /dev/fuse", fuse.exists(), fuse.display().to_string());
+    let has_fusermount = executable_on_path("fusermount3") || executable_on_path("fusermount");
+    report.check(
+        "  unmount helper",
+        has_fusermount,
+        "fusermount3 or fusermount on PATH",
+    );
+
    println!("\nAccount");
    match pdfs_core::auth::load() {
        Ok(session) => {
-            all_ok &= check("  keyring session", true, session.username);
+            report.finding(DiagnoseLevel::Ok, "  keyring session", session.username);
        }
        Err(e) => {
            // A locked keyring and an absent login look the same from here, so
            // the detail carries the distinction rather than the verdict.
-            all_ok &= check("  keyring session", false, format!("{e}"));
+            report.finding(DiagnoseLevel::Fail, "  keyring session", format!("{e}"));
        }
    }

    println!("\nDaemon");
    let socket = dirs.control_socket();
    let socket_exists = socket.exists();
-    check(
+    let socket_kind_ok =
+        std::fs::symlink_metadata(&socket).is_ok_and(|m| m.file_type().is_socket());
+    report.finding(
+        if socket_exists && !socket_kind_ok {
+            DiagnoseLevel::Fail
+        } else if socket_exists {
+            DiagnoseLevel::Ok
+        } else {
+            DiagnoseLevel::Warn
+        },
        "  control socket",
-        socket_exists,
-        format!("{}", socket.display()),
+        socket.display().to_string(),
    );
    // A stale socket file with no listener is the common failure, so the reply
    // is what decides this rather than the file's existence.
@@ -1822,47 +2032,127 @@ fn cmd_diagnose() -> Result<()> {
            pending_changes,
            ..
        }) => {
-            check("  daemon responding", true, "");
-            check("  mounted at", true, mountpoint);
-            check("  network", online, if online { "" } else { "offline" });
+            report.finding(DiagnoseLevel::Ok, "  daemon responding", "");
+            let live_type = mounted_fs_type(Path::new(&mountpoint));
+            let is_fuse = live_type
+                .as_deref()
+                .is_some_and(|kind| kind.starts_with("fuse"));
+            report.finding(
+                if is_fuse {
+                    DiagnoseLevel::Ok
+                } else {
+                    DiagnoseLevel::Fail
+                },
+                "  active mount",
+                live_type.map_or_else(
+                    || format!("{mountpoint} is not mounted"),
+                    |kind| format!("{mountpoint} ({kind})"),
+                ),
+            );
+            report.finding(
+                if online {
+                    DiagnoseLevel::Ok
+                } else {
+                    DiagnoseLevel::Warn
+                },
+                "  network",
+                if online {
+                    "online"
+                } else {
+                    "offline; cached data remains available"
+                },
+            );
            let pending = pending_uploads + pending_changes;
-            check(
+            report.finding(
+                if pending == 0 {
+                    DiagnoseLevel::Ok
+                } else {
+                    DiagnoseLevel::Warn
+                },
                "  queued writes",
-                true,
                if pending == 0 {
                    "none".to_string()
                } else {
                    format!("{pending} waiting to upload")
                },
            );
+            match control_request(CtlRequest::CacheInspect { deep: true }) {
+                Ok(CtlResponse::CacheReport {
+                    integrity_problems, ..
+                }) if integrity_problems.is_empty() => report.finding(
+                    DiagnoseLevel::Ok,
+                    "  database integrity",
+                    "SQLite integrity_check passed",
+                ),
+                Ok(CtlResponse::CacheReport {
+                    integrity_problems, ..
+                }) => report.finding(
+                    DiagnoseLevel::Fail,
+                    "  database integrity",
+                    format!(
+                        "{} problem(s): {}",
+                        integrity_problems.len(),
+                        integrity_problems.join("; ")
+                    ),
+                ),
+                Ok(other) => report.finding(
+                    DiagnoseLevel::Fail,
+                    "  database integrity",
+                    format!("unexpected: {other:?}"),
+                ),
+                Err(e) => report.finding(
+                    DiagnoseLevel::Fail,
+                    "  database integrity",
+                    format!("check failed: {e:#}"),
+                ),
+            }
        }
        Ok(other) => {
-            all_ok &= check(
+            report.finding(
+                DiagnoseLevel::Fail,
                "  daemon responding",
-                false,
                format!("unexpected: {other:?}"),
            );
        }
        Err(e) => {
            // Not a failure of the installation: a stopped daemon is a normal
            // state, and the rest of the report is still worth printing.
-            check("  daemon responding", false, format!("{e:#}"));
-            println!("         (start it with `systemctl --user start pdfs.service`)");
+            report.finding(
+                DiagnoseLevel::Warn,
+                "  daemon responding",
+                format!("stopped or unreachable: {e:#}"),
+            );
+            println!("         (start it with `systemctl --user start proton-drive.service`)");
        }
    }

    let mountpoint = dirs.resolved_mountpoint(&config);
-    check(
-        "  mountpoint exists",
-        mountpoint.is_dir(),
-        format!("{}", mountpoint.display()),
+    report.finding(
+        if mountpoint.is_dir() {
+            DiagnoseLevel::Ok
+        } else {
+            DiagnoseLevel::Warn
+        },
+        "  configured mountpoint",
+        mountpoint.display().to_string(),
    );

-    if all_ok {
-        println!("\nNo problems found.");
+    if report.failures == 0 {
+        if report.warnings == 0 {
+            println!("\nNo problems found.");
+        } else {
+            println!(
+                "\nNo critical problems found; {} warning(s) need attention.",
+                report.warnings
+            );
+        }
        Ok(())
    } else {
-        bail!("one or more checks failed; see the report above")
+        bail!(
+            "{} check(s) failed and {} warning(s) were reported; see above",
+            report.failures,
+            report.warnings
+        )
    }
 }

@@ -1873,3 +2163,39 @@ fn control_request(req: CtlRequest) -> Result<CtlResponse> {
    pdfs_core::control::send(&socket, &req)
        .with_context(|| format!("talk to mount daemon at {}", socket.display()))
 }
+
+#[cfg(test)]
+mod diagnose_tests {
+    use super::*;
+
+    #[test]
+    fn finding_severity_is_counted_centrally() {
+        let mut report = DiagnoseReport::default();
+        report.finding(DiagnoseLevel::Ok, "ok", "");
+        report.finding(DiagnoseLevel::Warn, "warn", "");
+        report.finding(DiagnoseLevel::Fail, "fail", "");
+        assert_eq!(report.warnings, 1);
+        assert_eq!(report.failures, 1);
+    }
+
+    #[test]
+    fn writable_probe_never_replaces_an_existing_file() {
+        let dir = std::env::temp_dir().join(format!(
+            "pdfs-diagnose-test-{}-{:?}",
+            std::process::id(),
+            std::thread::current().id()
+        ));
+        std::fs::create_dir_all(&dir).unwrap();
+        let collision = dir.join(format!(".pdfs-diagnose-probe-{}", std::process::id()));
+        std::fs::write(&collision, b"keep me").unwrap();
+
+        assert_eq!(
+            writable_probe(&dir).unwrap_err().kind(),
+            std::io::ErrorKind::AlreadyExists
+        );
+        assert_eq!(std::fs::read(&collision).unwrap(), b"keep me");
+
+        std::fs::remove_file(collision).unwrap();
+        std::fs::remove_dir(dir).unwrap();
+    }
+}
@@ -21,3 +21,4 @@ sha2.workspace = true
 rusqlite.workspace = true
 keyring.workspace = true
 parking_lot.workspace = true
+libc.workspace = true
@@ -0,0 +1,108 @@
+//! Effective access carried by mounted Drive nodes.
+
+use proton_drive_rs::MemberRole;
+
+/// Effective write access for a node in a mounted tree.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Access {
+    Owner,
+    Editor,
+    Viewer,
+    Unknown,
+}
+
+impl Access {
+    pub fn writable(self) -> bool {
+        matches!(self, Self::Owner | Self::Editor)
+    }
+
+    pub(crate) fn as_db_str(self) -> &'static str {
+        match self {
+            Self::Owner => "owner",
+            Self::Editor => "editor",
+            Self::Viewer => "viewer",
+            Self::Unknown => "unknown",
+        }
+    }
+
+    pub(crate) fn from_db_str(value: &str) -> Option<Self> {
+        match value {
+            "owner" => Some(Self::Owner),
+            "editor" => Some(Self::Editor),
+            "viewer" => Some(Self::Viewer),
+            "unknown" => Some(Self::Unknown),
+            _ => None,
+        }
+    }
+}
+
+/// Resolve a share root's effective access from its exact membership role.
+///
+/// Owned trees fail open. A share whose role is absent or unrecognised fails
+/// closed. Descendants normally inherit directly at intern time; `Inherited`
+/// exists for the explicit wire role and therefore returns `parent`.
+pub fn access_for(role: Option<MemberRole>, parent: Access, under_share: bool) -> Access {
+    match role {
+        Some(MemberRole::Viewer) => Access::Viewer,
+        Some(MemberRole::Editor | MemberRole::Admin) => Access::Editor,
+        Some(MemberRole::Inherited) => parent,
+        None if under_share => Access::Viewer,
+        None => Access::Owner,
+    }
+}
+
+/// POSIX permission bits advertised for a mounted node.
+pub fn perm_bits(is_dir: bool, access: Access) -> u16 {
+    match (is_dir, access.writable()) {
+        (true, true) => 0o755,
+        (false, true) => 0o644,
+        (true, false) => 0o555,
+        (false, false) => 0o444,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn access_for_covers_the_fail_open_and_fail_closed_table() {
+        for parent in [
+            Access::Owner,
+            Access::Editor,
+            Access::Viewer,
+            Access::Unknown,
+        ] {
+            assert_eq!(access_for(None, parent, false), Access::Owner);
+            assert_eq!(access_for(None, parent, true), Access::Viewer);
+            assert_eq!(
+                access_for(Some(MemberRole::Viewer), parent, true),
+                Access::Viewer
+            );
+            assert_eq!(
+                access_for(Some(MemberRole::Editor), parent, true),
+                Access::Editor
+            );
+            assert_eq!(
+                access_for(Some(MemberRole::Admin), parent, true),
+                Access::Editor
+            );
+            assert_eq!(
+                access_for(Some(MemberRole::Inherited), parent, true),
+                parent
+            );
+        }
+    }
+
+    #[test]
+    fn permission_bits_follow_effective_access() {
+        for writable in [Access::Owner, Access::Editor] {
+            assert_eq!(perm_bits(true, writable), 0o755);
+            assert_eq!(perm_bits(false, writable), 0o644);
+        }
+        for read_only in [Access::Viewer, Access::Unknown] {
+            assert_eq!(perm_bits(true, read_only), 0o555);
+            assert_eq!(perm_bits(false, read_only), 0o444);
+        }
+    }
+}
@@ -17,6 +17,7 @@
 //! [`Node`]: proton_drive_rs::Node

 use std::collections::{BTreeMap, HashSet};
+use std::fmt;
 use std::io::{Read, Seek, SeekFrom};
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
@@ -28,10 +29,11 @@ use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};

 use crate::db::{CacheEntryInput, Db};
-use crate::error::Result;
+use crate::error::{Error, Result};

 /// `cache_entries.kind` tag for whole-file content blobs.
 const KIND_BLOB: &str = "blob";
+static STAGING_N: AtomicU64 = AtomicU64::new(0);
 /// `cache_entries.kind` tag for on-demand block-cache chunks.
 const KIND_BLOCK: &str = "block";
 /// `cache_entries.kind` tag for cached thumbnails.
@@ -150,13 +152,52 @@ pub struct StagedWrite {
    pub based_on: Option<Baseline>,
 }

-/// The identity of a remote revision, as far as we can observe it: a file whose
-/// size and mtime both still match the ones a queued change was made against has
-/// not been rewritten by anyone else in the meantime.
-#[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq)]
+/// The identity of a remote revision, as far as we can observe it.
+///
+/// `revision_id` is the authoritative identity when present: the server assigns a
+/// fresh id to every sealed revision, so an unchanged id proves no one rewrote
+/// the file — even when the server re-stamped its `mtime` on the *same* revision,
+/// which is the drift that used to cut spurious conflict copies (B16/B25).
+/// `mtime`/`size` remain the fallback for a baseline recorded before the id was
+/// observable, or a node read through a surface that does not carry it.
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq)]
 pub struct Baseline {
    pub mtime: i64,
    pub size: u64,
+    #[serde(default)]
+    pub hash: Option<String>,
+    /// Server revision id this change was made against (`None` if unknown).
+    #[serde(default)]
+    pub revision_id: Option<String>,
+}
+
+/// A denied-write rescue that retained the bytes but could not fully publish
+/// their recovery metadata.
+#[derive(Debug)]
+pub struct PreserveWriteError {
+    /// The actual path that still contains the accepted bytes.
+    pub surviving_path: PathBuf,
+    /// The recovery metadata that still describes those bytes, when one could
+    /// be made durable. Callers must never clear this after an error.
+    pub marker_path: Option<PathBuf>,
+    error: Error,
+}
+
+impl fmt::Display for PreserveWriteError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(
+            formatter,
+            "{} (bytes retained at {})",
+            self.error,
+            self.surviving_path.display()
+        )
+    }
+}
+
+impl std::error::Error for PreserveWriteError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        Some(&self.error)
+    }
 }

 /// Content cache rooted at a directory, with a sibling pin-registry file.
@@ -215,6 +256,18 @@ pub struct ContentCache {
 }

 impl ContentCache {
+    fn staging_path(&self, meta: &StagedWrite) -> PathBuf {
+        // The uid goes in the name so a staged file can be tied back to its node
+        // without a database; `/` in a uid would otherwise open a path.
+        let safe_uid = meta.uid.replace(['/', '\\'], "_");
+        self.staging_dir.join(format!(
+            "{}-{}-{}",
+            safe_uid,
+            now_millis(),
+            STAGING_N.fetch_add(1, Ordering::Relaxed)
+        ))
+    }
+
    /// Open (and create) a cache under `content_dir`, with the pin registry at
    /// `pins_path` and a `max_bytes` size cap (`0` = unlimited). Both parent
    /// directories are created if missing. `db` is the shared metadata database
@@ -239,7 +292,9 @@ impl ContentCache {
        let recovery_dir = content_dir.join("recovery");
        std::fs::create_dir_all(&recovery_dir)?;
        Self::rescue_scratch(&scratch_dir, &recovery_dir);
-        let _ = std::fs::remove_dir_all(&scratch_dir);
+        // A failed rescue may leave the only durable copy here. Never clear the
+        // directory wholesale; discard only blobs that carry no fsync marker.
+        Self::discard_unmarked_scratch(&scratch_dir);
        std::fs::create_dir_all(&scratch_dir)?;
        // Staging, by contrast, is deliberately preserved across runs.
        let staging_dir = content_dir.join("staging");
@@ -431,7 +486,12 @@ impl ContentCache {
        // 64-char hex key with no `.`, so this appends rather than replaces.
        // `store_thumbnail` cannot use the same idiom — see the note there.
        let tmp = blob.with_extension("tmp");
-        std::fs::write(&tmp, bytes)?;
+        {
+            let mut f = std::fs::File::create(&tmp)?;
+            use std::io::Write;
+            f.write_all(bytes)?;
+            f.sync_all()?;
+        }
        std::fs::rename(&tmp, &blob)?;
        let meta = serde_json::to_vec(&Meta { mtime, size })?;
        std::fs::write(self.meta_path(uid), meta)?;
@@ -464,6 +524,9 @@ impl ContentCache {
        if std::fs::hard_link(src, &tmp).is_err() {
            std::fs::copy(src, &tmp)?;
        }
+        if let Ok(f) = std::fs::File::open(&tmp) {
+            let _ = f.sync_all();
+        }
        let bytes = std::fs::metadata(&tmp)?.len();
        std::fs::rename(&tmp, &blob)?;
        let meta = serde_json::to_vec(&Meta { mtime, size })?;
@@ -526,7 +589,12 @@ impl ContentCache {
        let tmp = self
            .block_dir
            .join(format!("{}.b{idx}.tmp", Self::key(uid)));
-        std::fs::write(&tmp, bytes)?;
+        {
+            let mut f = std::fs::File::create(&tmp)?;
+            use std::io::Write;
+            f.write_all(bytes)?;
+            f.sync_all()?;
+        }
        std::fs::rename(&tmp, &blob)?;
        std::fs::write(
            self.block_meta(uid, idx),
@@ -654,18 +722,24 @@ impl ContentCache {
    pub fn create_scratch(&self) -> Result<(std::fs::File, PathBuf)> {
        use std::sync::atomic::{AtomicU64, Ordering};
        static N: AtomicU64 = AtomicU64::new(0);
-        let path = self.scratch_dir.join(format!(
-            "w-{}-{}",
-            std::process::id(),
-            N.fetch_add(1, Ordering::Relaxed)
-        ));
-        let file = std::fs::OpenOptions::new()
-            .create(true)
-            .truncate(true)
-            .read(true)
-            .write(true)
-            .open(&path)?;
-        Ok((file, path))
+        loop {
+            let path = self.scratch_dir.join(format!(
+                "w-{}-{}-{}",
+                std::process::id(),
+                now_millis(),
+                N.fetch_add(1, Ordering::Relaxed)
+            ));
+            match std::fs::OpenOptions::new()
+                .create_new(true)
+                .read(true)
+                .write(true)
+                .open(&path)
+            {
+                Ok(file) => return Ok((file, path)),
+                Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => continue,
+                Err(e) => return Err(e.into()),
+            }
+        }
    }

    /// The sidecar path for a scratch file, holding the [`StagedWrite`] that
@@ -694,16 +768,23 @@ impl ContentCache {
    /// have synced `scratch` first: a sidecar promising bytes that never reached
    /// the disk is worse than no sidecar.
    pub fn mark_scratch_durable(&self, scratch: &Path, meta: &StagedWrite) -> Result<()> {
+        use std::io::Write as _;
+
        let side = Self::scratch_sidecar(scratch);
        let tmp = side.with_extension("json.tmp");
-        std::fs::write(&tmp, serde_json::to_vec(meta)?)?;
+        let mut file = std::fs::OpenOptions::new()
+            .write(true)
+            .create(true)
+            .truncate(true)
+            .open(&tmp)?;
+        file.write_all(&serde_json::to_vec(meta)?)?;
+        file.sync_all()?;
+        drop(file);
        std::fs::rename(&tmp, &side)?;
        // The rename is what publishes the sidecar; fsync the directory so the
        // rename itself survives, not just the bytes it points at.
-        if let Some(dir) = side.parent()
-            && let Ok(d) = std::fs::File::open(dir)
-        {
-            let _ = d.sync_all();
+        if let Some(dir) = side.parent() {
+            std::fs::File::open(dir)?.sync_all()?;
        }
        Ok(())
    }
@@ -733,14 +814,40 @@ impl ContentCache {
                continue;
            }
            let side = Self::scratch_sidecar(&blob);
-            // Parsed, not merely present: an unreadable sidecar cannot drive a
-            // recovery, so the blob is rubbish like any other leftover.
-            if std::fs::read(&side)
+            if !side.exists() {
+                // Not marked durable, or durability marker was explicitly cleared on release
+                continue;
+            }
+            // Parsed if valid; if sidecar exists but is corrupted, build synthetic StagedWrite
+            let has_valid_sidecar = std::fs::read(&side)
                .ok()
                .and_then(|b| serde_json::from_slice::<StagedWrite>(&b).ok())
-                .is_none()
-            {
-                continue;
+                .is_some();
+            if !has_valid_sidecar {
+                if let Ok(meta) = std::fs::metadata(&blob)
+                    && meta.len() > 0
+                {
+                    let blob_name = blob
+                        .file_name()
+                        .map(|n| n.to_string_lossy().to_string())
+                        .unwrap_or_default();
+                    let synthetic = StagedWrite {
+                        uid: format!("recovered~{blob_name}"),
+                        len: meta.len(),
+                        base_size: meta.len(),
+                        base_mtime: 0,
+                        authored: vec![(0, meta.len())],
+                        complete: true,
+                        based_on: None,
+                    };
+                    if let Ok(data) = serde_json::to_vec(&synthetic) {
+                        let _ = std::fs::write(&side, data);
+                    } else {
+                        continue;
+                    }
+                } else {
+                    continue;
+                }
            }
            let Some(name) = blob.file_name() else {
                continue;
@@ -755,9 +862,53 @@ impl ContentCache {
        }
    }

+    fn discard_unmarked_scratch(scratch_dir: &Path) {
+        let Ok(entries) = std::fs::read_dir(scratch_dir) else {
+            return;
+        };
+        for entry in entries.flatten() {
+            let blob = entry.path();
+            if blob.extension().is_some_and(|e| e == "json") {
+                continue;
+            }
+            if !Self::scratch_sidecar(&blob).exists() {
+                let _ = std::fs::remove_file(blob);
+            }
+        }
+    }
+
+    /// Emergency eviction of unpinned blobs when local disk runs out of space (ENOSPC).
+    pub fn emergency_evict(&self) {
+        let pinned: HashSet<String> = self
+            .db
+            .pinned_uids()
+            .unwrap_or_default()
+            .iter()
+            .map(|uid| Self::key_str(uid))
+            .collect();
+        let content_dir = self.content_dir.clone();
+        // Force pool enforcement ignoring current cap check to free disk space immediately
+        let Ok(list) = self.db.cache_eviction_candidates(KIND_BLOB, 10) else {
+            return;
+        };
+        for (key, bytes) in list {
+            if pinned.contains(&key) {
+                continue;
+            }
+            let p = content_dir.join(&key);
+            let m = content_dir.join(format!("{key}.meta"));
+            let _ = std::fs::remove_file(&p);
+            let _ = std::fs::remove_file(&m);
+            let _ = self.db.cache_remove(&key);
+            self.blob_bytes.fetch_sub(bytes, Ordering::Relaxed);
+            break; // Evict one item at a time until space is freed
+        }
+    }
+
    /// Writes rescued from an unclean shutdown, as `(blob, meta)` pairs for the
    /// daemon to hand to the upload queue. A blob whose sidecar did not survive
-    /// the rescue is deleted here — nothing can address it.
+    /// is not actionable automatically, but is retained for manual recovery:
+    /// unexplained bytes are never evidence that user data is disposable.
    pub fn recovered_writes(&self) -> Vec<(PathBuf, StagedWrite)> {
        let Ok(entries) = std::fs::read_dir(&self.recovery_dir) else {
            return Vec::new();
@@ -768,14 +919,11 @@ impl ContentCache {
            if blob.extension().is_some_and(|e| e == "json") {
                continue;
            }
-            match std::fs::read(Self::scratch_sidecar(&blob))
+            if let Some(meta) = std::fs::read(Self::scratch_sidecar(&blob))
                .ok()
                .and_then(|b| serde_json::from_slice::<StagedWrite>(&b).ok())
            {
-                Some(meta) => out.push((blob, meta)),
-                None => {
-                    let _ = std::fs::remove_file(&blob);
-                }
+                out.push((blob, meta));
            }
        }
        out
@@ -803,31 +951,186 @@ impl ContentCache {
    /// failure here means we could not save the bytes at all, so it is reported
    /// rather than swallowed.
    pub fn stage_write(&self, meta: &StagedWrite, scratch: &Path) -> Result<PathBuf> {
-        static N: AtomicU64 = AtomicU64::new(0);
-        // The uid goes in the name so a staged file can be tied back to its node
-        // without a database; `/` in a uid would otherwise open a path.
-        let safe_uid = meta.uid.replace(['/', '\\'], "_");
-        let path = self.staging_dir.join(format!(
-            "{}-{}-{}",
-            safe_uid,
-            now_millis(),
-            N.fetch_add(1, Ordering::Relaxed)
-        ));
-        if let Err(e) = std::fs::rename(scratch, &path) {
-            // Cross-device: rename cannot move it, so copy and drop the original.
-            let _ = e;
+        use std::io::Write as _;
+
+        let path = self.staging_path(meta);
+        let copied = if let Err(e) = std::fs::rename(scratch, &path) {
+            if e.kind() != std::io::ErrorKind::CrossesDevices {
+                return Err(e.into());
+            }
            std::fs::copy(scratch, &path)?;
-            let _ = std::fs::remove_file(scratch);
-        }
+            true
+        } else {
+            false
+        };
+        std::fs::File::open(&path)?.sync_all()?;
        // Sidecar last: a staged file without one is still recoverable bytes,
        // while a sidecar without a file would describe nothing.
-        std::fs::write(
-            path.with_extension("json"),
-            serde_json::to_vec_pretty(meta)?,
-        )?;
+        let side = path.with_extension("json");
+        let side_tmp = path.with_extension("json.tmp");
+        let mut side_file = std::fs::OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .open(&side_tmp)?;
+        side_file.write_all(&serde_json::to_vec_pretty(meta)?)?;
+        side_file.sync_all()?;
+        drop(side_file);
+        std::fs::rename(&side_tmp, &side)?;
+        std::fs::File::open(&self.staging_dir)?.sync_all()?;
+        if copied {
+            std::fs::remove_file(scratch)?;
+        }
        Ok(path)
    }

+    /// Preserve accepted bytes which cannot be queued.
+    ///
+    /// Scratch and staging normally share a filesystem, so the normal path is
+    /// an atomic rename. If that is impossible, the source first receives a
+    /// durable recovery marker and remains in place until a copied destination,
+    /// its sidecar, and the staging directory are all synced.
+    pub fn preserve_write(
+        &self,
+        meta: &StagedWrite,
+        scratch: &Path,
+    ) -> std::result::Result<PathBuf, PreserveWriteError> {
+        let path = self.staging_path(meta);
+        self.preserve_write_at(meta, scratch, &path)
+    }
+
+    fn preserve_write_at(
+        &self,
+        meta: &StagedWrite,
+        scratch: &Path,
+        path: &Path,
+    ) -> std::result::Result<PathBuf, PreserveWriteError> {
+        use std::io::Write as _;
+
+        let retained = |surviving_path: &Path, error: Error| {
+            let adjacent = Self::scratch_sidecar(surviving_path);
+            let source = Self::scratch_sidecar(scratch);
+            let marker_path = [adjacent, source].into_iter().find(|path| path.is_file());
+            PreserveWriteError {
+                surviving_path: surviving_path.to_path_buf(),
+                marker_path,
+                error,
+            }
+        };
+        // If rename cannot happen, this marker is what lets the next open move
+        // the still-authoritative source into recovery instead of deleting it.
+        let marker_result = self.mark_scratch_durable(scratch, meta);
+        let side = path.with_extension("json");
+        let side_tmp = path.with_extension("json.tmp");
+        let publish_sidecar = || -> Result<()> {
+            let mut side_file = std::fs::OpenOptions::new()
+                .write(true)
+                .create_new(true)
+                .open(&side_tmp)?;
+            side_file.write_all(&serde_json::to_vec_pretty(meta)?)?;
+            side_file.sync_all()?;
+            drop(side_file);
+            std::fs::rename(&side_tmp, &side)?;
+            std::fs::File::open(&self.staging_dir)?.sync_all()?;
+            Ok(())
+        };
+
+        match std::fs::rename(scratch, path) {
+            Ok(()) => {
+                if let Err(error) = std::fs::File::open(path).and_then(|file| file.sync_all()) {
+                    if std::fs::rename(path, scratch).is_ok() {
+                        if !Self::scratch_sidecar(scratch).is_file() {
+                            let _ = self.mark_scratch_durable(scratch, meta);
+                        }
+                        let _ =
+                            std::fs::File::open(&self.scratch_dir).and_then(|dir| dir.sync_all());
+                        return Err(retained(scratch, error.into()));
+                    }
+                    return Err(retained(path, error.into()));
+                }
+                let scratch_side = Self::scratch_sidecar(scratch);
+                let side_result = if marker_result.is_ok() {
+                    std::fs::rename(&scratch_side, &side)
+                        .map_err(Error::from)
+                        .and_then(|()| {
+                            std::fs::File::open(&self.staging_dir)?
+                                .sync_all()
+                                .map_err(Error::from)
+                        })
+                } else {
+                    publish_sidecar()
+                };
+                if let Err(error) = side_result {
+                    let _ = std::fs::remove_file(&side_tmp);
+                    // Publication did not complete. Put the blob back beside
+                    // the source marker so startup recovery still has a
+                    // reconstructable pair, rather than an unexplained staging
+                    // blob and a marker whose source vanished.
+                    if std::fs::rename(path, scratch).is_ok() {
+                        if !Self::scratch_sidecar(scratch).is_file() {
+                            let _ = self.mark_scratch_durable(scratch, meta);
+                        }
+                        let _ =
+                            std::fs::File::open(&self.scratch_dir).and_then(|dir| dir.sync_all());
+                        return Err(retained(scratch, error));
+                    }
+                    return Err(retained(path, error));
+                }
+                Ok(path.to_path_buf())
+            }
+            Err(rename_error) => {
+                let source_marked =
+                    marker_result.is_ok() || Self::scratch_sidecar(scratch).exists();
+                if let Err(marker_error) = marker_result {
+                    tracing::warn!(
+                        error = %marker_error,
+                        path = %scratch.display(),
+                        "could not mark rescue source durable before copy fallback"
+                    );
+                }
+                if let Err(error) = std::fs::copy(scratch, path) {
+                    if !source_marked {
+                        let recovery = self.recovery_dir.join(
+                            path.file_name()
+                                .unwrap_or_else(|| std::ffi::OsStr::new("denied-write")),
+                        );
+                        if std::fs::rename(scratch, &recovery).is_ok() {
+                            let _ = std::fs::File::open(&self.recovery_dir)
+                                .and_then(|dir| dir.sync_all());
+                            return Err(retained(
+                                &recovery,
+                                Error::Other(format!(
+                                    "rename failed ({rename_error}); copy fallback failed ({error})"
+                                )),
+                            ));
+                        }
+                    }
+                    return Err(retained(
+                        scratch,
+                        Error::Other(format!(
+                            "rename failed ({rename_error}); copy fallback failed ({error})"
+                        )),
+                    ));
+                }
+                if let Err(error) = std::fs::File::open(path).and_then(|file| file.sync_all()) {
+                    let surviving = if source_marked { scratch } else { path };
+                    return Err(retained(surviving, error.into()));
+                }
+                if let Err(error) = publish_sidecar() {
+                    let _ = std::fs::remove_file(&side_tmp);
+                    let surviving = if source_marked { scratch } else { path };
+                    return Err(retained(surviving, error));
+                }
+                // Deliberately last: fallback never removes its marked source
+                // until destination publication is complete.
+                if let Err(error) = std::fs::remove_file(scratch) {
+                    return Err(retained(path, error.into()));
+                }
+                self.clear_scratch_durable(scratch);
+                Ok(path.to_path_buf())
+            }
+        }
+    }
+
    /// Drop a staged blob and its sidecar, once its bytes are safely on the
    /// remote (or the op that owned them has been superseded). Best effort:
    /// leftovers cost disk, while failing here would strand a drained op.
@@ -1759,6 +2062,8 @@ mod tests {
            based_on: Some(Baseline {
                mtime: 100,
                size: 40,
+                hash: None,
+                revision_id: None,
            }),
        };
        let staged = c.stage_write(&meta, &scratch).unwrap();
@@ -1783,6 +2088,92 @@ mod tests {
        );
    }

+    fn preservation_meta() -> StagedWrite {
+        StagedWrite {
+            uid: uid("preserved").to_string(),
+            len: 14,
+            base_size: 0,
+            base_mtime: 100,
+            authored: vec![(0, 14)],
+            complete: true,
+            based_on: None,
+        }
+    }
+
+    #[test]
+    fn orphan_preservation_publishes_exact_bytes_then_removes_source() {
+        use std::io::Write as _;
+
+        let (c, _dir) = cache();
+        let (mut file, scratch) = c.create_scratch().unwrap();
+        file.write_all(b"accepted bytes").unwrap();
+        file.sync_all().unwrap();
+        drop(file);
+
+        let preserved = c.preserve_write(&preservation_meta(), &scratch).unwrap();
+
+        assert!(!scratch.exists());
+        assert_eq!(std::fs::read(&preserved).unwrap(), b"accepted bytes");
+        let sidecar: StagedWrite =
+            serde_json::from_slice(&std::fs::read(preserved.with_extension("json")).unwrap())
+                .unwrap();
+        let expected = preservation_meta();
+        assert_eq!(sidecar.uid, expected.uid);
+        assert_eq!(sidecar.len, expected.len);
+        assert_eq!(sidecar.authored, expected.authored);
+        assert_eq!(sidecar.complete, expected.complete);
+    }
+
+    #[test]
+    fn orphan_preservation_sidecar_failure_reports_surviving_blob_across_reopen() {
+        use std::io::Write as _;
+
+        let (c, dir) = cache();
+        let (mut file, scratch) = c.create_scratch().unwrap();
+        file.write_all(b"only surviving copy").unwrap();
+        file.sync_all().unwrap();
+        drop(file);
+
+        let destination = c.staging_dir.join("forced-preservation-failure");
+        let side = destination.with_extension("json");
+        std::fs::create_dir(&side).unwrap();
+
+        let error = c
+            .preserve_write_at(&preservation_meta(), &scratch, &destination)
+            .unwrap_err();
+        assert_eq!(error.surviving_path, scratch);
+        assert!(
+            scratch.exists(),
+            "failed sidecar publication must roll the blob back beside its marker"
+        );
+        assert_eq!(
+            std::fs::read(&error.surviving_path).unwrap(),
+            b"only surviving copy"
+        );
+        assert_eq!(
+            error.marker_path,
+            Some(ContentCache::scratch_sidecar(&scratch))
+        );
+        assert!(
+            side.is_dir(),
+            "the induced sidecar failure remains observable"
+        );
+
+        let content = dir.path().join("content");
+        let pins = dir.path().join("pins-reopen.json");
+        drop(c);
+        let reopened =
+            ContentCache::open(content, pins, 0, Arc::new(Db::open_in_memory().unwrap())).unwrap();
+        let recovered = reopened.recovered_writes();
+        assert_eq!(recovered.len(), 1);
+        assert_eq!(
+            std::fs::read(&recovered[0].0).unwrap(),
+            b"only surviving copy"
+        );
+        assert_eq!(recovered[0].1.uid, preservation_meta().uid);
+        drop(reopened);
+    }
+
    /// A2: `fsync(2)` promises the bytes survive a crash, but queueing happens
    /// at `release`. A scratch file marked durable must therefore outlive the
    /// open that clears the scratch directory — and an unmarked one must not,
@@ -1836,6 +2227,51 @@ mod tests {
        assert!(c2.recovered_writes().is_empty(), "recovery does not repeat");
    }

+    #[test]
+    fn recovery_keeps_an_orphan_blob_when_its_sidecar_is_missing() {
+        let (c, dir) = cache();
+        let orphan = dir.path().join("content/recovery/orphaned-user-bytes");
+        std::fs::write(&orphan, b"retain me").unwrap();
+
+        assert!(c.recovered_writes().is_empty());
+        assert_eq!(
+            std::fs::read(&orphan).unwrap(),
+            b"retain me",
+            "metadata loss must not trigger deletion of unexplained content"
+        );
+    }
+
+    #[test]
+    fn failed_scratch_rescue_does_not_delete_the_durable_source() {
+        use std::io::Write as _;
+        let dir = TempDir::new();
+        let db = Arc::new(Db::open_in_memory().unwrap());
+        let content = dir.path().join("content");
+        let pins = dir.path().join("pins.json");
+        let c = ContentCache::open(content.clone(), pins.clone(), 0, db.clone()).unwrap();
+        let (mut file, scratch) = c.create_scratch().unwrap();
+        file.write_all(b"durable source").unwrap();
+        file.sync_all().unwrap();
+        let meta = StagedWrite {
+            uid: uid("rescue").to_string(),
+            len: 14,
+            base_size: 0,
+            base_mtime: 0,
+            authored: vec![(0, 14)],
+            complete: true,
+            based_on: None,
+        };
+        c.mark_scratch_durable(&scratch, &meta).unwrap();
+        let blocking_destination = content.join("recovery").join(scratch.file_name().unwrap());
+        std::fs::create_dir(&blocking_destination).unwrap();
+        drop(file);
+        drop(c);
+
+        let _c2 = ContentCache::open(content, pins, 0, db).unwrap();
+        assert_eq!(std::fs::read(&scratch).unwrap(), b"durable source");
+        assert!(ContentCache::scratch_sidecar(&scratch).exists());
+    }
+
    /// Releasing a write hands the bytes to staging, so the sidecar an earlier
    /// `fsync` left must not offer recovery a second, stale copy of it.
    #[test]
@@ -20,6 +20,59 @@ pub const KEYRING_SERVICE: &str = "proton-drive-linux";
 /// blobs back under this; pinned files are exempt. See [`crate::cache`].
 pub const DEFAULT_CACHE_BUDGET_BYTES: u64 = 5 * 1024 * 1024 * 1024;

+/// Environment override for [`AppConfig::resolved_conflict_sweep`]. Exists so a
+/// support case can disable the sweep without editing the config file or
+/// reinstalling — it wins over the stored setting.
+pub const CONFLICT_SWEEP_ENV: &str = "PDFS_CONFLICT_SWEEP";
+
+/// What the background conflict sweep (`pdfs-fuse`'s `pdfs-conflict-sweep`
+/// thread) is allowed to do about a `(sync-conflict …)` copy it believes is a
+/// redundant duplicate.
+///
+/// Defaults to [`SweepMode::Report`]: the sweep's whole reason to exist is that
+/// the *previous* revision-identity check was wrong (B69), so the replacement is
+/// not trusted with deletion until it has a release cycle of field evidence
+/// behind it. See `docs/BUGS.md` B71.
+#[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq, Default)]
+#[serde(rename_all = "lowercase")]
+pub enum SweepMode {
+    /// Do not run the sweep at all — the thread is never spawned.
+    Off,
+    /// Run, and log what it *would* remove, but never trash anything. Divergent
+    /// and orphaned copies are still surfaced to the activity feed as usual.
+    #[default]
+    Report,
+    /// Trash copies proven identical to their live sibling.
+    Enforce,
+}
+
+impl SweepMode {
+    /// Parse an operator-supplied value ([`CONFLICT_SWEEP_ENV`] or a CLI flag).
+    /// `None` for anything unrecognised, so a typo falls back to the stored
+    /// setting rather than silently picking a mode the operator did not ask for.
+    pub fn parse(value: &str) -> Option<Self> {
+        match value.trim().to_ascii_lowercase().as_str() {
+            "off" | "no" | "false" | "0" | "disabled" => Some(Self::Off),
+            "report" | "dry-run" | "dryrun" | "observe" => Some(Self::Report),
+            "enforce" | "on" | "yes" | "true" | "1" => Some(Self::Enforce),
+            _ => None,
+        }
+    }
+
+    /// Whether this mode is allowed to trash a duplicate.
+    pub fn is_enforcing(self) -> bool {
+        matches!(self, Self::Enforce)
+    }
+}
+
+/// Precedence for [`AppConfig::resolved_conflict_sweep`], split out from the
+/// environment read so it can be unit-tested without mutating process state.
+fn resolve_sweep_mode(env: Option<&str>, stored: Option<SweepMode>) -> SweepMode {
+    env.and_then(SweepMode::parse)
+        .or(stored)
+        .unwrap_or_default()
+}
+
 /// Configuration structure allowing the user to customize client identification headers.
 #[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct AppConfig {
@@ -48,6 +101,11 @@ pub struct AppConfig {
    /// by hostname". Defaulted for configs predating the field.
    #[serde(default)]
    pub device_uid: Option<String>,
+    /// What the background conflict sweep may do. `None` means "use
+    /// [`SweepMode::default`]" (report-only). Defaulted for configs predating
+    /// the field, and overridable at runtime via [`CONFLICT_SWEEP_ENV`].
+    #[serde(default)]
+    pub conflict_sweep: Option<SweepMode>,
 }

 impl Default for AppConfig {
@@ -59,6 +117,7 @@ impl Default for AppConfig {
            mountpoint: None,
            ignore_patterns: None,
            device_uid: None,
+            conflict_sweep: None,
        }
    }
 }
@@ -70,6 +129,20 @@ impl AppConfig {
        self.cache_budget.unwrap_or(DEFAULT_CACHE_BUDGET_BYTES)
    }

+    /// The effective conflict-sweep mode: the [`CONFLICT_SWEEP_ENV`] override if
+    /// it parses, then the user's stored choice, then [`SweepMode::default`].
+    ///
+    /// The environment wins so a support case can stop a destructive background
+    /// loop without editing config or reinstalling (`docs/BUGS.md` B71). An
+    /// unparseable value is ignored rather than treated as "off", so a typo
+    /// cannot silently change behaviour in either direction.
+    pub fn resolved_conflict_sweep(&self) -> SweepMode {
+        resolve_sweep_mode(
+            std::env::var(CONFLICT_SWEEP_ENV).ok().as_deref(),
+            self.conflict_sweep,
+        )
+    }
+
    /// The effective global sync ignore patterns: the user's explicit list, or
    /// [`DEFAULT_IGNORE_PATTERNS`] when unset. An explicit empty list is
    /// honoured as "no global patterns", which is why this is not a
@@ -105,11 +178,21 @@ impl AppDirs {
    /// Load config from disk, creating default if missing.
    pub fn load_config(&self) -> AppConfig {
        let path = self.config_path();
-        if path.exists()
-            && let Ok(content) = std::fs::read_to_string(&path)
-            && let Ok(config) = serde_json::from_str::<AppConfig>(&content)
-        {
-            return config;
+        if path.exists() {
+            match std::fs::read_to_string(&path)
+                .map_err(Error::from)
+                .and_then(|content| {
+                    serde_json::from_str::<AppConfig>(&content).map_err(Error::from)
+                }) {
+                Ok(config) => return config,
+                Err(e) => {
+                    // Preserve the original bytes for diagnosis/recovery.  In
+                    // particular, never replace a truncated config with defaults
+                    // and silently lose mount, device, or ignore settings.
+                    tracing::error!(path = %path.display(), error = %e, "config is unreadable; using in-memory defaults without overwriting it");
+                    return AppConfig::default();
+                }
+            }
        }

        let default_config = AppConfig::default();
@@ -125,10 +208,26 @@ impl AppDirs {
    /// cache budget or mountpoint; the daemon re-reads the file on its next mount.
    pub fn save_config(&self, config: &AppConfig) -> Result<()> {
        let path = self.config_path();
-        if let Some(parent) = path.parent() {
-            std::fs::create_dir_all(parent)?;
-        }
-        std::fs::write(&path, serde_json::to_string_pretty(config)?)?;
+        let parent = path
+            .parent()
+            .ok_or_else(|| Error::Other("configuration path has no parent".into()))?;
+        std::fs::create_dir_all(parent)?;
+        let nonce = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .map(|duration| duration.as_nanos())
+            .unwrap_or(0);
+        let tmp = path.with_extension(format!("json.tmp-{}-{nonce}", std::process::id()));
+        use std::os::unix::fs::OpenOptionsExt as _;
+        let mut file = std::fs::OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .mode(0o600)
+            .open(&tmp)?;
+        use std::io::Write as _;
+        file.write_all(&serde_json::to_vec_pretty(config)?)?;
+        file.sync_all()?;
+        std::fs::rename(&tmp, &path)?;
+        std::fs::File::open(parent)?.sync_all()?;
        Ok(())
    }

@@ -211,24 +310,41 @@ impl AppDirs {
    pub fn ensure(&self) -> Result<()> {
        for dir in [self.state_dir(), self.cache_dir()] {
            std::fs::create_dir_all(&dir)?;
-            restrict_dir(&dir);
+            restrict_dir(&dir)?;
        }
        let config_dir = self.dirs.config_dir().to_path_buf();
-        if std::fs::create_dir_all(&config_dir).is_ok() {
-            restrict_dir(&config_dir);
-        }
+        std::fs::create_dir_all(&config_dir)?;
+        restrict_dir(&config_dir)?;
        Ok(())
    }
 }

-/// Make `dir` owner-only (`0700`). Best effort: a mode we cannot set (an
-/// exotic filesystem, a directory we do not own) is not worth refusing to
-/// start over, and the caller has no better answer than continuing.
-fn restrict_dir(dir: &Path) {
-    use std::os::unix::fs::PermissionsExt;
-    if let Err(e) = std::fs::set_permissions(dir, std::fs::Permissions::from_mode(0o700)) {
-        tracing::warn!(path = %dir.display(), error = %e, "could not restrict directory to 0700");
+/// Make `dir` owner-only (`0700`). These directories contain decrypted bytes,
+/// plaintext names, and an authenticated control socket, so failure is fatal.
+fn restrict_dir(dir: &Path) -> Result<()> {
+    use std::os::unix::fs::{MetadataExt as _, PermissionsExt};
+    let before = std::fs::symlink_metadata(dir)?;
+    if before.file_type().is_symlink() || !before.is_dir() {
+        return Err(Error::Other(format!(
+            "sensitive path is not a real directory: {}",
+            dir.display()
+        )));
    }
+    if before.uid() != unsafe { libc::geteuid() } {
+        return Err(Error::Other(format!(
+            "sensitive directory is not owned by the current user: {}",
+            dir.display()
+        )));
+    }
+    std::fs::set_permissions(dir, std::fs::Permissions::from_mode(0o700))?;
+    let after = std::fs::symlink_metadata(dir)?;
+    if after.permissions().mode() & 0o777 != 0o700 {
+        return Err(Error::Other(format!(
+            "sensitive directory did not become owner-only: {}",
+            dir.display()
+        )));
+    }
+    Ok(())
 }

 /// Make a just-bound Unix socket owner-only (`0600`).
@@ -263,29 +379,57 @@ mod tests {
    /// and the control socket that commands the daemon's session.
    #[test]
    fn restrict_dir_makes_a_directory_owner_only() {
-        let dir = std::env::temp_dir().join(format!("pdfs-cfg-{}", std::process::id()));
+        let dir = std::env::temp_dir().join(format!(
+            "pdfs-cfg-{}-{:?}",
+            std::process::id(),
+            std::thread::current().id()
+        ));
        let _ = std::fs::remove_dir_all(&dir);
        std::fs::create_dir_all(&dir).unwrap();
        // Start deliberately world-readable, as `create_dir_all` under a typical
        // umask would leave it.
        std::fs::set_permissions(&dir, std::fs::Permissions::from_mode(0o755)).unwrap();

-        restrict_dir(&dir);
+        restrict_dir(&dir).unwrap();

        assert_eq!(mode_of(&dir), 0o700, "group and other must have no access");
        let _ = std::fs::remove_dir_all(&dir);
    }

+    #[test]
+    fn restrict_dir_refuses_a_symlink() {
+        let root = std::env::temp_dir().join(format!(
+            "pdfs-cfg-link-{}-{:?}",
+            std::process::id(),
+            std::thread::current().id()
+        ));
+        let target = root.join("target");
+        let link = root.join("state");
+        std::fs::create_dir_all(&target).unwrap();
+        std::os::unix::fs::symlink(&target, &link).unwrap();
+
+        assert!(restrict_dir(&link).is_err());
+
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
    /// Connecting to the control socket confers the daemon's authenticated
    /// session with no credential, so it is an authority boundary rather than
    /// merely private data.
    #[test]
    fn restrict_socket_makes_a_socket_owner_only() {
-        let dir = std::env::temp_dir().join(format!("pdfs-sock-{}", std::process::id()));
+        let dir = std::env::temp_dir().join(format!(
+            "pdfs-sock-{}-{:?}",
+            std::process::id(),
+            std::thread::current().id()
+        ));
        let _ = std::fs::remove_dir_all(&dir);
        std::fs::create_dir_all(&dir).unwrap();
        let sock = dir.join("control.sock");
-        let listener = std::os::unix::net::UnixListener::bind(&sock).unwrap();
+        // chmod semantics are identical for a socket path and a regular file;
+        // use a file so this regression also runs in sandboxes that prohibit
+        // creating Unix sockets.
+        let listener = std::fs::File::create(&sock).unwrap();

        restrict_socket(&sock).unwrap();

@@ -303,6 +447,7 @@ mod tests {
            mountpoint: Some("/tmp/x".to_string()),
            ignore_patterns: Some(vec!["build/".to_string()]),
            device_uid: Some("dev-uid".to_string()),
+            conflict_sweep: Some(SweepMode::Enforce),
        };
        let json = serde_json::to_string(&config).unwrap();
        let decoded: AppConfig = serde_json::from_str(&json).unwrap();
@@ -317,6 +462,62 @@ mod tests {
        assert_eq!(default_config.user_agent, USER_AGENT);
    }

+    #[test]
+    fn sweep_mode_defaults_to_report_only() {
+        // The sweep trashes user files, so an installed config that has never
+        // heard of the setting must not get the enforcing behaviour.
+        assert_eq!(SweepMode::default(), SweepMode::Report);
+        assert!(!SweepMode::default().is_enforcing());
+        assert_eq!(resolve_sweep_mode(None, None), SweepMode::Report);
+    }
+
+    #[test]
+    fn sweep_mode_parses_operator_spellings() {
+        for s in ["off", "OFF", " no ", "false", "0", "disabled"] {
+            assert_eq!(SweepMode::parse(s), Some(SweepMode::Off), "{s}");
+        }
+        for s in ["report", "dry-run", "dryrun", "observe"] {
+            assert_eq!(SweepMode::parse(s), Some(SweepMode::Report), "{s}");
+        }
+        for s in ["enforce", "on", "yes", "true", "1"] {
+            assert_eq!(SweepMode::parse(s), Some(SweepMode::Enforce), "{s}");
+        }
+        // A typo must not resolve to anything, so it falls through to the config.
+        assert_eq!(SweepMode::parse("offf"), None);
+        assert_eq!(SweepMode::parse(""), None);
+    }
+
+    #[test]
+    fn sweep_mode_env_overrides_config_but_a_typo_does_not() {
+        let stored = Some(SweepMode::Enforce);
+        // The point of the override: kill a destructive loop without editing config.
+        assert_eq!(resolve_sweep_mode(Some("off"), stored), SweepMode::Off);
+        // Unrecognised value falls back to the stored choice rather than guessing.
+        assert_eq!(resolve_sweep_mode(Some("nope"), stored), SweepMode::Enforce);
+        assert_eq!(resolve_sweep_mode(None, stored), SweepMode::Enforce);
+        // No env, no stored value: report-only.
+        assert_eq!(resolve_sweep_mode(Some("nope"), None), SweepMode::Report);
+    }
+
+    #[test]
+    fn a_config_predating_conflict_sweep_still_loads() {
+        let json = r#"{"app_version":"v","user_agent":"u"}"#;
+        let decoded: AppConfig = serde_json::from_str(json).unwrap();
+        assert!(decoded.conflict_sweep.is_none());
+    }
+
+    #[test]
+    fn sweep_mode_round_trips_through_the_config_file() {
+        let config = AppConfig {
+            conflict_sweep: Some(SweepMode::Enforce),
+            ..Default::default()
+        };
+        let json = serde_json::to_string(&config).unwrap();
+        assert!(json.contains(r#""conflict_sweep":"enforce""#), "{json}");
+        let decoded: AppConfig = serde_json::from_str(&json).unwrap();
+        assert_eq!(decoded.conflict_sweep, Some(SweepMode::Enforce));
+    }
+
    #[test]
    fn a_config_predating_ignore_patterns_still_loads() {
        // Every installed config on disk looks like this; the field must not be
@@ -14,6 +14,7 @@ use serde::{Deserialize, Serialize};

 use crate::cache::Pin;
 use crate::error::Result;
+pub use crate::mounts::{MountAccess, MountKind, MountMode, MountSpec};

 /// Cap on the *write* half of a round-trip. A crashed daemon can leave its
 /// listening socket in the kernel (e.g. as a `<defunct>` zombie): `connect`
@@ -70,6 +71,20 @@ pub enum Request {
        #[serde(default)]
        kind: Option<PhotoKind>,
    },
+    /// List the account's photo albums, newest activity first, including the
+    /// albums other people share with us. Metadata only — an album's cover
+    /// thumbnail is fetched with [`Request::PhotoThumbs`] like any other photo.
+    /// Replies with [`Response::Albums`].
+    PhotoAlbums,
+    /// Fetch a page of one album's photos, newest capture first. Same reply
+    /// shape as [`Request::PhotosTimeline`] ([`Response::Photos`]), so a
+    /// front-end paints an album with the gallery it already has. `uid` is the
+    /// album node's uid, as reported by [`Request::PhotoAlbums`].
+    AlbumPhotos {
+        uid: String,
+        offset: usize,
+        limit: usize,
+    },
    /// Fetch thumbnails for the given photo uids, downloading the ones not
    /// already cached (one batched round-trip) and replying with their on-disk
    /// paths. Keep the batch small — it is served on demand, as tiles scroll in.
@@ -101,6 +116,19 @@ pub enum Request {
    /// Independent of [`Request::Search`] so a front-end can fire both at once and
    /// render whichever lands first. Replies with [`Response::LocalResults`].
    SearchLocal { query: String, limit: usize },
+    /// Search both the Drive metadata index and the local-file index in one
+    /// round-trip. This is the preferred prompt API; the two legacy search
+    /// requests remain available for older clients. `limit` applies to each
+    /// source independently. `filters` is applied before limiting, so selecting
+    /// (for example) images cannot hide valid matches below an unfiltered top
+    /// `limit`. Older clients omit it and therefore search both sources and all
+    /// kinds. Replies with [`Response::SearchResultsV2`].
+    SearchV2 {
+        query: String,
+        limit: usize,
+        #[serde(default)]
+        filters: SearchFilters,
+    },
    /// Rename a file or folder. `path` is mountpoint-relative; `new_name` is a
    /// single path component (no separators). Replies with [`Response::Ok`].
    Rename { path: String, new_name: String },
@@ -181,6 +209,11 @@ pub enum Request {
    /// it invalidates, it does not fetch.
    Refresh { scope: RefreshScope },

+    // ---- locations --------------------------------------------------------
+    /// List every local Proton Drive location. Replies with
+    /// [`Response::Locations`].
+    ListLocations,
+
    // ---- devices ----------------------------------------------------------
    /// List the account's registered devices. Replies with [`Response::Devices`].
    ListDevices,
@@ -227,9 +260,20 @@ pub enum Request {
        role: String,
        message: Option<String>,
    },
+    /// The by-uid twin of [`Request::ShareNode`], for nodes proven to belong to
+    /// an on-demand or mirror device location. This is a distinct variant so an
+    /// older daemon rejects it instead of ignoring `uid` and acting on `path`.
+    ShareNodeByUid {
+        uid: String,
+        emails: Vec<String>,
+        role: String,
+        message: Option<String>,
+    },
    /// List the members, pending invitations and public link of the node at
    /// mountpoint-relative `path`. Replies with [`Response::Share`].
    ListShare { path: String },
+    /// The by-uid twin of [`Request::ListShare`].
+    ListShareByUid { uid: String },
    /// Change the role of a share entry (member or pending invitation) on the node
    /// at `path`. `id` and `kind` identify the entry (from [`Response::Share`]).
    /// Replies with [`Response::Ok`].
@@ -239,6 +283,13 @@ pub enum Request {
        kind: ShareEntryKind,
        role: String,
    },
+    /// The by-uid twin of [`Request::UpdateShareRole`].
+    UpdateShareRoleByUid {
+        uid: String,
+        id: String,
+        kind: ShareEntryKind,
+        role: String,
+    },
    /// Remove a share entry (member, pending Proton invite, or external invite)
    /// from the node at `path`. Replies with [`Response::Ok`].
    RemoveShareEntry {
@@ -246,6 +297,12 @@ pub enum Request {
        id: String,
        kind: ShareEntryKind,
    },
+    /// The by-uid twin of [`Request::RemoveShareEntry`].
+    RemoveShareEntryByUid {
+        uid: String,
+        id: String,
+        kind: ShareEntryKind,
+    },
    /// Create a public link on the node at `path`. `role` is "viewer" or "editor";
    /// `password` optionally adds a custom password; `expires` is an optional Unix
    /// expiry. Replies with [`Response::PublicLink`] (carrying the shareable URL).
@@ -255,9 +312,18 @@ pub enum Request {
        password: Option<String>,
        expires: Option<i64>,
    },
+    /// The by-uid twin of [`Request::CreatePublicLink`].
+    CreatePublicLinkByUid {
+        uid: String,
+        role: String,
+        password: Option<String>,
+        expires: Option<i64>,
+    },
    /// Remove the public link `id` from the node at `path`. Replies with
    /// [`Response::Ok`].
    RemovePublicLink { path: String, id: String },
+    /// The by-uid twin of [`Request::RemovePublicLink`].
+    RemovePublicLinkByUid { uid: String, id: String },

    // ---- shared by me -----------------------------------------------------
    /// List the nodes I have shared with others — collaborative shares that still
@@ -560,6 +626,11 @@ pub enum ActivityKind {
    Share,
    PublicLink,
    Unshare,
+    /// A `(sync-conflict …)` copy that needs the user's attention: it diverges
+    /// from the live file (or has no sibling), so the auto-sweep left it in place
+    /// rather than removing it. An auto-*removed* identical copy is logged as a
+    /// [`ActivityKind::Trash`] instead, since that is what happened to it.
+    Conflict,
 }

 /// One line in the daemon's activity log (in [`Response::Activity`]). Newest
@@ -649,6 +720,12 @@ pub struct DirEntry {
    /// browser.
    #[serde(default)]
    pub path: String,
+    /// My role on this node when it is reached through a share I accepted —
+    /// `"viewer"`, `"editor"`, `"admin"`, or empty for content I own (where the
+    /// question does not arise) and for a share whose role the API did not
+    /// report. Defaulted for wire-compat with clients/daemons predating it.
+    #[serde(default)]
+    pub role: String,
 }

 /// One hit in a [`Request::Search`] result. Like [`DirEntry`] but carries the
@@ -665,6 +742,15 @@ pub struct SearchHit {
    pub pinned: bool,
    /// Node uid in `volume~link` form.
    pub uid: String,
+    /// Absolute path through the most specific active on-demand mount, when the
+    /// node is covered by one. Clients should prefer this for folders and
+    /// streamable media, and fall back to `mountpoint/path` when absent.
+    #[serde(default)]
+    pub mounted_path: Option<String>,
+    /// Relevance assigned by the daemon. Higher scores sort first. Legacy
+    /// daemons omit it, in which case clients retain the daemon's result order.
+    #[serde(default)]
+    pub score: i64,
 }

 /// One hit in a [`Request::SearchLocal`] result: a file on this machine, outside
@@ -679,6 +765,107 @@ pub struct LocalHit {
    pub size: u64,
    /// Modification time, epoch seconds.
    pub modified: i64,
+    /// Relevance assigned by the daemon. Higher scores sort first. Legacy
+    /// daemons omit it, in which case clients retain the daemon's result order.
+    #[serde(default)]
+    pub score: i64,
+}
+
+/// A searchable corpus in [`Request::SearchV2`]. Kept explicit on the wire so
+/// future sources can be added without multiplying request variants.
+#[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum SearchSource {
+    Drive,
+    Local,
+}
+
+/// Coarse result kind used by the prompt's facets. Classification belongs in
+/// core/the daemon and must happen before the per-source limit is applied.
+#[derive(Serialize, Deserialize, Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum SearchKind {
+    #[default]
+    All,
+    Folders,
+    Documents,
+    Images,
+    Media,
+}
+
+impl SearchKind {
+    /// Classify a result before the caller applies its final limit. This stays
+    /// beside the wire enum so every front end and both search corpora agree.
+    pub fn accepts(self, name: &str, is_dir: bool) -> bool {
+        if self == Self::All {
+            return true;
+        }
+        if self == Self::Folders {
+            return is_dir;
+        }
+        if is_dir {
+            return false;
+        }
+        let extension = std::path::Path::new(name)
+            .extension()
+            .and_then(|value| value.to_str())
+            .unwrap_or_default()
+            .to_ascii_lowercase();
+        match self {
+            Self::Documents => matches!(
+                extension.as_str(),
+                "pdf"
+                    | "doc"
+                    | "docx"
+                    | "odt"
+                    | "rtf"
+                    | "txt"
+                    | "md"
+                    | "xls"
+                    | "xlsx"
+                    | "ods"
+                    | "csv"
+                    | "ppt"
+                    | "pptx"
+                    | "odp"
+                    | "epub"
+            ),
+            Self::Images => matches!(
+                extension.as_str(),
+                "png" | "jpg" | "jpeg" | "webp" | "gif" | "bmp" | "svg" | "avif" | "heic" | "tiff"
+            ),
+            Self::Media => {
+                PhotoKind::classify(Some(name), None) == PhotoKind::Video
+                    || matches!(
+                        extension.as_str(),
+                        "mp3" | "flac" | "wav" | "ogg" | "opus" | "m4a" | "aac"
+                    )
+            }
+            Self::All | Self::Folders => unreachable!(),
+        }
+    }
+}
+
+/// Optional constraints for a unified search. The default deliberately means
+/// the original SearchV2 behaviour, preserving old JSON requests.
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq)]
+pub struct SearchFilters {
+    /// Sources to query. An explicit empty list searches neither source.
+    #[serde(default = "default_search_sources")]
+    pub sources: Vec<SearchSource>,
+    #[serde(default)]
+    pub kind: SearchKind,
+}
+
+impl Default for SearchFilters {
+    fn default() -> Self {
+        Self {
+            sources: default_search_sources(),
+            kind: SearchKind::All,
+        }
+    }
+}
+
+fn default_search_sources() -> Vec<SearchSource> {
+    vec![SearchSource::Drive, SearchSource::Local]
 }

 /// What kind of media a timeline entry is, so the Photos page can split into
@@ -779,6 +966,29 @@ pub struct PhotoMonth {
    pub count: usize,
 }

+/// One album in a [`Response::Albums`] listing.
+///
+/// An album is a folder node on the photos volume carrying album properties, so
+/// it has an ordinary name; everything else here comes from those properties.
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct AlbumInfo {
+    /// Album node uid in `volume~link` form — what [`Request::AlbumPhotos`]
+    /// takes.
+    pub uid: String,
+    pub name: String,
+    /// How many photos the server says the album holds.
+    pub photo_count: usize,
+    /// The photo shown as the album's cover, when it has one. Its thumbnail is
+    /// fetched with [`Request::PhotoThumbs`] like any other photo.
+    pub cover_uid: Option<String>,
+    /// Epoch seconds of the last change to the album's contents, when the server
+    /// reports one. The listing is ordered by it, newest first.
+    pub last_activity: Option<i64>,
+    /// True when this album lives on someone else's photos volume — it is shared
+    /// with us rather than ours.
+    pub shared: bool,
+}
+
 /// One photo in a [`Request::PhotosTimeline`] page.
 #[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct PhotoItem {
@@ -934,6 +1144,13 @@ pub enum Response {
        #[serde(default)]
        counts: Option<(usize, usize, usize)>,
    },
+    /// The account's photo albums (reply to [`Request::PhotoAlbums`]).
+    /// `available` is false when the account has no photos volume, matching
+    /// [`Response::Photos`].
+    Albums {
+        available: bool,
+        items: Vec<AlbumInfo>,
+    },
    /// The months the timeline spans (reply to [`Request::PhotoMonths`]),
    /// newest first.
    PhotoMonths { months: Vec<PhotoMonth> },
@@ -947,6 +1164,14 @@ pub enum Response {
    /// is true while a scan of the machine is still running, so a front-end can
    /// say "still indexing" instead of "no matches" on a cold first launch.
    LocalResults { hits: Vec<LocalHit>, indexing: bool },
+    /// Drive and local-file search results returned together (reply to
+    /// [`Request::SearchV2`]). `local_indexing` distinguishes a genuinely empty
+    /// local result set from one observed while the initial scan is running.
+    SearchResultsV2 {
+        drive_hits: Vec<SearchHit>,
+        local_hits: Vec<LocalHit>,
+        local_indexing: bool,
+    },
    /// A snapshot of what the daemon is working on (reply to
    /// [`Request::GetQueueStatus`]): `items` are byte-moving transfers, `jobs`
    /// the longer non-transfer work around them (scans, folder skeletons, the
@@ -958,6 +1183,8 @@ pub enum Response {
    },
    /// The account's devices (reply to [`Request::ListDevices`]).
    Devices { items: Vec<DeviceInfo> },
+    /// Every local Proton Drive location (reply to [`Request::ListLocations`]).
+    Locations { items: Vec<MountSpec> },
    /// This device's synced folders (reply to [`Request::ListSyncFolders`]).
    SyncFolders { items: Vec<SyncFolderInfo> },
    /// Folders offered for restore (reply to [`Request::ListRestorableFolders`]).
@@ -1104,6 +1331,58 @@ mod tests {
        assert_eq!(PhotoKind::classify(Some("x.jpg"), Some("video/mp4")), Photo);
    }

+    /// Keep every extension accepted by the shared classifier covered.  Drive
+    /// activation uses this classification before it knows whether opening a
+    /// file should stream through FUSE or materialise a complete cache entry;
+    /// silently dropping one of these formats would therefore regress large
+    /// videos back to the expensive whole-file path.
+    #[test]
+    fn photo_kind_recognises_every_supported_video_extension() {
+        for ext in VIDEO_EXTS {
+            let lower = format!("movie.{ext}");
+            let upper = format!("MOVIE.{}", ext.to_ascii_uppercase());
+            assert_eq!(
+                PhotoKind::classify(Some(&lower), None),
+                PhotoKind::Video,
+                "lower-case .{ext}"
+            );
+            assert_eq!(
+                PhotoKind::classify(Some(&upper), None),
+                PhotoKind::Video,
+                "upper-case .{ext}"
+            );
+        }
+    }
+
+    #[test]
+    fn photo_kind_uses_video_mime_only_when_extension_is_not_authoritative() {
+        use PhotoKind::*;
+
+        assert_eq!(
+            PhotoKind::classify(Some("extensionless"), Some("video/mp4; codecs=avc1")),
+            Video
+        );
+        assert_eq!(
+            PhotoKind::classify(Some("clip.unknown"), Some("video/x-matroska")),
+            Video
+        );
+        // Audio is not a video and must not accidentally take the video
+        // streaming policy merely because both are time-based media.
+        assert_eq!(
+            PhotoKind::classify(Some("recording"), Some("audio/flac")),
+            Photo
+        );
+        // A known still/raw suffix remains authoritative over server metadata.
+        assert_eq!(
+            PhotoKind::classify(Some("poster.AVIF"), Some("video/mp4")),
+            Photo
+        );
+        assert_eq!(
+            PhotoKind::classify(Some("negative.NEF"), Some("video/mp4")),
+            Raw
+        );
+    }
+
    #[test]
    fn photo_kind_i64_round_trips() {
        for k in [PhotoKind::Photo, PhotoKind::Video, PhotoKind::Raw] {
@@ -1167,6 +1446,150 @@ mod tests {
        }
    }

+    #[test]
+    fn unified_search_request_and_response_roundtrip() {
+        let request = Request::SearchV2 {
+            query: "quarterly report".into(),
+            limit: 37,
+            filters: SearchFilters::default(),
+        };
+        let line = serde_json::to_string(&request).unwrap();
+        assert_eq!(
+            line,
+            r#"{"SearchV2":{"query":"quarterly report","limit":37,"filters":{"sources":["Drive","Local"],"kind":"All"}}}"#
+        );
+        let decoded: Request = serde_json::from_str(&line).unwrap();
+        assert_eq!(line, serde_json::to_string(&decoded).unwrap());
+
+        let response = Response::SearchResultsV2 {
+            drive_hits: vec![SearchHit {
+                name: "report.pdf".into(),
+                path: "Work/report.pdf".into(),
+                is_dir: false,
+                size: 12,
+                modified: 123,
+                pinned: true,
+                uid: "vol~link".into(),
+                mounted_path: Some("/home/me/Videos/report.pdf".into()),
+                score: 985,
+            }],
+            local_hits: vec![LocalHit {
+                name: "notes.txt".into(),
+                path: "/home/me/notes.txt".into(),
+                is_dir: false,
+                size: 7,
+                modified: 456,
+                score: 720,
+            }],
+            local_indexing: true,
+        };
+        let line = serde_json::to_string(&response).unwrap();
+        assert!(!line.contains('\n'));
+        let decoded: Response = serde_json::from_str(&line).unwrap();
+        match decoded {
+            Response::SearchResultsV2 {
+                drive_hits,
+                local_hits,
+                local_indexing,
+            } => {
+                assert_eq!(drive_hits.len(), 1);
+                assert_eq!(drive_hits[0].uid, "vol~link");
+                assert_eq!(drive_hits[0].score, 985);
+                assert_eq!(local_hits.len(), 1);
+                assert_eq!(local_hits[0].path, "/home/me/notes.txt");
+                assert_eq!(local_hits[0].score, 720);
+                assert!(local_indexing);
+            }
+            other => panic!("expected unified search results, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn search_v2_legacy_wire_form_gets_compatible_defaults() {
+        let decoded: Request =
+            serde_json::from_str(r#"{"SearchV2":{"query":"old client","limit":20}}"#).unwrap();
+        match decoded {
+            Request::SearchV2 {
+                query,
+                limit,
+                filters,
+            } => {
+                assert_eq!(query, "old client");
+                assert_eq!(limit, 20);
+                assert_eq!(filters, SearchFilters::default());
+            }
+            other => panic!("expected SearchV2, got {other:?}"),
+        }
+
+        // New daemons add scores, but old-daemon replies remain readable and
+        // signal that their existing order should be retained with score 0.
+        let decoded: Response = serde_json::from_str(
+            r#"{"SearchResultsV2":{"drive_hits":[{"name":"a","path":"a","is_dir":false,"size":1,"modified":2,"pinned":false,"uid":"v~a"}],"local_hits":[{"name":"b","path":"/b","is_dir":false,"size":3,"modified":4}],"local_indexing":false}}"#,
+        )
+        .unwrap();
+        match decoded {
+            Response::SearchResultsV2 {
+                drive_hits,
+                local_hits,
+                ..
+            } => {
+                assert_eq!(drive_hits[0].score, 0);
+                assert_eq!(local_hits[0].score, 0);
+            }
+            other => panic!("expected SearchResultsV2, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn search_v2_filters_roundtrip() {
+        let request = Request::SearchV2 {
+            query: "holiday".into(),
+            limit: 50,
+            filters: SearchFilters {
+                sources: vec![SearchSource::Drive],
+                kind: SearchKind::Images,
+            },
+        };
+        let line = serde_json::to_string(&request).unwrap();
+        let decoded: Request = serde_json::from_str(&line).unwrap();
+        assert!(matches!(
+            decoded,
+            Request::SearchV2 {
+                filters: SearchFilters { sources, kind: SearchKind::Images },
+                ..
+            } if sources == vec![SearchSource::Drive]
+        ));
+    }
+
+    #[test]
+    fn search_kind_classifies_before_results_are_limited() {
+        assert!(SearchKind::Folders.accepts("movie.mp4", true));
+        assert!(!SearchKind::Folders.accepts("movie.mp4", false));
+        assert!(SearchKind::Documents.accepts("REPORT.PDF", false));
+        assert!(SearchKind::Images.accepts("scan.HEIC", false));
+        assert!(SearchKind::Media.accepts("film.mkv", false));
+        assert!(SearchKind::Media.accepts("recording.flac", false));
+        assert!(!SearchKind::Media.accepts("poster.jpg", false));
+        assert!(SearchKind::All.accepts("anything", true));
+    }
+
+    #[test]
+    fn legacy_search_wire_forms_still_decode() {
+        let drive: Request =
+            serde_json::from_str(r#"{"Search":{"query":"old","limit":20}}"#).unwrap();
+        assert!(matches!(
+            drive,
+            Request::Search { query, limit } if query == "old" && limit == 20
+        ));
+
+        let local: Request =
+            serde_json::from_str(r#"{"SearchLocal":{"query":"old","limit":10}}"#).unwrap();
+        assert!(matches!(
+            local,
+            Request::SearchLocal { query, limit } if query == "old" && limit == 10
+        ));
+    }
+
    /// The trash requests carry uids rather than paths; they must survive the same
    /// line-delimited round-trip, since a mangled uid would restore or destroy the
    /// wrong node.
@@ -1209,6 +1632,7 @@ mod tests {
    #[test]
    fn sharing_requests_roundtrip() {
        let reqs = [
+            Request::ListLocations,
            Request::ListDevices,
            Request::RenameDevice {
                uid: "dev-1".into(),
@@ -1248,28 +1672,58 @@ mod tests {
                role: "editor".into(),
                message: Some("hi".into()),
            },
+            Request::ShareNodeByUid {
+                uid: "vol~link".into(),
+                emails: vec!["x@proton.me".into(), "y@example.com".into()],
+                role: "editor".into(),
+                message: Some("hi".into()),
+            },
            Request::ListShare { path: "a/b".into() },
+            Request::ListShareByUid {
+                uid: "vol~link".into(),
+            },
            Request::UpdateShareRole {
                path: "a/b".into(),
                id: "mid-1".into(),
                kind: ShareEntryKind::Member,
                role: "admin".into(),
            },
+            Request::UpdateShareRoleByUid {
+                uid: "vol~link".into(),
+                id: "mid-1".into(),
+                kind: ShareEntryKind::Member,
+                role: "admin".into(),
+            },
            Request::RemoveShareEntry {
                path: "a/b".into(),
                id: "iid-1".into(),
                kind: ShareEntryKind::ExternalInvite,
            },
+            Request::RemoveShareEntryByUid {
+                uid: "vol~link".into(),
+                id: "iid-1".into(),
+                kind: ShareEntryKind::ExternalInvite,
+            },
            Request::CreatePublicLink {
                path: "a/b".into(),
                role: "viewer".into(),
                password: Some("pw".into()),
                expires: Some(1_700_000_000),
            },
+            Request::CreatePublicLinkByUid {
+                uid: "vol~link".into(),
+                role: "viewer".into(),
+                password: Some("pw".into()),
+                expires: Some(1_700_000_000),
+            },
            Request::RemovePublicLink {
                path: "a/b".into(),
                id: "url-1".into(),
            },
+            Request::RemovePublicLinkByUid {
+                uid: "vol~link".into(),
+                id: "url-1".into(),
+            },
            Request::ListSharedByMe,
            Request::ListActivity { limit: 100 },
            Request::ListSharedWithMe,
@@ -1303,6 +1757,323 @@ mod tests {
        }
    }

+    #[test]
+    fn locations_response_roundtrips_typed_mounts() {
+        let response = Response::Locations {
+            items: vec![
+                MountSpec {
+                    id: 1,
+                    kind: MountKind::MyFiles,
+                    local_path: "/home/me/ProtonDrive".into(),
+                    root_uid: "vol~root".into(),
+                    root_share_id: "share-main".into(),
+                    mode: MountMode::OnDemand,
+                    access: MountAccess::Rw,
+                    state: "idle".into(),
+                    last_sync: 0,
+                    pending_mode: None,
+                    mounted: true,
+                    progress: None,
+                },
+                MountSpec {
+                    id: 2,
+                    kind: MountKind::Device { sync_folder_id: 7 },
+                    local_path: "/home/me/Work".into(),
+                    root_uid: "device-vol~work".into(),
+                    root_share_id: "device-share".into(),
+                    mode: MountMode::Mirror,
+                    access: MountAccess::Rw,
+                    state: "syncing".into(),
+                    last_sync: 42,
+                    pending_mode: Some(MountMode::OnDemand),
+                    mounted: false,
+                    progress: None,
+                },
+                MountSpec {
+                    id: 3,
+                    kind: MountKind::Shared {
+                        share_root_uid: "shared-vol~root".into(),
+                    },
+                    local_path: "/home/me/Shared".into(),
+                    root_uid: "shared-vol~root".into(),
+                    root_share_id: "shared-share".into(),
+                    mode: MountMode::Unknown,
+                    access: MountAccess::Ro,
+                    state: "error".into(),
+                    last_sync: 0,
+                    pending_mode: Some(MountMode::Unknown),
+                    mounted: false,
+                    progress: Some(SyncProgress {
+                        phase: SyncPhase::Applying,
+                        done: 2,
+                        total: 5,
+                        current: "report.pdf".into(),
+                    }),
+                },
+            ],
+        };
+        let wire = serde_json::to_string(&response).unwrap();
+        assert!(!wire.contains('\n'), "wire form must be a single line");
+        assert!(wire.contains(r#""mode":"ondemand""#));
+        assert!(wire.contains(r#""kind":"shared""#));
+        assert!(wire.contains(r#""access":"ro""#));
+        assert!(wire.contains(r#""mode":"unknown""#));
+        let back: Response = serde_json::from_str(&wire).unwrap();
+        match back {
+            Response::Locations { items } => {
+                assert_eq!(items.len(), 3);
+                assert!(matches!(
+                    items[1].kind,
+                    MountKind::Device { sync_folder_id: 7 }
+                ));
+                assert_eq!(items[1].pending_mode, Some(MountMode::OnDemand));
+                assert!(matches!(
+                    &items[2].kind,
+                    MountKind::Shared { share_root_uid }
+                        if share_root_uid == "shared-vol~root"
+                ));
+                assert_eq!(items[2].access, MountAccess::Ro);
+                assert_eq!(items[2].mode, MountMode::Unknown);
+                assert_eq!(items[2].pending_mode, Some(MountMode::Unknown));
+                let progress = items[2].progress.as_ref().unwrap();
+                assert_eq!(progress.phase, SyncPhase::Applying);
+                assert_eq!((progress.done, progress.total), (2, 5));
+            }
+            other => panic!("unexpected response: {other:?}"),
+        }
+    }
+
+    #[test]
+    fn legacy_daemons_reject_list_locations_cleanly() {
+        #[allow(dead_code)]
+        #[derive(serde::Deserialize)]
+        enum LegacyLocationRequest {
+            ListSyncFolders,
+        }
+
+        let wire = serde_json::to_string(&Request::ListLocations).unwrap();
+        assert!(
+            serde_json::from_str::<LegacyLocationRequest>(&wire).is_err(),
+            "an old daemon must reject ListLocations instead of interpreting another request"
+        );
+    }
+
+    #[test]
+    fn path_share_requests_keep_their_existing_wire_shape() {
+        let cases = [
+            (
+                Request::ShareNode {
+                    path: "a/b".into(),
+                    emails: vec!["x@example.com".into()],
+                    role: "viewer".into(),
+                    message: None,
+                },
+                r#"{"ShareNode":{"path":"a/b","emails":["x@example.com"],"role":"viewer","message":null}}"#,
+            ),
+            (
+                Request::ListShare { path: "a/b".into() },
+                r#"{"ListShare":{"path":"a/b"}}"#,
+            ),
+            (
+                Request::UpdateShareRole {
+                    path: "a/b".into(),
+                    id: "member".into(),
+                    kind: ShareEntryKind::Member,
+                    role: "editor".into(),
+                },
+                r#"{"UpdateShareRole":{"path":"a/b","id":"member","kind":"Member","role":"editor"}}"#,
+            ),
+            (
+                Request::RemoveShareEntry {
+                    path: "a/b".into(),
+                    id: "invite".into(),
+                    kind: ShareEntryKind::ProtonInvite,
+                },
+                r#"{"RemoveShareEntry":{"path":"a/b","id":"invite","kind":"ProtonInvite"}}"#,
+            ),
+            (
+                Request::CreatePublicLink {
+                    path: "a/b".into(),
+                    role: "viewer".into(),
+                    password: None,
+                    expires: None,
+                },
+                r#"{"CreatePublicLink":{"path":"a/b","role":"viewer","password":null,"expires":null}}"#,
+            ),
+            (
+                Request::RemovePublicLink {
+                    path: "a/b".into(),
+                    id: "link".into(),
+                },
+                r#"{"RemovePublicLink":{"path":"a/b","id":"link"}}"#,
+            ),
+        ];
+
+        for (request, expected) in cases {
+            assert_eq!(serde_json::to_string(&request).unwrap(), expected);
+            assert!(
+                !expected.contains("\"uid\""),
+                "path variants must never acquire an optional uid"
+            );
+        }
+    }
+
+    #[test]
+    fn by_uid_share_requests_are_distinct_wire_variants() {
+        let cases = [
+            (
+                Request::ShareNodeByUid {
+                    uid: "vol~link".into(),
+                    emails: vec!["x@example.com".into()],
+                    role: "viewer".into(),
+                    message: None,
+                },
+                "ShareNodeByUid",
+            ),
+            (
+                Request::ListShareByUid {
+                    uid: "vol~link".into(),
+                },
+                "ListShareByUid",
+            ),
+            (
+                Request::UpdateShareRoleByUid {
+                    uid: "vol~link".into(),
+                    id: "member".into(),
+                    kind: ShareEntryKind::Member,
+                    role: "editor".into(),
+                },
+                "UpdateShareRoleByUid",
+            ),
+            (
+                Request::RemoveShareEntryByUid {
+                    uid: "vol~link".into(),
+                    id: "invite".into(),
+                    kind: ShareEntryKind::ProtonInvite,
+                },
+                "RemoveShareEntryByUid",
+            ),
+            (
+                Request::CreatePublicLinkByUid {
+                    uid: "vol~link".into(),
+                    role: "viewer".into(),
+                    password: None,
+                    expires: None,
+                },
+                "CreatePublicLinkByUid",
+            ),
+            (
+                Request::RemovePublicLinkByUid {
+                    uid: "vol~link".into(),
+                    id: "link".into(),
+                },
+                "RemovePublicLinkByUid",
+            ),
+        ];
+
+        for (request, variant) in cases {
+            let wire = serde_json::to_string(&request).unwrap();
+            let object = serde_json::from_str::<serde_json::Value>(&wire)
+                .unwrap()
+                .as_object()
+                .cloned()
+                .unwrap();
+            assert_eq!(object.len(), 1);
+            assert!(object.contains_key(variant));
+            let decoded = serde_json::from_str::<Request>(&wire).unwrap();
+            let decoded_uid = match &decoded {
+                Request::ShareNodeByUid { uid, .. }
+                | Request::ListShareByUid { uid }
+                | Request::UpdateShareRoleByUid { uid, .. }
+                | Request::RemoveShareEntryByUid { uid, .. }
+                | Request::CreatePublicLinkByUid { uid, .. }
+                | Request::RemovePublicLinkByUid { uid, .. } => uid,
+                other => panic!("decoded into the wrong dispatch variant: {other:?}"),
+            };
+            assert_eq!(decoded_uid, "vol~link");
+            assert_eq!(serde_json::to_string(&decoded).unwrap(), wire);
+        }
+    }
+
+    #[test]
+    fn legacy_daemons_reject_new_by_uid_variants() {
+        #[allow(dead_code)]
+        #[derive(serde::Deserialize)]
+        enum LegacyShareRequest {
+            ShareNode {
+                path: String,
+                emails: Vec<String>,
+                role: String,
+                message: Option<String>,
+            },
+            ListShare {
+                path: String,
+            },
+            UpdateShareRole {
+                path: String,
+                id: String,
+                kind: ShareEntryKind,
+                role: String,
+            },
+            RemoveShareEntry {
+                path: String,
+                id: String,
+                kind: ShareEntryKind,
+            },
+            CreatePublicLink {
+                path: String,
+                role: String,
+                password: Option<String>,
+                expires: Option<i64>,
+            },
+            RemovePublicLink {
+                path: String,
+                id: String,
+            },
+        }
+
+        let requests = [
+            Request::ShareNodeByUid {
+                uid: "vol~link".into(),
+                emails: Vec::new(),
+                role: "viewer".into(),
+                message: None,
+            },
+            Request::ListShareByUid {
+                uid: "vol~link".into(),
+            },
+            Request::UpdateShareRoleByUid {
+                uid: "vol~link".into(),
+                id: "member".into(),
+                kind: ShareEntryKind::Member,
+                role: "viewer".into(),
+            },
+            Request::RemoveShareEntryByUid {
+                uid: "vol~link".into(),
+                id: "member".into(),
+                kind: ShareEntryKind::Member,
+            },
+            Request::CreatePublicLinkByUid {
+                uid: "vol~link".into(),
+                role: "viewer".into(),
+                password: None,
+                expires: None,
+            },
+            Request::RemovePublicLinkByUid {
+                uid: "vol~link".into(),
+                id: "link".into(),
+            },
+        ];
+
+        for request in requests {
+            let wire = serde_json::to_string(&request).unwrap();
+            assert!(
+                serde_json::from_str::<LegacyShareRequest>(&wire).is_err(),
+                "an old daemon must reject {wire}, never reinterpret it as a path request"
+            );
+        }
+    }
+
    /// A daemon built before `kind` existed sends `Error` without the field.
    /// It must still parse, and land on the class that promises the least.
    #[test]
@@ -0,0 +1,238 @@
+//! Photo albums: the album listing and each album's contents, persisted like
+//! the timeline so the Albums view opens from disk instead of re-enumerating the
+//! photos volume on every launch.
+//!
+//! An album's photos are stored per album rather than as a join against
+//! `photos`: an album shared with us lives on the sharer's volume, so its photos
+//! never appear in our own timeline and have nowhere else to record what a
+//! thumbnail attempt learned about them.
+
+use rusqlite::params;
+
+use std::collections::HashMap;
+
+use super::{Db, StoredPhoto, THUMB_UNKNOWN};
+use crate::Result;
+
+/// One album of the persisted listing, ordered newest-activity-first in `seq`.
+#[derive(Clone, Debug, PartialEq)]
+pub struct StoredAlbum {
+    pub uid: String,
+    pub name: String,
+    pub photo_count: usize,
+    /// The photo shown as the album's cover, when the server named one.
+    pub cover_uid: Option<String>,
+    /// Epoch seconds of the last change to the album's contents.
+    pub last_activity: Option<i64>,
+    /// True when the album lives on someone else's photos volume.
+    pub shared: bool,
+}
+
+impl Db {
+    /// Replace the album listing wholesale, in the given order.
+    pub fn albums_replace(&self, albums: &[StoredAlbum]) -> Result<()> {
+        let mut conn = self.conn.lock();
+        let tx = conn.transaction()?;
+        // Contents of an album that no longer exists (unshared, deleted) go with
+        // it — otherwise they would linger forever, keyed by an album uid no
+        // listing mentions again.
+        {
+            let kept: std::collections::HashSet<&str> =
+                albums.iter().map(|a| a.uid.as_str()).collect();
+            let stale: Vec<String> = {
+                let mut stmt = tx.prepare("SELECT DISTINCT album_uid FROM album_photos")?;
+                let rows = stmt.query_map([], |r| r.get::<_, String>(0))?;
+                rows.filter_map(|r| r.ok())
+                    .filter(|uid| !kept.contains(uid.as_str()))
+                    .collect()
+            };
+            let mut stmt = tx.prepare("DELETE FROM album_photos WHERE album_uid = ?1")?;
+            for uid in stale {
+                stmt.execute([uid])?;
+            }
+        }
+        tx.execute("DELETE FROM albums", [])?;
+        {
+            let mut stmt = tx.prepare(
+                "INSERT INTO albums
+                   (uid, name, photo_count, cover_uid, last_activity, shared, seq)
+                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)",
+            )?;
+            for (seq, album) in albums.iter().enumerate() {
+                stmt.execute(params![
+                    album.uid,
+                    album.name,
+                    album.photo_count as i64,
+                    album.cover_uid,
+                    album.last_activity,
+                    album.shared as i64,
+                    seq as i64,
+                ])?;
+            }
+        }
+        tx.commit()?;
+        Ok(())
+    }
+
+    /// The persisted album listing, in stored order.
+    pub fn albums_list(&self) -> Result<Vec<StoredAlbum>> {
+        let conn = self.conn.lock();
+        let mut stmt = conn.prepare(
+            "SELECT uid, name, photo_count, cover_uid, last_activity, shared
+             FROM albums ORDER BY seq",
+        )?;
+        let rows = stmt
+            .query_map([], |r| {
+                Ok(StoredAlbum {
+                    uid: r.get(0)?,
+                    name: r.get(1)?,
+                    photo_count: r.get::<_, i64>(2)?.max(0) as usize,
+                    cover_uid: r.get(3)?,
+                    last_activity: r.get(4)?,
+                    shared: r.get::<_, i64>(5)? != 0,
+                })
+            })?
+            .collect::<rusqlite::Result<_>>()?;
+        Ok(rows)
+    }
+
+    /// Number of albums in the persisted listing.
+    pub fn albums_count(&self) -> Result<usize> {
+        let conn = self.conn.lock();
+        let n: i64 = conn.query_row("SELECT COUNT(*) FROM albums", [], |r| r.get(0))?;
+        Ok(n.max(0) as usize)
+    }
+
+    /// Replace one album's contents, in the given (newest-capture-first) order.
+    /// Learned aspect ratios and thumbnail verdicts survive the replacement, the
+    /// same way [`Db::photos_replace`] keeps them for the timeline.
+    pub fn album_photos_replace(
+        &self,
+        album_uid: &str,
+        items: &[(String, i64, Option<String>, Option<String>)],
+    ) -> Result<()> {
+        let mut conn = self.conn.lock();
+        let tx = conn.transaction()?;
+        let learned: HashMap<String, (Option<f64>, i64, Option<String>)> = {
+            let mut stmt = tx.prepare(
+                "SELECT uid, ratio, thumb_state, media_type FROM album_photos
+                 WHERE album_uid = ?1",
+            )?;
+            let rows = stmt.query_map([album_uid], |r| {
+                Ok((r.get::<_, String>(0)?, (r.get(1)?, r.get(2)?, r.get(3)?)))
+            })?;
+            rows.collect::<rusqlite::Result<_>>()?
+        };
+
+        tx.execute("DELETE FROM album_photos WHERE album_uid = ?1", [album_uid])?;
+        {
+            let mut stmt = tx.prepare(
+                "INSERT INTO album_photos
+                   (album_uid, uid, capture_time, name, media_type, kind, ratio, thumb_state, seq)
+                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)",
+            )?;
+            for (seq, (uid, capture_time, name, media_type)) in items.iter().enumerate() {
+                let (ratio, thumb_state, learned_media) =
+                    learned
+                        .get(uid)
+                        .cloned()
+                        .unwrap_or((None, THUMB_UNKNOWN, None));
+                let media_type = media_type.clone().or(learned_media);
+                let kind =
+                    crate::control::PhotoKind::classify(name.as_deref(), media_type.as_deref());
+                stmt.execute(params![
+                    album_uid,
+                    uid,
+                    capture_time,
+                    name,
+                    media_type,
+                    kind.as_i64(),
+                    ratio,
+                    thumb_state,
+                    seq as i64,
+                ])?;
+            }
+        }
+        tx.commit()?;
+        Ok(())
+    }
+
+    /// One page of an album's photos, in stored order.
+    pub fn album_photos_page(
+        &self,
+        album_uid: &str,
+        offset: usize,
+        limit: usize,
+    ) -> Result<Vec<StoredPhoto>> {
+        let conn = self.conn.lock();
+        let mut stmt = conn.prepare(
+            "SELECT uid, capture_time, name, ratio, thumb_state, kind FROM album_photos
+             WHERE album_uid = ?1 ORDER BY seq LIMIT ?2 OFFSET ?3",
+        )?;
+        let rows = stmt
+            .query_map(params![album_uid, limit as i64, offset as i64], |r| {
+                Ok(StoredPhoto {
+                    uid: r.get(0)?,
+                    capture_time: r.get(1)?,
+                    name: r.get(2)?,
+                    ratio: r.get(3)?,
+                    thumb_state: r.get(4)?,
+                    kind: crate::control::PhotoKind::from_i64(r.get(5)?),
+                })
+            })?
+            .collect::<rusqlite::Result<_>>()?;
+        Ok(rows)
+    }
+
+    /// How many photos of `album_uid` are persisted.
+    pub fn album_photos_count(&self, album_uid: &str) -> Result<usize> {
+        let conn = self.conn.lock();
+        let n: i64 = conn.query_row(
+            "SELECT COUNT(*) FROM album_photos WHERE album_uid = ?1",
+            [album_uid],
+            |r| r.get(0),
+        )?;
+        Ok(n.max(0) as usize)
+    }
+
+    /// The album-held photos among `uids`, one row per uid (a photo in two albums
+    /// is returned once). Backs the thumbnail path for photos that are in an
+    /// album but not in our own timeline — everything in a shared album, and an
+    /// album cover whose photo the current timeline page hasn't reached.
+    pub fn album_photos_by_uid(&self, uids: &[String]) -> Result<Vec<StoredPhoto>> {
+        if uids.is_empty() {
+            return Ok(Vec::new());
+        }
+        let conn = self.conn.lock();
+        let placeholders = vec!["?"; uids.len()].join(",");
+        let mut stmt = conn.prepare(&format!(
+            "SELECT uid, capture_time, name, ratio, thumb_state, kind FROM album_photos
+             WHERE uid IN ({placeholders}) GROUP BY uid"
+        ))?;
+        let rows = stmt
+            .query_map(rusqlite::params_from_iter(uids), |r| {
+                Ok(StoredPhoto {
+                    uid: r.get(0)?,
+                    capture_time: r.get(1)?,
+                    name: r.get(2)?,
+                    ratio: r.get(3)?,
+                    thumb_state: r.get(4)?,
+                    kind: crate::control::PhotoKind::from_i64(r.get(5)?),
+                })
+            })?
+            .collect::<rusqlite::Result<_>>()?;
+        Ok(rows)
+    }
+
+    /// Record a thumbnail verdict against every album row for `uid`, so what one
+    /// attempt learned is not re-learned per album the photo sits in. The
+    /// timeline's own copy is updated separately by [`Db::photo_set_thumb`].
+    pub fn album_photo_set_thumb(&self, uid: &str, state: i64, ratio: Option<f64>) -> Result<()> {
+        let conn = self.conn.lock();
+        conn.execute(
+            "UPDATE album_photos SET thumb_state = ?2, ratio = COALESCE(?3, ratio) WHERE uid = ?1",
+            params![uid, state, ratio],
+        )?;
+        Ok(())
+    }
+}
@@ -7,6 +7,7 @@ use super::Db;
 use crate::Result;
 use crate::localindex::LocalEntry;

+use super::nodes::candidate_trigrams;
 use super::utils::{TRIGRAM_MIN, like_escape};

 /// One hit from [`Db::search_local`]: an indexed file on the machine itself, not
@@ -147,6 +148,58 @@ impl Db {
        }
        Ok(out)
    }
+
+    /// Bounded candidates for the fuzzy scorer, including matches in the full
+    /// local path. ORed trigrams admit misspellings while the FTS index prevents
+    /// this from becoming an unbounded filesystem-table scan.
+    pub fn search_local_candidates(&self, query: &str, limit: usize) -> Result<Vec<LocalFileHit>> {
+        let query = query.trim();
+        if query.is_empty() || limit == 0 {
+            return Ok(Vec::new());
+        }
+        let conn = self.conn.lock();
+        let terms = candidate_trigrams(query);
+        let lane_limit = limit.div_ceil(2);
+        let mut rows: Vec<LocalFileHit> = if terms.is_empty() {
+            let pat = format!("%{}%", like_escape(query));
+            let mut stmt = conn.prepare(
+                "SELECT path, name, is_dir, size, mtime FROM local_files
+                 WHERE name LIKE ?1 ESCAPE '\\' OR path LIKE ?1 ESCAPE '\\'
+                 ORDER BY mtime DESC LIMIT ?2",
+            )?;
+            stmt.query_map(params![pat, limit as i64], local_hit)?
+                .collect::<std::result::Result<_, _>>()?
+        } else {
+            let mut stmt = conn.prepare(
+                "SELECT f.path, f.name, f.is_dir, f.size, f.mtime
+                   FROM local_fts x JOIN local_files f ON f.id = x.rowid
+                  WHERE local_fts MATCH ?1
+                  ORDER BY x.rank LIMIT ?2",
+            )?;
+            stmt.query_map(params![terms.join(" OR "), lane_limit as i64], local_hit)?
+                .collect::<std::result::Result<_, _>>()?
+        };
+        if !terms.is_empty()
+            && let Some(first) = query.chars().next()
+        {
+            let prefix = format!("{}%", like_escape(&first.to_string()));
+            let mut stmt = conn.prepare(
+                "SELECT path, name, is_dir, size, mtime FROM local_files
+                 WHERE name COLLATE NOCASE LIKE ?1 ESCAPE '\\'
+                 ORDER BY name COLLATE NOCASE LIMIT ?2",
+            )?;
+            let fallback = stmt
+                .query_map(params![prefix, lane_limit as i64], local_hit)?
+                .collect::<std::result::Result<Vec<_>, _>>()?;
+            for hit in fallback {
+                if !rows.iter().any(|existing| existing.path == hit.path) {
+                    rows.push(hit);
+                }
+            }
+            rows.truncate(limit);
+        }
+        Ok(rows)
+    }
 }

 /// Row → [`LocalFileHit`]. Every local-search query selects the same
@@ -77,10 +77,12 @@ const REPORTED_TABLES: &[&str] = &[
    "trash",
    "device",
    "sync_folder",
+    "mount",
    "sync_entry",
    "pending_op",
    "activity",
    "local_files",
+    "share_access",
 ];

 impl Db {
@@ -9,7 +9,7 @@ use super::Db;
 use crate::Result;

 /// Current schema version. Bump on every forward migration added below.
-pub(super) const SCHEMA_VERSION: i64 = 15;
+pub(super) const SCHEMA_VERSION: i64 = 19;

 impl Db {
    pub(super) fn migrate(&self) -> Result<()> {
@@ -31,7 +31,12 @@ impl Db {
            .and_then(|v| v.parse().ok())
            .unwrap_or(0);

-        if current >= SCHEMA_VERSION {
+        if current > SCHEMA_VERSION {
+            return Err(crate::Error::Other(format!(
+                "database schema {current} is newer than this build supports ({SCHEMA_VERSION}); refusing to open it to avoid corrupting user data"
+            )));
+        }
+        if current == SCHEMA_VERSION {
            return Ok(());
        }

@@ -81,6 +86,18 @@ impl Db {
        if current < 15 {
            tx.execute_batch(MIGRATION_V15)?;
        }
+        if current < 16 {
+            tx.execute_batch(MIGRATION_V16)?;
+        }
+        if current < 17 {
+            tx.execute_batch(MIGRATION_V17)?;
+        }
+        if current < 18 {
+            tx.execute_batch(MIGRATION_V18)?;
+        }
+        if current < 19 {
+            tx.execute_batch(MIGRATION_V19)?;
+        }
        tx.execute(
            "INSERT INTO sync_state (key, value) VALUES ('schema_version', ?1)
             ON CONFLICT(key) DO UPDATE SET value = excluded.value",
@@ -369,3 +386,128 @@ CREATE VIRTUAL TABLE nodes_fts USING fts5(
 INSERT INTO nodes_fts (rowid, name)
  SELECT rowid, name FROM nodes WHERE trashed = 0;
 ";
+
+/// Schema v16: fuzzy search needs a bounded candidate set that includes parent
+/// paths.  Keeping the path in the trigram indexes lets SQLite narrow both name
+/// and path candidates without walking either base table for every keystroke.
+/// Node paths are initially backfilled below and subsequently maintained by the
+/// node write path (including descendants after a folder move/rename).
+const MIGRATION_V16: &str = "
+DROP TABLE IF EXISTS nodes_fts;
+CREATE VIRTUAL TABLE nodes_fts USING fts5(
+  name, path, tokenize='trigram'
+);
+CREATE INDEX IF NOT EXISTS idx_nodes_name_nocase ON nodes(name COLLATE NOCASE);
+INSERT INTO nodes_fts (rowid, name, path)
+WITH RECURSIVE paths(rowid, uid, path) AS (
+  SELECT n.rowid, n.uid, '' FROM nodes n
+   WHERE n.parent_uid IS NULL
+      OR NOT EXISTS (SELECT 1 FROM nodes p WHERE p.uid = n.parent_uid)
+  UNION ALL
+  SELECT n.rowid, n.uid,
+         CASE WHEN paths.path = '' THEN n.name ELSE paths.path || '/' || n.name END
+    FROM nodes n JOIN paths ON n.parent_uid = paths.uid
+)
+SELECT n.rowid, n.name, paths.path
+  FROM nodes n JOIN paths ON paths.rowid = n.rowid
+ WHERE n.trashed = 0;
+
+DROP TABLE IF EXISTS local_fts;
+CREATE VIRTUAL TABLE local_fts USING fts5(
+  name, path, content='local_files', content_rowid='id', tokenize='trigram'
+);
+CREATE INDEX IF NOT EXISTS idx_local_files_name_nocase
+  ON local_files(name COLLATE NOCASE);
+INSERT INTO local_fts(local_fts) VALUES('rebuild');
+";
+
+/// Schema v17: effective access for roots shared with this account. The role is
+/// persisted separately from `nodes.node_json` so a cold/offline mount can
+/// enforce the last known permission even when the SDK cannot refresh metadata.
+const MIGRATION_V17: &str = "
+CREATE TABLE share_access (
+  root_uid TEXT PRIMARY KEY,
+  access   TEXT NOT NULL
+           CHECK (access IN ('owner', 'editor', 'viewer', 'unknown'))
+);
+";
+
+/// Schema v18: unified location presentation. Device rows carry only their
+/// `sync_folder` identity; reads join all device state from that authoritative
+/// table. The trigger projects future folders, while the foreign key removes a
+/// presentation row with its sync folder.
+const MIGRATION_V18: &str = "
+CREATE TABLE mount (
+  id              INTEGER PRIMARY KEY,
+  kind            TEXT NOT NULL
+                  CHECK (kind IN ('myfiles', 'device', 'shared')),
+  sync_folder_id  INTEGER REFERENCES sync_folder(id) ON DELETE CASCADE,
+  share_root_uid  TEXT,
+  local_path      TEXT NOT NULL DEFAULT '',
+  root_uid        TEXT NOT NULL DEFAULT '',
+  root_share_id   TEXT NOT NULL DEFAULT '',
+  mode            TEXT NOT NULL DEFAULT 'unknown',
+  access          TEXT NOT NULL DEFAULT 'rw'
+                  CHECK (access IN ('rw', 'ro')),
+  CHECK (
+    (kind = 'myfiles' AND sync_folder_id IS NULL AND share_root_uid IS NULL)
+    OR
+    (kind = 'device' AND sync_folder_id IS NOT NULL AND share_root_uid IS NULL)
+    OR
+    (kind = 'shared' AND sync_folder_id IS NULL AND share_root_uid IS NOT NULL)
+  )
+);
+
+CREATE UNIQUE INDEX mount_myfiles
+  ON mount(kind) WHERE kind = 'myfiles';
+CREATE UNIQUE INDEX mount_device
+  ON mount(sync_folder_id) WHERE kind = 'device';
+CREATE UNIQUE INDEX mount_shared
+  ON mount(share_root_uid) WHERE kind = 'shared';
+
+INSERT INTO mount (kind, sync_folder_id)
+SELECT 'device', id FROM sync_folder;
+
+CREATE TRIGGER mount_sync_folder_insert
+AFTER INSERT ON sync_folder
+BEGIN
+  INSERT OR IGNORE INTO mount (kind, sync_folder_id)
+  VALUES ('device', NEW.id);
+END;
+";
+
+/// Schema v19: photo albums and their contents. Both are projections of the
+/// server's listings — like `photos`, they are replaced wholesale on refresh —
+/// so the Albums view opens from disk instead of re-enumerating every launch.
+///
+/// `album_photos` carries its own `ratio` / `thumb_state` rather than joining
+/// `photos`: an album shared with us lives on the sharer's volume, so its
+/// photos are not in our timeline at all and would otherwise have nowhere to
+/// remember what a thumbnail attempt learned.
+const MIGRATION_V19: &str = "
+CREATE TABLE albums (
+  uid           TEXT PRIMARY KEY,
+  name          TEXT NOT NULL,
+  photo_count   INTEGER NOT NULL DEFAULT 0,
+  cover_uid     TEXT,
+  last_activity INTEGER,
+  shared        INTEGER NOT NULL DEFAULT 0,
+  seq           INTEGER NOT NULL
+);
+
+CREATE TABLE album_photos (
+  album_uid    TEXT NOT NULL,
+  uid          TEXT NOT NULL,
+  capture_time INTEGER NOT NULL,
+  name         TEXT,
+  media_type   TEXT,
+  kind         INTEGER NOT NULL DEFAULT 0,
+  ratio        REAL,
+  thumb_state  INTEGER NOT NULL DEFAULT 0,
+  seq          INTEGER NOT NULL,
+  PRIMARY KEY (album_uid, uid)
+);
+
+CREATE INDEX idx_album_photos_seq ON album_photos(album_uid, seq);
+CREATE INDEX idx_album_photos_uid ON album_photos(uid);
+";
@@ -22,28 +22,32 @@ use crate::Result;
 use std::path::Path;

 mod activity;
+mod albums;
 mod cache;
 mod devices;
 mod local;
 mod maintenance;
 mod migrations;
+mod mounts;
 mod nodes;
 mod ops;
 mod photos;
 mod pins;
+mod share_access;
 mod state;
 mod sync;
 mod trash;
 mod utils;

+pub use albums::StoredAlbum;
 pub use cache::CacheEntryInput;
 pub use devices::StoredDevice;
 pub use local::LocalFileHit;
 pub use maintenance::{DbStats, VacuumOutcome};
-pub use nodes::{SearchHit, StoredNode};
+pub use nodes::{PublishedSharedRoot, SearchHit, StoredNode};
 pub use ops::{
-    AttachedBlob, LOCAL_VOLUME, OP_CREATE, OP_MKDIR, OP_RENAME, OP_REVISION, OP_TRASH,
-    PendingCounts, PendingOp, op_supersedes,
+    AttachedBlob, LOCAL_VOLUME, OP_CREATE, OP_MKDIR, OP_RENAME, OP_REVISION, OP_TRASH, PARK_UNTIL,
+    PendingCounts, PendingOp, RenameMeta, op_supersedes,
 };
 pub use photos::{StoredPhoto, THUMB_HAVE, THUMB_NONE, THUMB_UNKNOWN};
 pub use sync::{StoredSyncEntry, StoredSyncFolder};
@@ -109,6 +113,10 @@ impl Db {
    #[cfg(test)]
    pub fn open_in_memory() -> Result<Self> {
        let conn = Connection::open_in_memory()?;
+        // Keep relational behavior identical to `open`: V18 relies on the
+        // `mount.sync_folder_id` cascade, and SQLite disables foreign keys per
+        // connection unless explicitly enabled.
+        conn.pragma_update(None, "foreign_keys", "ON")?;
        let db = Self {
            conn: Mutex::new(conn),
        };
@@ -0,0 +1,178 @@
+//! Unified mount/location presentation rows.
+//!
+//! A device row stores only its `sync_folder` identity. Its path, remote root,
+//! mode, state, pending mode, and last-sync timestamp are selected from
+//! `sync_folder`, which remains the authoritative sync-engine table.
+
+use rusqlite::params;
+
+use super::Db;
+use crate::mounts::{MountAccess, MountKind, MountMode, MountSpec};
+use crate::{Error, Result};
+
+impl Db {
+    /// Project the configured primary mount into the presentation table.
+    ///
+    /// `root_share_id` is optional because an offline startup may only have the
+    /// cached root node. A previously learned share id is retained only when it
+    /// belongs to the same root uid.
+    pub fn mount_upsert_my_files(
+        &self,
+        local_path: &str,
+        root_uid: &str,
+        root_share_id: Option<&str>,
+    ) -> Result<i64> {
+        let mut conn = self.conn.lock();
+        let tx = conn.transaction()?;
+        let updated = tx.execute(
+            "UPDATE mount
+                SET local_path = ?1,
+                    root_share_id = CASE
+                        WHEN root_uid = ?2
+                          THEN COALESCE(NULLIF(?3, ''), root_share_id)
+                        ELSE COALESCE(?3, '')
+                    END,
+                    root_uid = ?2,
+                    mode = 'ondemand',
+                    access = 'rw'
+              WHERE kind = 'myfiles'",
+            params![local_path, root_uid, root_share_id],
+        )?;
+        let id = if updated == 0 {
+            tx.execute(
+                "INSERT INTO mount
+                    (kind, local_path, root_uid, root_share_id, mode, access)
+                 VALUES ('myfiles', ?1, ?2, COALESCE(?3, ''), 'ondemand', 'rw')",
+                params![local_path, root_uid, root_share_id],
+            )?;
+            tx.last_insert_rowid()
+        } else {
+            tx.query_row("SELECT id FROM mount WHERE kind = 'myfiles'", [], |row| {
+                row.get(0)
+            })?
+        };
+        tx.commit()?;
+        Ok(id)
+    }
+
+    /// Store a share id learned asynchronously, but only if the projection still
+    /// names the root it was resolved for.
+    pub fn mount_repair_my_files_share_id(
+        &self,
+        root_uid: &str,
+        root_share_id: &str,
+    ) -> Result<bool> {
+        let conn = self.conn.lock();
+        Ok(conn.execute(
+            "UPDATE mount
+                SET root_share_id = ?2
+              WHERE kind = 'myfiles'
+                AND root_uid = ?1",
+            params![root_uid, root_share_id],
+        )? > 0)
+    }
+
+    /// Every local location, with device fields joined from `sync_folder`.
+    pub fn mount_list(&self) -> Result<Vec<MountSpec>> {
+        let conn = self.conn.lock();
+        let mut stmt = conn.prepare(
+            "SELECT
+                 m.id,
+                 m.kind,
+                 m.sync_folder_id,
+                 m.share_root_uid,
+                 CASE WHEN m.kind = 'device' THEN sf.local_path ELSE m.local_path END,
+                 CASE WHEN m.kind = 'device' THEN sf.remote_uid ELSE m.root_uid END,
+                 CASE WHEN m.kind = 'device' THEN sf.remote_share_id ELSE m.root_share_id END,
+                 CASE WHEN m.kind = 'device' THEN sf.mode ELSE m.mode END,
+                 m.access,
+                 CASE WHEN m.kind = 'device' THEN sf.state ELSE 'idle' END,
+                 CASE WHEN m.kind = 'device' THEN sf.last_sync ELSE 0 END,
+                 CASE WHEN m.kind = 'device' THEN sf.pending_mode ELSE NULL END
+               FROM mount AS m
+               LEFT JOIN sync_folder AS sf ON sf.id = m.sync_folder_id
+              ORDER BY CASE m.kind
+                         WHEN 'myfiles' THEN 0
+                         WHEN 'device' THEN 1
+                         ELSE 2
+                       END,
+                       m.id",
+        )?;
+        let rows = stmt.query_map([], |row| {
+            Ok((
+                row.get::<_, i64>(0)?,
+                row.get::<_, String>(1)?,
+                row.get::<_, Option<i64>>(2)?,
+                row.get::<_, Option<String>>(3)?,
+                row.get::<_, String>(4)?,
+                row.get::<_, String>(5)?,
+                row.get::<_, String>(6)?,
+                row.get::<_, String>(7)?,
+                row.get::<_, String>(8)?,
+                row.get::<_, String>(9)?,
+                row.get::<_, i64>(10)?,
+                row.get::<_, Option<String>>(11)?,
+            ))
+        })?;
+
+        let mut mounts = Vec::new();
+        for row in rows {
+            let (
+                id,
+                kind,
+                sync_folder_id,
+                share_root_uid,
+                local_path,
+                root_uid,
+                root_share_id,
+                mode,
+                access,
+                state,
+                last_sync,
+                pending_mode,
+            ) = row?;
+            let kind = match kind.as_str() {
+                "myfiles" => MountKind::MyFiles,
+                "device" => MountKind::Device {
+                    sync_folder_id: sync_folder_id.ok_or_else(|| {
+                        Error::Other(format!("mount row {id} has no sync_folder_id"))
+                    })?,
+                },
+                "shared" => MountKind::Shared {
+                    share_root_uid: share_root_uid.ok_or_else(|| {
+                        Error::Other(format!("mount row {id} has no share_root_uid"))
+                    })?,
+                },
+                other => {
+                    return Err(Error::Other(format!(
+                        "mount row {id} has unknown kind {other:?}"
+                    )));
+                }
+            };
+            let access = match access.as_str() {
+                "rw" => MountAccess::Rw,
+                "ro" => MountAccess::Ro,
+                other => {
+                    return Err(Error::Other(format!(
+                        "mount row {id} has unknown access {other:?}"
+                    )));
+                }
+            };
+            mounts.push(MountSpec {
+                id,
+                kind,
+                local_path,
+                root_uid,
+                root_share_id,
+                mode: MountMode::from(mode.as_str()),
+                access,
+                state,
+                last_sync,
+                pending_mode: pending_mode.as_deref().map(MountMode::from),
+                mounted: false,
+                progress: None,
+            });
+        }
+        Ok(mounts)
+    }
+}
@@ -1,11 +1,13 @@
 //! Node rows: the persisted mirror of the remote tree, plus the trigram
 //! full-text index over names and paths that backs `Request::Search`.

-use rusqlite::{OptionalExtension, params};
+use std::collections::HashSet;
+
+use rusqlite::{OptionalExtension, Transaction, params};

 use super::Db;
-use crate::Result;
-use proton_drive_rs::proton_sdk::ids::NodeUid;
+use crate::{Access, Result};
+use proton_drive_rs::proton_sdk::ids::{LinkId, NodeUid, VolumeId};
 use proton_drive_rs::{Node, NodeKind};

 use super::utils::{TRIGRAM_MIN, collect_pairs, like_escape, pair, path_of};
@@ -22,6 +24,11 @@ pub struct SearchHit {
    pub path: String,
 }

+pub struct PublishedSharedRoot {
+    pub node: Node,
+    pub access: Access,
+}
+
 impl Db {
    pub fn upsert_node(&self, node: &Node) -> Result<()> {
        self.upsert_nodes(std::slice::from_ref(node))
@@ -42,57 +49,188 @@ impl Db {
        let mut conn = self.conn.lock();
        let tx = conn.transaction()?;
        for node in nodes {
-            let json = serde_json::to_string(node)?;
-            let uid = node.uid.to_string();
-            tx.execute(
-                "INSERT INTO nodes
-                   (uid, parent_uid, name, is_dir, size, mtime, trashed, node_json)
-                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)
-                 ON CONFLICT(uid) DO UPDATE SET
-                   parent_uid = excluded.parent_uid,
-                   name       = excluded.name,
-                   is_dir     = excluded.is_dir,
-                   size       = excluded.size,
-                   mtime      = excluded.mtime,
-                   trashed    = excluded.trashed,
-                   node_json  = excluded.node_json",
-                params![
-                    uid,
-                    node.parent_uid.as_ref().map(|u| u.to_string()),
-                    node.name,
-                    node.is_folder() as i64,
-                    node_size(node),
-                    node.modification_time,
-                    node.trashed as i64,
-                    json,
-                ],
-            )?;
-            // FTS5 has no UPSERT, so refresh the row by delete-then-insert.
-            // Trashed nodes are kept out of the index entirely so they never
-            // surface in search results.
-            //
-            // Keyed by the node's rowid, never by its uid: the uid is not an
-            // indexed FTS column, so deleting by it scans the entire index once
-            // per node written (B12). The rowid is stable across the upsert
-            // above — `ON CONFLICT DO UPDATE` keeps the existing row — so it is
-            // the same key before and after.
-            let rowid: i64 = tx.query_row(
-                "SELECT rowid FROM nodes WHERE uid = ?1",
-                params![uid],
-                |row| row.get(0),
-            )?;
-            tx.execute("DELETE FROM nodes_fts WHERE rowid = ?1", params![rowid])?;
-            if !node.trashed {
-                tx.execute(
-                    "INSERT INTO nodes_fts (rowid, name) VALUES (?1, ?2)",
-                    params![rowid, node.name],
-                )?;
-            }
+            upsert_node_tx(&tx, node)?;
        }
        tx.commit()?;
        Ok(())
    }

+    /// Return visible direct children without consulting the parent's `listed`
+    /// flag. Synthetic shared listings use this to serve the last completed
+    /// snapshot while offline, including after a live event expired its TTL.
+    pub fn visible_children(&self, parent: &NodeUid) -> Result<Vec<Node>> {
+        let conn = self.conn.lock();
+        let mut stmt = conn.prepare(
+            "SELECT node_json FROM nodes
+              WHERE parent_uid = ?1 AND trashed = 0 AND node_json IS NOT NULL
+              ORDER BY name, uid",
+        )?;
+        let rows = stmt.query_map([parent.to_string()], |row| row.get::<_, String>(0))?;
+        let mut nodes = Vec::new();
+        for row in rows {
+            nodes.push(serde_json::from_str(&row?)?);
+        }
+        Ok(nodes)
+    }
+
+    /// Atomically publish one completed `Shared with me` root listing.
+    ///
+    /// Roots absent from `accepted` and every persisted descendant are
+    /// tombstoned, not deleted. Accepted roots omitted from materialization keep
+    /// their visible snapshot but are downgraded to Viewer until membership is
+    /// verified again. Both cases preserve queued operations and staged writes.
+    pub fn publish_shared_roots(
+        &self,
+        parent: &NodeUid,
+        accepted: &[NodeUid],
+        roots: &[PublishedSharedRoot],
+    ) -> Result<Vec<NodeUid>> {
+        let parent = parent.to_string();
+        let present: HashSet<String> = accepted.iter().map(NodeUid::to_string).collect();
+        let materialized: HashSet<String> = roots
+            .iter()
+            .map(|published| published.node.uid.to_string())
+            .collect();
+        let mut conn = self.conn.lock();
+        let tx = conn.transaction()?;
+
+        let existing = direct_child_uids_tx(&tx, &parent)?;
+        let removed: Vec<String> = existing
+            .into_iter()
+            .filter(|uid| !present.contains(uid))
+            .collect();
+
+        for published in roots {
+            if !present.contains(&published.node.uid.to_string()) {
+                continue;
+            }
+            upsert_node_tx(&tx, &published.node)?;
+            upsert_share_access_tx(&tx, &published.node.uid.to_string(), published.access)?;
+        }
+        for uid in present.difference(&materialized) {
+            upsert_share_access_tx(&tx, uid, Access::Viewer)?;
+        }
+        for root in &removed {
+            tombstone_subtree_tx(&tx, root)?;
+            upsert_share_access_tx(&tx, root, Access::Viewer)?;
+        }
+        tx.execute(
+            "UPDATE nodes SET listed = 1 WHERE uid = ?1",
+            params![parent],
+        )?;
+        tx.commit()?;
+
+        Ok(removed
+            .into_iter()
+            .filter_map(|uid| parse_node_uid(&uid))
+            .collect())
+    }
+
+    /// Atomically withdraw a deleted foreign subtree and deny stale handles.
+    ///
+    /// Node rows and queued operations remain so retries and staged writes keep
+    /// their references. FTS and completed-listing state are withdrawn for the
+    /// whole subtree, and the deleted UID becomes a fail-closed authority.
+    pub fn tombstone_foreign_subtree(&self, uid: &NodeUid) -> Result<()> {
+        let uid = uid.to_string();
+        let mut conn = self.conn.lock();
+        let tx = conn.transaction()?;
+        tombstone_subtree_tx(&tx, &uid)?;
+        upsert_share_access_tx(&tx, &uid, Access::Viewer)?;
+        tx.commit()?;
+        Ok(())
+    }
+
+    /// Publish a completed foreign-folder listing from its authoritative UID
+    /// list and the subset that materialized successfully. Accepted-but-omitted
+    /// children retain their previous snapshot; only absent UIDs are tombstoned.
+    pub fn publish_foreign_children(
+        &self,
+        parent: &NodeUid,
+        accepted: &[NodeUid],
+        materialized: &[Node],
+    ) -> Result<Vec<NodeUid>> {
+        let parent = parent.to_string();
+        let present: HashSet<String> = accepted.iter().map(NodeUid::to_string).collect();
+        let mut conn = self.conn.lock();
+        let tx = conn.transaction()?;
+        let removed: Vec<String> = direct_child_uids_tx(&tx, &parent)?
+            .into_iter()
+            .filter(|uid| !present.contains(uid))
+            .collect();
+        for node in materialized {
+            if present.contains(&node.uid.to_string()) {
+                upsert_node_tx(&tx, node)?;
+            }
+        }
+        for uid in &removed {
+            tombstone_subtree_tx(&tx, uid)?;
+        }
+        tx.execute(
+            "UPDATE nodes SET listed = 1 WHERE uid = ?1",
+            params![parent],
+        )?;
+        tx.commit()?;
+        Ok(removed
+            .into_iter()
+            .filter_map(|uid| parse_node_uid(&uid))
+            .collect())
+    }
+
+    /// Atomically publish the synthetic root's pinned name, node/FTS state, and
+    /// Viewer authority.
+    ///
+    /// The pin is inserted last so any failure there rolls back the node and
+    /// its descendant FTS updates as well as the access row. Returning `false`
+    /// guarantees no write occurred, which keeps cached root lookups O(1).
+    pub fn publish_virtual_root(&self, pinned_name_key: &str, node: &Node) -> Result<bool> {
+        let uid = node.uid.to_string();
+        let desired_parent = node.parent_uid.as_ref().map(NodeUid::to_string);
+        let mut conn = self.conn.lock();
+        let tx = conn.transaction()?;
+        let pinned_name: Option<String> = tx
+            .query_row(
+                "SELECT value FROM sync_state WHERE key = ?1",
+                params![pinned_name_key],
+                |row| row.get(0),
+            )
+            .optional()?;
+        let stored: Option<(Option<String>, String, i64, i64)> = tx
+            .query_row(
+                "SELECT parent_uid, name, is_dir, trashed FROM nodes WHERE uid = ?1",
+                params![uid],
+                |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?, row.get(3)?)),
+            )
+            .optional()?;
+        let access: Option<String> = tx
+            .query_row(
+                "SELECT access FROM share_access WHERE root_uid = ?1",
+                params![uid],
+                |row| row.get(0),
+            )
+            .optional()?;
+        let unchanged = stored.is_some_and(|(parent, name, is_dir, trashed)| {
+            parent == desired_parent
+                && name == node.name
+                && is_dir == 1
+                && trashed == node.trashed as i64
+        }) && access.as_deref() == Some(Access::Viewer.as_db_str())
+            && pinned_name.is_some();
+        if unchanged {
+            tx.commit()?;
+            return Ok(false);
+        }
+        upsert_share_access_tx(&tx, &uid, Access::Viewer)?;
+        upsert_node_tx(&tx, node)?;
+        tx.execute(
+            "INSERT INTO sync_state (key, value) VALUES (?1, ?2)
+             ON CONFLICT(key) DO NOTHING",
+            params![pinned_name_key, node.name],
+        )?;
+        tx.commit()?;
+        Ok(true)
+    }
+
    /// Drop a node row (delete or trash from the hot cache). Children rows are
    /// not cascaded here; the daemon forgets a whole subtree node-by-node.
    pub fn delete_node(&self, uid: &NodeUid) -> Result<()> {
@@ -118,6 +256,78 @@ impl Db {
        Ok(())
    }

+    /// Atomically retire a landed trash operation and its retained authority.
+    ///
+    /// Queued trash keeps the node row so drain-time permission checks can
+    /// resolve its shared-tree access. Removing the op first could resurrect
+    /// that row after a crash; removing the row first could strand a now
+    /// unauthorizable op. One transaction closes both windows.
+    pub fn complete_trash_op(&self, op_id: i64, uid: &NodeUid) -> Result<()> {
+        let uid = uid.to_string();
+        let mut conn = self.conn.lock();
+        let tx = conn.transaction()?;
+        let rowid: Option<i64> = tx
+            .query_row(
+                "SELECT rowid FROM nodes WHERE uid = ?1",
+                params![uid],
+                |row| row.get(0),
+            )
+            .optional()?;
+        tx.execute("DELETE FROM nodes WHERE uid = ?1", params![uid])?;
+        if let Some(rowid) = rowid {
+            tx.execute("DELETE FROM nodes_fts WHERE rowid = ?1", params![rowid])?;
+        }
+        tx.execute("DELETE FROM pending_op WHERE id = ?1", params![op_id])?;
+        tx.commit()?;
+        Ok(())
+    }
+
+    /// Check if a folder node has any non-trashed children in the database.
+    pub fn has_children(&self, parent_uid: &NodeUid) -> Result<bool> {
+        let uid_str = parent_uid.to_string();
+        let conn = self.conn.lock();
+        let count: i64 = conn.query_row(
+            "SELECT COUNT(*) FROM nodes WHERE parent_uid = ?1 AND trashed = 0",
+            params![uid_str],
+            |row| row.get(0),
+        )?;
+        Ok(count > 0)
+    }
+
+    /// Resolve `uid` relative to an ancestor node.
+    ///
+    /// This is used when a remote subtree has its own local sync mount: the
+    /// sync folder stores the ancestor UID, while search results identify the
+    /// selected descendant. Returning `None` for an unrelated or incomplete
+    /// chain keeps callers from accidentally joining a Drive-wide path onto the
+    /// wrong mountpoint. The ancestor itself resolves to the empty path.
+    pub fn path_relative_to(&self, ancestor_uid: &str, uid: &str) -> Result<Option<String>> {
+        let conn = self.conn.lock();
+        let mut stmt = conn.prepare(
+            "WITH RECURSIVE anc(uid, parent_uid, name, depth) AS (
+               SELECT uid, parent_uid, name, 0 FROM nodes WHERE uid = ?1
+               UNION ALL
+               SELECT n.uid, n.parent_uid, n.name, anc.depth + 1
+               FROM nodes n JOIN anc ON n.uid = anc.parent_uid
+               WHERE anc.depth < 1024
+             )
+             SELECT uid, name FROM anc ORDER BY depth",
+        )?;
+        let rows = stmt.query_map(params![uid], |row| {
+            Ok((row.get::<_, String>(0)?, row.get::<_, String>(1)?))
+        })?;
+        let mut parts = Vec::new();
+        for row in rows {
+            let (current_uid, name) = row?;
+            if current_uid == ancestor_uid {
+                parts.reverse();
+                return Ok(Some(parts.join("/")));
+            }
+            parts.push(name);
+        }
+        Ok(None)
+    }
+
    /// Full-text search over node names, newest schema's trigram index giving
    /// substring (not just prefix) matches. Returns up to `limit` non-trashed
    /// hits, each with its mountpoint-relative path resolved. Queries shorter
@@ -163,6 +373,68 @@ impl Db {
        Ok(hits)
    }

+    /// Return a bounded, deliberately broad candidate pool for fuzzy ranking.
+    /// Unlike [`search`](Self::search), trigram terms are ORed across both the
+    /// basename and parent path, so a typo can still share enough trigrams to
+    /// enter the pool. Final relevance ordering belongs to the caller.
+    pub fn search_candidates(&self, query: &str, limit: usize) -> Result<Vec<SearchHit>> {
+        let query = query.trim();
+        if query.is_empty() || limit == 0 {
+            return Ok(Vec::new());
+        }
+        let conn = self.conn.lock();
+        let terms = candidate_trigrams(query);
+        let lane_limit = limit.div_ceil(2);
+        let mut rows: Vec<(String, String)> = if terms.is_empty() {
+            let pat = format!("%{}%", like_escape(query));
+            let mut stmt = conn.prepare(
+                "SELECT node_json, uid FROM nodes
+                 WHERE name LIKE ?1 ESCAPE '\\' AND trashed = 0 AND node_json IS NOT NULL
+                 ORDER BY name LIMIT ?2",
+            )?;
+            collect_pairs(stmt.query_map(params![pat, limit as i64], pair)?)?
+        } else {
+            let expression = terms.join(" OR ");
+            let mut stmt = conn.prepare(
+                "SELECT n.node_json, n.uid
+                   FROM nodes_fts f JOIN nodes n ON n.rowid = f.rowid
+                  WHERE nodes_fts MATCH ?1 AND n.trashed = 0 AND n.node_json IS NOT NULL
+                  ORDER BY f.rank LIMIT ?2",
+            )?;
+            collect_pairs(stmt.query_map(params![expression, lane_limit as i64], pair)?)?
+        };
+        // A short substitution can destroy every trigram (`vedio` vs `video`).
+        // Feed the scorer an additional indexed same-initial lane so it can
+        // recover those candidates without scanning the full node table.
+        if !terms.is_empty()
+            && let Some(first) = query.chars().next()
+        {
+            let prefix = format!("{}%", like_escape(&first.to_string()));
+            let mut stmt = conn.prepare(
+                "SELECT node_json, uid FROM nodes
+                 WHERE name COLLATE NOCASE LIKE ?1 ESCAPE '\\'
+                   AND trashed = 0 AND node_json IS NOT NULL
+                 ORDER BY name COLLATE NOCASE LIMIT ?2",
+            )?;
+            let fallback =
+                collect_pairs(stmt.query_map(params![prefix, lane_limit as i64], pair)?)?;
+            for row in fallback {
+                if !rows.iter().any(|(_, uid)| uid == &row.1) {
+                    rows.push(row);
+                }
+            }
+            rows.truncate(limit);
+        }
+        rows.into_iter()
+            .map(|(json, uid)| {
+                Ok(SearchHit {
+                    node: serde_json::from_str(&json)?,
+                    path: path_of(&conn, &uid)?,
+                })
+            })
+            .collect()
+    }
+
    /// Mark (or unmark) a folder's child listing as complete. A listed folder
    /// rehydrates its `children` map on mount even when empty; an unlisted one
    /// re-enumerates from the remote on next access.
@@ -249,6 +521,185 @@ impl Db {
    // in sync on every store/read/evict, so it is authoritative for eviction.
 }

+fn upsert_node_tx(tx: &Transaction<'_>, node: &Node) -> Result<()> {
+    let json = serde_json::to_string(node)?;
+    let uid = node.uid.to_string();
+    tx.execute(
+        "INSERT INTO nodes
+           (uid, parent_uid, name, is_dir, size, mtime, trashed, node_json)
+         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)
+         ON CONFLICT(uid) DO UPDATE SET
+           parent_uid = excluded.parent_uid,
+           name       = excluded.name,
+           is_dir     = excluded.is_dir,
+           size       = excluded.size,
+           mtime      = excluded.mtime,
+           trashed    = excluded.trashed,
+           node_json  = excluded.node_json",
+        params![
+            uid,
+            node.parent_uid.as_ref().map(|u| u.to_string()),
+            node.name,
+            node.is_folder() as i64,
+            node_size(node),
+            node.modification_time,
+            node.trashed as i64,
+            json,
+        ],
+    )?;
+    // FTS5 has no UPSERT. Folder moves also change every descendant path, so
+    // refresh the whole affected subtree while keeping rowid deletes indexed.
+    let rowid: i64 = tx.query_row(
+        "SELECT rowid FROM nodes WHERE uid = ?1",
+        params![uid],
+        |row| row.get(0),
+    )?;
+    let mut affected = vec![rowid];
+    if node.is_folder() {
+        let mut stmt = tx.prepare(
+            "WITH RECURSIVE descendants(rowid, uid) AS (
+               SELECT rowid, uid FROM nodes WHERE parent_uid = ?1
+               UNION ALL
+               SELECT n.rowid, n.uid FROM nodes n
+                 JOIN descendants d ON n.parent_uid = d.uid
+             ) SELECT rowid FROM descendants",
+        )?;
+        for descendant in stmt.query_map(params![uid], |row| row.get(0))? {
+            affected.push(descendant?);
+        }
+    }
+    for affected_rowid in affected {
+        tx.execute(
+            "DELETE FROM nodes_fts WHERE rowid = ?1",
+            params![affected_rowid],
+        )?;
+        let indexed: Option<(String, String)> = tx
+            .query_row(
+                "SELECT name, uid FROM nodes WHERE rowid = ?1",
+                params![affected_rowid],
+                |row| Ok((row.get(0)?, row.get(1)?)),
+            )
+            .optional()?;
+        if let Some((name, indexed_uid)) = indexed
+            && node_is_indexable_tx(tx, &indexed_uid)?
+        {
+            let path = path_of(tx, &indexed_uid)?;
+            tx.execute(
+                "INSERT INTO nodes_fts (rowid, name, path) VALUES (?1, ?2, ?3)",
+                params![affected_rowid, name, path],
+            )?;
+        }
+    }
+    Ok(())
+}
+
+fn direct_child_uids_tx(tx: &Transaction<'_>, parent: &str) -> Result<Vec<String>> {
+    let mut stmt = tx.prepare("SELECT uid FROM nodes WHERE parent_uid = ?1")?;
+    let rows = stmt.query_map([parent], |row| row.get::<_, String>(0))?;
+    let mut uids = Vec::new();
+    for row in rows {
+        uids.push(row?);
+    }
+    Ok(uids)
+}
+
+fn node_is_indexable_tx(tx: &Transaction<'_>, uid: &str) -> Result<bool> {
+    let indexable: i64 = tx.query_row(
+        "WITH RECURSIVE ancestors(uid, parent_uid, trashed, path) AS (
+           SELECT uid, parent_uid, trashed, char(31) || uid || char(31)
+             FROM nodes WHERE uid = ?1
+           UNION ALL
+           SELECT n.uid, n.parent_uid, n.trashed,
+                  a.path || n.uid || char(31)
+             FROM ancestors a JOIN nodes n ON n.uid = a.parent_uid
+            WHERE instr(a.path, char(31) || n.uid || char(31)) = 0
+         )
+         SELECT CASE
+           WHEN COUNT(*) = 0 THEN 0
+           WHEN MAX(trashed) != 0 THEN 0
+           WHEN MAX(CASE WHEN parent_uid IS NULL THEN 1 ELSE 0 END) = 0 THEN 0
+           ELSE 1
+         END
+         FROM ancestors",
+        [uid],
+        |row| row.get(0),
+    )?;
+    Ok(indexable == 1)
+}
+
+fn tombstone_subtree_tx(tx: &Transaction<'_>, root_uid: &str) -> Result<()> {
+    let rows = {
+        let mut stmt = tx.prepare(
+            "WITH RECURSIVE subtree(rowid, uid, node_json) AS (
+               SELECT rowid, uid, node_json FROM nodes WHERE uid = ?1
+               UNION
+               SELECT n.rowid, n.uid, n.node_json FROM nodes n
+                 JOIN subtree s ON n.parent_uid = s.uid
+             )
+             SELECT rowid, uid, node_json FROM subtree",
+        )?;
+        let mapped = stmt.query_map([root_uid], |row| {
+            Ok((
+                row.get::<_, i64>(0)?,
+                row.get::<_, String>(1)?,
+                row.get::<_, Option<String>>(2)?,
+            ))
+        })?;
+        let mut rows = Vec::new();
+        for row in mapped {
+            rows.push(row?);
+        }
+        rows
+    };
+    for (rowid, uid, json) in rows {
+        let json = match json {
+            Some(json) => {
+                let mut node: Node = serde_json::from_str(&json)?;
+                node.trashed = true;
+                Some(serde_json::to_string(&node)?)
+            }
+            None => None,
+        };
+        tx.execute(
+            "UPDATE nodes SET trashed = 1, listed = 0, node_json = ?2 WHERE uid = ?1",
+            params![uid, json],
+        )?;
+        tx.execute("DELETE FROM nodes_fts WHERE rowid = ?1", [rowid])?;
+    }
+    Ok(())
+}
+
+fn upsert_share_access_tx(tx: &Transaction<'_>, uid: &str, access: Access) -> Result<()> {
+    tx.execute(
+        "INSERT INTO share_access (root_uid, access) VALUES (?1, ?2)
+         ON CONFLICT(root_uid) DO UPDATE SET access = excluded.access",
+        params![uid, access.as_db_str()],
+    )?;
+    Ok(())
+}
+
+fn parse_node_uid(value: &str) -> Option<NodeUid> {
+    let (volume, link) = value.split_once('~')?;
+    Some(NodeUid::new(VolumeId::from(volume), LinkId::from(link)))
+}
+
+/// Unique quoted character trigrams suitable for an FTS5 OR expression.
+pub(super) fn candidate_trigrams(query: &str) -> Vec<String> {
+    let chars: Vec<char> = query.to_lowercase().chars().collect();
+    let mut terms = Vec::new();
+    for window in chars.windows(TRIGRAM_MIN) {
+        if window.iter().all(|c| c.is_whitespace()) {
+            continue;
+        }
+        let raw: String = window.iter().collect();
+        let quoted = format!("\"{}\"", raw.replace('"', "\"\""));
+        if !terms.contains(&quoted) {
+            terms.push(quoted);
+        }
+    }
+    terms
+}
+
 /// Effective plaintext size of a node for the indexed `size` column: the
 /// claimed size when known, else the on-storage size; folders are 0.
 pub(super) fn node_size(node: &Node) -> i64 {
@@ -3,6 +3,7 @@
 //! order, so a child never drains before the parent that gives it a real uid.

 use rusqlite::{OptionalExtension, params};
+use serde::{Deserialize, Serialize};

 use super::Db;
 use crate::Result;
@@ -35,6 +36,16 @@ pub const OP_MKDIR: &str = "mkdir";
 /// that folder's own drain, exactly as for [`OP_CREATE`].
 pub const OP_RENAME: &str = "rename";

+/// Drain-time authority retained by a queued rename.
+///
+/// The optimistic local move rewrites the node's persisted ancestry to the
+/// destination immediately. Keeping the original parent here prevents that
+/// rewrite from erasing the shared tree that admitted the move.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct RenameMeta {
+    pub original_parent_uid: String,
+}
+
 /// The `kind` of a [`PendingOp`] that trashes a node the server knows about
 /// (offline.md Phase 3b).
 ///
@@ -63,6 +74,16 @@ pub fn op_supersedes(kind: &str) -> bool {
 /// drain replaces it with the uid the server assigns.
 pub const LOCAL_VOLUME: &str = "local";

+/// A `next_attempt_at` far enough in the future that [`Db::next_due_op`] never
+/// selects the op (ms since epoch, ≈ year 2223). Used to *park* a queued create
+/// for a transient file — a browser's in-flight `*.crdownload`/`*.part`, an
+/// editor's `*.swp` — so its bytes never upload while it wears that name. A
+/// rename to the finished name un-parks it (see [`Db::set_create_hold`]), which
+/// is the only moment the completed file is meant to reach Drive. Without the
+/// park, every partial and every abandoned temp would upload and, on a
+/// stall+resume, fork a `(sync-conflict)` copy (docs/BUGS.md B70).
+pub const PARK_UNTIL: i64 = 8_000_000_000_000;
+
 /// A mutation that has been accepted locally but not yet performed against the
 /// API — the durable half of the write-back queue (offline.md Phase 3).
 ///
@@ -117,10 +138,37 @@ pub struct AttachedBlob {
 }

 impl Db {
-    pub fn enqueue_op(&self, op: &PendingOp) -> Result<(i64, Option<String>)> {
+    /// Whether a specific desired-state operation is still queued for a node.
+    pub fn has_pending_op(&self, uid: &str, kind: &str) -> Result<bool> {
        let conn = self.conn.lock();
+        conn.query_row(
+            "SELECT EXISTS(
+                SELECT 1 FROM pending_op WHERE uid = ?1 AND kind = ?2
+             )",
+            params![uid, kind],
+            |row| row.get(0),
+        )
+        .map_err(Into::into)
+    }
+
+    /// Read an existing operation's metadata before a superseding enqueue.
+    pub fn pending_op_meta(&self, uid: &str, kind: &str) -> Result<Option<String>> {
+        let conn = self.conn.lock();
+        conn.query_row(
+            "SELECT meta_json FROM pending_op WHERE uid = ?1 AND kind = ?2",
+            params![uid, kind],
+            |row| row.get(0),
+        )
+        .optional()
+        .map(|value| value.flatten())
+        .map_err(Into::into)
+    }
+
+    pub fn enqueue_op(&self, op: &PendingOp) -> Result<(i64, Option<String>)> {
+        let mut conn = self.conn.lock();
+        let tx = conn.transaction()?;
        let superseded: Option<String> = if op_supersedes(&op.kind) {
-            let blob: Option<String> = conn
+            let blob: Option<String> = tx
                .query_row(
                    "SELECT blob_path FROM pending_op WHERE uid = ?1 AND kind = ?2",
                    params![op.uid, op.kind],
@@ -128,7 +176,7 @@ impl Db {
                )
                .optional()?
                .flatten();
-            conn.execute(
+            tx.execute(
                "DELETE FROM pending_op WHERE uid = ?1 AND kind = ?2",
                params![op.uid, op.kind],
            )?;
@@ -136,10 +184,10 @@ impl Db {
        } else {
            None
        };
-        conn.execute(
+        tx.execute(
            "INSERT INTO pending_op
-               (kind, uid, parent_uid, name, blob_path, meta_json, created_at)
-             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)",
+               (kind, uid, parent_uid, name, blob_path, meta_json, created_at, next_attempt_at)
+             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)",
            params![
                op.kind,
                op.uid,
@@ -147,10 +195,57 @@ impl Db {
                op.name,
                op.blob_path,
                op.meta_json,
-                op.created_at
+                op.created_at,
+                op.next_attempt_at
            ],
        )?;
-        Ok((conn.last_insert_rowid(), superseded))
+        let id = tx.last_insert_rowid();
+        tx.commit()?;
+        Ok((id, superseded))
+    }
+
+    /// Atomically replace every queued operation for `uid` and its queued
+    /// descendants with one remote trash intent.
+    ///
+    /// Staged blob paths are returned only after the transaction commits. A
+    /// failed trash insert therefore rolls the deletions back and leaves every
+    /// prior operation owning its bytes.
+    pub fn replace_ops_with_trash(
+        &self,
+        uid: &str,
+        name: &str,
+        created_at: i64,
+    ) -> Result<(i64, Vec<String>)> {
+        const SUBTREE: &str = "
+            WITH RECURSIVE doomed(uid) AS (
+              SELECT ?1
+              UNION
+              SELECT p.uid FROM pending_op p JOIN doomed d ON p.parent_uid = d.uid
+            )";
+        let mut conn = self.conn.lock();
+        let tx = conn.transaction()?;
+        let blobs: Vec<String> = {
+            let mut stmt = tx.prepare(&format!(
+                "{SUBTREE}
+                 SELECT blob_path FROM pending_op
+                 WHERE uid IN (SELECT uid FROM doomed) AND blob_path IS NOT NULL"
+            ))?;
+            let rows = stmt.query_map(params![uid], |row| row.get::<_, String>(0))?;
+            rows.collect::<std::result::Result<Vec<_>, _>>()?
+        };
+        tx.execute(
+            &format!("{SUBTREE} DELETE FROM pending_op WHERE uid IN (SELECT uid FROM doomed)"),
+            params![uid],
+        )?;
+        tx.execute(
+            "INSERT INTO pending_op
+               (kind, uid, parent_uid, name, blob_path, meta_json, created_at, next_attempt_at)
+             VALUES (?1, ?2, NULL, ?3, NULL, NULL, ?4, 0)",
+            params![OP_TRASH, uid, name, created_at],
+        )?;
+        let id = tx.last_insert_rowid();
+        tx.commit()?;
+        Ok((id, blobs))
    }

    /// Point a queued create at the bytes that were just written to it, returning
@@ -179,11 +274,18 @@ impl Db {
        let Some((id, superseded)) = existing else {
            return Ok(None);
        };
+        // Clearing the backoff lets the fresh bytes be tried promptly — except
+        // when the create is *parked* (a transient file, next_attempt_at at the
+        // PARK_UNTIL sentinel). Attaching a new revision to a still-growing
+        // download must not wake it; only the finalize rename does. So preserve a
+        // park and reset an ordinary backoff.
        conn.execute(
            "UPDATE pending_op
-             SET blob_path = ?2, meta_json = ?3, attempts = 0, next_attempt_at = 0
+             SET blob_path = ?2, meta_json = ?3, attempts = 0,
+                 next_attempt_at = CASE WHEN next_attempt_at >= ?4
+                                        THEN next_attempt_at ELSE 0 END
             WHERE id = ?1",
-            params![id, blob_path, meta_json],
+            params![id, blob_path, meta_json, PARK_UNTIL],
        )?;
        Ok(Some(AttachedBlob { id, superseded }))
    }
@@ -229,6 +331,52 @@ impl Db {
        Ok(n > 0)
    }

+    /// Park or un-park a queued create/mkdir for `uid`, returning whether a row
+    /// was touched.
+    ///
+    /// Parking sets `next_attempt_at` to [`PARK_UNTIL`] so [`Db::next_due_op`]
+    /// skips it indefinitely; un-parking sets it due now. Used to keep a
+    /// transient file's bytes off Drive until it is renamed to its finished name
+    /// (docs/BUGS.md B70). Un-parking a create that was never parked is harmless:
+    /// it just makes the create due immediately, which for a normal local node it
+    /// already is.
+    pub fn set_create_hold(&self, uid: &str, held: bool) -> Result<bool> {
+        let conn = self.conn.lock();
+        let n = conn.execute(
+            "UPDATE pending_op SET next_attempt_at = ?2
+             WHERE uid = ?1 AND kind IN (?3, ?4)",
+            params![uid, if held { PARK_UNTIL } else { 0 }, OP_CREATE, OP_MKDIR],
+        )?;
+        Ok(n > 0)
+    }
+
+    /// Check if a queued create or mkdir op exists for `uid`.
+    pub fn has_create_op(&self, uid: &str) -> Result<bool> {
+        let conn = self.conn.lock();
+        let count: i64 = conn.query_row(
+            "SELECT COUNT(*) FROM pending_op WHERE uid = ?1 AND kind IN (?2, ?3)",
+            params![uid, OP_CREATE, OP_MKDIR],
+            |row| row.get(0),
+        )?;
+        Ok(count > 0)
+    }
+
+    /// Check whether *any* op of any kind is queued against `uid`.
+    ///
+    /// Used as a safety interlock by callers that are about to remove a node
+    /// they only know about from a stale snapshot: a queued op means the user's
+    /// bytes are still owed an upload, and dropping it would discard the staged
+    /// blob that holds them (`docs/BUGS.md` B71).
+    pub fn has_any_op(&self, uid: &str) -> Result<bool> {
+        let conn = self.conn.lock();
+        let count: i64 = conn.query_row(
+            "SELECT COUNT(*) FROM pending_op WHERE uid = ?1",
+            params![uid],
+            |row| row.get(0),
+        )?;
+        Ok(count > 0)
+    }
+
    /// Drop every op targeting a node **or anything queued beneath it**,
    /// returning the staged blobs they held so the caller can delete them.
    ///
@@ -347,6 +495,28 @@ impl Db {
        Ok(op)
    }

+    /// The earliest `next_attempt_at` among all queued ops, or `None` if the
+    /// queue is empty. Used by the drain loop to sleep exactly until the next
+    /// debounced or backed-off op becomes eligible rather than waiting the full
+    /// idle-poll interval.
+    pub fn earliest_due_at(&self) -> Result<Option<i64>> {
+        let conn = self.conn.lock();
+        let ts: Option<i64> = conn
+            .query_row(
+                &format!(
+                    "SELECT MIN(next_attempt_at) FROM pending_op \
+                     WHERE parent_uid IS NULL OR substr(parent_uid, 1, {n}) <> '{v}~'",
+                    v = LOCAL_VOLUME,
+                    n = LOCAL_VOLUME.len() + 1,
+                ),
+                [],
+                |r| r.get(0),
+            )
+            .optional()?
+            .flatten();
+        Ok(ts)
+    }
+
    /// Every queued op, oldest first. For status read-outs and the CLI — the
    /// drain wants [`next_due_op`](Self::next_due_op) instead.
    pub fn pending_ops(&self) -> Result<Vec<PendingOp>> {
@@ -420,4 +590,23 @@ impl Db {
        )?;
        Ok(())
    }
+
+    /// Defer a due operation without recording a failed remote attempt.
+    ///
+    /// Access checks happen before the drain calls Proton, so a locally denied
+    /// operation has not failed remotely and must not consume a retry. Preserve
+    /// the long-lived transient-create sentinel if this is ever called for one.
+    pub fn defer_op_without_attempt(&self, id: i64, next_attempt_at: i64) -> Result<()> {
+        let conn = self.conn.lock();
+        conn.execute(
+            "UPDATE pending_op
+             SET next_attempt_at = CASE
+                 WHEN next_attempt_at >= ?3 THEN next_attempt_at
+                 ELSE ?2
+             END
+             WHERE id = ?1",
+            params![id, next_attempt_at, PARK_UNTIL],
+        )?;
+        Ok(())
+    }
 }
@@ -0,0 +1,143 @@
+//! Persisted effective access for roots shared with this account.
+
+use std::collections::HashMap;
+
+use proton_drive_rs::proton_sdk::ids::{LinkId, NodeUid, VolumeId};
+use rusqlite::{OptionalExtension, params};
+
+use super::Db;
+use crate::{Access, Error, Result};
+
+impl Db {
+    /// Load the complete, deliberately small shared-root authority map.
+    ///
+    /// Mount state keeps this resident so ordinary node interning and subtree
+    /// propagation never turn into one SQLite query per inode. The database
+    /// remains the restart/offline authority and every explicit role change is
+    /// written through before this cache is updated.
+    pub fn all_share_access(&self) -> Result<HashMap<NodeUid, Access>> {
+        let conn = self.conn.lock();
+        let mut stmt = conn.prepare("SELECT root_uid, access FROM share_access")?;
+        let rows = stmt.query_map([], |row| {
+            Ok((row.get::<_, String>(0)?, row.get::<_, String>(1)?))
+        })?;
+        let mut access = HashMap::new();
+        for row in rows {
+            let (uid, value) = row?;
+            let (volume, link) = uid.split_once('~').ok_or_else(|| {
+                Error::Other(format!(
+                    "invalid shared-root uid {uid:?} stored in database"
+                ))
+            })?;
+            let access_value = Access::from_db_str(&value).ok_or_else(|| {
+                Error::Other(format!("invalid share access {value:?} stored for {uid}"))
+            })?;
+            access.insert(
+                NodeUid::new(VolumeId::from(volume), LinkId::from(link)),
+                access_value,
+            );
+        }
+        Ok(access)
+    }
+
+    /// Read the effective access recorded for a shared-tree root.
+    pub fn share_access(&self, uid: &NodeUid) -> Result<Option<Access>> {
+        let conn = self.conn.lock();
+        let value = conn
+            .query_row(
+                "SELECT access FROM share_access WHERE root_uid = ?1",
+                [uid.to_string()],
+                |row| row.get::<_, String>(0),
+            )
+            .optional()?;
+        value
+            .map(|value| {
+                Access::from_db_str(&value).ok_or_else(|| {
+                    Error::Other(format!("invalid share access {value:?} stored for {uid}"))
+                })
+            })
+            .transpose()
+    }
+
+    /// Insert or replace the effective access for a shared-tree root.
+    pub fn set_share_access(&self, uid: &NodeUid, access: Access) -> Result<()> {
+        let conn = self.conn.lock();
+        conn.execute(
+            "INSERT INTO share_access (root_uid, access) VALUES (?1, ?2)
+             ON CONFLICT(root_uid) DO UPDATE SET access = excluded.access",
+            params![uid.to_string(), access.as_db_str()],
+        )?;
+        Ok(())
+    }
+
+    /// Forget a shared-tree root's effective access.
+    pub fn delete_share_access(&self, uid: &NodeUid) -> Result<()> {
+        let conn = self.conn.lock();
+        conn.execute(
+            "DELETE FROM share_access WHERE root_uid = ?1",
+            [uid.to_string()],
+        )?;
+        Ok(())
+    }
+
+    /// Fail closed every persisted shared-tree authority.
+    ///
+    /// Owned and device trees have no row in `share_access`, so this only
+    /// affects roots already identified as shared with this account.
+    pub fn downgrade_all_share_access(&self) -> Result<usize> {
+        let conn = self.conn.lock();
+        Ok(conn.execute(
+            "UPDATE share_access SET access = 'viewer' WHERE access != 'viewer'",
+            [],
+        )?)
+    }
+
+    /// Resolve a persisted node's effective access through its nearest recorded
+    /// share root. `None` means the node itself is not persisted, which callers
+    /// must not treat as owned: stale handles need to fail closed.
+    pub fn effective_node_access(&self, uid: &NodeUid) -> Result<Option<Access>> {
+        let conn = self.conn.lock();
+        let exists: bool = conn.query_row(
+            "SELECT EXISTS(SELECT 1 FROM nodes WHERE uid = ?1)",
+            [uid.to_string()],
+            |row| row.get(0),
+        )?;
+        if !exists {
+            return Ok(None);
+        }
+        let value = conn
+            .query_row(
+                "WITH RECURSIVE ancestors(uid, parent_uid, depth, path) AS (
+                   SELECT uid, parent_uid, 0, char(31) || uid || char(31)
+                     FROM nodes WHERE uid = ?1
+                   UNION ALL
+                   SELECT a.parent_uid, n.parent_uid, a.depth + 1,
+                          a.path || a.parent_uid || char(31)
+                     FROM ancestors a
+                     LEFT JOIN nodes n ON n.uid = a.parent_uid
+                    WHERE a.parent_uid IS NOT NULL
+                      AND instr(
+                            a.path,
+                            char(31) || a.parent_uid || char(31)
+                          ) = 0
+                 )
+                 SELECT sa.access
+                   FROM ancestors a JOIN share_access sa ON sa.root_uid = a.uid
+                  ORDER BY a.depth ASC
+                  LIMIT 1",
+                [uid.to_string()],
+                |row| row.get::<_, String>(0),
+            )
+            .optional()?;
+        value
+            .map(|value| {
+                Access::from_db_str(&value).ok_or_else(|| {
+                    Error::Other(format!(
+                        "invalid effective share access {value:?} for {uid}"
+                    ))
+                })
+            })
+            .transpose()
+            .map(|access| Some(access.unwrap_or(Access::Owner)))
+    }
+}
@@ -94,4 +94,26 @@ impl Db {
        conn.execute("DELETE FROM sync_state WHERE key = ?1", params![key])?;
        Ok(())
    }
+
+    /// Drop every `sync_state` key starting with `prefix` — the per-entity
+    /// stamps (one album, one shared folder) that are keyed by uid and so have
+    /// no fixed name to clear individually.
+    pub fn clear_state_prefix(&self, prefix: &str) -> Result<()> {
+        let conn = self.conn.lock();
+        // `\` escapes the LIKE wildcards, so a prefix containing `%` or `_`
+        // (a uid never does today, but this is not the place to rely on that)
+        // matches literally instead of sweeping unrelated keys.
+        let pattern = format!(
+            "{}%",
+            prefix
+                .replace('\\', "\\\\")
+                .replace('%', "\\%")
+                .replace('_', "\\_")
+        );
+        conn.execute(
+            "DELETE FROM sync_state WHERE key LIKE ?1 ESCAPE '\\'",
+            params![pattern],
+        )?;
+        Ok(())
+    }
 }
@@ -115,14 +115,17 @@ impl Db {
        Ok(n > 0)
    }

-    /// Update a synced folder's mode (`mirror`/`ondemand`). The folder has
-    /// reached the mode it was asked for, so any queued request is satisfied and
-    /// cleared in the same write — a `pending_mode` outliving the switch it asked
-    /// for would have the engine try to apply it again on the next pass.
+    /// Update a synced folder's mode (`mirror`/`ondemand`). A queued request for
+    /// that mode is satisfied and cleared in the same write. An opposite pending
+    /// mode arrived after this transition started, so preserve it as the newer
+    /// last-request intent.
    pub fn sync_folder_set_mode(&self, id: i64, mode: &str) -> Result<()> {
        let conn = self.conn.lock();
        conn.execute(
-            "UPDATE sync_folder SET mode = ?2, pending_mode = NULL WHERE id = ?1",
+            "UPDATE sync_folder
+                SET mode = ?2,
+                    pending_mode = CASE WHEN pending_mode = ?2 THEN NULL ELSE pending_mode END
+              WHERE id = ?1",
            params![id, mode],
        )?;
        Ok(())
@@ -139,6 +142,18 @@ impl Db {
        Ok(())
    }

+    /// Withdraw a queued mode only if it is still the intent the caller
+    /// inspected. A newer request must survive an older settlement attempt.
+    pub fn sync_folder_clear_pending_mode_if(&self, id: i64, expected: &str) -> Result<bool> {
+        let conn = self.conn.lock();
+        let changed = conn.execute(
+            "UPDATE sync_folder SET pending_mode = NULL
+             WHERE id = ?1 AND pending_mode = ?2",
+            params![id, expected],
+        )?;
+        Ok(changed > 0)
+    }
+
    /// Update a synced folder's state and stamp `last_sync` to now.
    pub fn sync_folder_set_state(&self, id: i64, state: &str, last_sync: i64) -> Result<()> {
        let conn = self.conn.lock();
@@ -174,6 +189,28 @@ impl Db {
        Ok(map)
    }

+    /// Whether `uid` is represented by a mirror location.
+    ///
+    /// An on-demand location proves residency through its live inode state.
+    /// Mirror locations have no FUSE state, so their folder root comes from
+    /// `sync_folder` and descendants come from the last successful
+    /// `sync_entry` baseline.
+    pub fn mirror_contains_uid(&self, uid: &str) -> Result<bool> {
+        let conn = self.conn.lock();
+        conn.query_row(
+            "SELECT EXISTS(
+                 SELECT 1
+                   FROM sync_folder AS folder
+              LEFT JOIN sync_entry AS entry ON entry.folder_id = folder.id
+                  WHERE folder.mode = 'mirror'
+                    AND (folder.remote_uid = ?1 OR entry.remote_uid = ?1)
+             )",
+            params![uid],
+            |row| row.get(0),
+        )
+        .map_err(Into::into)
+    }
+
    /// Insert or replace one baseline row.
    pub fn sync_entry_upsert(&self, folder_id: i64, e: &StoredSyncEntry) -> Result<()> {
        let conn = self.conn.lock();
@@ -2,6 +2,7 @@
 //! identity, XDG paths, and the login/session/keyring layer that every
 //! front-end (CLI today, daemon + GUI later) shares.

+pub mod access;
 pub mod auth;
 pub mod cache;
 pub mod config;
@@ -9,11 +10,14 @@ pub mod control;
 pub mod db;
 pub mod error;
 pub mod localindex;
+pub mod mounts;
 pub mod profile;
+pub mod search;
 pub mod service;
 pub mod shell;
 pub mod syncignore;

+pub use access::{Access, access_for, perm_bits};
 pub use error::{CoreError, CoreResult, Error, Result};

 // Re-export the SDK surface downstream crates need, so they depend on
@@ -0,0 +1,146 @@
+//! Unified presentation model for every local Proton Drive location.
+//!
+//! Device sync state remains owned by `sync_folder`; these types are the stable
+//! shape exposed to front-ends after that state is joined with the `mount`
+//! presentation table.
+
+use std::fmt;
+
+use serde::{Deserialize, Serialize};
+
+use crate::control::SyncProgress;
+
+/// How a location makes remote content available locally.
+#[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq, Default)]
+#[serde(rename_all = "lowercase")]
+pub enum MountMode {
+    /// A full local copy reconciled in both directions.
+    Mirror,
+    /// A FUSE session that fetches content as it is accessed.
+    OnDemand,
+    /// A mode written by a newer client.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
+impl MountMode {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Mirror => "mirror",
+            Self::OnDemand => "ondemand",
+            Self::Unknown => "unknown",
+        }
+    }
+}
+
+impl From<&str> for MountMode {
+    fn from(value: &str) -> Self {
+        match value {
+            "mirror" => Self::Mirror,
+            "ondemand" => Self::OnDemand,
+            _ => Self::Unknown,
+        }
+    }
+}
+
+impl fmt::Display for MountMode {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+/// Whether the location itself was declared writable.
+#[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+pub enum MountAccess {
+    Rw,
+    Ro,
+}
+
+impl MountAccess {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Rw => "rw",
+            Self::Ro => "ro",
+        }
+    }
+}
+
+impl fmt::Display for MountAccess {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+/// What remote root a local location presents.
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq)]
+#[serde(tag = "kind", rename_all = "lowercase")]
+pub enum MountKind {
+    /// The account's primary My Files mount.
+    MyFiles,
+    /// A folder owned by this machine's Proton Drive device.
+    Device { sync_folder_id: i64 },
+    /// A future standalone mount rooted at a node shared with this account.
+    Shared { share_root_uid: String },
+}
+
+/// One local Proton Drive location as exposed over the control protocol.
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct MountSpec {
+    /// Presentation-row id. Device actions use the `sync_folder_id` carried by
+    /// [`MountKind::Device`], not this id.
+    pub id: i64,
+    pub kind: MountKind,
+    pub local_path: String,
+    pub root_uid: String,
+    pub root_share_id: String,
+    pub mode: MountMode,
+    pub access: MountAccess,
+    /// `idle` | `syncing` | `error` | `conflict` for device locations.
+    pub state: String,
+    /// Last successful device sync, epoch seconds; `0` when not applicable.
+    pub last_sync: i64,
+    /// A device mode switch accepted but not yet applied.
+    #[serde(default)]
+    pub pending_mode: Option<MountMode>,
+    /// Whether a FUSE session currently owns `local_path`.
+    #[serde(default)]
+    pub mounted: bool,
+    /// Live device sync progress, absent when no pass is running.
+    #[serde(default)]
+    pub progress: Option<SyncProgress>,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn mount_mode_keeps_legacy_wire_strings() {
+        assert_eq!(
+            serde_json::to_string(&MountMode::Mirror).unwrap(),
+            r#""mirror""#
+        );
+        assert_eq!(
+            serde_json::to_string(&MountMode::OnDemand).unwrap(),
+            r#""ondemand""#
+        );
+        assert_eq!(
+            serde_json::from_str::<MountMode>(r#""mirror""#).unwrap(),
+            MountMode::Mirror
+        );
+        assert_eq!(
+            serde_json::from_str::<MountMode>(r#""ondemand""#).unwrap(),
+            MountMode::OnDemand
+        );
+    }
+
+    #[test]
+    fn mount_mode_tolerates_unknown_values() {
+        assert_eq!(
+            serde_json::from_str::<MountMode>(r#""from-the-future""#).unwrap(),
+            MountMode::Unknown
+        );
+    }
+}
@@ -17,9 +17,20 @@

 use serde::{Deserialize, Serialize};

-/// File name of the profile inside the device root folder.
+use crate::mounts::MountMode;
+
+/// File name of the profile.
 pub const PROFILE_FILE_NAME: &str = "profile.json";

+/// Folder, directly under the device root, that holds the profile.
+///
+/// The API refuses `Cannot create file at the root of a device` (HTTP 422), so
+/// the profile cannot live at the device root itself even though that is where
+/// it logically belongs (docs/BUGS.md B68/B78). A dotted name keeps it out of
+/// the way in the web UI, and the restore ignores it when listing the device's
+/// restorable folders.
+pub const PROFILE_DIR_NAME: &str = ".proton-drive-linux";
+
 /// Format version of the profile document.
 ///
 /// Bumped only for changes a *reader* cannot survive. Adding fields does not
@@ -39,8 +50,9 @@ pub struct ProfileFolder {
    /// Absolute local path it was synced to. A *suggestion* on restore: another
    /// machine may have a different username, home, or mount layout.
    pub local_path: String,
-    /// `mirror` or `ondemand`.
-    pub mode: String,
+    /// `mirror` or `ondemand`. Unknown values written by a newer client do not
+    /// invalidate the rest of the profile.
+    pub mode: MountMode,
 }

 /// One pinned node (P5 pins), as `pins` stores it.
@@ -114,7 +126,7 @@ mod tests {
            folders: vec![ProfileFolder {
                remote_uid: "vol~link".to_string(),
                local_path: "/home/nils/Documents".to_string(),
-                mode: "mirror".to_string(),
+                mode: MountMode::Mirror,
            }],
            pins: vec![ProfilePin {
                uid: "vol~pin".to_string(),
@@ -133,6 +145,52 @@ mod tests {
        assert_eq!(Profile::parse(&p.to_bytes().unwrap()).unwrap(), p);
    }

+    #[test]
+    fn profile_keeps_legacy_mode_bytes_and_parses_old_documents() {
+        let bytes = sample().to_bytes().unwrap();
+        let json = String::from_utf8(bytes).unwrap();
+        assert!(json.contains(r#""mode": "mirror""#));
+
+        let old = br#"{
+            "version": 1,
+            "device_uid": "dev-1",
+            "hostname": "old-client",
+            "saved_at": 1,
+            "folders": [
+                {
+                    "remote_uid": "vol~mirror",
+                    "local_path": "/home/me/Mirror",
+                    "mode": "mirror"
+                },
+                {
+                    "remote_uid": "vol~ondemand",
+                    "local_path": "/home/me/Cloud",
+                    "mode": "ondemand"
+                }
+            ]
+        }"#;
+        let profile = Profile::parse(old).unwrap();
+        assert_eq!(profile.folders[0].mode, MountMode::Mirror);
+        assert_eq!(profile.folders[1].mode, MountMode::OnDemand);
+    }
+
+    #[test]
+    fn unknown_folder_mode_does_not_reject_profile() {
+        let json = br#"{
+            "version": 1,
+            "device_uid": "dev-1",
+            "hostname": "future-client",
+            "saved_at": 1,
+            "folders": [{
+                "remote_uid": "vol~future",
+                "local_path": "/home/me/Future",
+                "mode": "streaming"
+            }]
+        }"#;
+        let profile = Profile::parse(json).unwrap();
+        assert_eq!(profile.folders[0].mode, MountMode::Unknown);
+    }
+
    /// A field added by a later client must not break this one's restore: the
    /// common subset is still usable, which is the whole reason `version` is
    /// reserved for breaking changes only.
@@ -0,0 +1,214 @@
+//! Shared, deterministic search-result relevance scoring.
+//!
+//! The scorer deliberately operates on a small candidate set rather than
+//! replacing an index. Callers should use SQLite (or another index) to find
+//! candidates, then use this module to put local and remote results on the
+//! same relevance scale.
+
+/// Scores a candidate against a user query.
+///
+/// Every query term must match either `basename` or `parent_path`. Basename
+/// matches are weighted twice as strongly as path matches. The returned score
+/// is stable and only meaningful when compared with scores produced by this
+/// function.
+#[must_use]
+pub fn relevance_score(query: &str, basename: &str, parent_path: &str) -> Option<i64> {
+    let query = normalize(query);
+    if query.is_empty() {
+        return Some(0);
+    }
+
+    let name = normalize(basename);
+    let path = normalize(parent_path);
+    let query_terms: Vec<_> = query.split_whitespace().collect();
+    let name_words: Vec<_> = name.split_whitespace().collect();
+    let path_words: Vec<_> = path.split_whitespace().collect();
+
+    let mut total = 0_i64;
+    for term in query_terms {
+        let name_score = field_term_score(term, &name, &name_words).map(|score| score * 2);
+        let path_score = field_term_score(term, &path, &path_words);
+        total += name_score.into_iter().chain(path_score).max()?;
+    }
+
+    // Whole-field bonuses make ordering intuitive without changing whether a
+    // candidate matches. They dominate small differences between term scores.
+    if name == query {
+        total += 20_000;
+    } else if name.starts_with(&query) {
+        total += 10_000;
+    } else if name.contains(&query) {
+        total += 4_000;
+    }
+
+    Some(total)
+}
+
+fn normalize(value: &str) -> String {
+    let mut normalized = String::with_capacity(value.len());
+    let mut last_was_space = true;
+
+    for character in value.chars().flat_map(char::to_lowercase) {
+        if character.is_alphanumeric() {
+            normalized.push(character);
+            last_was_space = false;
+        } else if !last_was_space {
+            normalized.push(' ');
+            last_was_space = true;
+        }
+    }
+
+    if last_was_space {
+        normalized.pop();
+    }
+    normalized
+}
+
+fn field_term_score(term: &str, field: &str, words: &[&str]) -> Option<i64> {
+    if field == term {
+        return Some(10_000);
+    }
+    if field.starts_with(term) {
+        return Some(8_500);
+    }
+    if words.contains(&term) {
+        return Some(8_000);
+    }
+    if words.iter().any(|word| word.starts_with(term)) {
+        return Some(7_000);
+    }
+    if field.contains(term) {
+        return Some(6_000);
+    }
+
+    // Subsequence matching supports useful abbreviations such as "qtrrpt".
+    let subsequence = std::iter::once(field)
+        .chain(words.iter().copied())
+        .filter_map(|word| subsequence_gap(term, word))
+        .min();
+    if let Some(gap) = subsequence {
+        return Some(4_500 - i64::try_from(gap.min(500)).unwrap_or(500));
+    }
+
+    // Typo matching is deliberately restricted to substantial terms to avoid
+    // noisy matches for one- and two-letter searches.
+    if term.chars().count() >= 4
+        && words
+            .iter()
+            .any(|word| bounded_damerau_levenshtein(term, word, typo_limit(term)))
+    {
+        return Some(3_500);
+    }
+
+    None
+}
+
+fn subsequence_gap(needle: &str, haystack: &str) -> Option<usize> {
+    let needle_length = needle.chars().count();
+    let mut needle = needle.chars();
+    let mut wanted = needle.next()?;
+    let mut first = None;
+
+    for (index, character) in haystack.chars().enumerate() {
+        if character == wanted {
+            first.get_or_insert(index);
+            match needle.next() {
+                Some(next) => wanted = next,
+                None => return Some(index + 1 - first.unwrap_or(index) - needle_length),
+            }
+        }
+    }
+    None
+}
+
+fn typo_limit(term: &str) -> usize {
+    usize::from(term.chars().count() >= 5) + 1
+}
+
+/// A bounded optimal-string-alignment distance check. This treats a single
+/// adjacent transposition (for example, `vidoe`) as one edit.
+fn bounded_damerau_levenshtein(left: &str, right: &str, limit: usize) -> bool {
+    let left: Vec<_> = left.chars().collect();
+    let right: Vec<_> = right.chars().collect();
+    if left.len().abs_diff(right.len()) > limit || left.len().max(right.len()) > 64 {
+        return false;
+    }
+
+    let mut distances = vec![vec![0_usize; right.len() + 1]; left.len() + 1];
+    for (index, row) in distances.iter_mut().enumerate() {
+        row[0] = index;
+    }
+    for (index, distance) in distances[0].iter_mut().enumerate() {
+        *distance = index;
+    }
+
+    for i in 1..=left.len() {
+        for j in 1..=right.len() {
+            let cost = usize::from(left[i - 1] != right[j - 1]);
+            distances[i][j] = (distances[i - 1][j] + 1)
+                .min(distances[i][j - 1] + 1)
+                .min(distances[i - 1][j - 1] + cost);
+            if i > 1 && j > 1 && left[i - 1] == right[j - 2] && left[i - 2] == right[j - 1] {
+                distances[i][j] = distances[i][j].min(distances[i - 2][j - 2] + 1);
+            }
+        }
+    }
+
+    distances[left.len()][right.len()] <= limit
+}
+
+#[cfg(test)]
+mod tests {
+    use super::relevance_score;
+
+    #[test]
+    fn exact_name_beats_prefix_and_substring() {
+        let exact = relevance_score("report", "report", "work").unwrap();
+        let prefix = relevance_score("report", "report final", "work").unwrap();
+        let substring = relevance_score("report", "annual report", "work").unwrap();
+        assert!(exact > prefix);
+        assert!(prefix > substring);
+    }
+
+    #[test]
+    fn basename_is_weighted_above_parent_path() {
+        let name = relevance_score("budget", "budget notes", "archive").unwrap();
+        let path = relevance_score("budget", "notes", "work/budget").unwrap();
+        assert!(name > path);
+    }
+
+    #[test]
+    fn matches_typos_and_adjacent_transpositions() {
+        assert!(relevance_score("vedio", "video.mp4", "media").is_some());
+        assert!(relevance_score("vidoe", "video.mp4", "media").is_some());
+        assert!(relevance_score("presentaton", "presentation.pdf", "work").is_some());
+    }
+
+    #[test]
+    fn separators_form_searchable_word_boundaries() {
+        assert!(relevance_score("final draft", "Final_Draft-v2.pdf", "work").is_some());
+        assert!(relevance_score("quarter report", "quarterly-report.pdf", "work").is_some());
+    }
+
+    #[test]
+    fn unicode_case_folding_preserves_accented_matches() {
+        assert!(relevance_score("CAFÉ", "Café Photos", "Trips").is_some());
+        assert!(relevance_score("ångström", "ÅNGSTRÖM notes", "Research").is_some());
+    }
+
+    #[test]
+    fn matches_terms_across_name_and_path() {
+        assert!(relevance_score("tax invoice", "invoice-1042.pdf", "archive/tax/2025").is_some());
+    }
+
+    #[test]
+    fn ordered_subsequence_supports_abbreviations() {
+        assert!(relevance_score("qtrrpt", "quarter-report.pdf", "finance").is_some());
+    }
+
+    #[test]
+    fn rejects_unrelated_candidates_and_short_typos() {
+        assert_eq!(relevance_score("video", "holiday.jpg", "photos"), None);
+        assert_eq!(relevance_score("xy", "xz.txt", "misc"), None);
+    }
+}
@@ -45,6 +45,45 @@ pub const DEFAULT_IGNORE_PATTERNS: &[&str] = &[
    "Thumbs.db",
 ];

+/// Suffixes of files that are, by convention, incomplete or throwaway while they
+/// wear the name: a download in flight, an editor's swap or backup, an atomic
+/// write's scratch copy. On an on-demand mount these should never seal a remote
+/// revision — the app renames the finished file to its real name, and only that
+/// belongs on Drive. See [`is_transient_name`] and docs/BUGS.md B70.
+const TRANSIENT_SUFFIXES: &[&str] = &[
+    ".crdownload", // Chromium/Brave/Edge
+    ".part",       // Firefox, wget, aria2c
+    ".partial",    // some downloaders / older IE
+    ".download",   // Safari / macOS
+    ".tmp",        // generic scratch
+    ".temp",       // generic scratch
+    ".swp",        // vim swap
+    ".swx",        // vim swap (secondary)
+];
+
+/// Whether `name` is a transient scratch/in-flight file whose bytes should not
+/// be uploaded on an on-demand mount until it is renamed to its finished name.
+///
+/// Recognises browser download temps, editor swap/backup files, and lock files.
+/// Case-insensitive on the suffix so `FOO.CRDOWNLOAD` counts too. This is the
+/// on-demand-write counterpart to [`DEFAULT_IGNORE_PATTERNS`] (which only covers
+/// mirror-folder reconcile); keep the two conceptually in step.
+pub fn is_transient_name(name: &str) -> bool {
+    let lower = name.to_ascii_lowercase();
+    if TRANSIENT_SUFFIXES.iter().any(|s| lower.ends_with(s)) {
+        return true;
+    }
+    // Emacs/gedit/kate backup copies.
+    if name.ends_with('~') {
+        return true;
+    }
+    // LibreOffice lock files (`.~lock.<doc>#`) and MS Office temps (`~$doc`).
+    if name.starts_with(".~lock.") || name.starts_with("~$") {
+        return true;
+    }
+    false
+}
+
 /// Filenames accepted as a folder's ignore file, in precedence order.
 const IGNORE_FILE_NAMES: &[&str] = &[".pdfsignore", ".protonignore"];

@@ -272,4 +311,37 @@ mod tests {
        // have nothing to reconcile against.
        assert!(!rules.is_ignored("", true));
    }
+
+    #[test]
+    fn transient_download_and_editor_names_are_recognised() {
+        for name in [
+            "Unconfirmed 540477.crdownload",
+            "movie.mkv.part",
+            "big.iso.partial",
+            "photo.jpg.download",
+            "export.xml.tmp",
+            "notes.TEMP",
+            ".notes.txt.swp",
+            "doc.txt~",
+            ".~lock.report.odt#",
+            "~$budget.xlsx",
+            "FOO.CRDOWNLOAD",
+        ] {
+            assert!(is_transient_name(name), "{name} should be transient");
+        }
+    }
+
+    #[test]
+    fn finished_names_are_not_transient() {
+        for name in [
+            "teamspeak.tar.gz",
+            "nils.zip",
+            "report.xml",
+            "archive.partly.zip", // ".partly" is not ".part"
+            "template.dotx",
+            "readme",
+        ] {
+            assert!(!is_transient_name(name), "{name} should not be transient");
+        }
+    }
 }
@@ -0,0 +1,245 @@
+//! Photo albums: the album listing, and one album's contents.
+//!
+//! Both are persisted projections of what the photos volume reports, refreshed
+//! on the same stale-while-serving rule as the timeline
+//! ([`crate::photos`]): a listing already on disk is served immediately and
+//! refreshed behind the caller, and only an empty one waits on the network.
+//!
+//! An album is a folder node carrying album properties, so it has a name like
+//! any other node; the properties supply the photo count and the cover. Albums
+//! other people share with us come from a second listing and live on *their*
+//! photos volume — which is why an album's photos are persisted per album rather
+//! than looked up in our own timeline, where a shared album's photos never
+//! appear.
+
+use std::collections::{HashMap, HashSet};
+use std::sync::atomic::Ordering;
+
+use pdfs_core::control::{AlbumInfo, PhotoItem};
+use pdfs_core::db::StoredAlbum;
+use pdfs_core::{CoreError, CoreResult};
+
+use proton_drive_rs::NodeKind;
+use proton_drive_rs::proton_sdk::ids::NodeUid;
+use tracing::warn;
+
+use super::{
+    ALBUM_SYNCED_PREFIX, ALBUMS_SYNCED_MS, Core, PHOTOS_AVAILABLE, PHOTOS_SYNCED_MS,
+    TIMELINE_ENRICH_CHUNK, TIMELINE_TTL, now_ms, parse_uid,
+};
+
+impl Core {
+    /// The album listing, served from disk and refreshed behind the caller when
+    /// stale. `None` means the account has no photos volume — the same signal
+    /// [`Core::photos_timeline`] gives.
+    pub(crate) fn albums(&self) -> CoreResult<Option<Vec<AlbumInfo>>> {
+        let count = self.db.albums_count().map_err(CoreError::from)?;
+        if count == 0 {
+            // Nothing on disk, so this one request waits for the fetch — unless
+            // the account is already known to have no photos volume.
+            let known_empty = self.db.state_i64(PHOTOS_AVAILABLE).ok().flatten() == Some(0);
+            if known_empty && !self.listing_stale(ALBUMS_SYNCED_MS, TIMELINE_TTL) {
+                return Ok(None);
+            }
+            if !self.rt.block_on(self.refresh_albums())? {
+                return Ok(None);
+            }
+        } else if self.listing_stale(ALBUMS_SYNCED_MS, TIMELINE_TTL) {
+            self.spawn_albums_refresh();
+        }
+
+        let albums = self.db.albums_list().map_err(CoreError::from)?;
+        Ok(Some(albums.into_iter().map(album_info).collect()))
+    }
+
+    /// Re-enumerate the albums — ours and the ones shared with us — and replace
+    /// the persisted listing. Returns false when the account has no photos
+    /// volume.
+    pub(crate) async fn refresh_albums(&self) -> CoreResult<bool> {
+        let photos = self.photos();
+        if photos
+            .get_photos_root()
+            .await
+            .map_err(|e| CoreError::from_api(&e, "photos root"))?
+            .is_none()
+        {
+            let _ = self.db.set_state_i64(PHOTOS_AVAILABLE, 0);
+            let _ = self.db.set_state_i64(PHOTOS_SYNCED_MS, now_ms());
+            let _ = self.db.set_state_i64(ALBUMS_SYNCED_MS, now_ms());
+            return Ok(false);
+        }
+
+        let mut uids = photos
+            .enumerate_album_node_uids()
+            .await
+            .map_err(|e| CoreError::from_api(&e, "albums"))?;
+
+        // Shared-with-me albums are a separate listing on the sharer's volume.
+        // Best-effort: an account whose sharing listing fails still gets its own
+        // albums rather than an error page.
+        let shared: HashSet<String> = match photos.enumerate_shared_with_me_album_uids().await {
+            Ok(shared) => {
+                let keys = shared.iter().map(|u| u.to_string()).collect();
+                uids.extend(shared);
+                keys
+            }
+            Err(e) => {
+                warn!(error = %e, "enumerating shared-with-me albums failed");
+                HashSet::new()
+            }
+        };
+
+        // The listings carry uids only; the name, photo count and cover come from
+        // the album nodes themselves. A chunk that fails to resolve drops those
+        // albums from this refresh rather than failing the whole listing.
+        let mut albums: Vec<StoredAlbum> = Vec::with_capacity(uids.len());
+        for chunk in uids.chunks(TIMELINE_ENRICH_CHUNK) {
+            match photos.enumerate_nodes(chunk).await {
+                Ok(nodes) => {
+                    for node in nodes {
+                        let key = node.uid.to_string();
+                        let props = node.album.as_ref();
+                        albums.push(StoredAlbum {
+                            shared: shared.contains(&key),
+                            uid: key,
+                            name: node.name,
+                            photo_count: props.map_or(0, |a| a.photo_count.max(0) as usize),
+                            cover_uid: props
+                                .and_then(|a| a.cover_photo_uid.as_ref())
+                                .map(|u| u.to_string()),
+                            last_activity: props.and_then(|a| a.last_activity_time),
+                        });
+                    }
+                }
+                Err(e) => warn!(error = %e, "resolving an album chunk failed"),
+            }
+        }
+
+        // Newest activity first, and albums the server gave no activity time for
+        // last — an album nobody has touched belongs below the ones in use. Ties
+        // fall back to the name so the order is stable between refreshes.
+        albums.sort_by(|a, b| {
+            b.last_activity
+                .cmp(&a.last_activity)
+                .then_with(|| a.name.to_lowercase().cmp(&b.name.to_lowercase()))
+        });
+
+        self.db.albums_replace(&albums).map_err(CoreError::from)?;
+        let _ = self.db.set_state_i64(PHOTOS_AVAILABLE, 1);
+        let _ = self.db.set_state_i64(ALBUMS_SYNCED_MS, now_ms());
+        Ok(true)
+    }
+
+    /// Refresh the album listing off the request path. At most one runs at a time.
+    pub(crate) fn spawn_albums_refresh(&self) {
+        if self.albums_refreshing.swap(true, Ordering::SeqCst) {
+            return;
+        }
+        let core = self.clone();
+        self.rt.spawn(async move {
+            if let Err(e) = core.refresh_albums().await {
+                warn!(error = %e, "background album refresh failed");
+            }
+            core.albums_refreshing.store(false, Ordering::SeqCst);
+        });
+    }
+
+    /// A page of one album's photos, newest capture first. The album's contents
+    /// are fetched on first open and refreshed behind the caller afterwards, so
+    /// paging never waits on the network twice.
+    pub(crate) fn album_photos(
+        &self,
+        album: &NodeUid,
+        offset: usize,
+        limit: usize,
+    ) -> CoreResult<Vec<PhotoItem>> {
+        let key = album.to_string();
+        let stamp = format!("{ALBUM_SYNCED_PREFIX}{key}");
+        let count = self.db.album_photos_count(&key).map_err(CoreError::from)?;
+        if count == 0 {
+            self.rt.block_on(self.refresh_album(album))?;
+        } else if self.listing_stale(&stamp, TIMELINE_TTL) {
+            let core = self.clone();
+            let album = album.clone();
+            self.rt.spawn(async move {
+                if let Err(e) = core.refresh_album(&album).await {
+                    warn!(%album, error = %e, "background album refresh failed");
+                }
+            });
+        }
+
+        let page = self
+            .db
+            .album_photos_page(&key, offset, limit)
+            .map_err(CoreError::from)?;
+        Ok(page.into_iter().map(|p| self.photo_item(p)).collect())
+    }
+
+    /// Re-enumerate one album's photos and replace its persisted contents.
+    pub(crate) async fn refresh_album(&self, album: &NodeUid) -> CoreResult<()> {
+        let photos = self.photos();
+        let items = photos
+            .enumerate_album(album)
+            .await
+            .map_err(|e| CoreError::from_api(&e, "album"))?;
+
+        // Same enrichment as the timeline: the listing carries a uid and a
+        // capture time, and the gallery needs a name and media type to classify
+        // each entry. Best-effort per chunk.
+        let uids: Vec<NodeUid> = items.iter().map(|it| it.uid.clone()).collect();
+        let mut meta: HashMap<String, (Option<String>, Option<String>)> = HashMap::new();
+        for chunk in uids.chunks(TIMELINE_ENRICH_CHUNK) {
+            match photos.enumerate_nodes(chunk).await {
+                Ok(nodes) => {
+                    for node in nodes {
+                        let media_type = match &node.kind {
+                            NodeKind::File { media_type, .. } => Some(media_type.clone()),
+                            NodeKind::Folder => None,
+                        };
+                        meta.insert(node.uid.to_string(), (Some(node.name), media_type));
+                    }
+                }
+                Err(e) => warn!(error = %e, "resolving album photo metadata failed"),
+            }
+        }
+
+        let rows: Vec<(String, i64, Option<String>, Option<String>)> = items
+            .iter()
+            .map(|it| {
+                let key = it.uid.to_string();
+                let (name, media_type) = meta.get(&key).cloned().unwrap_or((None, None));
+                (key, it.capture_time, name, media_type)
+            })
+            .collect();
+        let key = album.to_string();
+        self.db
+            .album_photos_replace(&key, &rows)
+            .map_err(CoreError::from)?;
+        let _ = self
+            .db
+            .set_state_i64(&format!("{ALBUM_SYNCED_PREFIX}{key}"), now_ms());
+        Ok(())
+    }
+
+    /// Drop the album listing's and every album's freshness stamp, so the next
+    /// request re-enumerates. Paired with [`Core::invalidate_photos`] — a change
+    /// to the timeline can just as easily be a change to an album.
+    pub(crate) fn invalidate_albums(&self) {
+        let _ = self.db.clear_state(ALBUMS_SYNCED_MS);
+        let _ = self.db.clear_state_prefix(ALBUM_SYNCED_PREFIX);
+    }
+}
+
+/// Project a persisted album into the wire item a front-end paints.
+fn album_info(album: StoredAlbum) -> AlbumInfo {
+    AlbumInfo {
+        uid: album.uid,
+        name: album.name,
+        photo_count: album.photo_count,
+        // A cover uid the daemon cannot parse is no cover: the front-end would
+        // only ask for a thumbnail that can never be resolved.
+        cover_uid: album.cover_uid.filter(|uid| parse_uid(uid).is_some()),
+        last_activity: album.last_activity,
+        shared: album.shared,
+    }
+}
@@ -0,0 +1,797 @@
+//! Remote-event invalidation and local-index background workers.
+
+use super::*;
+
+/// Drop `uid` from one mount's tree and tell that mount's kernel session the
+/// entry is gone. Shared by the trash and delete paths, which differ only in
+/// which event carried them.
+///
+/// Returns whether this mount actually held the node, so the caller can evict
+/// its content blob once if *any* mount did.
+fn forget_and_notify(st: &mut State, notifier: Option<&Notifier>, uid: &NodeUid) -> bool {
+    // Capture the inode before `forget` clears the uid mapping.
+    let child = st.by_uid.get(uid).copied();
+    let Some((parent, name)) = st.forget(uid) else {
+        return false;
+    };
+    if let Some(notifier) = notifier {
+        match child {
+            Some(child) => {
+                let _ = notifier.delete(INodeNo(parent), INodeNo(child), OsStr::new(&name));
+            }
+            None => {
+                let _ = notifier.inval_entry(INodeNo(parent), OsStr::new(&name));
+            }
+        }
+    }
+    true
+}
+
+fn invalidate_access_changes(notifier: Option<&Notifier>, changed: &[u64]) {
+    let Some(notifier) = notifier else {
+        return;
+    };
+    for &ino in changed {
+        let _ = notifier.inval_inode(INodeNo(ino), 0, 0);
+    }
+}
+
+fn hide_foreign_deleted_and_notify(st: &mut State, notifier: Option<&Notifier>, uid: &NodeUid) {
+    let child = st.by_uid.get(uid).copied();
+    let dentry = child.and_then(|ino| {
+        st.entries
+            .get(&ino)
+            .map(|entry| (entry.parent, entry.node.name.clone()))
+    });
+    let changed = st.downgrade_shared_subtree(uid);
+    st.hide_foreign_subtree(uid);
+    invalidate_access_changes(notifier, &changed);
+    if let (Some(notifier), Some((parent, name)), Some(child)) = (notifier, dentry, child) {
+        let _ = notifier.delete(INodeNo(parent), INodeNo(child), OsStr::new(&name));
+    }
+}
+
+/// Persist the fail-closed part of an access event and install the same denial
+/// in resident state even when SQLite rejects the write. The caller must not
+/// acknowledge the event when this returns an error.
+fn apply_access_downgrade(
+    db: &Db,
+    event: &DriveEvent,
+    mut deny: impl FnMut(Option<&NodeUid>),
+) -> pdfs_core::Result<()> {
+    match event {
+        DriveEvent::NodeDeleted { node_uid, .. } => {
+            let result = db.set_share_access(node_uid, Access::Viewer);
+            deny(Some(node_uid));
+            result
+        }
+        DriveEvent::ContinuityLost { .. }
+        | DriveEvent::ScopeAccessLost { .. }
+        | DriveEvent::SharedWithMeUpdated { .. } => {
+            let result = db.downgrade_all_share_access().map(|_| ());
+            deny(None);
+            result
+        }
+        _ => Ok(()),
+    }
+}
+
+fn apply_foreign_delete(
+    db: &Db,
+    uid: &NodeUid,
+    mut deny_and_hide: impl FnMut(&NodeUid),
+) -> pdfs_core::Result<()> {
+    let result = db.tombstone_foreign_subtree(uid);
+    deny_and_hide(uid);
+    result
+}
+
+fn is_foreign_node_delete(event: &DriveEvent, own_volume: &VolumeId) -> bool {
+    match event {
+        DriveEvent::NodeDeleted { node_uid, .. } => {
+            !is_own_or_virtual_uid(node_uid, own_volume) && !is_local_uid(node_uid)
+        }
+        _ => false,
+    }
+}
+
+fn event_serializes_shared_publication(event: &DriveEvent, own_volume: &VolumeId) -> bool {
+    matches!(
+        event,
+        DriveEvent::ContinuityLost { .. }
+            | DriveEvent::ScopeAccessLost { .. }
+            | DriveEvent::SharedWithMeUpdated { .. }
+    ) || is_foreign_node_delete(event, own_volume)
+}
+
+/// Apply one remote event to the local cache and notify the kernel so it drops
+/// any stale cached metadata/data for the affected inodes.
+///
+/// The cache is authoritative-by-absence: dropping a directory's `children`
+/// entry forces the next `lookup`/`readdir` to re-enumerate from the remote, so
+/// most events only need to invalidate listings rather than re-fetch eagerly.
+///
+/// Applied to **every** mounted inode space, not just the primary one. This task
+/// is per-daemon while node state is per-mount, and a `DriveEvent` names a uid,
+/// not a mount — so a file trashed from another device has to be withdrawn from
+/// whichever of our sessions is showing it, which for anything under a sync
+/// folder is a [`Core::fork_state`] fork rather than `core.state`. Reaching for
+/// the primary state alone left forks serving a deleted file indefinitely, the
+/// read-side twin of `docs/BUGS.md` B74. Inode numbers are per-mount, so each
+/// mount must be notified through its **own** channel; that pairing is what
+/// [`Core::for_each_mount`] exists to preserve.
+fn apply_event(core: &Core, event: &DriveEvent, dirty: &mut DirtyParents) -> pdfs_core::Result<()> {
+    let foreign_delete = is_foreign_node_delete(event, &core.primary_root_uid.volume_id);
+    let serializes_shared_publication =
+        event_serializes_shared_publication(event, &core.primary_root_uid.volume_id);
+    let _publication = serializes_shared_publication.then(|| core.shared_publication.lock());
+    if serializes_shared_publication {
+        core.invalidate_shared_refreshes();
+    }
+    let mut apply_result = if let DriveEvent::NodeDeleted { node_uid, .. } = event
+        && foreign_delete
+    {
+        apply_foreign_delete(&core.db, node_uid, |uid| {
+            core.for_each_mount(|st, notifier| {
+                hide_foreign_deleted_and_notify(st, notifier, uid);
+            });
+        })
+    } else {
+        apply_access_downgrade(&core.db, event, |root| {
+            core.for_each_mount(|st, notifier| {
+                let changed = match root {
+                    Some(uid) => st.downgrade_shared_subtree(uid),
+                    None => st.downgrade_known_shared_access(),
+                };
+                invalidate_access_changes(notifier, &changed);
+            });
+        })
+    };
+    match event {
+        DriveEvent::NodeUpdated {
+            node_uid,
+            parent_node_uid,
+            is_trashed,
+            ..
+        } => {
+            // A node we owe an upload for is *ahead* of the remote, not behind
+            // it: this event is almost always the echo of our own empty-file
+            // create, and re-fetching would replace the size and mtime of the
+            // write we just accepted with the stale revision's — making a file
+            // that was copied in seconds ago read as empty until its upload
+            // lands (offline.md Phase 3).
+            //
+            // A write that has already drained is the same story one step later:
+            // the drain brought the tree level with the revision it sealed, so
+            // the feed's report of that revision has nothing to add, and acting
+            // on it evicts the very bytes we uploaded. Claimed unconditionally,
+            // even for a trash, so an echo we no longer care about does not
+            // linger to suppress a later foreign change.
+            let echo = core.take_self_change(node_uid);
+            let ours = !*is_trashed && (echo || core.pending.lock().contains_key(node_uid));
+            if ours {
+                debug!(uid = %node_uid, "ignoring remote event for a node with a queued write");
+            }
+            let mut had_node = false;
+            core.for_each_mount(|st, notifier| {
+                if *is_trashed {
+                    // Trashing makes a node vanish from its parent listing.
+                    had_node |= forget_and_notify(st, notifier, node_uid);
+                } else if !ours && let Some(&ino) = st.by_uid.get(node_uid) {
+                    // Known node changed: drop its cached attrs/data (and
+                    // listing if it is a directory) so the next access
+                    // re-fetches. Its content blob may now be stale too.
+                    had_node = true;
+                    st.invalidate_listing(ino);
+                    if let Some(notifier) = notifier {
+                        let _ = notifier.inval_inode(INodeNo(ino), 0, 0);
+                    }
+                }
+            });
+            // Once, not once per mount: the content cache is per-daemon.
+            if had_node {
+                core.cache.evict(node_uid);
+            }
+            // A create, rename or move-in shows up as a change to the parent
+            // listing too, which is recorded for the end of the batch rather
+            // than acted on here — see [`DirtyParents`].
+            if let Some(parent_uid) = parent_node_uid {
+                match ours {
+                    true => dirty
+                        .ours
+                        .entry(parent_uid.clone())
+                        .or_default()
+                        .insert(node_uid.clone()),
+                    false => dirty.foreign.insert(parent_uid.clone()),
+                };
+            }
+        }
+        DriveEvent::NodeDeleted { node_uid, .. } => {
+            core.cache.evict(node_uid);
+            if !foreign_delete {
+                core.for_each_mount(|st, notifier| {
+                    forget_and_notify(st, notifier, node_uid);
+                });
+            }
+        }
+        // Losing event continuity or any shared-access signal makes persisted
+        // shared roots untrustworthy. Keep owned/device trees unchanged, but
+        // fail every known shared subtree closed until a root refresh carries a
+        // current membership role.
+        DriveEvent::ContinuityLost { .. }
+        | DriveEvent::ScopeAccessLost { .. }
+        | DriveEvent::SharedWithMeUpdated { .. } => {
+            warn!("event access continuity lost; downgrading shared trees and resyncing lazily");
+            apply_result = apply_result.and(core.db.clear_state(SHARED_WITH_ME_SYNCED_MS));
+            core.for_each_mount(|st, notifier| {
+                let dirs: Vec<u64> = st.children.keys().copied().collect();
+                for &ino in &dirs {
+                    st.invalidate_listing(ino);
+                    if let Some(notifier) = notifier {
+                        let _ = notifier.inval_inode(INodeNo(ino), 0, 0);
+                    }
+                }
+            });
+        }
+        // No substantive local change; the cursor advance is handled by the
+        // caller persisting the event id.
+        DriveEvent::CursorAdvanced { .. } => {}
+    }
+    apply_result
+}
+
+fn acknowledge_applied_event(
+    db: &Db,
+    event: &DriveEvent,
+    applied: pdfs_core::Result<()>,
+) -> pdfs_core::Result<DriveEventId> {
+    applied?;
+    let id = event.id().clone();
+    db.set_event_cursor(id.as_str())?;
+    Ok(id)
+}
+
+/// The folders one batch of events changed, collected so the listings are
+/// dropped once at the end of the batch rather than once per event.
+///
+/// Both halves of that matter. A burst of uploads produces one event per file
+/// all naming the *same* folder, and dropping the listing per event made every
+/// interleaved lookup re-enumerate that folder from the API — quadratic in its
+/// size, and slow enough to stall a busy mount. Splitting foreign changes from
+/// our own then removes the re-enumeration entirely for the common case: a file
+/// this daemon created is already in the tree under the right parent, so there
+/// is nothing for a re-enumeration to discover.
+///
+/// Neither is a weakening. The state after the batch is what it always was.
+#[derive(Default)]
+struct DirtyParents {
+    /// Folders changed by someone else. Their listings must go: an event names
+    /// no name, so a rename inside a folder is indistinguishable from a write to
+    /// a file in it, and only re-enumerating can tell us which happened.
+    foreign: HashSet<NodeUid>,
+    /// Folders changed by this daemon, and the children the changes were about.
+    /// Checked per mount — a mount that already lists every one of those
+    /// children under that parent keeps its listing.
+    ours: HashMap<NodeUid, HashSet<NodeUid>>,
+}
+
+/// Whether this mount's cached listing of `parent_uid` already accounts for
+/// `child_uid`, so a change we made to that child leaves nothing to re-read.
+///
+/// "Nothing cached" counts as current: an absent listing is re-enumerated on the
+/// next `readdir` regardless, so there is nothing to drop.
+fn listing_accounts_for(st: &State, parent_uid: &NodeUid, child_uid: &NodeUid) -> bool {
+    let Some(&parent) = st.by_uid.get(parent_uid) else {
+        return true;
+    };
+    let Some(children) = st.children.get(&parent) else {
+        return true;
+    };
+    let Some(&child) = st.by_uid.get(child_uid) else {
+        return false;
+    };
+    children.contains(&child) && st.entries.get(&child).is_some_and(|e| e.parent == parent)
+}
+
+/// Drop the cached listing of every folder a batch of events changed, in every
+/// mount that holds one, so the next `readdir`/`lookup` re-enumerates it.
+///
+/// Runs strictly after the whole batch is applied: doing it per event would
+/// leave a window where a concurrent `readdir` re-populates a listing that a
+/// later event in the same batch then has to drop again.
+fn flush_dirty_parents(core: &Core, dirty: &DirtyParents) {
+    if dirty.foreign.is_empty() && dirty.ours.is_empty() {
+        return;
+    }
+    core.for_each_mount(|st, notifier| {
+        let drop_listing = |st: &mut State, parent_uid: &NodeUid| {
+            let Some(&parent) = st.by_uid.get(parent_uid) else {
+                return;
+            };
+            st.invalidate_listing(parent);
+            if let Some(notifier) = notifier {
+                let _ = notifier.inval_inode(INodeNo(parent), 0, 0);
+            }
+        };
+        for parent_uid in &dirty.foreign {
+            drop_listing(st, parent_uid);
+        }
+        for (parent_uid, children) in &dirty.ours {
+            if dirty.foreign.contains(parent_uid) {
+                continue;
+            }
+            // One child this mount has not placed is enough: the listing it is
+            // serving is missing something the user just made.
+            if children
+                .iter()
+                .all(|child| listing_accounts_for(st, parent_uid, child))
+            {
+                continue;
+            }
+            drop_listing(st, parent_uid);
+        }
+    });
+}
+
+/// Poll the remote event cursor forever, applying each batch to the shared
+/// state. Resumes from the cursor persisted in the DB so changes made while
+/// unmounted are applied; only a first-ever mount seeds from the server head.
+/// The cursor is persisted after every batch. Runs as a Tokio task; returns
+/// only on fatal error.
+///
+/// Takes the whole `Core` rather than the primary mount's pieces: an event has
+/// to be applied to every mounted inode space, and the registry that enumerates
+/// them lives on the `Core` (see [`apply_event`]).
+pub(super) async fn run_event_sync(
+    client: ProtonDriveClient,
+    scope: DriveEventScopeId,
+    core: Core,
+) {
+    let db = core.db.clone();
+    let mut cursor: Option<DriveEventId> = match db.get_event_cursor() {
+        // Resume: pick up exactly where the last run left off.
+        Ok(Some(saved)) => Some(DriveEventId::from(saved)),
+        // First mount: a `None` cursor yields a single `CursorAdvanced` at the
+        // server head; persist it so the next restart resumes instead of
+        // reseeding (which would skip everything that changed offline).
+        // Seeding needs the network, and this task also runs on mounts that
+        // started offline (offline.md Phase 1) — so retry rather than giving up,
+        // which used to disable live sync for the life of the daemon.
+        Ok(None) => {
+            let mut delay = ONLINE_PROBE_MIN;
+            loop {
+                match client.enumerate_events(&scope, None).await {
+                    Ok(events) => {
+                        let head = events.last().map(|e| e.id().clone());
+                        let Some(c) = &head else {
+                            break None;
+                        };
+                        if let Err(e) = db.set_event_cursor(c.as_str()) {
+                            warn!(error = %e, ?delay, "persist seed cursor failed; retrying");
+                            tokio::time::sleep(delay).await;
+                            delay = (delay * 2).min(ONLINE_PROBE_MAX);
+                            continue;
+                        }
+                        break Some(c.clone());
+                    }
+                    Err(e) => {
+                        warn!(error = %e, ?delay, "seed event cursor failed; retrying");
+                        tokio::time::sleep(delay).await;
+                        delay = (delay * 2).min(ONLINE_PROBE_MAX);
+                    }
+                }
+            }
+        }
+        Err(e) => {
+            error!(error = %e, "read persisted cursor failed; live sync disabled");
+            return;
+        }
+    };
+    info!(?cursor, "event sync started");
+
+    loop {
+        tokio::time::sleep(POLL_INTERVAL).await;
+        let events = match client.enumerate_events(&scope, cursor.as_ref()).await {
+            Ok(events) => events,
+            Err(e) => {
+                warn!(error = %e, "event poll failed; retrying after interval");
+                continue;
+            }
+        };
+        if events.is_empty() {
+            continue;
+        }
+        debug!(count = events.len(), "applying remote events");
+        // Folders whose listing this batch invalidates, applied once at the end
+        // rather than per event — see [`DirtyParents`]. Every `break` below falls
+        // through to that flush, so an interrupted batch still publishes what it
+        // did apply.
+        let mut dirty = DirtyParents::default();
+        for event in &events {
+            // Converge the SDK's own caches (folder keys, entity cache) on the
+            // server before applying the event to our tree. Without this, a node
+            // re-keyed/moved by another client keeps a stale key in the SDK for
+            // the life of the daemon (SDK plan #9). `apply_event` only touches
+            // our FUSE state, so nothing else does this.
+            if let Err(e) = client.invalidate_caches_for_event(event).await {
+                warn!(error = %e, "sdk cache invalidation for event failed; retaining cursor for retry");
+                break;
+            }
+            let applied = match acknowledge_applied_event(
+                &db,
+                event,
+                apply_event(&core, event, &mut dirty),
+            ) {
+                Ok(applied) => applied,
+                Err(e) => {
+                    warn!(error = %e, "event application or acknowledgment failed; retaining prior cursor for retry");
+                    break;
+                }
+            };
+            // Advance only after this exact event is durably acknowledged. If a
+            // later event fails, polling resumes from here and replays nothing
+            // that was not already made visible locally.
+            cursor = Some(applied);
+        }
+        flush_dirty_parents(&core, &dirty);
+    }
+}
+
+/// Keep the local-file index fresh for the launcher prompt's "This computer"
+/// results. Rebuilds the index whenever it is older than [`LOCAL_INDEX_TTL`],
+/// then sleeps; runs on its own thread for the life of the daemon.
+///
+/// The walk is the one part of the daemon that touches the wider filesystem, so
+/// it is deliberately kept off every hot path: it never runs on a FUSE or
+/// control-socket thread, and it excludes the mountpoint (walking it would fault
+/// every remote node in through FUSE, defeating on-demand hydration).
+pub(super) fn run_local_index(
+    db: Arc<Db>,
+    indexing: Arc<AtomicBool>,
+    transfers: Arc<TransferRegistry>,
+    mountpoint: PathBuf,
+) {
+    loop {
+        let age = db.local_indexed_at().ok().flatten();
+        let stale =
+            age.is_none_or(|at| now_secs().saturating_sub(at) >= LOCAL_INDEX_TTL.as_secs() as i64);
+        if stale {
+            scan_local_once(&db, &indexing, &transfers, &mountpoint);
+        }
+        std::thread::sleep(LOCAL_INDEX_CHECK);
+    }
+}
+
+/// Walk `$HOME` once and replace the local-file index with what it finds.
+/// Batches stream straight into SQLite, so peak memory is one batch — not the
+/// whole home directory.
+///
+/// Reports itself as a job: the first scan after a fresh install walks the whole
+/// home directory, and `indexing` alone only tells the launcher prompt to say
+/// "still indexing" — nothing else showed that the daemon was busy.
+fn scan_local_once(
+    db: &Db,
+    indexing: &AtomicBool,
+    transfers: &Arc<TransferRegistry>,
+    mountpoint: &Path,
+) {
+    let dirs = match AppDirs::new() {
+        Ok(d) => d,
+        Err(e) => {
+            warn!(error = %e, "local index: cannot resolve app dirs");
+            return;
+        }
+    };
+    let Some(home) = dirs.home_dir() else {
+        warn!("local index: cannot resolve home directory");
+        return;
+    };
+    let generation = match db.local_begin_scan() {
+        Ok(g) => g,
+        Err(e) => {
+            warn!(error = %e, "local index: cannot open scan generation");
+            return;
+        }
+    };
+
+    let excludes = localindex::default_excludes(mountpoint, &dirs.state_dir(), &dirs.cache_dir());
+    indexing.store(true, Ordering::Relaxed);
+    let started = Instant::now();
+
+    // The walk has no idea how many files it will find, so the job counts what it
+    // has seen and stays indeterminate.
+    let job = transfers.begin_job("Indexing this computer");
+    job.detail("Scanning your files");
+    let walked = localindex::scan(&[home], &excludes, |batch| {
+        if let Err(e) = db.local_upsert_batch(generation, &batch) {
+            warn!(error = %e, "local index: batch write failed");
+        }
+    });
+
+    // Prune what this scan did not see and rebuild the FTS index over the rest,
+    // even if some batches failed — a partial index still beats none.
+    job.detail("Building the search index");
+    match db.local_finish_scan(generation, now_secs()) {
+        Ok(indexed) => info!(
+            walked,
+            indexed,
+            elapsed_ms = started.elapsed().as_millis() as u64,
+            "local index rebuilt"
+        ),
+        Err(e) => warn!(error = %e, "local index: finish failed"),
+    }
+    indexing.store(false, Ordering::Relaxed);
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::cell::Cell;
+
+    fn uid(link: &str) -> NodeUid {
+        NodeUid::new(VolumeId::from("vol"), LinkId::from(link))
+    }
+
+    fn folder(volume: &str, link: &str, parent: Option<NodeUid>, name: &str) -> Node {
+        Node {
+            uid: NodeUid::new(VolumeId::from(volume), LinkId::from(link)),
+            parent_uid: parent,
+            kind: NodeKind::Folder,
+            name: name.to_string(),
+            creation_time: 1,
+            modification_time: 1,
+            trashed: false,
+            is_shared: false,
+            is_shared_publicly: false,
+            signature_email: None,
+            membership: None,
+            photo: None,
+            album: None,
+            verification: Default::default(),
+        }
+    }
+
+    #[test]
+    fn foreign_delete_invalidates_an_earlier_refresh_generation() {
+        let own_volume = VolumeId::from("own");
+        let event = DriveEvent::NodeDeleted {
+            id: DriveEventId::from("foreign-delete"),
+            node_uid: NodeUid::new(VolumeId::from("foreign"), LinkId::from("child")),
+            parent_node_uid: None,
+        };
+        let generation = AtomicU64::new(7);
+        let captured = generation.load(Ordering::SeqCst);
+
+        assert!(event_serializes_shared_publication(&event, &own_volume));
+        generation.fetch_add(1, Ordering::SeqCst);
+
+        assert!(!refresh_generation_is_current(
+            captured,
+            generation.load(Ordering::SeqCst)
+        ));
+        let own_delete = DriveEvent::NodeDeleted {
+            id: DriveEventId::from("own-delete"),
+            node_uid: NodeUid::new(own_volume.clone(), LinkId::from("child")),
+            parent_node_uid: None,
+        };
+        assert!(!event_serializes_shared_publication(
+            &own_delete,
+            &own_volume
+        ));
+    }
+
+    #[test]
+    fn foreign_delete_tombstones_subtree_and_advances_cursor_after_success() {
+        let db = Db::open(std::path::Path::new(":memory:")).unwrap();
+        let root = folder("own", "root", None, "My Files");
+        let deleted = folder(
+            "foreign",
+            "deleted",
+            Some(root.uid.clone()),
+            "Deleted foreign",
+        );
+        let deep = folder(
+            "foreign",
+            "deep",
+            Some(deleted.uid.clone()),
+            "Searchable descendant",
+        );
+        db.upsert_nodes(&[root, deleted.clone(), deep.clone()])
+            .unwrap();
+        db.set_share_access(&deleted.uid, Access::Editor).unwrap();
+        db.enqueue_op(&PendingOp {
+            id: 0,
+            kind: OP_RENAME.to_string(),
+            uid: deep.uid.to_string(),
+            parent_uid: Some(deleted.uid.to_string()),
+            name: Some("pending".to_string()),
+            blob_path: None,
+            meta_json: Some("{}".to_string()),
+            created_at: 1,
+            attempts: 0,
+            last_error: None,
+            next_attempt_at: 0,
+        })
+        .unwrap();
+        let event = DriveEvent::NodeDeleted {
+            id: DriveEventId::from("foreign-delete-success"),
+            node_uid: deleted.uid.clone(),
+            parent_node_uid: deleted.parent_uid.clone(),
+        };
+        let denied = Cell::new(false);
+
+        let applied = apply_foreign_delete(&db, &deleted.uid, |_| denied.set(true));
+        let acknowledged = acknowledge_applied_event(&db, &event, applied).unwrap();
+
+        assert!(denied.get());
+        assert_eq!(acknowledged.as_str(), "foreign-delete-success");
+        assert_eq!(
+            db.get_event_cursor().unwrap().as_deref(),
+            Some("foreign-delete-success")
+        );
+        for uid in [&deleted.uid, &deep.uid] {
+            assert!(db.node_by_uid(&uid.to_string()).unwrap().unwrap().trashed);
+        }
+        assert!(db.search("Searchable", 10).unwrap().is_empty());
+        assert_eq!(db.pending_ops().unwrap().len(), 1);
+        assert_eq!(db.share_access(&deleted.uid).unwrap(), Some(Access::Viewer));
+    }
+
+    #[test]
+    fn foreign_delete_db_failure_denies_memory_and_retains_prior_cursor() {
+        let db = Db::open(std::path::Path::new(":memory:")).unwrap();
+        let root = folder("own", "root", None, "My Files");
+        let deleted = folder(
+            "foreign",
+            "deleted",
+            Some(root.uid.clone()),
+            "Deleted foreign",
+        );
+        let deep = folder(
+            "foreign",
+            "deep",
+            Some(deleted.uid.clone()),
+            "Still searchable",
+        );
+        db.upsert_nodes(&[root, deleted.clone(), deep.clone()])
+            .unwrap();
+        db.set_share_access(&deleted.uid, Access::Editor).unwrap();
+        db.set_event_cursor("prior-event").unwrap();
+        db.with_conn(|conn| {
+            conn.execute_batch(
+                "CREATE TRIGGER reject_foreign_tombstone
+                 BEFORE UPDATE OF trashed ON nodes
+                 WHEN OLD.uid = 'foreign~deleted'
+                 BEGIN SELECT RAISE(ABORT, 'forced tombstone failure'); END;",
+            )?;
+            Ok(())
+        })
+        .unwrap();
+        let event = DriveEvent::NodeDeleted {
+            id: DriveEventId::from("foreign-delete-failed"),
+            node_uid: deleted.uid.clone(),
+            parent_node_uid: deleted.parent_uid.clone(),
+        };
+        let denied = Cell::new(false);
+
+        let applied = apply_foreign_delete(&db, &deleted.uid, |_| denied.set(true));
+
+        assert!(applied.is_err());
+        assert!(
+            denied.get(),
+            "resident state must fail closed on DB failure"
+        );
+        assert!(acknowledge_applied_event(&db, &event, applied).is_err());
+        assert_eq!(
+            db.get_event_cursor().unwrap().as_deref(),
+            Some("prior-event")
+        );
+        assert!(
+            !db.node_by_uid(&deleted.uid.to_string())
+                .unwrap()
+                .unwrap()
+                .trashed
+        );
+        assert_eq!(db.search("searchable", 10).unwrap().len(), 1);
+        assert_eq!(
+            db.share_access(&deleted.uid).unwrap(),
+            Some(Access::Editor),
+            "the failed atomic transaction must not partially publish"
+        );
+    }
+
+    #[test]
+    fn deleted_share_downgrade_failure_denies_memory_and_retains_cursor() {
+        let db = Db::open(std::path::Path::new(":memory:")).unwrap();
+        let root = uid("shared");
+        db.set_share_access(&root, Access::Editor).unwrap();
+        db.with_conn(|conn| {
+            conn.execute_batch(
+                "CREATE TRIGGER reject_share_update
+                 BEFORE UPDATE ON share_access
+                 BEGIN SELECT RAISE(FAIL, 'forced downgrade failure'); END;",
+            )?;
+            Ok(())
+        })
+        .unwrap();
+        let event = DriveEvent::NodeDeleted {
+            id: DriveEventId::from("event-1"),
+            node_uid: root,
+            parent_node_uid: None,
+        };
+        let denied = Cell::new(false);
+
+        let applied = apply_access_downgrade(&db, &event, |root| {
+            denied.set(root.is_some());
+        });
+        assert!(applied.is_err());
+        assert!(denied.get(), "resident state must fail closed immediately");
+        assert!(acknowledge_applied_event(&db, &event, applied).is_err());
+        assert!(
+            db.get_event_cursor().unwrap().is_none(),
+            "failed downgrade must leave the event unacknowledged"
+        );
+    }
+
+    #[test]
+    fn deleted_resident_root_without_share_row_is_denied_and_tombstoned() {
+        let db = Db::open(std::path::Path::new(":memory:")).unwrap();
+        let root = uid("resident-without-row");
+        assert!(db.share_access(&root).unwrap().is_none());
+        let resident = std::cell::RefCell::new(std::collections::HashMap::from([(
+            root.clone(),
+            Access::Editor,
+        )]));
+        let event = DriveEvent::NodeDeleted {
+            id: DriveEventId::from("event-missing-row"),
+            node_uid: root.clone(),
+            parent_node_uid: None,
+        };
+
+        let applied = apply_access_downgrade(&db, &event, |target| {
+            assert_eq!(target, Some(&root));
+            resident.borrow_mut().insert(root.clone(), Access::Viewer);
+        });
+        assert!(applied.is_ok());
+        assert_eq!(resident.borrow().get(&root), Some(&Access::Viewer));
+        assert_eq!(db.share_access(&root).unwrap(), Some(Access::Viewer));
+
+        let acknowledged = acknowledge_applied_event(&db, &event, applied).unwrap();
+        assert_eq!(acknowledged.as_str(), "event-missing-row");
+        assert_eq!(
+            db.get_event_cursor().unwrap().as_deref(),
+            Some("event-missing-row")
+        );
+    }
+
+    #[test]
+    fn continuity_downgrade_failure_denies_memory_and_retains_cursor() {
+        let db = Db::open(std::path::Path::new(":memory:")).unwrap();
+        let root = uid("shared");
+        db.set_share_access(&root, Access::Editor).unwrap();
+        db.with_conn(|conn| {
+            conn.execute_batch(
+                "CREATE TRIGGER reject_all_share_updates
+                 BEFORE UPDATE ON share_access
+                 BEGIN SELECT RAISE(FAIL, 'forced global downgrade failure'); END;",
+            )?;
+            Ok(())
+        })
+        .unwrap();
+        let event = DriveEvent::ContinuityLost {
+            id: DriveEventId::from("event-2"),
+        };
+        let denied_all = Cell::new(false);
+
+        let applied = apply_access_downgrade(&db, &event, |root| {
+            denied_all.set(root.is_none());
+        });
+        assert!(applied.is_err());
+        assert!(
+            denied_all.get(),
+            "all resident shared roots must fail closed immediately"
+        );
+        assert!(acknowledge_applied_event(&db, &event, applied).is_err());
+        assert!(db.get_event_cursor().unwrap().is_none());
+    }
+}
@@ -12,8 +12,8 @@
 use std::io::{BufRead, BufReader, Write as _};
 use std::os::unix::net::{UnixListener, UnixStream};
 use std::path::{Path, PathBuf};
-use std::sync::atomic::Ordering;
-use std::time::Instant;
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::time::{Duration, Instant};

 use pdfs_core::config::AppDirs;
 use pdfs_core::control::{
@@ -27,6 +27,67 @@ use tracing::{info, warn};
 use super::transfers::CountingReader;
 use super::{Core, count_noun, human_bytes, human_duration, parse_uid};

+const MAX_CONTROL_REQUEST_BYTES: u64 = 1024 * 1024;
+const CONTROL_READ_TIMEOUT: Duration = Duration::from_secs(10);
+const MAX_CONTROL_HANDLERS: usize = 64;
+static ACTIVE_CONTROL_HANDLERS: AtomicUsize = AtomicUsize::new(0);
+
+struct ControlHandlerPermit;
+
+impl ControlHandlerPermit {
+    fn acquire() -> Option<Self> {
+        ACTIVE_CONTROL_HANDLERS
+            .fetch_update(Ordering::AcqRel, Ordering::Acquire, |active| {
+                (active < MAX_CONTROL_HANDLERS).then_some(active + 1)
+            })
+            .ok()
+            .map(|_| Self)
+    }
+}
+
+impl Drop for ControlHandlerPermit {
+    fn drop(&mut self) {
+        ACTIVE_CONTROL_HANDLERS.fetch_sub(1, Ordering::AcqRel);
+    }
+}
+
+fn read_request_line(reader: &mut impl BufRead) -> std::io::Result<Option<String>> {
+    let mut bytes = Vec::new();
+    loop {
+        let available = reader.fill_buf()?;
+        if available.is_empty() {
+            break;
+        }
+        let take = available
+            .iter()
+            .position(|byte| *byte == b'\n')
+            .map_or(available.len(), |index| index + 1);
+        if bytes.len().saturating_add(take) > MAX_CONTROL_REQUEST_BYTES as usize {
+            return Err(std::io::Error::new(
+                std::io::ErrorKind::InvalidData,
+                "control request exceeds size limit",
+            ));
+        }
+        bytes.extend_from_slice(&available[..take]);
+        reader.consume(take);
+        if bytes.ends_with(b"\n") {
+            break;
+        }
+    }
+    if bytes.is_empty() {
+        return Ok(None);
+    }
+    if bytes.len() as u64 > MAX_CONTROL_REQUEST_BYTES || !bytes.ends_with(b"\n") {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidData,
+            "control request exceeds limit or is not newline terminated",
+        ));
+    }
+    String::from_utf8(bytes)
+        .map(Some)
+        .map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, e))
+}
+
 /// Turn a CLI-supplied path into a mountpoint-relative path. An absolute path
 /// must live under `mountpoint`; a relative path is taken as already relative to
 /// the mount root.
@@ -44,6 +105,10 @@ fn rel_to_mount(mountpoint: &Path, path: &str) -> CoreResult<PathBuf> {
 /// Handle one control-socket connection: read a single JSON request line,
 /// dispatch it against `core`, and write back a JSON response line.
 fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: UnixStream) {
+    if let Err(e) = stream.set_read_timeout(Some(CONTROL_READ_TIMEOUT)) {
+        warn!(error = %e, "control: could not set request timeout");
+        return;
+    }
    let mut reader = BufReader::new(match stream.try_clone() {
        Ok(s) => s,
        Err(e) => {
@@ -51,10 +116,14 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
            return;
        }
    });
-    let mut line = String::new();
-    if reader.read_line(&mut line).is_err() || line.trim().is_empty() {
-        return;
-    }
+    let line = match read_request_line(&mut reader) {
+        Ok(Some(line)) if !line.trim().is_empty() => line,
+        Ok(_) => return,
+        Err(e) => {
+            warn!(error = %e, "control: rejected request");
+            return;
+        }
+    };
    let response = match serde_json::from_str::<CtlRequest>(line.trim()) {
        Ok(CtlRequest::Status) => {
            let pins = core.cache.list_pins();
@@ -116,6 +185,9 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
                }
                RefreshScope::Photos => {
                    core.invalidate_photos();
+                    // Whatever changed the timeline can just as easily have
+                    // changed an album; one scope covers the whole photos view.
+                    core.invalidate_albums();
                    Ok(())
                }
            };
@@ -144,6 +216,31 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
            },
            Err(e) => CtlResponse::error(e),
        },
+        Ok(CtlRequest::PhotoAlbums) => match core.albums() {
+            Ok(Some(items)) => CtlResponse::Albums {
+                available: true,
+                items,
+            },
+            Ok(None) => CtlResponse::Albums {
+                available: false,
+                items: Vec::new(),
+            },
+            Err(e) => CtlResponse::error(e),
+        },
+        Ok(CtlRequest::AlbumPhotos { uid, offset, limit }) => match parse_uid(&uid) {
+            // An album page is a timeline page as far as the front-end is
+            // concerned, so it comes back in the same reply — with `counts`
+            // unset, which describe the whole timeline rather than this album.
+            Some(album) => match core.album_photos(&album, offset, limit) {
+                Ok(items) => CtlResponse::Photos {
+                    available: true,
+                    items,
+                    counts: None,
+                },
+                Err(e) => CtlResponse::error(e),
+            },
+            None => CtlResponse::error(CoreError::invalid(format!("bad album uid: {uid}"))),
+        },
        Ok(CtlRequest::PhotoMonths { kind }) => match core.db.photos_months(kind) {
            Ok(months) => CtlResponse::PhotoMonths {
                months: months
@@ -241,6 +338,18 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
            },
            Err(e) => CtlResponse::error(e),
        },
+        Ok(CtlRequest::SearchV2 {
+            query,
+            limit,
+            filters,
+        }) => match core.search_v2(&query, limit, &filters) {
+            Ok((drive_hits, local_hits)) => CtlResponse::SearchResultsV2 {
+                drive_hits,
+                local_hits,
+                local_indexing: core.indexing.load(Ordering::Relaxed),
+            },
+            Err(e) => CtlResponse::error(e),
+        },
        Ok(CtlRequest::Rename { path, new_name }) => match rel_to_mount(mountpoint, &path) {
            Ok(rel) => match core.rename(&rel, &new_name) {
                Ok(name) => {
@@ -480,6 +589,10 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
            Ok(items) => CtlResponse::Devices { items },
            Err(e) => CtlResponse::error(e),
        },
+        Ok(CtlRequest::ListLocations) => match core.list_locations() {
+            Ok(items) => CtlResponse::Locations { items },
+            Err(e) => CtlResponse::error(e),
+        },
        Ok(CtlRequest::RenameDevice { uid, name }) => match core.rename_device(&uid, &name) {
            Ok(()) => CtlResponse::Ok {
                message: format!("renamed device to {name}"),
@@ -611,6 +724,28 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
            },
            Err(e) => CtlResponse::error(e),
        },
+        Ok(CtlRequest::ShareNodeByUid {
+            uid,
+            emails,
+            role,
+            message,
+        }) => match core.share_node_by_uid(&uid, &emails, &role, message.as_deref()) {
+            Ok((proton, external)) => {
+                core.log_activity(
+                    ActivityKind::Share,
+                    &uid,
+                    format!("{} recipient(s) as {role}", proton + external),
+                    true,
+                );
+                CtlResponse::Ok {
+                    message: format!("invited {proton} Proton and {external} external user(s)"),
+                }
+            }
+            Err(e) => {
+                core.log_activity(ActivityKind::Share, &uid, &e, false);
+                CtlResponse::error(e)
+            }
+        },
        Ok(CtlRequest::ListShare { path }) => match rel_to_mount(mountpoint, &path) {
            Ok(rel) => match core.list_share(&rel) {
                Ok((entries, link)) => CtlResponse::Share { entries, link },
@@ -618,6 +753,10 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
            },
            Err(e) => CtlResponse::error(e),
        },
+        Ok(CtlRequest::ListShareByUid { uid }) => match core.list_share_by_uid(&uid) {
+            Ok((entries, link)) => CtlResponse::Share { entries, link },
+            Err(e) => CtlResponse::error(e),
+        },
        Ok(CtlRequest::UpdateShareRole {
            path,
            id,
@@ -632,6 +771,17 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
            },
            Err(e) => CtlResponse::error(e),
        },
+        Ok(CtlRequest::UpdateShareRoleByUid {
+            uid,
+            id,
+            kind,
+            role,
+        }) => match core.update_share_role_by_uid(&uid, &id, kind, &role) {
+            Ok(()) => CtlResponse::Ok {
+                message: format!("role updated to {role}"),
+            },
+            Err(e) => CtlResponse::error(e),
+        },
        Ok(CtlRequest::RemoveShareEntry { path, id, kind }) => {
            match rel_to_mount(mountpoint, &path) {
                Ok(rel) => match core.remove_share_entry(&rel, &id, kind) {
@@ -646,6 +796,17 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
                Err(e) => CtlResponse::error(e),
            }
        }
+        Ok(CtlRequest::RemoveShareEntryByUid { uid, id, kind }) => {
+            match core.remove_share_entry_by_uid(&uid, &id, kind) {
+                Ok(()) => {
+                    core.log_activity(ActivityKind::Unshare, &uid, "access removed", true);
+                    CtlResponse::Ok {
+                        message: "removed".to_string(),
+                    }
+                }
+                Err(e) => CtlResponse::error(e),
+            }
+        }
        Ok(CtlRequest::CreatePublicLink {
            path,
            role,
@@ -664,6 +825,21 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
            },
            Err(e) => CtlResponse::error(e),
        },
+        Ok(CtlRequest::CreatePublicLinkByUid {
+            uid,
+            role,
+            password,
+            expires,
+        }) => match core.create_public_link_by_uid(&uid, &role, password.as_deref(), expires) {
+            Ok(link) => {
+                core.log_activity(ActivityKind::PublicLink, &uid, "link created", true);
+                CtlResponse::PublicLink { link }
+            }
+            Err(e) => {
+                core.log_activity(ActivityKind::PublicLink, &uid, &e, false);
+                CtlResponse::error(e)
+            }
+        },
        Ok(CtlRequest::RemovePublicLink { path, id }) => match rel_to_mount(mountpoint, &path) {
            Ok(rel) => match core.remove_public_link(&rel, &id) {
                Ok(()) => {
@@ -676,6 +852,17 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
            },
            Err(e) => CtlResponse::error(e),
        },
+        Ok(CtlRequest::RemovePublicLinkByUid { uid, id }) => {
+            match core.remove_public_link_by_uid(&uid, &id) {
+                Ok(()) => {
+                    core.log_activity(ActivityKind::Unshare, &uid, "link removed", true);
+                    CtlResponse::Ok {
+                        message: "public link removed".to_string(),
+                    }
+                }
+                Err(e) => CtlResponse::error(e),
+            }
+        }
        Ok(CtlRequest::ListSharedWithMe) => match core.list_shared_with_me() {
            Ok(entries) => CtlResponse::Entries { entries },
            Err(e) => CtlResponse::error(e),
@@ -780,12 +967,22 @@ pub(crate) fn run_control_socket(
    for conn in listener.incoming() {
        match conn {
            Ok(stream) => {
+                let Some(permit) = ControlHandlerPermit::acquire() else {
+                    warn!(
+                        limit = MAX_CONTROL_HANDLERS,
+                        "control: rejecting connection at handler limit"
+                    );
+                    continue;
+                };
                let core = core.clone();
                let username = username.clone();
                let mountpoint = mountpoint.clone();
                if let Err(e) = std::thread::Builder::new()
                    .name("pdfs-control".into())
-                    .spawn(move || handle_control_conn(&core, &username, &mountpoint, stream))
+                    .spawn(move || {
+                        let _permit = permit;
+                        handle_control_conn(&core, &username, &mountpoint, stream);
+                    })
                {
                    warn!(error = %e, "control: spawn handler failed");
                }
@@ -796,3 +993,38 @@ pub(crate) fn run_control_socket(
        }
    }
 }
+
+#[cfg(test)]
+mod request_limit_tests {
+    use super::*;
+    use std::io::Cursor;
+
+    #[test]
+    fn accepts_one_bounded_newline_terminated_request() {
+        let mut input = Cursor::new(b"{\"Status\":null}\n".to_vec());
+        assert_eq!(
+            read_request_line(&mut input).unwrap().as_deref(),
+            Some("{\"Status\":null}\n")
+        );
+    }
+
+    #[test]
+    fn rejects_a_request_without_a_terminating_newline() {
+        let mut input = Cursor::new(b"{\"Status\":null}".to_vec());
+        assert_eq!(
+            read_request_line(&mut input).unwrap_err().kind(),
+            std::io::ErrorKind::InvalidData
+        );
+    }
+
+    #[test]
+    fn rejects_a_request_larger_than_the_limit() {
+        let mut bytes = vec![b'x'; MAX_CONTROL_REQUEST_BYTES as usize + 1];
+        bytes.push(b'\n');
+        let mut input = Cursor::new(bytes);
+        assert_eq!(
+            read_request_line(&mut input).unwrap_err().kind(),
+            std::io::ErrorKind::InvalidData
+        );
+    }
+}
@@ -11,12 +11,13 @@ use std::collections::HashMap;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;

-use fuser::{Config, MountOption, Session};
 use parking_lot::Mutex;
 use pdfs_core::control::{
-    ActivityKind, DeviceInfo, JobItem, SyncFolderInfo, SyncPhase, SyncProgress,
+    ActivityKind, DeviceInfo, JobItem, MountKind, MountSpec, SyncFolderInfo, SyncPhase,
+    SyncProgress,
 };
 use pdfs_core::db::{StoredDevice, StoredSyncFolder};
+use pdfs_core::mounts::MountMode;
 use pdfs_core::{CoreError, CoreResult};
 use proton_drive_rs::proton_sdk::ids::{DeviceUid, NodeUid};
 use proton_drive_rs::{DeviceType, Node};
@@ -25,11 +26,69 @@ use tracing::{info, warn};

 use super::sync::{self, base_name};
 use super::{
-    BackgroundSession, Core, ProtonFs, State, SwitchBlocked, clear_stale_mount, device_type_str,
-    dir_is_empty, evict_dir_contents, fuse_connection_id, is_stale_mount, now_secs, parse_uid,
-    sync_folder_info, this_hostname, umount_session_unblocked,
+    Core, SecondaryInsertRejection, SecondaryMount, State, SwitchBlocked, clear_stale_mount,
+    device_type_str, dir_is_empty, evict_dir_contents, fuse_connection_id, is_stale_mount,
+    now_secs, parse_uid, spawn_session, sync_folder_info, this_hostname,
 };

+/// A mode that this daemon is allowed to apply.
+///
+/// Persisted and control-protocol values first pass through [`MountMode`] so
+/// forward-compatible unknown values never reach either destructive transition.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum ApplicableMountMode {
+    Mirror,
+    OnDemand,
+}
+
+impl ApplicableMountMode {
+    fn parse(value: &str) -> Result<Self, String> {
+        match MountMode::from(value) {
+            MountMode::Mirror => Ok(Self::Mirror),
+            MountMode::OnDemand => Ok(Self::OnDemand),
+            MountMode::Unknown => Err(format!("unknown mode {value:?} (want mirror|ondemand)")),
+        }
+    }
+
+    const fn as_str(self) -> &'static str {
+        match self {
+            Self::Mirror => "mirror",
+            Self::OnDemand => "ondemand",
+        }
+    }
+}
+
+fn select_mode_transition(
+    current: &str,
+    target: &str,
+) -> Result<Option<ApplicableMountMode>, String> {
+    let current = ApplicableMountMode::parse(current)
+        .map_err(|error| format!("unsupported current mode: {error}"))?;
+    let target = ApplicableMountMode::parse(target)
+        .map_err(|error| format!("unsupported target mode: {error}"))?;
+    Ok((current != target).then_some(target))
+}
+
+fn restore_snapshot_matches(snapshot: &StoredSyncFolder, current: &StoredSyncFolder) -> bool {
+    current.id == snapshot.id
+        && current.local_path == snapshot.local_path
+        && current.remote_uid == snapshot.remote_uid
+        && current.remote_share_id == snapshot.remote_share_id
+        && current.mode == "ondemand"
+}
+
+fn pending_intent_matches(pending: Option<&str>, expected: Option<&str>) -> bool {
+    expected.is_none_or(|expected| pending == Some(expected))
+}
+
+fn commit_after_teardown<T, E>(
+    teardown: Result<(), E>,
+    commit: impl FnOnce() -> T,
+) -> Result<T, E> {
+    teardown?;
+    Ok(commit())
+}
+
 /// The device uid this machine has been adopted into, from `config.json`.
 ///
 /// Read fresh each time rather than cached on [`Core`]: adoption rewrites the
@@ -57,6 +116,22 @@ pub(crate) fn set_adopted_device_uid(uid: Option<&str>) -> CoreResult<()> {
 impl Core {
    // ---- devices ----------------------------------------------------------

+    /// Unified local-location listing for the control protocol.
+    pub(crate) fn list_locations(&self) -> CoreResult<Vec<MountSpec>> {
+        let progress = self.sync_progress.lock();
+        let mut locations = self
+            .db
+            .mount_list()
+            .map_err(|e| CoreError::internal(format!("db: {e:?}")))?;
+        for location in &mut locations {
+            location.mounted = self.states.is_mounted_at(Path::new(&location.local_path));
+            if let MountKind::Device { sync_folder_id } = &location.kind {
+                location.progress = progress.get(sync_folder_id).cloned();
+            }
+        }
+        Ok(locations)
+    }
+
    /// List the account's registered devices, flagging the one *this* machine
    /// syncs to so a front-end can treat it as more than another computer in the
    /// list — deleting it takes this machine's synced folders down with it.
@@ -308,6 +383,15 @@ impl Core {
            })?
            .to_string();

+        // Syncing a local `.proton-drive-linux` would land on the folder holding
+        // this device's own profile (`find_device_child_folder` reuses by name),
+        // and the sync engine would then delete or overwrite it.
+        if name == pdfs_core::profile::PROFILE_DIR_NAME {
+            return Err(CoreError::invalid(format!(
+                "{name} is reserved for this device's profile backup"
+            )));
+        }
+
        let device = self.ensure_device()?;
        let root_uid = parse_uid(&device.root_uid).ok_or_else(|| {
            CoreError::internal(format!("bad device root uid: {}", device.root_uid))
@@ -439,6 +523,8 @@ impl Core {
    /// Remove a synced folder from the sync set. `delete_remote` also deletes its
    /// folder under the device root; otherwise the cloud copy is left in place.
    pub(crate) fn remove_sync_folder(&self, id: i64, delete_remote: bool) -> CoreResult<()> {
+        let lock = self.sync_lock(id);
+        let _guard = lock.lock();
        let folder = self
            .db
            .sync_folder_get(id)
@@ -449,19 +535,16 @@ impl Core {
        // folder the daemon no longer tracks, and nothing would ever unmount it.
        // Tear it down first — including before trashing the remote tree it
        // serves, which would otherwise leave it answering for deleted nodes.
-        if let Some((session, conn)) = self.mounts.lock().remove(&id) {
-            if let Err(e) = umount_session_unblocked(session, conn) {
-                warn!(id, error = %e, "unmount on-demand folder failed");
-            } else {
-                info!(id, path = %folder.local_path, "unmounted on-demand folder");
-            }
-        }
-        if delete_remote
-            && let Some(uid) = parse_uid(&folder.remote_uid)
-            && let Err(e) = self.rt.block_on(self.client.trash_nodes(&[uid]))
+        if let Some(mount) = self.mounts.lock().remove(&id)
+            && let Err(error) = commit_after_teardown(mount.teardown(), || ())
        {
-            warn!(id, error = %e, "delete remote device folder failed");
+            let _ = self.db.sync_folder_set_state(id, "error", now_secs());
+            return Err(CoreError::internal(format!(
+                "cannot remove synced folder: unmount {} failed: {error}",
+                folder.local_path
+            )));
        }
+        info!(id, path = %folder.local_path, "unmounted on-demand folder");
        if !self
            .db
            .sync_folder_remove(id)
@@ -469,8 +552,15 @@ impl Core {
        {
            return Err(CoreError::invalid(format!("no synced folder with id {id}")));
        }
+        drop(_guard);
        // Stop watching the folder we just dropped.
        let _ = self.sync_tx.send(sync::SyncMsg::Rewatch);
+        if delete_remote
+            && let Some(uid) = parse_uid(&folder.remote_uid)
+            && let Err(e) = self.rt.block_on(self.client.trash_nodes(&[uid]))
+        {
+            warn!(id, error = %e, "delete remote device folder failed");
+        }
        Ok(())
    }

@@ -489,19 +579,25 @@ impl Core {
    /// (devices.md Phase 3).
    pub(crate) fn fork_state(&self) -> Core {
        let mut fork = self.clone();
+        fork.primary = false;
+        let share_access = self.state.lock().share_access.clone();
        fork.state = Arc::new(Mutex::new(State {
            entries: HashMap::new(),
            by_uid: HashMap::new(),
            children: HashMap::new(),
            next_ino: 2,
+            active_writes: HashMap::new(),
            handles: HashMap::new(),
            next_fh: 1,
+            access_changes: std::collections::HashSet::new(),
+            share_access,
            db: self.db.clone(),
        }));
        // A fresh inode space needs a fresh notification channel: this fork's
        // session is the only one that knows these inodes, so it must be the one
        // notified about them. Filled in by `spawn_ondemand_mount`.
        fork.notifier = Arc::new(OnceLock::new());
+        fork.session_live = Arc::new(std::sync::atomic::AtomicBool::new(false));
        // Size upgrades are keyed by inode, which is per-fork too.
        fork.size_upgrades = Arc::new(Mutex::new(HashMap::new()));
        fork
@@ -519,49 +615,84 @@ impl Core {
    /// running — which, seeing a queued `ondemand`, also stops pulling down files
    /// it is about to evict ([`Core::push_pass`]).
    pub(crate) fn request_sync_folder_mode(&self, id: i64, mode: &str) -> CoreResult<String> {
-        if mode != "mirror" && mode != "ondemand" {
-            return Err(CoreError::invalid(format!(
-                "unknown mode {mode:?} (want mirror|ondemand)"
-            )));
-        }
+        // Preserve the existing control behavior: reject an unsupported request
+        // before looking up the folder, then validate the persisted source too.
+        let target_mode = ApplicableMountMode::parse(mode).map_err(CoreError::invalid)?;
        let folder = self
            .db
            .sync_folder_get(id)
            .map_err(|e| CoreError::internal(format!("db: {e:?}")))?
            .ok_or_else(|| CoreError::not_found(format!("no synced folder with id {id}")))?;
-        if folder.mode == mode {
-            // Already there. A queued switch the other way is the user changing
-            // their mind back before it landed, so withdraw it.
-            if folder.pending_mode.is_some() {
-                self.db
-                    .sync_folder_set_pending_mode(id, None)
-                    .map_err(|e| CoreError::internal(format!("db: {e:?}")))?;
-                let _ = self.sync_tx.send(sync::SyncMsg::Rewatch);
-                return Ok(format!("staying {mode}"));
+        let current_mode = ApplicableMountMode::parse(&folder.mode)
+            .map_err(|error| CoreError::invalid(format!("unsupported current mode: {error}")))?;
+        if current_mode == target_mode {
+            let mode_str = target_mode.as_str();
+            let lock = self.sync_lock(id);
+            match lock.try_lock() {
+                Some(_guard) => {
+                    let current = self
+                        .db
+                        .sync_folder_get(id)
+                        .map_err(|e| CoreError::internal(format!("db: {e:?}")))?
+                        .ok_or_else(|| {
+                            CoreError::not_found(format!("no synced folder with id {id}"))
+                        })?;
+                    let locked_mode =
+                        ApplicableMountMode::parse(&current.mode).map_err(|error| {
+                            CoreError::invalid(format!("unsupported current mode: {error}"))
+                        })?;
+                    if locked_mode == target_mode {
+                        self.db
+                            .sync_folder_set_pending_mode(id, None)
+                            .map_err(|e| CoreError::internal(format!("db: {e:?}")))?;
+                        let _ = self.sync_tx.send(sync::SyncMsg::Rewatch);
+                        return Ok(if current.pending_mode.is_some() {
+                            format!("staying {mode_str}")
+                        } else {
+                            format!("already {mode_str}")
+                        });
+                    }
+                }
+                None => {
+                    // A transition or reconcile owns the folder lock. Record
+                    // this request instead of clearing the old target: if a
+                    // queued switch already passed its recheck, its mode write
+                    // preserves this opposite marker and the engine switches
+                    // back next.
+                    self.db
+                        .sync_folder_set_pending_mode(id, Some(mode_str))
+                        .map_err(|e| CoreError::internal(format!("db: {e:?}")))?;
+                    let _ = self.sync_tx.send(sync::SyncMsg::Reconcile(id));
+                    return Ok(format!("staying {mode_str}"));
+                }
            }
-            return Ok(format!("already {mode}"));
        }
+        let mode = target_mode;
+        let mode_str = target_mode.as_str();

-        match self.apply_sync_folder_mode(id, mode) {
+        match self.apply_sync_folder_mode(id, mode, None) {
            Ok(message) => Ok(message),
            // Not switchable this instant — remember the intent instead of making
            // the user retry, and kick a pass to clear whatever is in the way.
            Err(SwitchBlocked::NotNow) => {
                self.db
-                    .sync_folder_set_pending_mode(id, Some(mode))
+                    .sync_folder_set_pending_mode(id, Some(mode_str))
                    .map_err(|e| CoreError::internal(format!("db: {e:?}")))?;
                let _ = self.sync_tx.send(sync::SyncMsg::Reconcile(id));
                Ok(match mode {
-                    "ondemand" => format!(
+                    ApplicableMountMode::OnDemand => format!(
                        "{} will go on-demand once its local changes are uploaded",
                        base_name(&folder.local_path)
                    ),
-                    _ => format!(
+                    ApplicableMountMode::Mirror => format!(
                        "{} will start mirroring once the current sync finishes",
                        base_name(&folder.local_path)
                    ),
                })
            }
+            Err(SwitchBlocked::Superseded) => Err(CoreError::internal(
+                "direct mode request was unexpectedly superseded",
+            )),
            Err(SwitchBlocked::Failed(e)) => Err(CoreError::internal(e)),
        }
    }
@@ -575,27 +706,45 @@ impl Core {
        let Ok(Some(folder)) = self.db.sync_folder_get(id) else {
            return;
        };
-        let Some(mode) = folder.pending_mode.as_deref() else {
+        let Some(expected_mode) = folder.pending_mode.as_deref() else {
            return;
        };
-        if folder.mode == mode {
-            let _ = self.db.sync_folder_set_pending_mode(id, None);
-            return;
-        }
-        match self.apply_sync_folder_mode(id, mode) {
+        let mode = match select_mode_transition(&folder.mode, expected_mode) {
+            Ok(Some(mode)) => mode,
+            Ok(None) => {
+                let _ = self.db.sync_folder_clear_pending_mode_if(id, expected_mode);
+                return;
+            }
+            Err(error) => {
+                warn!(
+                    id,
+                    current_mode = %folder.mode,
+                    pending_mode = %expected_mode,
+                    %error,
+                    "withdrawing unsafe queued mode transition"
+                );
+                let _ = self.db.sync_folder_clear_pending_mode_if(id, expected_mode);
+                return;
+            }
+        };
+        let mode_str = mode.as_str();
+        match self.apply_sync_folder_mode(id, mode, Some(expected_mode)) {
            Ok(message) => {
-                info!(id, mode, "applied queued mode switch");
+                info!(id, mode = mode_str, "applied queued mode switch");
                self.log_activity(ActivityKind::Sync, &message, "", true);
            }
            // Still blocked: the pass could not get everything up, so the local copy
            // is not safe to evict yet. Leave the request standing — the next pass
            // (poll, or the retry the engine schedules) tries again.
            Err(SwitchBlocked::NotNow) => {
-                info!(id, mode, "queued mode switch still waiting");
+                info!(id, mode = mode_str, "queued mode switch still waiting");
+            }
+            Err(SwitchBlocked::Superseded) => {
+                info!(id, mode = mode_str, "queued mode switch was replaced");
            }
            Err(SwitchBlocked::Failed(e)) => {
-                warn!(id, mode, error = %e, "queued mode switch failed; withdrawing");
-                let _ = self.db.sync_folder_set_pending_mode(id, None);
+                warn!(id, mode = mode_str, error = %e, "queued mode switch failed; withdrawing");
+                let _ = self.db.sync_folder_clear_pending_mode_if(id, expected_mode);
                self.log_activity(
                    ActivityKind::Sync,
                    format!("couldn't switch {}", base_name(&folder.local_path)),
@@ -621,8 +770,10 @@ impl Core {
    pub(crate) fn apply_sync_folder_mode(
        &self,
        id: i64,
-        mode: &str,
+        mode: ApplicableMountMode,
+        expected_pending: Option<&str>,
    ) -> Result<String, SwitchBlocked> {
+        let mode_str = mode.as_str();
        // Hold the folder's lock for the whole switch so no reconcile pass can be
        // running over the tree we are about to evict (or start while we mount over
        // it). A pass in flight holds the lock for its full duration, so `try_lock`
@@ -640,13 +791,18 @@ impl Core {
            .sync_folder_get(id)
            .map_err(|e| SwitchBlocked::Failed(format!("db: {e:?}")))?
            .ok_or_else(|| SwitchBlocked::Failed(format!("no synced folder with id {id}")))?;
-        if folder.mode == mode {
-            return Ok(format!("already {mode}"));
+        if !pending_intent_matches(folder.pending_mode.as_deref(), expected_pending) {
+            return Err(SwitchBlocked::Superseded);
+        }
+        let current_mode = ApplicableMountMode::parse(&folder.mode)
+            .map_err(|e| SwitchBlocked::Failed(format!("unsupported current mode: {e}")))?;
+        if current_mode == mode {
+            return Ok(format!("already {mode_str}"));
        }
        let local = PathBuf::from(&folder.local_path);

        match mode {
-            "ondemand" => {
+            ApplicableMountMode::OnDemand => {
                // Only flip a folder that is fully in sync — a failed reconcile means
                // local edits could still be un-uploaded, and we are about to delete
                // the local copy. Not an error: a pass makes this true, and the queued
@@ -682,40 +838,39 @@ impl Core {
                // fails, since eviction may already have deleted part of the tree.
                // Recovery is the user's explicit switch back to `mirror`, whose arm
                // clears the baseline and re-downloads.
-                self.db
-                    .sync_folder_set_mode(id, "ondemand")
-                    .map_err(|e| SwitchBlocked::Failed(format!("db: {e:?}")))?;
-
-                // Reclaim the disk: empty the local dir (keep it as the mountpoint).
-                if let Err(e) = evict_dir_contents(&local) {
-                    let _ = self.db.sync_folder_set_state(id, "error", now_secs());
-                    return Err(SwitchBlocked::Failed(format!(
-                        "evict {}: {e}",
-                        local.display()
-                    )));
+                if let Err(e) = self.db.sync_folder_set_mode(id, "ondemand") {
+                    return Err(SwitchBlocked::Failed(format!("db: {e:?}")));
                }

-                let session = match self.spawn_ondemand_mount(&local, root) {
-                    Ok(session) => session,
-                    Err(e) => {
-                        let _ = self.db.sync_folder_set_state(id, "error", now_secs());
-                        return Err(SwitchBlocked::Failed(e.to_string()));
-                    }
-                };
-                self.mounts
-                    .lock()
-                    .insert(id, (session, fuse_connection_id(&local)));
+                // Reclaim the disk before mounting. Once FUSE covers `local`, a
+                // directory walk addresses the remote namespace, so evicting at
+                // that point sends unlink/rmdir requests to Drive and leaves the
+                // underlying mirror hidden and untouched.
+                if let Err(e) = evict_dir_contents(&local) {
+                    warn!(id, path = %local.display(), error = %e, "evict local dir contents failed");
+                }
+                let mount = self.spawn_ondemand_mount(&local, root).map_err(|e| {
+                    SwitchBlocked::Failed(format!(
+                        "mount ondemand failed after local cache eviction; switch back to mirror to restore it: {e}"
+                    ))
+                })?;
+                self.publish_secondary_mount(id, mount)
+                    .map_err(SwitchBlocked::Failed)?;
                let _ = self.sync_tx.send(sync::SyncMsg::Rewatch);
                self.db.sync_folder_set_state(id, "idle", now_secs()).ok();
                info!(id, path = %local.display(), "mounted sync folder on-demand");
                Ok(format!("{} is now on-demand", local.display()))
            }
-            _ => {
+            ApplicableMountMode::Mirror => {
                // ondemand→mirror: tear down the secondary mount first.
-                if let Some((session, conn)) = self.mounts.lock().remove(&id)
-                    && let Err(e) = umount_session_unblocked(session, conn)
+                if let Some(mount) = self.mounts.lock().remove(&id)
+                    && let Err(error) = commit_after_teardown(mount.teardown(), || ())
                {
-                    warn!(id, error = %e, "unmount on-demand folder failed");
+                    let _ = self.db.sync_folder_set_state(id, "error", now_secs());
+                    return Err(SwitchBlocked::Failed(format!(
+                        "unmount {} failed; folder remains on-demand: {error}",
+                        local.display()
+                    )));
                }
                // The evicted local tree makes the old baseline lie ("everything
                // deleted locally"); clear it so the reconcile is a pure download.
@@ -743,23 +898,52 @@ impl Core {
        &self,
        local: &Path,
        root: Node,
-    ) -> CoreResult<BackgroundSession> {
-        clear_stale_mount(local);
-        let mut config = Config::default();
-        config.mount_options = vec![
-            MountOption::FSName("protondrive".to_string()),
-            MountOption::Subtype("protondrive".to_string()),
-            MountOption::DefaultPermissions,
-        ];
+    ) -> CoreResult<SecondaryMount> {
        let core = self.fork_state();
-        let fs = ProtonFs::new(core.clone(), root);
-        let session = Session::new(fs, local, &config)
-            .and_then(|s| s.spawn())
+        let session_live = core.session_live.clone();
+        // The fork owns this state/path registration. `spawn_session` only
+        // marks it live after FUSE has spawned successfully.
+        core.register_state(local);
+        let session = spawn_session(&core, local, root)
            .map_err(|e| CoreError::internal(format!("mount {}: {e}", local.display())))?;
-        // Hand this fork its own session's notification channel, so a background
-        // size upgrade can drop the kernel's cached attrs for these inodes.
-        let _ = core.notifier.set(session.notifier());
-        Ok(session)
+        Ok(SecondaryMount::new(
+            session,
+            fuse_connection_id(local),
+            session_live,
+        ))
+    }
+
+    /// Publish one newly spawned secondary or explicitly tear it down when
+    /// shutdown has closed publication or another session already owns the id.
+    fn publish_secondary_mount(&self, id: i64, mount: SecondaryMount) -> Result<(), String> {
+        let rejected = self.mounts.lock().insert(id, mount);
+        let Err((reason, mount)) = rejected else {
+            return Ok(());
+        };
+        let reason = match reason {
+            SecondaryInsertRejection::Closed => "daemon is shutting down",
+            SecondaryInsertRejection::Duplicate => "folder already has a live mount",
+        };
+        match mount.teardown() {
+            Ok(()) => Err(reason.to_string()),
+            Err(error) => Err(format!("{reason}; rejected mount teardown failed: {error}")),
+        }
+    }
+
+    fn mark_restore_error_if_current(&self, snapshot: &StoredSyncFolder) {
+        let lock = self.sync_lock(snapshot.id);
+        let _guard = lock.lock();
+        if self
+            .db
+            .sync_folder_get(snapshot.id)
+            .ok()
+            .flatten()
+            .is_some_and(|current| restore_snapshot_matches(snapshot, &current))
+        {
+            let _ = self
+                .db
+                .sync_folder_set_state(snapshot.id, "error", now_secs());
+        }
    }

    /// Re-establish FUSE mounts for folders left in `ondemand` mode across a daemon
@@ -780,14 +964,57 @@ impl Core {
            if folder.mode != "ondemand" {
                continue;
            }
-            let local = PathBuf::from(&folder.local_path);
-            // A daemon killed before it could unmount (systemd's stop timeout,
-            // say) leaves this path attached to a dead FUSE connection: it still
-            // exists, but every stat on it fails with ENOTCONN — so `is_dir()`
-            // reads it as *missing* and the folder gets parked in `error` on
-            // every subsequent start, with no way back but a manual
-            // `fusermount -u`. Detach the corpse first; the directory
-            // underneath then restores normally.
+            let Some(root_uid) = parse_uid(&folder.remote_uid) else {
+                warn!(id = folder.id, "restore on-demand: bad remote uid");
+                self.mark_restore_error_if_current(&folder);
+                continue;
+            };
+            let root = match self
+                .rt
+                .block_on(self.client.enumerate_nodes(std::slice::from_ref(&root_uid)))
+            {
+                Ok(v) => match v.into_iter().next() {
+                    Some(n) => n,
+                    None => {
+                        warn!(id = folder.id, "restore on-demand: remote folder gone");
+                        self.mark_restore_error_if_current(&folder);
+                        continue;
+                    }
+                },
+                Err(e) => {
+                    warn!(id = folder.id, error = %e, "restore on-demand: fetch remote failed");
+                    self.mark_restore_error_if_current(&folder);
+                    continue;
+                }
+            };
+            let lock = self.sync_lock(folder.id);
+            let _guard = lock.lock();
+            let current = match self.db.sync_folder_get(folder.id) {
+                Ok(Some(current)) if restore_snapshot_matches(&folder, &current) => current,
+                Ok(_) => {
+                    info!(
+                        id = folder.id,
+                        "restore on-demand: folder changed while fetching"
+                    );
+                    continue;
+                }
+                Err(error) => {
+                    warn!(
+                        id = folder.id,
+                        ?error,
+                        "restore on-demand: cannot re-read folder"
+                    );
+                    continue;
+                }
+            };
+            if !self.mounts.lock().is_accepting() {
+                info!(id = folder.id, "restore on-demand: shutdown in progress");
+                continue;
+            }
+            let local = PathBuf::from(&current.local_path);
+            // A daemon killed before it could unmount can leave a dead FUSE
+            // connection over the path. Clear it only after the row identity
+            // and mode have been revalidated under the folder lock.
            if is_stale_mount(&local) {
                warn!(id = folder.id, path = %local.display(), "restore on-demand: clearing stale mount");
                clear_stale_mount(&local);
@@ -799,11 +1026,6 @@ impl Core {
                    .sync_folder_set_state(folder.id, "error", now_secs());
                continue;
            }
-            // An `ondemand` folder's local dir is empty by construction — the switch
-            // evicts it. Finding files there means the row is lying (a switch that
-            // died between persisting the mode and evicting), and mounting over them
-            // would hide real local data behind the remote tree. Leave the files
-            // alone and let the user resolve it.
            match dir_is_empty(&local) {
                Ok(true) => {}
                Ok(false) => {
@@ -825,40 +1047,16 @@ impl Core {
                    continue;
                }
            }
-            let Some(root_uid) = parse_uid(&folder.remote_uid) else {
-                warn!(id = folder.id, "restore on-demand: bad remote uid");
-                continue;
-            };
-            let root = match self
-                .rt
-                .block_on(self.client.enumerate_nodes(std::slice::from_ref(&root_uid)))
-            {
-                Ok(v) => match v.into_iter().next() {
-                    Some(n) => n,
-                    None => {
-                        warn!(id = folder.id, "restore on-demand: remote folder gone");
-                        let _ = self
-                            .db
-                            .sync_folder_set_state(folder.id, "error", now_secs());
-                        continue;
+            match self.spawn_ondemand_mount(&local, root) {
+                Ok(mount) => match self.publish_secondary_mount(folder.id, mount) {
+                    Ok(()) => {
+                        let _ = self.db.sync_folder_set_state(folder.id, "idle", now_secs());
+                        info!(id = folder.id, path = %local.display(), "remounted on-demand folder");
+                    }
+                    Err(error) => {
+                        warn!(id = folder.id, %error, "restore on-demand: mount rejected");
                    }
                },
-                Err(e) => {
-                    warn!(id = folder.id, error = %e, "restore on-demand: fetch remote failed");
-                    let _ = self
-                        .db
-                        .sync_folder_set_state(folder.id, "error", now_secs());
-                    continue;
-                }
-            };
-            match self.spawn_ondemand_mount(&local, root) {
-                Ok(session) => {
-                    self.mounts
-                        .lock()
-                        .insert(folder.id, (session, fuse_connection_id(&local)));
-                    let _ = self.db.sync_folder_set_state(folder.id, "idle", now_secs());
-                    info!(id = folder.id, path = %local.display(), "remounted on-demand folder");
-                }
                Err(e) => {
                    warn!(id = folder.id, error = %e, "restore on-demand: mount failed");
                    let _ = self
@@ -869,3 +1067,118 @@ impl Core {
        }
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use pdfs_core::db::StoredSyncFolder;
+
+    use super::{
+        ApplicableMountMode, commit_after_teardown, pending_intent_matches,
+        restore_snapshot_matches, select_mode_transition,
+    };
+
+    #[test]
+    fn unknown_mode_cannot_select_a_destructive_transition() {
+        let mut unmounts = 0;
+        let mut baseline_clears = 0;
+        let mut mode_writes = 0;
+        if let Ok(mode) = ApplicableMountMode::parse("streaming") {
+            match mode {
+                ApplicableMountMode::Mirror => {
+                    unmounts += 1;
+                    baseline_clears += 1;
+                    mode_writes += 1;
+                }
+                ApplicableMountMode::OnDemand => {
+                    mode_writes += 1;
+                }
+            }
+        }
+        assert_eq!((unmounts, baseline_clears, mode_writes), (0, 0, 0));
+        assert_eq!(
+            ApplicableMountMode::parse("streaming"),
+            Err("unknown mode \"streaming\" (want mirror|ondemand)".to_string())
+        );
+        assert_eq!(
+            ApplicableMountMode::parse("mirror"),
+            Ok(ApplicableMountMode::Mirror)
+        );
+        assert_eq!(
+            ApplicableMountMode::parse("ondemand"),
+            Ok(ApplicableMountMode::OnDemand)
+        );
+    }
+
+    #[test]
+    fn unknown_source_mode_with_pending_mirror_cannot_select_a_transition() {
+        let mut destructive_helper_reached = false;
+        let selected = select_mode_transition("streaming", "mirror");
+        if let Ok(Some(_)) = selected {
+            destructive_helper_reached = true;
+        }
+
+        assert!(!destructive_helper_reached);
+        assert_eq!(
+            selected,
+            Err(
+                "unsupported current mode: unknown mode \"streaming\" (want mirror|ondemand)"
+                    .to_string()
+            )
+        );
+    }
+
+    fn folder(local_path: &str, remote_uid: &str, mode: &str) -> StoredSyncFolder {
+        StoredSyncFolder {
+            id: 7,
+            local_path: local_path.to_string(),
+            remote_uid: remote_uid.to_string(),
+            remote_share_id: "share".to_string(),
+            mode: mode.to_string(),
+            pending_mode: None,
+            state: "idle".to_string(),
+            last_sync: 0,
+        }
+    }
+
+    #[test]
+    fn stale_restore_identity_or_mode_is_rejected() {
+        let snapshot = folder("/mnt/folder", "volume~node", "ondemand");
+        assert!(restore_snapshot_matches(
+            &snapshot,
+            &folder("/mnt/folder", "volume~node", "ondemand")
+        ));
+        assert!(!restore_snapshot_matches(
+            &snapshot,
+            &folder("/mnt/replaced", "volume~node", "ondemand")
+        ));
+        assert!(!restore_snapshot_matches(
+            &snapshot,
+            &folder("/mnt/folder", "volume~other", "ondemand")
+        ));
+        assert!(!restore_snapshot_matches(
+            &snapshot,
+            &folder("/mnt/folder", "volume~node", "mirror")
+        ));
+    }
+
+    #[test]
+    fn teardown_failure_prevents_follow_up_state_changes() {
+        let mut commits = 0;
+        let result = commit_after_teardown::<_, &str>(Err("busy"), || {
+            commits += 1;
+        });
+        assert_eq!(result, Err("busy"));
+        assert_eq!(commits, 0);
+
+        commit_after_teardown::<_, &str>(Ok(()), || commits += 1).unwrap();
+        assert_eq!(commits, 1);
+    }
+
+    #[test]
+    fn canceled_or_replaced_queued_intent_cannot_transition() {
+        assert!(pending_intent_matches(Some("ondemand"), Some("ondemand")));
+        assert!(!pending_intent_matches(None, Some("ondemand")));
+        assert!(!pending_intent_matches(Some("mirror"), Some("ondemand")));
+        assert!(pending_intent_matches(Some("mirror"), None));
+    }
+}
@@ -23,10 +23,11 @@
 use std::fs::File;
 use std::path::{Path, PathBuf};
 use std::sync::atomic::Ordering;
+use std::time::Duration;

 use pdfs_core::cache::{Baseline, StagedWrite};
 use pdfs_core::control::{ActivityKind, TransferDirection};
-use pdfs_core::db::{OP_CREATE, OP_MKDIR, OP_RENAME, OP_REVISION, OP_TRASH, PendingOp};
+use pdfs_core::db::{OP_CREATE, OP_MKDIR, OP_RENAME, OP_REVISION, OP_TRASH, PendingOp, RenameMeta};
 use proton_drive_rs::Node;
 use proton_drive_rs::proton_sdk::ids::NodeUid;
 use tracing::{debug, error, info, warn};
@@ -35,10 +36,82 @@ use super::state::Intervals;
 use super::transfers::CountingReader;
 use super::{
    Core, DRAIN_BACKOFF_MAX, DRAIN_BACKOFF_MIN, DRAIN_IDLE_POLL, ROOT_INO, conflict_name,
-    is_already_exists, is_gone, is_local_uid_str, media_type_for, node_size, now_millis, now_secs,
-    parse_node_uid,
+    is_already_exists, is_gone, is_local_uid_str, media_type_for, node_revision_id, node_size,
+    now_millis, now_secs, parse_node_uid,
 };

+const DRAIN_ACCESS_RECHECK: Duration = Duration::from_secs(5);
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum DrainDisposition {
+    Applied,
+    AccessDeferred,
+}
+
+fn pending_op_authorities(op: &PendingOp) -> Result<Vec<NodeUid>, Box<dyn std::error::Error>> {
+    let uid = || -> Result<NodeUid, Box<dyn std::error::Error>> {
+        parse_node_uid(&op.uid)
+            .ok_or_else(|| Box::<dyn std::error::Error>::from("pending op has an unparseable uid"))
+    };
+    let parent = || -> Result<NodeUid, Box<dyn std::error::Error>> {
+        let parent = op
+            .parent_uid
+            .as_deref()
+            .ok_or("pending op has no parent authority")?;
+        parse_node_uid(parent).ok_or_else(|| {
+            Box::<dyn std::error::Error>::from("pending op has an unparseable parent")
+        })
+    };
+    match op.kind.as_str() {
+        OP_REVISION | OP_TRASH => Ok(vec![uid()?]),
+        OP_CREATE | OP_MKDIR => Ok(vec![parent()?]),
+        OP_RENAME => {
+            let mut authorities = vec![uid()?];
+            if let Some(json) = op.meta_json.as_deref() {
+                let meta: RenameMeta = serde_json::from_str(json)?;
+                authorities.push(
+                    parse_node_uid(&meta.original_parent_uid)
+                        .ok_or("rename op has an unparseable original parent")?,
+                );
+            } else {
+                // Rows written by 1.1.1 predate foreign shared mounts. Their
+                // source tree was necessarily owned, so the node plus desired
+                // destination are the complete available authority set.
+            }
+            authorities.push(parent()?);
+            authorities.dedup();
+            Ok(authorities)
+        }
+        other => Err(format!("unknown pending op kind {other:?}").into()),
+    }
+}
+
+fn run_authorized_drain(
+    op: &PendingOp,
+    mut require: impl FnMut(&NodeUid) -> Result<(), fuser::Errno>,
+    apply: impl FnOnce() -> Result<(), Box<dyn std::error::Error>>,
+) -> Result<DrainDisposition, Box<dyn std::error::Error>> {
+    // This check is the admission/linearization point. A downgrade that lands
+    // first defers the op; one observed afterwards does not revoke this admitted
+    // attempt. Every later queued operation rechecks. No permission lock is
+    // held across remote latency.
+    for authority in pending_op_authorities(op)? {
+        match require(&authority) {
+            Ok(()) => {}
+            Err(error) if error.code() == libc::EACCES => {
+                return Ok(DrainDisposition::AccessDeferred);
+            }
+            Err(error) => {
+                return Err(
+                    format!("drain access check failed with errno {}", error.code()).into(),
+                );
+            }
+        }
+    }
+    apply()?;
+    Ok(DrainDisposition::Applied)
+}
+
 impl Core {
    /// Drain the pending-op queue: the background half of every write
    /// (offline.md Phase 3).
@@ -62,23 +135,53 @@ impl Core {
            let due = self.db.next_due_op(now).unwrap_or_default();

            let Some(op) = due.filter(|_| self.online.load(Ordering::Relaxed)) else {
-                self.wait_for_drain_work();
+                self.recover_fsynced_writes();
+                // A debounced or backed-off op may be waiting: sleep only
+                // until it becomes due rather than the full idle-poll.
+                self.wait_for_drain_work_or_due();
                continue;
            };
-            if let Err(e) = self.drain_op(&op) {
+            let outcome = run_authorized_drain(
+                &op,
+                |uid| self.require_uid_writable(uid),
+                || self.drain_op(&op),
+            );
+            if matches!(outcome, Ok(DrainDisposition::AccessDeferred)) {
+                let next_attempt_at = now_millis() + DRAIN_ACCESS_RECHECK.as_millis() as i64;
+                if let Err(error) = self.db.defer_op_without_attempt(op.id, next_attempt_at) {
+                    error!(
+                        uid = %op.uid,
+                        %error,
+                        "deferring access-blocked pending operation failed"
+                    );
+                    self.wait_for_drain_work();
+                } else {
+                    debug!(
+                        uid = %op.uid,
+                        next_attempt_at,
+                        "pending operation deferred until access is writable"
+                    );
+                }
+                continue;
+            }
+            if let Err(e) = outcome {
                let attempts = op.attempts + 1;
+                let err_str = e.to_string();
+                // Never infer that user data is disposable from an error string
+                // or an arbitrary retry count. The staged blob and this row are
+                // the only durable description of an accepted write. Even a
+                // permission/quota error can become recoverable after the user
+                // changes account state, and deleting the row here made the blob
+                // unreachable after five ordinary network failures.
                let backoff = DRAIN_BACKOFF_MIN
                    .saturating_mul(1u32 << attempts.min(6))
                    .min(DRAIN_BACKOFF_MAX);
-                warn!(uid = %op.uid, attempts, error = %e, "pending upload failed; will retry");
+                warn!(uid = %op.uid, attempts, error = %err_str, "pending upload failed; will retry");
                if let Err(e) = self.db.record_op_failure(
                    op.id,
-                    &e.to_string(),
+                    &err_str,
                    now_millis() + backoff.as_millis() as i64,
                ) {
-                    // The backoff is the only thing keeping a failing op from
-                    // being picked again immediately, so without it the loop
-                    // would spin on this op as fast as the API can refuse it.
                    error!(uid = %op.uid, error = %e, "recording a drain failure failed");
                    self.wait_for_drain_work();
                }
@@ -97,6 +200,25 @@ impl Core {
        *woken = false;
    }

+    /// Like [`wait_for_drain_work`](Self::wait_for_drain_work), but first
+    /// checks whether a debounced or backed-off op is due before the idle-poll
+    /// ceiling. A 2-second debounce must not sleep 30 seconds.
+    fn wait_for_drain_work_or_due(&self) {
+        let timeout = match self.db.earliest_due_at() {
+            Ok(Some(ts)) => {
+                let remaining = (ts - now_millis()).max(0) as u64;
+                Duration::from_millis(remaining).min(DRAIN_IDLE_POLL)
+            }
+            _ => DRAIN_IDLE_POLL,
+        };
+        let (lock, cv) = &*self.drain_wake;
+        let mut woken = lock.lock();
+        if !*woken {
+            cv.wait_for(&mut woken, timeout);
+        }
+        *woken = false;
+    }
+
    /// Perform one queued op and retire it.
    pub(crate) fn drain_op(&self, op: &PendingOp) -> Result<(), Box<dyn std::error::Error>> {
        match op.kind.as_str() {
@@ -202,6 +324,7 @@ impl Core {
            }
        }
        self.db.delete_op(op.id)?;
+        self.note_self_change(&uid);
        info!(%uid, name = %landed, "pending rename landed");
        Ok(())
    }
@@ -224,7 +347,8 @@ impl Core {
            }
            Err(e) => return Err(e.into()),
        }
-        self.db.delete_op(op.id)?;
+        self.db.complete_trash_op(op.id, &uid)?;
+        self.own_sealed_revs.lock().remove(&uid);
        self.invalidate_trash();
        self.log_activity(ActivityKind::Trash, &name, "trashed", true);
        info!(%uid, name, "pending trash landed");
@@ -235,18 +359,19 @@ impl Core {
    /// it away from the one the user asked for. Best effort: the event sync
    /// would correct the tree anyway, but not before the user has looked at it.
    pub(crate) fn adopt_drained_name(&self, uid: &NodeUid, name: &str) {
-        let mut st = self.state.lock();
-        let Some(&ino) = st.by_uid.get(uid) else {
-            return;
-        };
-        let Some(entry) = st.entries.get_mut(&ino) else {
-            return;
-        };
-        entry.node.name = name.to_string();
-        let node = entry.node.clone();
-        if let Err(e) = st.db.upsert_node(&node) {
-            warn!(%uid, error = %e, "db upsert_node failed after a conflict rename");
-        }
+        self.for_each_state(|st| {
+            let Some(&ino) = st.by_uid.get(uid) else {
+                return;
+            };
+            let Some(entry) = st.entries.get_mut(&ino) else {
+                return;
+            };
+            entry.node.name = name.to_string();
+            let node = entry.node.clone();
+            if let Err(e) = st.db.upsert_node(&node) {
+                warn!(%uid, error = %e, "db upsert_node failed after a conflict rename");
+            }
+        });
    }

    /// Make a node that so far exists only on this machine real, and adopt the
@@ -315,6 +440,9 @@ impl Core {
        // sync, whereas a surviving op would create the file a second time.
        self.db.delete_op(op.id)?;
        self.adopt_real_uid(&local, &real)?;
+        // The feed will report this create back to us; the tree already has it
+        // under its real uid, so that event is ours to ignore (`Core::self_changes`).
+        self.note_self_change(&real);
        if let Some(blob) = op.blob_path.as_deref() {
            self.cache.discard_staged(Path::new(blob));
        }
@@ -391,6 +519,14 @@ impl Core {
    ///
    /// The inode is deliberately kept, so anything already holding the file open
    /// keeps working across the drain.
+    ///
+    /// Applied to **every** live inode space, not just this Core's. A node
+    /// created inside an on-demand sync folder lives in that fork's `state`,
+    /// while the drain that lands its create belongs to the primary mount — so
+    /// reaching for `self.state` here found nothing and left the fork's entry on
+    /// its `local~` uid, which reads as an empty file for as long as the daemon
+    /// runs (`docs/BUGS.md` B74). A uid is unique across mounts, so at most one
+    /// of them matches and the others are no-ops.
    pub(crate) fn adopt_real_uid(
        &self,
        local: &NodeUid,
@@ -403,8 +539,10 @@ impl Core {
        self.db
            .remap_local_uid(&local.to_string(), &real.to_string())?;

-        let mut st = self.state.lock();
-        if let Some(ino) = st.by_uid.remove(local) {
+        self.for_each_state(|st| {
+            let Some(ino) = st.by_uid.remove(local) else {
+                return;
+            };
            st.by_uid.insert(real.clone(), ino);
            if let Some(e) = st.entries.get_mut(&ino) {
                e.uid = real.clone();
@@ -432,8 +570,7 @@ impl Core {
                    kids.push(ino);
                }
            }
-        }
-        drop(st);
+        });
        // Write the real node through, now that nothing points at the old uid.
        if let Err(e) = self.db.upsert_node(&node) {
            warn!(%real, error = %e, "db upsert_node failed after remap");
@@ -467,7 +604,7 @@ impl Core {
        uid: &NodeUid,
        meta: &StagedWrite,
    ) -> Result<Option<String>, Box<dyn std::error::Error>> {
-        let Some(base) = meta.based_on else {
+        let Some(ref base) = meta.based_on else {
            return Ok(None);
        };
        let Some(node) = self.fetch_node_remote(uid)? else {
@@ -476,15 +613,23 @@ impl Core {
        if node.trashed {
            return Ok(Some("the file was trashed remotely".into()));
        }
-        let (mtime, size) = (node.modification_time, node_size(&node));
-        if mtime != base.mtime || size != base.size {
-            return Ok(Some(format!(
-                "the remote revision changed under the queued write \
-                 (expected {} bytes at mtime {}, found {size} at {mtime})",
-                base.size, base.mtime
-            )));
+        let Some(reason) = revision_changed(base, &node) else {
+            return Ok(None);
+        };
+        // The remote moved on from the baseline — normally a conflict. But if it
+        // sits at a revision *this daemon* sealed, no other device changed the
+        // file: it is a single-writer stall→resume (a browser that closed and
+        // reopened its download fd; B70 layer B). Chain onto it — supersede
+        // instead of forking — so the finished bytes win the name rather than
+        // being exiled to a `(sync-conflict)` copy.
+        let remote_rev = node_revision_id(&node);
+        let own_rev = self.own_sealed_revs.lock().get(uid).cloned();
+        if is_own_self_supersede(meta.complete, remote_rev.as_deref(), own_rev.as_deref()) {
+            debug!(%uid, ?remote_rev,
+                   "queued write chains onto our own sealed revision; not a conflict");
+            return Ok(None);
        }
-        Ok(None)
+        Ok(Some(reason))
    }

    /// Land a queued write that can no longer be applied to its own node as a
@@ -568,11 +713,11 @@ impl Core {
        self.cache.evict(uid);
        self.evict_reader(uid);
        // The conflict copy is a node the tree has never seen.
-        let mut st = self.state.lock();
-        if let Some(&ino) = st.by_uid.get(&parent) {
-            st.invalidate_listing(ino);
-        }
-        drop(st);
+        self.for_each_state(|st| {
+            if let Some(&ino) = st.by_uid.get(&parent) {
+                st.invalidate_listing(ino);
+            }
+        });
        self.log_activity(
            ActivityKind::Upload,
            &name,
@@ -626,13 +771,25 @@ impl Core {

    /// A node's parent uid and name, as the tree currently has them.
    pub(crate) fn node_place(&self, uid: &NodeUid) -> Option<(NodeUid, String)> {
-        {
-            let st = self.state.lock();
+        // Across every mount: the drain runs on the primary Core, but a node
+        // written inside a sync folder is interned in that fork's inode space,
+        // so asking `self.state` alone always missed it and fell through to the
+        // DB. That still gave the right answer — the fallback below exists for
+        // exactly this shape of miss — but it went to disk for something already
+        // in memory, and only *because* of the fallback was it not a bug.
+        let mut found = None;
+        self.for_each_state(|st| {
+            if found.is_some() {
+                return;
+            }
            if let Some(entry) = st.by_uid.get(uid).and_then(|ino| st.entries.get(ino))
                && let Some(parent) = entry.node.parent_uid.clone()
            {
-                return Some((parent, entry.node.name.clone()));
+                found = Some((parent, entry.node.name.clone()));
            }
+        });
+        if found.is_some() {
+            return found;
        }
        // The in-memory tree only holds what has been walked to since the daemon
        // started, and the drain routinely runs before anything has walked to
@@ -727,7 +884,14 @@ impl Core {
        // an orphaned file (harmless), whereas the reverse would leave a queued
        // op pointing at nothing.
        self.db.delete_op(op.id)?;
-        self.pending.lock().remove(&uid);
+        {
+            let mut p = self.pending.lock();
+            if let Some(op_in_mem) = p.get(&uid)
+                && op_in_mem.path == blob
+            {
+                p.remove(&uid);
+            }
+        }

        // The staged blob now matches the sealed revision, so a pinned file keeps
        // it as its cached content rather than re-downloading what we just sent.
@@ -780,22 +944,60 @@ impl Core {
                return;
            }
        };
+        // This function's whole job is to bring the tree level with the revision
+        // we just sealed, so the feed's report of that revision has nothing left
+        // to tell us. Claimed here rather than at the upload call so it is only
+        // recorded when the node was actually re-read (`Core::self_changes`).
+        self.note_self_change(uid);
+        // Rebase any *open* write handles targeting this node. A handle opened
+        // before this upload carries a stale base — its `base_mtime`/`base_size`
+        // name the revision we just replaced. Without this update,
+        // `remote_baseline` will build a `based_on` from those stale values, the
+        // drain will compare them against the revision we sealed, and the write
+        // will be diverted into a conflict copy of itself.
+        //
+        // This is the open-handle counterpart of `rebaseline_pending`, which
+        // covers the same gap for *queued* ops.
+        {
+            let sealed_mtime = node.modification_time;
+            let sealed_size = node_size(&node);
+            let sealed_rev = node_revision_id(&node);
+            // Remember it as ours, so a queued write that opened over an earlier
+            // revision recognises this as a self-supersede rather than a foreign
+            // change and does not fork (B70 layer B; consulted in
+            // `revision_conflict`).
+            if let Some(rev) = sealed_rev.clone() {
+                self.own_sealed_revs.lock().insert(uid.clone(), rev);
+            }
+            self.for_each_state(|st| {
+                for aw in st.active_writes.values_mut() {
+                    if aw.uid == *uid {
+                        aw.base_mtime = sealed_mtime;
+                        aw.base_size = sealed_size;
+                        aw.base_revision_id = sealed_rev.clone();
+                        debug!(%uid, mtime = sealed_mtime, size = sealed_size,
+                               "rebased open write handle onto the revision just uploaded");
+                    }
+                }
+            });
+        }
        // Ordered so that a write queued *during* the fetch above is still
        // caught: it took its baseline from the node's optimistic stamp, and
        // this overwrites it with the revision the server actually holds.
        if self.rebaseline_pending(uid, &node) {
            return;
        }
-        let mut st = self.state.lock();
-        let Some(parent) = st
-            .by_uid
-            .get(uid)
-            .and_then(|ino| st.entries.get(ino))
-            .map(|e| e.parent)
-        else {
-            return;
-        };
-        st.intern(parent, node);
+        self.for_each_state(|st| {
+            let Some(parent) = st
+                .by_uid
+                .get(uid)
+                .and_then(|ino| st.entries.get(ino))
+                .map(|e| e.parent)
+            else {
+                return;
+            };
+            st.intern(parent, node.clone());
+        });
    }

    /// Point a still-queued write at the revision this upload just sealed, and
@@ -818,12 +1020,14 @@ impl Core {
        let base = Baseline {
            mtime: sealed.modification_time,
            size: node_size(sealed),
+            hash: None,
+            revision_id: node_revision_id(sealed),
        };
        let mut pending = self.pending.lock();
        let Some(p) = pending.get_mut(uid) else {
            return false;
        };
-        p.meta.based_on = Some(base);
+        p.meta.based_on = Some(base.clone());
        match serde_json::to_string(&p.meta) {
            Ok(json) => {
                if let Err(e) = self.db.update_op_meta(&uid.to_string(), OP_REVISION, &json) {
@@ -839,3 +1043,334 @@ impl Core {
        true
    }
 }
+
+/// Whether the remote `node` moved on from the revision a queued write was
+/// `base`d on — the reason string when it did, `None` when the write can still be
+/// applied. Pure so it is testable without a live remote (the trashed/gone checks
+/// stay in [`Core::revision_conflict`], which does the fetch).
+///
+/// The revision id is the authoritative identity: it advances iff a *new* revision
+/// was sealed. When both sides carry one, it alone decides — the server re-stamps
+/// the *same* revision's mtime, and reading that drift as a change is exactly what
+/// diverted a write into a conflict copy of its own base (B16/B25). Only when
+/// there is no id to compare (an old sidecar, or a surface that omits it) does it
+/// fall back to the observable `(mtime, size)` tuple.
+fn revision_changed(base: &Baseline, node: &Node) -> Option<String> {
+    if let (Some(base_rev), Some(remote_rev)) = (&base.revision_id, node_revision_id(node)) {
+        return (*base_rev != remote_rev).then(|| {
+            format!(
+                "the remote revision changed under the queued write \
+                 (based on revision {base_rev}, remote now at {remote_rev})"
+            )
+        });
+    }
+    let (mtime, size) = (node.modification_time, node_size(node));
+    (mtime != base.mtime || size != base.size).then(|| {
+        format!(
+            "the remote revision changed under the queued write \
+             (expected {} bytes at mtime {}, found {size} at {mtime})",
+            base.size, base.mtime
+        )
+    })
+}
+
+/// Whether a queued write that found the remote moved on ([`revision_changed`]
+/// fired) is nonetheless a single-writer self-supersede rather than a foreign
+/// conflict — the remote sits at a revision this daemon sealed itself, so
+/// chaining onto it is safe and forking would be wrong (B70 layer B).
+///
+/// `remote_rev` is the id the remote currently holds, `own_rev` this node's
+/// latest own-sealed id. Requires a `complete` blob: an incomplete one's gaps
+/// still refer to the stale base, so it must take the non-destructive
+/// conflict-copy path instead of overwriting. A `None` remote id never matches
+/// (there is nothing to prove it was ours), so absence falls through to a fork.
+fn is_own_self_supersede(complete: bool, remote_rev: Option<&str>, own_rev: Option<&str>) -> bool {
+    complete && remote_rev.is_some() && remote_rev == own_rev
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use pdfs_core::Access;
+    use pdfs_core::db::Db;
+    use proton_drive_rs::NodeKind;
+    use proton_drive_rs::proton_sdk::ids::{LinkId, VolumeId};
+    use std::cell::Cell;
+
+    fn pending(kind: &str) -> PendingOp {
+        PendingOp {
+            id: 0,
+            kind: kind.to_string(),
+            uid: NodeUid::new(VolumeId::from("v"), LinkId::from("node")).to_string(),
+            parent_uid: Some(NodeUid::new(VolumeId::from("v"), LinkId::from("parent")).to_string()),
+            name: Some("name".to_string()),
+            blob_path: (kind == OP_REVISION).then(|| "/staging/blob".to_string()),
+            meta_json: None,
+            created_at: 1,
+            attempts: 0,
+            last_error: None,
+            next_attempt_at: 0,
+        }
+    }
+
+    #[test]
+    fn drain_authorities_match_each_operation_kind() {
+        for kind in [OP_REVISION, OP_TRASH] {
+            assert_eq!(pending_op_authorities(&pending(kind)).unwrap().len(), 1);
+        }
+        for kind in [OP_CREATE, OP_MKDIR] {
+            let authorities = pending_op_authorities(&pending(kind)).unwrap();
+            assert_eq!(authorities.len(), 1);
+            assert_eq!(authorities[0].to_string(), "v~parent");
+        }
+        let authorities = pending_op_authorities(&pending(OP_RENAME)).unwrap();
+        assert_eq!(authorities.len(), 2);
+        assert_eq!(authorities[0].to_string(), "v~node");
+        assert_eq!(authorities[1].to_string(), "v~parent");
+    }
+
+    fn folder_node(link: &str, parent: Option<&str>) -> Node {
+        Node {
+            uid: NodeUid::new(VolumeId::from("v"), LinkId::from(link)),
+            parent_uid: parent
+                .map(|parent| NodeUid::new(VolumeId::from("v"), LinkId::from(parent))),
+            kind: NodeKind::Folder,
+            name: link.to_string(),
+            creation_time: 0,
+            modification_time: 0,
+            trashed: false,
+            is_shared: false,
+            is_shared_publicly: false,
+            signature_email: None,
+            membership: None,
+            photo: None,
+            album: None,
+            verification: Default::default(),
+        }
+    }
+
+    #[test]
+    fn queued_cross_parent_rename_retains_viewer_source_authority_after_local_move() {
+        use std::sync::atomic::{AtomicU64, Ordering};
+
+        static N: AtomicU64 = AtomicU64::new(0);
+        let dir = std::env::temp_dir().join(format!(
+            "pdfs-drain-rename-access-{}-{}",
+            std::process::id(),
+            N.fetch_add(1, Ordering::Relaxed)
+        ));
+        std::fs::create_dir_all(&dir).unwrap();
+        let db = Db::open(&dir.join("cache.db")).unwrap();
+        let source = folder_node("source", None);
+        let destination = folder_node("destination", None);
+        let mut moved = file_node(1, 0, None);
+        moved.parent_uid = Some(destination.uid.clone());
+        for node in [&source, &destination, &moved] {
+            db.upsert_node(node).unwrap();
+        }
+        db.set_share_access(&source.uid, Access::Viewer).unwrap();
+        db.set_share_access(&destination.uid, Access::Editor)
+            .unwrap();
+
+        let mut op = pending(OP_RENAME);
+        op.uid = moved.uid.to_string();
+        op.parent_uid = Some(destination.uid.to_string());
+        op.meta_json = Some(
+            serde_json::to_string(&RenameMeta {
+                original_parent_uid: source.uid.to_string(),
+            })
+            .unwrap(),
+        );
+        let authorities = pending_op_authorities(&op).unwrap();
+        assert_eq!(authorities.len(), 3);
+        assert_eq!(authorities[1], source.uid);
+
+        let applied = Cell::new(false);
+        let disposition = run_authorized_drain(
+            &op,
+            |uid| {
+                db.effective_node_access(uid)
+                    .unwrap()
+                    .filter(|access| access.writable())
+                    .map(|_| ())
+                    .ok_or(fuser::Errno::EACCES)
+            },
+            || {
+                applied.set(true);
+                Ok(())
+            },
+        )
+        .unwrap();
+        assert_eq!(disposition, DrainDisposition::AccessDeferred);
+        assert!(!applied.get());
+        assert_eq!(
+            db.effective_node_access(&moved.uid).unwrap(),
+            Some(Access::Editor),
+            "the node's optimistic destination ancestry is writable"
+        );
+        drop(db);
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn viewer_deferred_drain_never_applies_or_consumes_an_attempt() {
+        use std::sync::atomic::{AtomicU64, Ordering};
+
+        static N: AtomicU64 = AtomicU64::new(0);
+        let dir = std::env::temp_dir().join(format!(
+            "pdfs-drain-access-{}-{}",
+            std::process::id(),
+            N.fetch_add(1, Ordering::Relaxed)
+        ));
+        std::fs::create_dir_all(&dir).unwrap();
+        let db = Db::open(&dir.join("cache.db")).unwrap();
+        let mut queued = pending(OP_REVISION);
+        queued.attempts = 2;
+        db.enqueue_op(&queued).unwrap();
+        let op = db.pending_ops().unwrap().remove(0);
+        let before_count = db.pending_op_counts().unwrap();
+        let applied = Cell::new(false);
+
+        let disposition = run_authorized_drain(
+            &op,
+            |_| Err(fuser::Errno::EACCES),
+            || {
+                applied.set(true);
+                Ok(())
+            },
+        )
+        .unwrap();
+        assert_eq!(disposition, DrainDisposition::AccessDeferred);
+        assert!(!applied.get(), "no API surrogate may run while read-only");
+        db.defer_op_without_attempt(op.id, 5_000).unwrap();
+
+        let retained = db.pending_ops().unwrap();
+        let after_count = db.pending_op_counts().unwrap();
+        assert_eq!(retained.len(), 1);
+        assert_eq!(retained[0].attempts, op.attempts);
+        assert_eq!(after_count.uploads, before_count.uploads);
+        assert_eq!(after_count.changes, before_count.changes);
+        drop(db);
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn owner_and_editor_drain_authorities_apply_normally() {
+        for access in [Access::Owner, Access::Editor] {
+            let applied = Cell::new(false);
+            let disposition = run_authorized_drain(
+                &pending(OP_REVISION),
+                |_| access.writable().then_some(()).ok_or(fuser::Errno::EACCES),
+                || {
+                    applied.set(true);
+                    Ok(())
+                },
+            )
+            .unwrap();
+            assert_eq!(disposition, DrainDisposition::Applied);
+            assert!(applied.get());
+        }
+    }
+
+    fn file_node(mtime: i64, size: i64, rev: Option<&str>) -> Node {
+        Node {
+            uid: NodeUid::new(VolumeId::from("v"), LinkId::from("l")),
+            parent_uid: None,
+            kind: NodeKind::File {
+                media_type: "text/plain".into(),
+                total_size_on_storage: size,
+                active_revision_state: None,
+                active_revision_id: rev.map(String::from),
+                claimed_size: Some(size),
+                claimed_modification_time: None,
+                content_sha1: None,
+            },
+            name: "f.txt".into(),
+            creation_time: 0,
+            modification_time: mtime,
+            trashed: false,
+            is_shared: false,
+            is_shared_publicly: false,
+            signature_email: None,
+            membership: None,
+            photo: None,
+            album: None,
+            verification: Default::default(),
+        }
+    }
+
+    fn baseline(mtime: i64, size: u64, rev: Option<&str>) -> Baseline {
+        Baseline {
+            mtime,
+            size,
+            hash: None,
+            revision_id: rev.map(String::from),
+        }
+    }
+
+    #[test]
+    fn same_revision_id_is_not_a_conflict_despite_mtime_drift() {
+        // The exact shape of the reported bug: same revision, server re-stamped
+        // its mtime (1784897777 -> 1784897780), same size. Must NOT conflict.
+        let base = baseline(1_784_897_777, 87_438, Some("rev-A"));
+        let remote = file_node(1_784_897_780, 87_438, Some("rev-A"));
+        assert_eq!(revision_changed(&base, &remote), None);
+    }
+
+    #[test]
+    fn a_new_revision_id_is_a_conflict_even_at_the_same_size() {
+        // A same-size edit by another device advances the revision id: this is a
+        // real conflict the id catches where (mtime, size) alone could miss it.
+        let base = baseline(100, 40, Some("rev-A"));
+        let remote = file_node(100, 40, Some("rev-B"));
+        assert!(revision_changed(&base, &remote).is_some());
+    }
+
+    #[test]
+    fn without_ids_it_falls_back_to_mtime_and_size() {
+        // Old sidecar (no revision id): the (mtime, size) tuple still governs.
+        let base = baseline(100, 40, None);
+        assert_eq!(revision_changed(&base, &file_node(100, 40, None)), None);
+        assert!(revision_changed(&base, &file_node(101, 40, None)).is_some());
+        assert!(revision_changed(&base, &file_node(100, 41, None)).is_some());
+    }
+
+    #[test]
+    fn a_complete_write_over_our_own_sealed_revision_chains_not_forks() {
+        // B70 layer B: the partial we sealed ourselves (rev-mine) is what the
+        // remote holds; the resume rewrote the whole file. Not a foreign change.
+        assert!(is_own_self_supersede(
+            true,
+            Some("rev-mine"),
+            Some("rev-mine")
+        ));
+    }
+
+    #[test]
+    fn a_move_to_a_revision_we_did_not_seal_still_forks() {
+        // Another device wrote rev-theirs; we only ever sealed rev-mine. Fork.
+        assert!(!is_own_self_supersede(
+            true,
+            Some("rev-theirs"),
+            Some("rev-mine")
+        ));
+    }
+
+    #[test]
+    fn an_incomplete_blob_never_self_supersedes() {
+        // Its gaps still refer to the stale base; overwriting would mix
+        // revisions, so it must take the conflict-copy path even over our seal.
+        assert!(!is_own_self_supersede(
+            false,
+            Some("rev-mine"),
+            Some("rev-mine")
+        ));
+    }
+
+    #[test]
+    fn a_missing_remote_id_never_self_supersedes() {
+        // No id to prove the revision was ours: fall through to a fork rather
+        // than matching None==None.
+        assert!(!is_own_self_supersede(true, None, None));
+    }
+}
@@ -0,0 +1,656 @@
+//! Mount lifecycle and background-service orchestration.
+
+use super::*;
+
+/// Why a [`mount`] call returned. Lets the daemon decide whether to exit (clean
+/// shutdown) or remount (the mount went away under it).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum MountOutcome {
+    /// The daemon was asked to stop (SIGTERM/SIGINT) and we lazily unmounted
+    /// ourselves. The caller should exit cleanly.
+    Shutdown,
+    /// The kernel mount ended on its own (e.g. an external `fusermount -u`).
+    /// The caller may want to remount.
+    Unmounted,
+}
+
+/// Whether `path` is a mountpoint whose FUSE connection is dead — the state a
+/// daemon killed before it could unmount leaves behind.
+///
+/// The kernel answers every operation on such a path with `ENOTCONN`, which the
+/// ordinary existence checks (`is_dir`, `exists`) report as plain `false`: the
+/// path looks *absent* rather than broken. Callers that would otherwise treat
+/// that as "nothing to mount here" use this to tell the two apart.
+pub(crate) fn is_stale_mount(path: &Path) -> bool {
+    matches!(
+        std::fs::metadata(path).map_err(|e| e.raw_os_error()),
+        Err(Some(libc::ENOTCONN))
+    )
+}
+
+/// A secondary (on-demand sync folder) FUSE session and the exact liveness flag
+/// published with its forked inode state.
+///
+/// Keeping these together makes every teardown mark the fork unroutable before
+/// unmounting, including paths that can block on an in-flight FUSE request.
+pub(super) struct SecondaryMount {
+    session: BackgroundSession,
+    conn: Option<u32>,
+    session_live: Arc<AtomicBool>,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(super) enum SecondaryInsertRejection {
+    Closed,
+    Duplicate,
+}
+
+/// Secondary sessions and the daemon-wide gate controlling whether newly
+/// spawned sessions may become visible. The gate and map share one lock so
+/// shutdown cannot race an insertion between checking and publishing.
+pub(super) struct SecondaryMountRegistry<T> {
+    accepting: bool,
+    entries: HashMap<i64, T>,
+}
+
+impl<T> Default for SecondaryMountRegistry<T> {
+    fn default() -> Self {
+        Self {
+            accepting: false,
+            entries: HashMap::new(),
+        }
+    }
+}
+
+impl<T> SecondaryMountRegistry<T> {
+    pub(super) fn open(&mut self) {
+        self.accepting = true;
+    }
+
+    pub(super) fn is_accepting(&self) -> bool {
+        self.accepting
+    }
+
+    pub(super) fn close(&mut self) {
+        self.accepting = false;
+    }
+
+    pub(super) fn insert(
+        &mut self,
+        id: i64,
+        mount: T,
+    ) -> Result<(), (SecondaryInsertRejection, T)> {
+        if !self.accepting {
+            return Err((SecondaryInsertRejection::Closed, mount));
+        }
+        if self.entries.contains_key(&id) {
+            return Err((SecondaryInsertRejection::Duplicate, mount));
+        }
+        self.entries.insert(id, mount);
+        Ok(())
+    }
+
+    pub(super) fn remove(&mut self, id: &i64) -> Option<T> {
+        self.entries.remove(id)
+    }
+
+    pub(super) fn contains_key(&self, id: &i64) -> bool {
+        self.entries.contains_key(id)
+    }
+
+    pub(super) fn close_and_drain(&mut self) -> Vec<(i64, T)> {
+        self.close();
+        self.entries.drain().collect()
+    }
+}
+
+impl SecondaryMount {
+    pub(super) fn new(
+        session: BackgroundSession,
+        conn: Option<u32>,
+        session_live: Arc<AtomicBool>,
+    ) -> Self {
+        Self {
+            session,
+            conn,
+            session_live,
+        }
+    }
+
+    pub(super) fn teardown(self) -> std::io::Result<()> {
+        teardown_session(&self.session_live, || {
+            umount_session_unblocked(self.session, self.conn)
+        })
+    }
+}
+
+/// The kernel's id for the FUSE connection backing the mount at `mountpoint` —
+/// the directory name under `/sys/fs/fuse/connections`, which is the minor
+/// number of the mountpoint's device. Must be read *while still mounted*; after
+/// unmount the path resolves to the underlying directory on another device.
+/// `None` when the path can't be stat'd.
+pub(super) fn fuse_connection_id(mountpoint: &Path) -> Option<u32> {
+    use std::os::unix::fs::MetadataExt;
+    let dev = std::fs::metadata(mountpoint).ok()?.dev();
+    Some(libc::minor(dev))
+}
+
+/// Force the kernel to abort FUSE connection `id`, erroring every in-flight
+/// request.
+///
+/// On a stop signal we unmount lazily (`MNT_DETACH`) so the call succeeds even
+/// mid-transfer — but detach only removes the mountpoint; it does *not* end the
+/// connection while a request is still in flight. fuser's session loop then
+/// blocks on `/dev/fuse` waiting for a next request that never comes, so `join`
+/// hangs — long enough during a transfer that systemd's stop timeout SIGKILLs
+/// the daemon mid-unmount, stranding the on-demand mounts as dead endpoints.
+/// Writing the connection's `abort` file makes the pending reads fail with
+/// `ENODEV`, so the loop returns and `join` completes at once. Best-effort:
+/// there is nothing more to do on the shutdown path if it fails.
+pub(super) fn abort_fuse_connection(id: u32) {
+    let path = format!("/sys/fs/fuse/connections/{id}/abort");
+    if std::fs::write(&path, b"1").is_ok() {
+        info!(id, "aborted FUSE connection to unblock unmount");
+    }
+}
+
+/// Unmount a background session that may be mid-transfer without wedging: abort
+/// its connection first (so the session loop exits promptly), then lazily
+/// unmount and join. `conn` is the id captured at mount time; `None` skips the
+/// abort and just unmounts (a healthy idle mount joins on its own `Destroy`).
+pub(super) fn umount_session_unblocked(
+    session: BackgroundSession,
+    conn: Option<u32>,
+) -> std::io::Result<()> {
+    if let Some(id) = conn {
+        abort_fuse_connection(id);
+    }
+    session.umount_and_join()
+}
+
+/// Best-effort teardown of a stale mount left behind by a crashed daemon. A
+/// previous run that died without unmounting leaves the kernel mount in place,
+/// so the fresh `Session::new` below would fail with EBUSY ("Device or resource
+/// busy"). `fusermount3 -u -z` is the lazy (detach) unmount, which succeeds even
+/// when the old mount is still busy. Swallow all output/errors: if there is no
+/// stale mount this is simply a no-op.
+pub(super) fn clear_stale_mount(mountpoint: &Path) {
+    for bin in ["fusermount3", "fusermount"] {
+        let ok = std::process::Command::new(bin)
+            .arg("-u")
+            .arg("-z")
+            .arg(mountpoint)
+            .stdout(std::process::Stdio::null())
+            .stderr(std::process::Stdio::null())
+            .status()
+            .map(|s| s.success())
+            .unwrap_or(false);
+        if ok {
+            info!(mountpoint = %mountpoint.display(), "cleared stale mount before remount");
+            return;
+        }
+    }
+}
+
+/// `sync_state` key holding the uid of the My Files root, so a later run can
+/// recover it from `nodes` without the API (offline.md Phase 1).
+const ROOT_UID_KEY: &str = "root_uid";
+
+/// The My Files root, and whether we got it from the API (`true`) or from the
+/// cache because the API was unreachable (`false`).
+///
+/// A successful fetch also records the root's uid, which is what makes the
+/// fallback possible on a later run: `nodes` is keyed by uid, so without this we
+/// would have the root's row on disk and no way to tell which one it is.
+///
+/// Failing to fetch is only fatal on a genuinely cold start — no cached root
+/// means an empty tree, and mounting that would show the user an empty Drive
+/// rather than an honest error.
+fn fetch_or_recall_root(
+    client: &ProtonDriveClient,
+    rt: &tokio::runtime::Handle,
+    db: &Db,
+) -> std::io::Result<(Node, bool)> {
+    let err = match rt.block_on(client.get_my_files_folder()) {
+        Ok(root) => {
+            if let Err(e) = db.set_state_str(ROOT_UID_KEY, &root.uid.to_string()) {
+                warn!(error = %e, "persist root uid failed");
+            }
+            return Ok((root, true));
+        }
+        Err(e) => e,
+    };
+    let cached = db
+        .state_str(ROOT_UID_KEY)
+        .ok()
+        .flatten()
+        .and_then(|uid| db.node_by_uid(&uid).ok().flatten());
+    match cached {
+        Some(root) => {
+            warn!(error = %err, "fetch My Files root failed; mounting from cache (offline)");
+            Ok((root, false))
+        }
+        None => Err(std::io::Error::other(format!("fetch My Files root: {err}"))),
+    }
+}
+
+/// Per-mount settings resolved from [`pdfs_core::config::AppConfig`] by the
+/// caller, so `mount` itself never reads config or the environment.
+pub struct MountOptions {
+    /// Proton account the session belongs to, for display and per-user paths.
+    pub username: String,
+    /// What the background conflict sweep may do. See `docs/BUGS.md` B71.
+    pub sweep_mode: SweepMode,
+}
+
+/// Spawn one FUSE session rooted at an arbitrary remote node.
+///
+/// Primary My Files and secondary on-demand device locations use this same
+/// construction path so mount options, stale-mount recovery, registry
+/// liveness, and notifier ownership cannot drift apart. Each caller owns its
+/// state/path registration and performs it exactly once before calling here.
+pub(super) fn spawn_session(
+    core: &Core,
+    mountpoint: &Path,
+    root: Node,
+) -> std::io::Result<BackgroundSession> {
+    let mut config = Config::default();
+    config.mount_options = vec![
+        MountOption::FSName("protondrive".to_string()),
+        MountOption::Subtype("protondrive".to_string()),
+        MountOption::DefaultPermissions,
+    ];
+
+    clear_stale_mount(mountpoint);
+    info!(mountpoint = %mountpoint.display(), "mounting Proton Drive location");
+    let fs = ProtonFs::new(core.clone(), root);
+    if core.primary {
+        // Only My Files rehydrates the daemon-wide node cache. A secondary
+        // inode space is rooted at one device subtree and must not import every
+        // unrelated persisted node.
+        core.hydrate();
+    }
+    let session = Session::new(fs, mountpoint, &config)?.spawn()?;
+    let _ = core.notifier.set(session.notifier());
+    core.session_live.store(true, Ordering::Release);
+    Ok(session)
+}
+
+/// Make a session unroutable before beginning any teardown that may block.
+fn teardown_session<T>(session_live: &AtomicBool, teardown: impl FnOnce() -> T) -> T {
+    session_live.store(false, Ordering::Release);
+    teardown()
+}
+
+impl Core {
+    /// Resolve the primary share id away from startup and publish it only if the
+    /// projected root has not changed while the request was in flight.
+    pub(crate) fn repair_primary_share_id(&self, root_uid: &NodeUid) {
+        match self.rt.block_on(self.client.context_share_id(root_uid)) {
+            Ok(share_id) => {
+                match self
+                    .db
+                    .mount_repair_my_files_share_id(&root_uid.to_string(), &share_id.to_string())
+                {
+                    Ok(true) => debug!(%root_uid, "repaired My Files share id"),
+                    Ok(false) => {
+                        debug!(%root_uid, "discarded stale My Files share-id result");
+                    }
+                    Err(error) => {
+                        warn!(%root_uid, error = %error, "persist My Files share id failed");
+                    }
+                }
+            }
+            Err(error) => {
+                debug!(%root_uid, error = %error, "resolve My Files share id failed");
+            }
+        }
+    }
+}
+
+/// Mount the filesystem at `mountpoint` and block until it is unmounted or the
+/// daemon is asked to stop.
+///
+/// Resolves the My Files root up front — from the API, or from the cached tree
+/// when the API is unreachable (`fetch_or_recall_root`) — then spawns the
+/// Phase 2 event-sync task, the
+/// Phase 4 control socket, and runs the FUSE session on its own thread while
+/// this thread waits for either a stop signal (SIGTERM/SIGINT) or the kernel
+/// mount ending on its own. On a stop signal we lazily unmount ourselves
+/// (`umount_and_join`, the MNT_DETACH path that succeeds even while downloads
+/// are in flight), so `systemctl --user stop` is always a clean teardown.
+/// `rt` must be a handle to a *running* multi-threaded runtime.
+pub fn mount(
+    client: ProtonDriveClient,
+    rt: tokio::runtime::Handle,
+    mountpoint: &Path,
+    cache: ContentCache,
+    control_socket: &Path,
+    db: Arc<Db>,
+    options: MountOptions,
+) -> std::io::Result<MountOutcome> {
+    let MountOptions {
+        username,
+        sweep_mode,
+    } = options;
+    let (root, online) = fetch_or_recall_root(&client, &rt, &db)?;
+    let scope = root.tree_event_scope_id();
+    db.mount_upsert_my_files(&mountpoint.to_string_lossy(), &root.uid.to_string(), None)
+        .map_err(|error| std::io::Error::other(format!("project My Files mount: {error}")))?;
+    let share_access = db
+        .all_share_access()
+        .map_err(|error| std::io::Error::other(format!("load shared access: {error}")))?;
+
+    // The folder-sync engine (devices.md Phase 2) runs on its own thread and is
+    // nudged over this channel; the sender lives in Core so control-socket
+    // handlers can trigger reconciles.
+    let (sync_tx, sync_rx) = std::sync::mpsc::channel::<sync::SyncMsg>();
+
+    let core = Core {
+        client: client.clone(),
+        rt: rt.clone(),
+        primary_root_uid: root.uid.clone(),
+        primary: true,
+        state: Arc::new(Mutex::new(State {
+            entries: HashMap::new(),
+            by_uid: HashMap::new(),
+            children: HashMap::new(),
+            next_ino: 2,
+            active_writes: HashMap::new(),
+            handles: HashMap::new(),
+            next_fh: 1,
+            access_changes: HashSet::new(),
+            share_access,
+            db: db.clone(),
+        })),
+        cache: Arc::new(cache),
+        readers: Arc::new(Mutex::new(HashMap::new())),
+        stream_ring: Arc::new(Mutex::new(StreamRing::default())),
+        workers: Arc::new(Workers::new(FUSE_WORKERS)?),
+        db,
+        shared_publication: Arc::new(Mutex::new(())),
+        shared_generation: Arc::new(AtomicU64::new(0)),
+        shared_refresh_deadlines: Arc::new(Mutex::new(SharedRefreshDeadlines::default())),
+        online: Arc::new(AtomicBool::new(online)),
+        pending: Arc::new(Mutex::new(HashMap::new())),
+        hidden: Arc::new(Mutex::new(HashSet::new())),
+        drain_wake: Arc::new((Mutex::new(false), Condvar::new())),
+        timeline_refreshing: Arc::new(AtomicBool::new(false)),
+        albums_refreshing: Arc::new(AtomicBool::new(false)),
+        trash_refreshing: Arc::new(AtomicBool::new(false)),
+        trash_progress: Arc::new(tokio::sync::Notify::new()),
+        conflict_notified: Arc::new(Mutex::new(HashSet::new())),
+        sweep_mode,
+        own_sealed_revs: Arc::new(Mutex::new(HashMap::new())),
+        self_changes: Arc::new(Mutex::new(HashMap::new())),
+        thumb_gen: Arc::new(Mutex::new(HashSet::new())),
+        no_thumbnail: Arc::new(Mutex::new(HashMap::new())),
+        size_upgrades: Arc::new(Mutex::new(HashMap::new())),
+        notifier: Arc::new(OnceLock::new()),
+        session_live: Arc::new(AtomicBool::new(false)),
+        transfers: TransferRegistry::new(),
+        indexing: Arc::new(AtomicBool::new(false)),
+        sync_progress: Arc::new(Mutex::new(HashMap::new())),
+        sync_tx,
+        mounts: Arc::new(Mutex::new(SecondaryMountRegistry::default())),
+        sync_locks: Arc::new(Mutex::new(HashMap::new())),
+        states: Arc::new(StateRegistry::default()),
+    };
+    // Before anything can queue work against it: the drain thread below reaches
+    // every mount's inode space through this registry, not through `core.state`.
+    core.register_state(mountpoint);
+
+    // Writes queued by a previous run (or left behind by a crash) are still owed
+    // an upload, and reads must be served from their staged blobs until they land.
+    core.hydrate_pending();
+    // Then the writes that were fsynced but never closed, which the cache moved
+    // aside at open. After `hydrate_pending`, so a recovered partial write can
+    // see an already-queued write to the same node.
+    core.recover_fsynced_writes();
+    {
+        let core = core.clone();
+        std::thread::Builder::new()
+            .name("pdfs-drain".into())
+            .spawn(move || core.run_pending_drain())?;
+    }
+
+    // Start the folder-sync engine. It watches every mirror folder, polls the
+    // remotes, and reconciles on its own thread — never in front of a FUSE call.
+    sync::spawn(core.clone(), sync_rx);
+
+    // Reconcile leftover `(sync-conflict …)` copies: drop the ones that turned
+    // out identical to the live file, surface the ones that genuinely diverge.
+    // Its own thread — it enumerates and trashes, and must never block a FUSE call.
+    // `Off` skips the thread entirely rather than starting an idle one, so the
+    // setting is verifiable from the outside (`ls /proc/<pid>/task/*/comm`).
+    if sweep_mode == SweepMode::Off {
+        info!("conflict sweep disabled by configuration");
+    } else {
+        info!(mode = ?sweep_mode, "conflict sweep enabled");
+        let core = core.clone();
+        std::thread::Builder::new()
+            .name("pdfs-conflict-sweep".into())
+            .spawn(move || core.run_conflict_sweep_loop())?;
+    }
+
+    // Mounted from the cache: watch for the network coming back so the mount can
+    // stop being read-only-ish without the user restarting the daemon.
+    if !online {
+        let core = core.clone();
+        std::thread::Builder::new()
+            .name("pdfs-online-probe".into())
+            .spawn(move || core.run_online_probe())?;
+    }
+
+    // Keep the launcher prompt's "This computer" index fresh. Its own thread:
+    // the walk is I/O-heavy and must never sit in front of a FUSE callback.
+    {
+        let db = core.db.clone();
+        let indexing = core.indexing.clone();
+        let transfers = core.transfers.clone();
+        let mountpoint = mountpoint.to_path_buf();
+        std::thread::Builder::new()
+            .name("pdfs-localindex".into())
+            .spawn(move || run_local_index(db, indexing, transfers, mountpoint))?;
+    }
+
+    // Bind the control socket before the FUSE session takes over the thread. A
+    // stale socket file from a previous run would block the bind, so clear it.
+    let _ = std::fs::remove_file(control_socket);
+    let old_umask = unsafe { libc::umask(0o77) };
+    let listener_res = UnixListener::bind(control_socket);
+    unsafe { libc::umask(old_umask) };
+    let listener = listener_res?;
+    // Owner-only before anything can connect: a peer on this socket commands the
+    // daemon's authenticated session without a credential of its own (B6).
+    if let Err(e) = pdfs_core::config::restrict_socket(control_socket) {
+        error!(error = %e, "cannot restrict control socket permissions; refusing to serve");
+        let _ = std::fs::remove_file(control_socket);
+        return Err(std::io::Error::other(format!(
+            "control socket permissions: {e}"
+        )));
+    }
+    // Do not accept control requests until `spawn_session` has transitioned the
+    // primary registration to live. The listener may queue a connection during
+    // this short window, but its handler cannot observe `mounted = false`.
+    let bg = match spawn_session(&core, mountpoint, root) {
+        Ok(session) => session,
+        Err(error) => {
+            let _ = std::fs::remove_file(control_socket);
+            return Err(error);
+        }
+    };
+    core.mounts.lock().open();
+    // The connection id, captured now while the mount is live, so a stop signal
+    // mid-transfer can abort it rather than block `join` (see `abort_fuse_connection`).
+    let main_conn = fuse_connection_id(mountpoint);
+    {
+        let control_core = core.clone();
+        let username = username.clone();
+        let mountpoint = mountpoint.to_path_buf();
+        if let Err(error) = std::thread::Builder::new()
+            .name("pdfs-control".into())
+            .spawn(move || run_control_socket(control_core, username, mountpoint, listener))
+        {
+            let secondaries = core.mounts.lock().close_and_drain();
+            for (id, mount) in secondaries {
+                if let Err(unmount_error) = mount.teardown() {
+                    warn!(id, error = %unmount_error, "secondary teardown after control startup failure failed");
+                }
+            }
+            if let Err(unmount_error) = teardown_session(&core.session_live, || {
+                umount_session_unblocked(bg, main_conn)
+            }) {
+                warn!(error = %unmount_error, "unmount after control startup failure failed");
+            }
+            let _ = std::fs::remove_file(control_socket);
+            return Err(error);
+        }
+    }
+    // Re-establish on-demand mounts only after the primary session is live.
+    // Keep the worker so shutdown can close publication, wait for any in-flight
+    // fetch to observe that closure, and then drain a stable registry.
+    let restore_worker = {
+        let restore_core = core.clone();
+        match std::thread::Builder::new()
+            .name("pdfs-restore-ondemand".into())
+            .spawn(move || restore_core.restore_ondemand_mounts())
+        {
+            Ok(worker) => Some(worker),
+            Err(error) => {
+                warn!(%error, "start on-demand restore worker failed");
+                None
+            }
+        }
+    };
+    rt.spawn(run_event_sync(client, scope, core.clone()));
+    if online {
+        let repair_core = core.clone();
+        let root_uid = core.primary_root_uid.clone();
+        if let Err(error) = std::thread::Builder::new()
+            .name("pdfs-share-id".into())
+            .spawn(move || repair_core.repair_primary_share_id(&root_uid))
+        {
+            warn!(%error, "start My Files share-id repair failed");
+        }
+    }
+
+    // Stop signals (SIGTERM from `systemctl --user stop`, SIGINT from Ctrl-C)
+    // are delivered onto the async runtime; bridge them onto a sync channel so
+    // the loop below can react without blocking a worker thread. A bounded
+    // channel of 1 is enough — we only need to know that *a* stop arrived.
+    let (sig_tx, sig_rx) = std::sync::mpsc::sync_channel::<()>(1);
+    rt.spawn(async move {
+        let mut sigterm =
+            match tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate()) {
+                Ok(s) => s,
+                Err(e) => {
+                    warn!(error = %e, "install SIGTERM handler failed");
+                    return;
+                }
+            };
+        let mut sigint =
+            match tokio::signal::unix::signal(tokio::signal::unix::SignalKind::interrupt()) {
+                Ok(s) => s,
+                Err(e) => {
+                    warn!(error = %e, "install SIGINT handler failed");
+                    return;
+                }
+            };
+        tokio::select! {
+            _ = sigterm.recv() => info!("received SIGTERM"),
+            _ = sigint.recv() => info!("received SIGINT"),
+        }
+        let _ = sig_tx.try_send(());
+    });
+
+    // Wait for whichever happens first: a stop signal (→ we unmount ourselves
+    // via the lazy MNT_DETACH path, clean even mid-download), or the kernel
+    // mount ending on its own (→ the session thread finishes). Poll instead of
+    // blocking on `join` so we can also notice the signal.
+    let outcome = loop {
+        match sig_rx.recv_timeout(Duration::from_millis(500)) {
+            Ok(()) => {
+                info!("stop requested; unmounting");
+                core.mounts.lock().close();
+                if let Err(e) = teardown_session(&core.session_live, || {
+                    umount_session_unblocked(bg, main_conn)
+                }) {
+                    warn!(error = %e, "umount_and_join failed");
+                }
+                break MountOutcome::Shutdown;
+            }
+            Err(std::sync::mpsc::RecvTimeoutError::Timeout) => {
+                if bg.guard.is_finished() {
+                    info!("mount ended externally");
+                    core.mounts.lock().close();
+                    if let Err(e) = teardown_session(&core.session_live, || bg.join()) {
+                        warn!(error = %e, "session join failed");
+                    }
+                    break MountOutcome::Unmounted;
+                }
+            }
+            Err(std::sync::mpsc::RecvTimeoutError::Disconnected) => {
+                // Signal task gone (failed to install); fall back to join.
+                core.mounts.lock().close();
+                let _ = teardown_session(&core.session_live, || bg.join());
+                break MountOutcome::Unmounted;
+            }
+        }
+    };
+
+    // Unmount every on-demand sync folder too, or the kernel mounts linger as
+    // stale and the next start fails with EBUSY (devices.md Phase 3).
+    if let Some(worker) = restore_worker
+        && worker.join().is_err()
+    {
+        warn!("on-demand restore worker panicked");
+    }
+    let secondaries = core.mounts.lock().close_and_drain();
+    for (id, mount) in secondaries {
+        if let Err(e) = mount.teardown() {
+            warn!(id, error = %e, "unmount on-demand folder failed");
+        }
+    }
+
+    let _ = std::fs::remove_file(control_socket);
+    Ok(outcome)
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::atomic::{AtomicBool, Ordering};
+
+    use super::{SecondaryInsertRejection, SecondaryMountRegistry, teardown_session};
+
+    #[test]
+    fn session_is_unroutable_before_teardown_starts() {
+        let live = AtomicBool::new(true);
+        teardown_session(&live, || {
+            assert!(
+                !live.load(Ordering::Acquire),
+                "teardown must never run while the registry still reports mounted"
+            );
+        });
+    }
+
+    #[test]
+    fn secondary_registry_rejects_closed_and_duplicate_insertions() {
+        let mut mounts = SecondaryMountRegistry::default();
+        assert_eq!(
+            mounts.insert(7, "closed"),
+            Err((SecondaryInsertRejection::Closed, "closed"))
+        );
+
+        mounts.open();
+        assert_eq!(mounts.insert(7, "first"), Ok(()));
+        assert_eq!(
+            mounts.insert(7, "duplicate"),
+            Err((SecondaryInsertRejection::Duplicate, "duplicate"))
+        );
+        assert!(mounts.contains_key(&7));
+
+        assert_eq!(mounts.close_and_drain(), vec![(7, "first")]);
+        assert!(!mounts.is_accepting());
+    }
+}
@@ -5,7 +5,7 @@
 //! user. Thumbnails the server has none for (anything a camera wrote rather than
 //! a phone) are generated locally and stored as if the server had served them.

-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 use std::path::PathBuf;

 use pdfs_core::control::{PhotoItem, PhotoKind, PhotoThumb};
@@ -18,10 +18,78 @@ use proton_drive_rs::{NodeKind, ThumbnailType};
 use tracing::{info, warn};

 use super::{
-    Core, PHOTOS_AVAILABLE, PHOTOS_SYNCED_MS, THUMB_GEN_CONCURRENCY, TIMELINE_ENRICH_CHUNK,
-    TIMELINE_TTL, ThumbAttempt, node_size, now_ms, parse_uid, ratio_of, scale_thumbnail,
+    Core, PHOTOS_AVAILABLE, PHOTOS_SYNCED_MS, TIMELINE_ENRICH_CHUNK, TIMELINE_TTL, node_size,
+    now_ms, parse_uid,
 };

+/// Longest edge, in px, of a thumbnail generated locally for a photo the server
+/// has none for. Matches the server's own thumbnail scale closely enough that a
+/// tile can't tell them apart.
+const THUMB_EDGE: u32 = 512;
+/// JPEG quality of a locally generated thumbnail.
+const THUMB_QUALITY: u8 = 82;
+/// How many photos may be downloaded at once to generate their missing
+/// thumbnails. Bounded: a screenful of 20 MB digicam JPEGs would otherwise
+/// saturate the link and starve the rest of the daemon.
+const THUMB_GEN_CONCURRENCY: usize = 4;
+
+/// The aspect ratio (w/h) of an encoded image, read from its header alone — no
+/// pixels are decoded. `None` when the format is unknown or the header is torn.
+fn ratio_of(bytes: &[u8]) -> Option<f64> {
+    let (width, height) = image::ImageReader::new(std::io::Cursor::new(bytes))
+        .with_guessed_format()
+        .ok()?
+        .into_dimensions()
+        .ok()?;
+    (height > 0).then(|| f64::from(width) / f64::from(height))
+}
+
+/// A thumbnail the daemon made itself, and the aspect ratio of the photo it was
+/// made from (free at that point — the full image had to be decoded anyway).
+struct GeneratedThumb {
+    bytes: Vec<u8>,
+    ratio: f64,
+}
+
+/// How one attempt at generating a missing thumbnail ended. The distinction that
+/// matters is *permanent* versus *transient*: only bytes we cannot decode prove
+/// the photo will never have a thumbnail, and only that verdict is persisted.
+enum ThumbAttempt {
+    Made(GeneratedThumb),
+    /// Decoded nothing — a format this build has no decoder for. Permanent.
+    Undecodable,
+    /// The photo couldn't be downloaded. Transient: try again next time.
+    Unavailable,
+}
+
+/// Scale a full-size photo down to a thumbnail: at most [`THUMB_EDGE`] on its
+/// longest side, JPEG, aspect ratio preserved. `None` when the bytes aren't an
+/// image this build can decode — the caller then writes the photo off as
+/// un-thumbnailable.
+///
+/// CPU-bound (a 20 MP JPEG is real work), so callers run it on the blocking pool.
+fn scale_thumbnail(bytes: &[u8]) -> Option<GeneratedThumb> {
+    let image = image::ImageReader::new(std::io::Cursor::new(bytes))
+        .with_guessed_format()
+        .ok()?
+        .decode()
+        .ok()?;
+    let (width, height) = (image.width(), image.height());
+    if width == 0 || height == 0 {
+        return None;
+    }
+    let ratio = f64::from(width) / f64::from(height);
+
+    // `thumbnail` fits the image *inside* the box, so the longest edge lands on
+    // THUMB_EDGE and the ratio is untouched.
+    let thumb = image.thumbnail(THUMB_EDGE, THUMB_EDGE).to_rgb8();
+    let mut bytes = Vec::new();
+    image::codecs::jpeg::JpegEncoder::new_with_quality(&mut bytes, THUMB_QUALITY)
+        .encode_image(&thumb)
+        .ok()?;
+    Some(GeneratedThumb { bytes, ratio })
+}
+
 impl Core {
    pub(crate) fn photos_timeline(
        &self,
@@ -86,7 +154,20 @@ impl Core {
    pub(crate) fn photo_thumbs(&self, uids: &[NodeUid]) -> Vec<PhotoThumb> {
        let ttype = ThumbnailType::Thumbnail.as_i32();
        let keys: Vec<String> = uids.iter().map(|u| u.to_string()).collect();
-        let stored = self.db.photos_by_uid(&keys).unwrap_or_default();
+        let mut stored = self.db.photos_by_uid(&keys).unwrap_or_default();
+        // Album covers and the contents of an album shared with us are not in our
+        // own timeline, so their capture time — the cache's validity tag — only
+        // exists on the album rows. Fill in whatever the timeline didn't cover.
+        {
+            let have: HashSet<String> = stored.iter().map(|p| p.uid.clone()).collect();
+            let missing: Vec<String> = keys
+                .iter()
+                .filter(|k| !have.contains(*k))
+                .cloned()
+                .collect();
+            stored.extend(self.db.album_photos_by_uid(&missing).unwrap_or_default());
+        }
+        let stored = stored;
        let tags: HashMap<String, i64> = stored
            .iter()
            .map(|p| (p.uid.clone(), p.capture_time))
@@ -261,11 +342,17 @@ impl Core {
        }
    }

-    /// Persist what a thumbnail attempt learned about a photo.
+    /// Persist what a thumbnail attempt learned about a photo, against the
+    /// timeline and against every album the photo sits in — one attempt, one
+    /// verdict, wherever the photo is painted.
    pub(crate) fn record_thumb(&self, uid: &NodeUid, state: i64, ratio: Option<f64>) {
-        if let Err(e) = self.db.photo_set_thumb(&uid.to_string(), state, ratio) {
+        let key = uid.to_string();
+        if let Err(e) = self.db.photo_set_thumb(&key, state, ratio) {
            warn!(%uid, error = %e, "recording thumbnail state failed");
        }
+        if let Err(e) = self.db.album_photo_set_thumb(&key, state, ratio) {
+            warn!(%uid, error = %e, "recording album thumbnail state failed");
+        }
    }

    /// Whether the listing stamped under `key` is older than `ttl` (or was never
@@ -361,3 +448,60 @@ impl Core {
        Ok(self.cache.content_path(uid))
    }
 }
+
+#[cfg(test)]
+mod thumb_tests {
+    use super::{THUMB_EDGE, ratio_of, scale_thumbnail};
+
+    /// A `width`×`height` JPEG, standing in for a camera photo the server never
+    /// generated a thumbnail for.
+    fn jpeg(width: u32, height: u32) -> Vec<u8> {
+        let image = image::RgbImage::from_fn(width, height, |x, y| {
+            image::Rgb([(x % 256) as u8, (y % 256) as u8, 128])
+        });
+        let mut bytes = Vec::new();
+        image::codecs::jpeg::JpegEncoder::new(&mut bytes)
+            .encode_image(&image)
+            .unwrap();
+        bytes
+    }
+
+    #[test]
+    fn scaling_fits_the_long_edge_and_keeps_the_aspect_ratio() {
+        let photo = jpeg(4000, 3000);
+        let thumb = scale_thumbnail(&photo).expect("a JPEG scales");
+
+        let (width, height) = image::ImageReader::new(std::io::Cursor::new(&thumb.bytes))
+            .with_guessed_format()
+            .unwrap()
+            .into_dimensions()
+            .unwrap();
+        assert_eq!(width, THUMB_EDGE, "the long edge lands on the target");
+        assert_eq!(height, THUMB_EDGE * 3 / 4, "and nothing is cropped");
+        assert!((thumb.ratio - 4.0 / 3.0).abs() < 1e-6);
+        assert!(
+            thumb.bytes.len() < photo.len(),
+            "a thumbnail that isn't smaller than its photo is no thumbnail"
+        );
+    }
+
+    #[test]
+    fn a_portrait_photo_fits_its_long_edge_too() {
+        let thumb = scale_thumbnail(&jpeg(1000, 2000)).expect("a JPEG scales");
+        assert!(thumb.ratio < 1.0, "portrait stays portrait");
+        assert_eq!(ratio_of(&thumb.bytes).map(|r| r < 1.0), Some(true));
+    }
+
+    #[test]
+    fn undecodable_bytes_are_not_a_thumbnail() {
+        // What a photo in a format this build has no decoder for looks like: the
+        // caller writes it off as un-thumbnailable rather than retrying forever.
+        assert!(scale_thumbnail(b"not an image at all").is_none());
+        assert!(ratio_of(b"not an image at all").is_none());
+    }
+
+    #[test]
+    fn ratio_is_read_from_the_header_alone() {
+        assert_eq!(ratio_of(&jpeg(300, 200)), Some(1.5));
+    }
+}
@@ -12,7 +12,10 @@ use std::sync::OnceLock;
 use std::sync::atomic::{AtomicBool, Ordering};

 use pdfs_core::control::RestorableFolder;
-use pdfs_core::profile::{PROFILE_FILE_NAME, PROFILE_VERSION, Profile, ProfileFolder, ProfilePin};
+use pdfs_core::mounts::MountMode;
+use pdfs_core::profile::{
+    PROFILE_DIR_NAME, PROFILE_FILE_NAME, PROFILE_VERSION, Profile, ProfileFolder, ProfilePin,
+};
 use pdfs_core::{CoreError, CoreResult};
 use proton_drive_rs::proton_sdk::ids::NodeUid;
 use tracing::{info, warn};
@@ -63,8 +66,9 @@ impl Core {
        });
    }

-    /// Serialize this machine's arrangement and upload it to `profile.json` in
-    /// the device root, replacing any existing one.
+    /// Serialize this machine's arrangement and upload it to `profile.json`
+    /// inside the device's `.proton-drive-linux` folder, replacing any existing
+    /// one.
    ///
    /// Does nothing when no device is registered: a machine that has never
    /// synced a folder has nothing to describe, and registering a device just to
@@ -85,11 +89,15 @@ impl Core {
        let bytes = profile.to_bytes().map_err(CoreError::internal)?;
        let len = bytes.len() as i64;

+        // The device root itself rejects file creation (B78), so the profile
+        // lives one level down, in a folder created on first save.
+        let dir_uid = self.ensure_profile_dir(&root_uid)?;
+
        // Replace the existing document rather than adding a second file of the
-        // same name: the profile is a single mutable record, and a device root
-        // with `profile.json` and `profile (1).json` in it teaches the restore
+        // same name: the profile is a single mutable record, and a folder with
+        // `profile.json` and `profile (1).json` in it teaches the restore
        // nothing about which to trust.
-        let existing = self.find_device_child_file(&root_uid, PROFILE_FILE_NAME)?;
+        let existing = self.find_device_child_file(&dir_uid, PROFILE_FILE_NAME)?;
        match existing {
            Some(uid) => self
                .rt
@@ -105,7 +113,7 @@ impl Core {
            None => {
                self.rt
                    .block_on(self.client.upload_file_replacing_draft_from(
-                        &root_uid,
+                        &dir_uid,
                        PROFILE_FILE_NAME,
                        "application/json",
                        Cursor::new(bytes),
@@ -133,7 +141,7 @@ impl Core {
                local_path: f.local_path,
                // A queued switch is where the user asked the folder to be, so
                // that is what the next machine should set up.
-                mode: f.pending_mode.unwrap_or(f.mode),
+                mode: MountMode::from(f.pending_mode.unwrap_or(f.mode).as_str()),
            })
            .collect();
        let pins = self
@@ -163,18 +171,18 @@ impl Core {
        })
    }

-    /// An untrashed *file* named `name` directly under the device root.
+    /// An untrashed *file* named `name` directly under `parent_uid`.
    ///
    /// The sibling of `find_device_child_folder`; kept separate because a folder
    /// named `profile.json` must not be mistaken for the profile.
    fn find_device_child_file(
        &self,
-        root_uid: &NodeUid,
+        parent_uid: &NodeUid,
        name: &str,
    ) -> CoreResult<Option<NodeUid>> {
        let uids = self
            .rt
-            .block_on(self.client.enumerate_folder_children_node_uids(root_uid))
+            .block_on(self.client.enumerate_folder_children_node_uids(parent_uid))
            .map_err(|e| CoreError::from_api(&e, "list device root"))?;
        if uids.is_empty() {
            return Ok(None);
@@ -189,10 +197,47 @@ impl Core {
            .map(|n| n.uid))
    }

-    /// Download and parse the profile in the device root, if there is one.
+    /// The device's `.proton-drive-linux` folder, creating it if this is the
+    /// first save on this device.
+    ///
+    /// Reused by stable identity rather than recreated: a second folder of the
+    /// same name would split the profile across two documents, and the restore
+    /// would have no way to tell which is current.
+    fn ensure_profile_dir(&self, root_uid: &NodeUid) -> CoreResult<NodeUid> {
+        if let Some(uid) = self.find_device_child_folder(root_uid, PROFILE_DIR_NAME)? {
+            return Ok(uid);
+        }
+        let uid = self
+            .rt
+            .block_on(
+                self.client
+                    .create_folder(root_uid, PROFILE_DIR_NAME, Some(now_secs())),
+            )
+            .map_err(|e| CoreError::from_api(&e, "create profile folder"))?;
+        info!(name = PROFILE_DIR_NAME, "created device profile folder");
+        Ok(uid)
+    }
+
+    /// Download and parse this device's profile, if there is one.
+    ///
+    /// Looks in `.proton-drive-linux/` first and falls back to the device root,
+    /// where clients before the B78 fix wrote it. The fallback is read-only: the
+    /// next save writes to the folder, and the legacy document is left alone
+    /// rather than trashed, so an older client on another machine keeps working.
    fn load_profile(&self, root_uid: &NodeUid) -> CoreResult<Option<Profile>> {
-        let Some(uid) = self.find_device_child_file(root_uid, PROFILE_FILE_NAME)? else {
-            return Ok(None);
+        let current = match self.find_device_child_folder(root_uid, PROFILE_DIR_NAME)? {
+            Some(dir_uid) => self.find_device_child_file(&dir_uid, PROFILE_FILE_NAME)?,
+            None => None,
+        };
+        let uid = match current {
+            Some(uid) => uid,
+            None => match self.find_device_child_file(root_uid, PROFILE_FILE_NAME)? {
+                Some(uid) => {
+                    info!("reading legacy profile from the device root");
+                    uid
+                }
+                None => return Ok(None),
+            },
        };
        let mut buf: Vec<u8> = Vec::new();
        self.rt
@@ -251,7 +296,10 @@ impl Core {

        Ok(nodes
            .into_iter()
-            .filter(|n| n.is_folder() && !n.trashed)
+            // `.proton-drive-linux` holds the profile itself, not user data:
+            // offering it as a restorable folder would sync the bookkeeping
+            // back onto the machine it describes.
+            .filter(|n| n.is_folder() && !n.trashed && n.name != PROFILE_DIR_NAME)
            .map(|n| {
                let uid = n.uid.to_string();
                let saved = profile
@@ -267,7 +315,7 @@ impl Core {
                    name: n.name,
                    local_path: proposed.to_string_lossy().to_string(),
                    mode: saved
-                        .map(|f| f.mode.clone())
+                        .map(|f| f.mode.to_string())
                        .unwrap_or_else(|| "mirror".into()),
                }
            })
@@ -319,10 +367,10 @@ impl Core {
                skipped.push(format!("{}: {e}", item.local_path));
                continue;
            }
-            let mode = match item.mode.as_str() {
-                "mirror" | "ondemand" => item.mode.as_str(),
-                other => {
-                    skipped.push(format!("{}: unknown mode {other}", item.local_path));
+            let mode = match restore_mode(&item.mode) {
+                Some(mode) => mode,
+                None => {
+                    skipped.push(format!("{}: unknown mode {}", item.local_path, item.mode));
                    continue;
                }
            };
@@ -333,7 +381,7 @@ impl Core {
            // `ondemand` is applied through the normal request path, which
            // mounts the FUSE session and handles the folder being busy — the
            // restore does not get its own copy of that logic.
-            if mode == "ondemand" {
+            if mode == MountMode::OnDemand {
                let _ = self.request_sync_folder_mode(id, "ondemand");
            }
            let _ = self.sync_tx.send(sync::SyncMsg::Reconcile(id));
@@ -350,6 +398,17 @@ impl Core {
    }
 }

+/// Accept only modes this build can safely restore. `MountMode` itself is
+/// tolerant so a future value does not reject the whole profile; the folder
+/// carrying that value is skipped here with the message assembled above.
+fn restore_mode(value: &str) -> Option<MountMode> {
+    match MountMode::from(value) {
+        MountMode::Mirror => Some(MountMode::Mirror),
+        MountMode::OnDemand => Some(MountMode::OnDemand),
+        MountMode::Unknown => None,
+    }
+}
+
 /// Whether a path recorded on another machine can be reused verbatim here.
 ///
 /// Requires the *parent* to exist: `~/Documents` on a machine with the same
@@ -382,6 +441,90 @@ mod tests {
        assert!(!path_is_usable_here(Path::new("relative/path")));
    }

+    #[test]
+    fn unknown_profile_mode_is_skipped_without_rejecting_known_modes() {
+        assert_eq!(restore_mode("mirror"), Some(MountMode::Mirror));
+        assert_eq!(restore_mode("ondemand"), Some(MountMode::OnDemand));
+        assert_eq!(restore_mode("streaming"), None);
+        assert_eq!(restore_mode("unknown"), None);
+    }
+
+    /// The device root refuses file creation (B78), so every upload in
+    /// `save_profile` must be addressed to the profile folder. Checked against
+    /// the source because both branches are pure network calls.
+    #[test]
+    fn the_profile_is_never_uploaded_to_the_device_root() {
+        let source = include_str!("profile.rs");
+        let save = function_source(source, "fn save_profile(");
+        assert!(
+            save.contains("ensure_profile_dir(&root_uid)"),
+            "save_profile resolves the profile folder"
+        );
+        for upload in [
+            "upload_new_revision_from",
+            "upload_file_replacing_draft_from",
+        ] {
+            let call = save.find(upload).expect("upload call exists");
+            let args = &save[call..];
+            let root = args.find("&root_uid").unwrap_or(usize::MAX);
+            let dir = args.find("&dir_uid").unwrap_or(usize::MAX);
+            assert!(dir < root, "{upload} must target the profile folder");
+        }
+    }
+
+    /// A read has to keep finding profiles written before the fix, which sat in
+    /// the device root.
+    #[test]
+    fn loading_falls_back_to_a_legacy_device_root_profile() {
+        let source = include_str!("profile.rs");
+        let load = function_source(source, "fn load_profile(");
+        assert!(load.contains("PROFILE_DIR_NAME"), "prefers the folder");
+        assert!(
+            load.find("PROFILE_DIR_NAME").unwrap()
+                < load.find("legacy profile").expect("legacy fallback exists"),
+            "the folder is consulted before the device root"
+        );
+    }
+
+    /// The profile folder is the client's own bookkeeping: neither the restore
+    /// picker nor `add_sync_folder` may treat it as a user folder.
+    #[test]
+    fn the_profile_folder_is_not_offered_as_user_data() {
+        let restorable = function_source(include_str!("profile.rs"), "fn list_restorable_folders(");
+        assert!(
+            restorable.contains("n.name != PROFILE_DIR_NAME"),
+            "restorable folders exclude the profile folder"
+        );
+        let add = function_source(include_str!("devices.rs"), "fn add_sync_folder(");
+        assert_before(add, "PROFILE_DIR_NAME", "ensure_device()");
+    }
+
+    fn function_source<'a>(source: &'a str, signature: &str) -> &'a str {
+        let start = source.find(signature).expect("function signature exists");
+        let body = &source[start..];
+        let open = body.find('{').expect("function body starts");
+        let mut depth = 0usize;
+        for (offset, byte) in body.as_bytes()[open..].iter().enumerate() {
+            match byte {
+                b'{' => depth += 1,
+                b'}' => {
+                    depth -= 1;
+                    if depth == 0 {
+                        return &body[..open + offset + 1];
+                    }
+                }
+                _ => {}
+            }
+        }
+        panic!("function body closes")
+    }
+
+    fn assert_before(source: &str, first: &str, second: &str) {
+        let first_at = source.find(first).expect("first operation exists");
+        let second_at = source.find(second).expect("second operation exists");
+        assert!(first_at < second_at, "{first} must precede {second}");
+    }
+
    /// A path whose parent exists but which does not itself is exactly the
    /// restore case — the directory is about to be created.
    #[test]
@@ -0,0 +1,645 @@
+//! Revision-reader cache and streamed range-read subsystem.
+
+use super::*;
+
+/// A read of an unpinned video at least this large streams *without* persisting
+/// its blocks to the on-disk cache. Playing a 2 GB film would otherwise pour it
+/// through the block LRU and evict everything else the user actually wants kept —
+/// and it re-streams cheaply enough on a rewatch that keeping it was never worth
+/// that. Pinned videos (kept offline on purpose) and anything smaller cache as
+/// usual.
+pub(super) const STREAM_BYPASS_MIN: u64 = 256 * 1024 * 1024;
+
+/// How many bytes of streamed blocks the in-memory ring keeps. Bypassing the
+/// on-disk cache must not mean re-fetching: the kernel asks for a streamed file
+/// in reads far smaller than [`BLOCK_SIZE`], so without a ring every 128 KiB the
+/// player consumes would download and decrypt a whole 4 MiB block again. Sized
+/// for a handful of blocks per concurrently-streamed file.
+const STREAM_RING_BYTES: u64 = 128 * 1024 * 1024;
+
+/// Blocks fetched *past* the one a sequential streaming read needed, warmed into
+/// the ring in the background so the player's next read is already in memory
+/// instead of waiting a round-trip. Kept small so it cannot crowd out the
+/// in-flight block governor.
+const STREAM_READAHEAD: u64 = 4;
+
+/// How many [`RevisionReader`]s stay open at once.
+///
+/// A reader holds its revision's content key and block table — a few KB even for
+/// a large file, so this is bounded for tidiness and staleness rather than
+/// memory. Evicted least-recently-used; a dropped reader costs one re-open
+/// (two API calls and a node-key unlock) the next time that file is read.
+const MAX_OPEN_READERS: usize = 64;
+
+/// An open reader plus the node metadata it was opened against.
+///
+/// The SDK pins a reader to the revision that was active at `open_revision`, so
+/// a reader is only reusable while the node still reports the same
+/// `(mtime, size)` — the same validity pair the content cache uses (a new
+/// revision bumps mtime). On a mismatch the reader is dropped and reopened.
+pub(super) struct CachedReader {
+    reader: Arc<RevisionReader>,
+    mtime: i64,
+    size: u64,
+    /// For LRU eviction.
+    last_used: Instant,
+}
+
+/// What the `readers` map holds for a node: an open reader, or the fact that
+/// someone is already opening one.
+///
+/// The `Pending` arm is what makes the map single-flight rather than merely a
+/// cache. Opening resolves link details, ancestor keys, an S2K node-key unlock
+/// and the block table — five round-trips — and read-ahead on a cold file puts
+/// several workers into the open at the same moment, so without this each
+/// racer would redo all of it and discard every result but one.
+pub(super) enum ReaderSlot {
+    Ready(CachedReader),
+    Pending(PendingOpen),
+}
+
+/// An `open_revision` in flight. Racers clone `rx` and await the leader's result
+/// instead of opening their own.
+pub(super) struct PendingOpen {
+    /// Identifies this attempt so the leader can tell "my slot is still there"
+    /// from "someone evicted or replaced it while I was on the network", and
+    /// only publish its reader in the first case.
+    id: u64,
+    /// What the leader is opening against. A racer wanting a different revision
+    /// must not join this open — it would get a reader for the wrong bytes.
+    mtime: i64,
+    size: u64,
+    rx: tokio::sync::watch::Receiver<Option<Result<Arc<RevisionReader>, Errno>>>,
+}
+
+/// Distinguishes `PendingOpen`s. Only uniqueness matters, so a plain counter
+/// does; ids are never compared for order.
+static NEXT_OPEN_ID: AtomicU64 = AtomicU64::new(0);
+
+/// Drive client, a Tokio handle to bridge the synchronous FUSE/socket threads
+/// to the async SDK, the inode bookkeeping, and the on-disk content cache.
+///
+/// Cheaply cloneable (every field is a handle/`Arc`), so the control-socket task
+/// gets its own copy while the FUSE session keeps another.
+/// In-memory LRU of blocks belonging to a file streaming past the on-disk cache
+/// (see [`STREAM_BYPASS_MIN`]). Bypassing the disk stops one film evicting the
+/// block LRU; it must not also mean the same 4 MiB block is downloaded once per
+/// 128 KiB the player reads out of it.
+///
+/// Validated by the same `(mtime, size)` pair the on-disk caches use: a node
+/// whose tag no longer matches has its blocks dropped rather than served, so a
+/// new revision can never be stitched together from the old one.
+#[derive(Default)]
+pub(super) struct StreamRing {
+    blocks: HashMap<(NodeUid, u64), Arc<Vec<u8>>>,
+    /// Keys oldest-first, for eviction.
+    order: VecDeque<(NodeUid, u64)>,
+    /// Per-node validity tag, `(mtime, size)`.
+    tags: HashMap<NodeUid, (i64, u64)>,
+    bytes: u64,
+}
+
+impl StreamRing {
+    fn get(&mut self, uid: &NodeUid, mtime: i64, size: u64, idx: u64) -> Option<Arc<Vec<u8>>> {
+        if self.tags.get(uid) != Some(&(mtime, size)) {
+            return None;
+        }
+        self.blocks.get(&(uid.clone(), idx)).cloned()
+    }
+
+    fn insert(&mut self, uid: &NodeUid, mtime: i64, size: u64, idx: u64, bytes: Arc<Vec<u8>>) {
+        if self.tags.get(uid) != Some(&(mtime, size)) {
+            // Revision changed under us (or first sight): anything held for this
+            // node describes the old one.
+            self.drop_node(uid);
+            self.tags.insert(uid.clone(), (mtime, size));
+        }
+        let key = (uid.clone(), idx);
+        if self.blocks.contains_key(&key) {
+            return;
+        }
+        self.bytes += bytes.len() as u64;
+        self.blocks.insert(key.clone(), bytes);
+        self.order.push_back(key);
+        while self.bytes > STREAM_RING_BYTES {
+            let Some(victim) = self.order.pop_front() else {
+                break;
+            };
+            if let Some(dropped) = self.blocks.remove(&victim) {
+                self.bytes -= dropped.len() as u64;
+            }
+        }
+    }
+
+    fn drop_node(&mut self, uid: &NodeUid) {
+        self.order.retain(|(u, _)| u != uid);
+        let mut freed = 0u64;
+        self.blocks.retain(|(u, _), bytes| {
+            if u == uid {
+                freed += bytes.len() as u64;
+                false
+            } else {
+                true
+            }
+        });
+        self.bytes -= freed;
+        self.tags.remove(uid);
+    }
+}
+
+impl Core {
+    /// An open [`RevisionReader`] for `uid`, reusing the cached one when it is
+    /// still valid for `(mtime, fsize)` and opening a fresh one otherwise.
+    ///
+    /// Opening resolves the file's link details, ancestor keys, node key (an S2K
+    /// unlock) and block table. Doing that once per file rather than once per
+    /// block is the whole point: a cold 100 MB read is 25 block misses, which
+    /// used to mean 25 full resolutions (50 API calls, 25 unlocks) and now means
+    /// one.
+    ///
+    /// Racing reads of one cold file open it **once**: the first caller claims
+    /// the slot and the rest await its result. That matters now that `read` is
+    /// served off the dispatch loop, because read-ahead on a first touch issues
+    /// several parallel reads of the same file as a matter of course.
+    async fn revision_reader(
+        &self,
+        uid: &NodeUid,
+        mtime: i64,
+        fsize: u64,
+    ) -> Result<Arc<RevisionReader>, Errno> {
+        loop {
+            // Decide under the lock, act outside it — network I/O must never run
+            // under a std `Mutex`, and an await must never hold one.
+            enum Act {
+                Hit(Arc<RevisionReader>),
+                Join(tokio::sync::watch::Receiver<Option<Result<Arc<RevisionReader>, Errno>>>),
+                Lead(
+                    u64,
+                    tokio::sync::watch::Sender<Option<Result<Arc<RevisionReader>, Errno>>>,
+                ),
+            }
+            let act = {
+                let mut readers = self.readers.lock();
+                match readers.get_mut(uid) {
+                    Some(ReaderSlot::Ready(entry))
+                        if entry.mtime == mtime && entry.size == fsize =>
+                    {
+                        entry.last_used = Instant::now();
+                        Act::Hit(entry.reader.clone())
+                    }
+                    Some(ReaderSlot::Pending(p)) if p.mtime == mtime && p.size == fsize => {
+                        Act::Join(p.rx.clone())
+                    }
+                    // Either nothing here, or something for a revision we no
+                    // longer want (a stale reader, or an open for one). Ours
+                    // replaces it: the newer `(mtime, size)` is the truth.
+                    _ => {
+                        let id = NEXT_OPEN_ID.fetch_add(1, Ordering::Relaxed);
+                        let (tx, rx) = tokio::sync::watch::channel(None);
+                        readers.insert(
+                            uid.clone(),
+                            ReaderSlot::Pending(PendingOpen {
+                                id,
+                                mtime,
+                                size: fsize,
+                                rx,
+                            }),
+                        );
+                        Act::Lead(id, tx)
+                    }
+                }
+            };
+
+            match act {
+                Act::Hit(reader) => return Ok(reader),
+                Act::Join(mut rx) => {
+                    // `changed()` errors only if the leader dropped its sender
+                    // without publishing — it panicked. Retry from the top
+                    // rather than fail: the slot it left is gone, so this pass
+                    // leads its own open.
+                    loop {
+                        if let Some(result) = rx.borrow_and_update().clone() {
+                            return result;
+                        }
+                        if rx.changed().await.is_err() {
+                            break;
+                        }
+                    }
+                    continue;
+                }
+                Act::Lead(id, tx) => {
+                    debug!(%uid, mtime, fsize, "opening revision");
+                    let result = match self.client.open_revision(uid).await {
+                        Ok(reader) => Ok(Arc::new(reader)),
+                        Err(e) => {
+                            warn!(%uid, error = %e, "open_revision failed");
+                            Err(Errno::EIO)
+                        }
+                    };
+                    {
+                        let mut readers = self.readers.lock();
+                        // Publish only into the slot we claimed. If it is gone
+                        // or belongs to a later attempt, an eviction or a newer
+                        // revision overtook us: our reader still answers the
+                        // callers waiting on it, but it must not be cached.
+                        let ours = matches!(
+                            readers.get(uid),
+                            Some(ReaderSlot::Pending(p)) if p.id == id
+                        );
+                        if ours {
+                            match &result {
+                                Ok(reader) => {
+                                    readers.insert(
+                                        uid.clone(),
+                                        ReaderSlot::Ready(CachedReader {
+                                            reader: reader.clone(),
+                                            mtime,
+                                            size: fsize,
+                                            last_used: Instant::now(),
+                                        }),
+                                    );
+                                }
+                                // Never cache a failure: the next read retries.
+                                Err(_) => {
+                                    readers.remove(uid);
+                                }
+                            }
+                        }
+                        Self::trim_readers(&mut readers);
+                    }
+                    // After the map is updated, so a racer that wakes and
+                    // re-enters finds the finished slot rather than racing us.
+                    let _ = tx.send(Some(result.clone()));
+                    return result;
+                }
+            }
+        }
+    }
+
+    /// Bound the reader map: drop least-recently-used entries until it is back
+    /// at [`MAX_OPEN_READERS`]. Only `Ready` slots are eviction candidates — a
+    /// `Pending` has callers waiting on it and no reader to drop yet.
+    fn trim_readers(readers: &mut HashMap<NodeUid, ReaderSlot>) {
+        while readers.len() > MAX_OPEN_READERS {
+            let victim = readers
+                .iter()
+                .filter_map(|(uid, slot)| match slot {
+                    ReaderSlot::Ready(entry) => Some((uid, entry.last_used)),
+                    ReaderSlot::Pending(_) => None,
+                })
+                .min_by_key(|(_, last_used)| *last_used)
+                .map(|(uid, _)| uid.clone());
+            let Some(victim) = victim else {
+                break; // every slot is an open in flight; nothing to drop
+            };
+            readers.remove(&victim);
+        }
+    }
+
+    /// Drop any open reader for `uid`, so the next read reopens against the
+    /// current revision. Called wherever cached content is evicted.
+    ///
+    /// Drops an in-flight open too: its leader finds the slot gone and declines
+    /// to cache what it opened, which is what we want — the eviction says that
+    /// revision is no longer the truth.
+    pub(super) fn evict_reader(&self, uid: &NodeUid) {
+        self.readers.lock().remove(uid);
+    }
+
+    /// Serve bytes `[offset, offset + len)` of `uid`'s active revision, hitting
+    /// the on-disk caches before the network: a whole-file blob (pinned files)
+    /// first, then the block cache — fetching only the [`BLOCK_SIZE`]-aligned
+    /// blocks that overlap the request and caching each. `mtime`/`fsize` validate
+    /// both caches. Network I/O runs without any lock held.
+    pub(super) fn read_range(
+        &self,
+        uid: &NodeUid,
+        mtime: i64,
+        fsize: u64,
+        offset: u64,
+        len: u64,
+        cache_blocks: bool,
+    ) -> Result<Vec<u8>, Errno> {
+        // A queued write has not reached the remote yet, so the remote's current
+        // revision is stale and the staged blob is the truth. Serve from it until
+        // the drain worker lands the upload (offline.md Phase 3).
+        if let Some(pending) = self.pending.lock().get(uid).cloned() {
+            return self.read_pending(&pending, offset, len);
+        }
+        // A node created offline and never written has no blob and no remote: it
+        // is an empty file, and asking the API about a `local~` uid would only
+        // earn a 404 (offline.md Phase 3b).
+        if is_local_uid(uid) {
+            return Ok(Vec::new());
+        }
+        self.read_range_remote(uid, mtime, fsize, offset, len, cache_blocks)
+    }
+
+    /// Serve a read from a staged blob, falling back to the remote base for any
+    /// range the write did not author (an incomplete [`StagedWrite`] holds zeros
+    /// there, which must never be handed out as content).
+    fn read_pending(
+        &self,
+        pending: &PendingRevision,
+        offset: u64,
+        len: u64,
+    ) -> Result<Vec<u8>, Errno> {
+        let m = &pending.meta;
+        if offset >= m.len || len == 0 {
+            return Ok(Vec::new());
+        }
+        let uid = parse_node_uid(&m.uid).ok_or(Errno::EIO)?;
+        let file = File::open(&pending.path).map_err(|e| {
+            error!(%uid, path = %pending.path.display(), error = %e, "open staged blob failed");
+            Errno::EIO
+        })?;
+        let mut written = Intervals::default();
+        for &(s, e) in &m.authored {
+            written.add(s, e);
+        }
+        // Same merge as `serve_open_read`, but resolving gaps against the remote
+        // rather than through `read_range` — going through `read_range` would find
+        // this very pending op and recurse.
+        let end = offset.saturating_add(len).min(m.len);
+        let mut out = Vec::with_capacity((end - offset) as usize);
+        for (s, e, authored) in written.segments(offset, end) {
+            if authored {
+                let mut buf = vec![0u8; (e - s) as usize];
+                file.read_exact_at(&mut buf, s).map_err(|err| {
+                    warn!(%uid, error = %err, "staged blob read failed");
+                    Errno::EIO
+                })?;
+                out.extend_from_slice(&buf);
+                continue;
+            }
+            let bend = e.min(m.base_size);
+            if s < bend {
+                out.extend_from_slice(&self.read_range_remote(
+                    &uid,
+                    m.base_mtime,
+                    m.base_size,
+                    s,
+                    bend - s,
+                    true,
+                )?);
+            }
+            // Past the base: a hole the write extended over.
+            out.resize(out.len() + e.saturating_sub(s.max(m.base_size)) as usize, 0);
+        }
+        Ok(out)
+    }
+
+    /// Warm the [`STREAM_READAHEAD`] blocks after `last` into the ring, in the
+    /// background, so a player reading forward finds its next block already in
+    /// memory rather than paying a fetch + decrypt round-trip at each boundary.
+    ///
+    /// Fire-and-forget: a failure here is not an error, it only means the read
+    /// that needs those bytes will fetch them itself.
+    fn stream_readahead(&self, uid: &NodeUid, mtime: i64, fsize: u64, last: u64) {
+        let last_block = (fsize.saturating_sub(1)) / BLOCK_SIZE;
+        let wanted: Vec<u64> = ((last + 1)..=(last + STREAM_READAHEAD).min(last_block))
+            .filter(|&bidx| {
+                self.stream_ring
+                    .lock()
+                    .get(uid, mtime, fsize, bidx)
+                    .is_none()
+            })
+            .collect();
+        if wanted.is_empty() {
+            return;
+        }
+        let core = self.clone();
+        let uid = uid.clone();
+        self.rt.spawn(async move {
+            let Ok(reader) = core.revision_reader(&uid, mtime, fsize).await else {
+                return;
+            };
+            // Concurrently, for the same reason the demand path fetches its
+            // misses concurrently: serially awaited blocks cost the sum of their
+            // round-trips, and the player catches up with the readahead before it
+            // finishes. The SDK's in-flight block governor bounds the fan-out.
+            let mut set = tokio::task::JoinSet::new();
+            for bidx in wanted {
+                let reader = reader.clone();
+                let bstart = bidx * BLOCK_SIZE;
+                let blen = BLOCK_SIZE.min(fsize - bstart);
+                set.spawn(async move { (bidx, reader.read_at(bstart, blen).await) });
+            }
+            while let Some(joined) = set.join_next().await {
+                let Ok((bidx, read)) = joined else { continue };
+                match read {
+                    Ok(bytes) => {
+                        core.stream_ring
+                            .lock()
+                            .insert(&uid, mtime, fsize, bidx, Arc::new(bytes))
+                    }
+                    Err(e) => debug!(%uid, bidx, error = %e, "stream readahead failed"),
+                }
+            }
+        });
+    }
+
+    /// Read from the content cache, else the remote. The base-content path, with
+    /// no awareness of queued writes — callers wanting the file's *current*
+    /// content want [`Core::read_range`]. Gap-filling a staged blob is the one
+    /// caller that genuinely means "the base", since that is what its zeroed
+    /// ranges have to be filled from.
+    fn read_range_remote(
+        &self,
+        uid: &NodeUid,
+        mtime: i64,
+        fsize: u64,
+        offset: u64,
+        len: u64,
+        cache_blocks: bool,
+    ) -> Result<Vec<u8>, Errno> {
+        if let Some(bytes) = self.cache.read_range(uid, mtime, fsize, offset, len) {
+            return Ok(bytes);
+        }
+        if offset >= fsize || len == 0 {
+            return Ok(Vec::new());
+        }
+        let end = offset.saturating_add(len).min(fsize);
+        let mut out = Vec::with_capacity((end - offset) as usize);
+        let first = offset / BLOCK_SIZE;
+        let last = (end - 1) / BLOCK_SIZE;
+
+        // Collect the blocks overlapping the request, serving any already cached
+        // and fetching the rest concurrently. A multi-block read (e.g. a media
+        // player buffering, or a large sequential read split into one FUSE call)
+        // would otherwise stall on each block round-trip in turn; downloading the
+        // misses in parallel saturates the connection and bounds latency at the
+        // slowest single block instead of their sum.
+        let mut blocks: Vec<Option<Arc<Vec<u8>>>> = Vec::with_capacity((last - first + 1) as usize);
+        let mut misses: Vec<u64> = Vec::new();
+        for bidx in first..=last {
+            // A streaming read keeps its blocks only in memory, so the ring is
+            // the only cache it has — check it before the disk (which will not
+            // hold them) and before the network (which would refetch the same
+            // 4 MiB block for every 128 KiB the player consumes).
+            let hit = if cache_blocks {
+                self.cache
+                    .cached_block(uid, mtime, fsize, bidx)
+                    .map(Arc::new)
+            } else {
+                self.stream_ring.lock().get(uid, mtime, fsize, bidx)
+            };
+            match hit {
+                Some(b) => blocks.push(Some(b)),
+                None => {
+                    blocks.push(None);
+                    misses.push(bidx);
+                }
+            }
+        }
+
+        if !misses.is_empty() {
+            let fetched = self.rt.block_on(async {
+                // Resolve the file's keys and block table once, then read every
+                // missing block through the shared reader. Previously each block
+                // called `download_range`, which redid that resolution per block.
+                let reader = self.revision_reader(uid, mtime, fsize).await?;
+
+                let mut set = tokio::task::JoinSet::new();
+                for &bidx in &misses {
+                    let reader = reader.clone();
+                    let uid = uid.clone();
+                    let bstart = bidx * BLOCK_SIZE;
+                    let blen = BLOCK_SIZE.min(fsize - bstart);
+                    set.spawn(async move {
+                        reader
+                            .read_at(bstart, blen)
+                            .await
+                            .map(|bytes| (bidx, bytes))
+                            .map_err(|e| {
+                                warn!(%uid, bstart, blen, error = %e, "block read failed");
+                                Errno::EIO
+                            })
+                    });
+                }
+                let mut out = Vec::with_capacity(misses.len());
+                while let Some(joined) = set.join_next().await {
+                    // A join error means the task panicked; surface it as EIO.
+                    out.push(joined.map_err(|_| Errno::EIO)??);
+                }
+                Ok::<_, Errno>(out)
+            })?;
+            for (bidx, bytes) in fetched {
+                // A streaming read (large unpinned video) skips the on-disk cache
+                // so it can't evict the rest of it; it keeps the block in the
+                // in-memory ring instead, which is bounded and dies with the read.
+                let bytes = Arc::new(bytes);
+                if cache_blocks {
+                    let _ = self.cache.store_block(uid, mtime, fsize, bidx, &bytes);
+                } else {
+                    self.stream_ring
+                        .lock()
+                        .insert(uid, mtime, fsize, bidx, bytes.clone());
+                }
+                blocks[(bidx - first) as usize] = Some(bytes);
+            }
+            if !cache_blocks {
+                self.stream_readahead(uid, mtime, fsize, last);
+            }
+        }
+
+        for (i, block) in blocks.into_iter().enumerate() {
+            let bidx = first + i as u64;
+            let bstart = bidx * BLOCK_SIZE;
+            // Every slot is populated: cache hits up front, misses by the fetch above.
+            let block = block.expect("block fetched or cached");
+            let s = (offset.max(bstart) - bstart) as usize;
+            let e = (end.min(bstart + block.len() as u64) - bstart) as usize;
+            if s < e {
+                out.extend_from_slice(&block[s..e]);
+            }
+        }
+        Ok(out)
+    }
+
+    /// Serve a read against an open write handle: stitch authored ranges (from
+    /// the scratch file) and untouched ranges (from the remote base via the
+    /// block cache) in order, zero-filling any region past the base.
+    #[allow(clippy::too_many_arguments)]
+    pub(super) fn serve_open_read(
+        &self,
+        file: &Arc<File>,
+        len: u64,
+        uid: &NodeUid,
+        base_mtime: i64,
+        base_size: u64,
+        written: &Intervals,
+        offset: u64,
+        size: u64,
+    ) -> Result<Vec<u8>, Errno> {
+        if offset >= len || size == 0 {
+            return Ok(Vec::new());
+        }
+        let end = offset.saturating_add(size).min(len);
+        let mut out = Vec::with_capacity((end - offset) as usize);
+        for (s, e, authored) in written.segments(offset, end) {
+            if authored {
+                let mut buf = vec![0u8; (e - s) as usize];
+                file.read_exact_at(&mut buf, s).map_err(|err| {
+                    warn!(%uid, error = %err, "scratch read failed");
+                    Errno::EIO
+                })?;
+                out.extend_from_slice(&buf);
+            } else {
+                let bend = e.min(base_size);
+                if s < bend {
+                    out.extend_from_slice(&self.read_range(
+                        uid,
+                        base_mtime,
+                        base_size,
+                        s,
+                        bend - s,
+                        true,
+                    )?);
+                }
+                // Anything past the base is a hole: zero-fill.
+                let zeros = e.saturating_sub(s.max(base_size));
+                out.resize(out.len() + zeros as usize, 0);
+            }
+        }
+        Ok(out)
+    }
+
+    /// Fill every unauthored range of a scratch/staged file that overlaps its
+    /// base with the base's bytes, so the file becomes the complete new content.
+    ///
+    /// This is the step a partial overwrite cannot skip: only the authored bytes
+    /// were ever written to disk, and a revision upload sends the whole file.
+    /// The gaps come from the *remote base* (through the block cache, so a small
+    /// edit of a large file does not pull all of it), which is exactly why this
+    /// can fail with no network — see `StagedWrite`.
+    pub(super) fn fill_gaps(
+        &self,
+        uid: &NodeUid,
+        file: &File,
+        len: u64,
+        base_mtime: i64,
+        base_size: u64,
+        written: &Intervals,
+    ) -> Result<(), Errno> {
+        file.set_len(len).map_err(|e| {
+            error!(%uid, error = %e, "resize scratch file failed");
+            Errno::EIO
+        })?;
+        for (s, e, authored) in written.segments(0, len) {
+            if authored {
+                continue;
+            }
+            let bend = e.min(base_size);
+            if s >= bend {
+                continue; // wholly past the base: already zero-filled on disk
+            }
+            let bytes = self.read_range_remote(uid, base_mtime, base_size, s, bend - s, true)?;
+            file.write_all_at(&bytes, s).map_err(|err| {
+                error!(%uid, error = %err, "scratch gap-fill write failed");
+                Errno::EIO
+            })?;
+        }
+        Ok(())
+    }
+}
@@ -19,10 +19,15 @@ use proton_drive_rs::Node;

 use super::{Core, ROOT_INO, node_size, parse_uid, public_link_info, role_from_str, role_to_str};

-/// A node from a *shared* listing as a [`DirEntry`]. Shared nodes live outside
-/// the mount, so the entry is uid-addressed: `path` is empty, and the local-state
-/// flags (`pinned`, `cached`) are false — they describe my own tree, not this one.
-fn shared_entry(n: Node) -> DirEntry {
+/// A node from a *shared* listing as a [`DirEntry`].
+///
+/// Still uid-addressed — that is the only handle a foreign-volume node is
+/// guaranteed to have — but `path` is filled in when the node is resident under
+/// the synthetic `Shared with me/` directory, which is what lets a front-end
+/// offer path-keyed actions on it. The local-state flags (`pinned`, `cached`)
+/// stay false: they describe content this account owns a local copy policy for,
+/// which a share on someone else's volume is not.
+fn shared_entry_of(core: &Core, n: Node) -> DirEntry {
    let is_dir = n.is_folder();
    let size = match &n.kind {
        NodeKind::File {
@@ -32,6 +37,13 @@ fn shared_entry(n: Node) -> DirEntry {
        } => claimed_size.unwrap_or(*total_size_on_storage).max(0) as u64,
        NodeKind::Folder => 0,
    };
+    let role = n
+        .membership
+        .as_ref()
+        .and_then(|m| m.role_exact())
+        .map(role_to_str)
+        .unwrap_or_default()
+        .to_string();
    DirEntry {
        name: n.name,
        is_dir,
@@ -39,8 +51,9 @@ fn shared_entry(n: Node) -> DirEntry {
        modified: n.modification_time,
        pinned: false,
        cached: false,
+        path: core.rel_path_for_uid(&n.uid).unwrap_or_default(),
        uid: n.uid.to_string(),
-        path: String::new(),
+        role,
    }
 }

@@ -57,11 +70,33 @@ impl Core {
        message: Option<&str>,
    ) -> CoreResult<(usize, usize)> {
        let (_ino, uid) = self.resolve(rel)?;
+        self.share_node_for_uid(&uid, emails, role, message)
+    }
+
+    /// [`Core::share_node`] for a node addressed through any daemon location.
+    pub(crate) fn share_node_by_uid(
+        &self,
+        uid: &str,
+        emails: &[String],
+        role: &str,
+        message: Option<&str>,
+    ) -> CoreResult<(usize, usize)> {
+        let uid = self.resolve_anywhere(uid)?;
+        self.share_node_for_uid(&uid, emails, role, message)
+    }
+
+    fn share_node_for_uid(
+        &self,
+        uid: &NodeUid,
+        emails: &[String],
+        role: &str,
+        message: Option<&str>,
+    ) -> CoreResult<(usize, usize)> {
        let role = role_from_str(role)?;
        let invitees: Vec<(String, MemberRole)> =
            emails.iter().map(|e| (e.clone(), role)).collect();
        self.rt
-            .block_on(self.client.invite_users(&uid, &invitees, message))
+            .block_on(self.client.invite_users(uid, &invitees, message))
            .map_err(|e| CoreError::from_api(&e, "share"))
    }

@@ -71,11 +106,26 @@ impl Core {
        rel: &Path,
    ) -> CoreResult<(Vec<ShareEntry>, Option<PublicLinkInfo>)> {
        let (_ino, uid) = self.resolve(rel)?;
+        self.list_share_for_uid(&uid)
+    }

+    /// [`Core::list_share`] for a node addressed through any daemon location.
+    pub(crate) fn list_share_by_uid(
+        &self,
+        uid: &str,
+    ) -> CoreResult<(Vec<ShareEntry>, Option<PublicLinkInfo>)> {
+        let uid = self.resolve_anywhere(uid)?;
+        self.list_share_for_uid(&uid)
+    }
+
+    fn list_share_for_uid(
+        &self,
+        uid: &NodeUid,
+    ) -> CoreResult<(Vec<ShareEntry>, Option<PublicLinkInfo>)> {
        let mut entries = Vec::new();
        for m in self
            .rt
-            .block_on(self.client.list_share_members(&uid))
+            .block_on(self.client.list_share_members(uid))
            .map_err(|e| CoreError::from_api(&e, "list members"))?
        {
            entries.push(ShareEntry {
@@ -87,7 +137,7 @@ impl Core {
        }
        for inv in self
            .rt
-            .block_on(self.client.list_share_invitations(&uid))
+            .block_on(self.client.list_share_invitations(uid))
            .map_err(|e| CoreError::from_api(&e, "list invitations"))?
        {
            entries.push(ShareEntry {
@@ -99,7 +149,7 @@ impl Core {
        }
        for ext in self
            .rt
-            .block_on(self.client.list_external_invitations(&uid))
+            .block_on(self.client.list_external_invitations(uid))
            .map_err(|e| CoreError::from_api(&e, "list external invitations"))?
        {
            entries.push(ShareEntry {
@@ -112,7 +162,7 @@ impl Core {

        let link = self
            .rt
-            .block_on(self.client.get_public_link(&uid))
+            .block_on(self.client.get_public_link(uid))
            .map_err(|e| CoreError::from_api(&e, "get public link"))?
            .map(public_link_info);

@@ -129,12 +179,35 @@ impl Core {
        role: &str,
    ) -> CoreResult<()> {
        let (_ino, uid) = self.resolve(rel)?;
+        self.update_share_role_for_uid(&uid, id, kind, role)
+    }
+
+    /// [`Core::update_share_role`] for a node addressed through any daemon
+    /// location.
+    pub(crate) fn update_share_role_by_uid(
+        &self,
+        uid: &str,
+        id: &str,
+        kind: ShareEntryKind,
+        role: &str,
+    ) -> CoreResult<()> {
+        let uid = self.resolve_anywhere(uid)?;
+        self.update_share_role_for_uid(&uid, id, kind, role)
+    }
+
+    fn update_share_role_for_uid(
+        &self,
+        uid: &NodeUid,
+        id: &str,
+        kind: ShareEntryKind,
+        role: &str,
+    ) -> CoreResult<()> {
        let role = role_from_str(role)?;
        match kind {
            ShareEntryKind::Member => {
                let member = self
                    .rt
-                    .block_on(self.client.list_share_members(&uid))
+                    .block_on(self.client.list_share_members(uid))
                    .map_err(|e| CoreError::from_api(&e, "list members"))?
                    .into_iter()
                    .find(|m| m.membership_id.to_string() == id)
@@ -146,7 +219,7 @@ impl Core {
            ShareEntryKind::ProtonInvite => {
                let inv = self
                    .rt
-                    .block_on(self.client.list_share_invitations(&uid))
+                    .block_on(self.client.list_share_invitations(uid))
                    .map_err(|e| CoreError::from_api(&e, "list invitations"))?
                    .into_iter()
                    .find(|i| i.invitation_id == id)
@@ -170,11 +243,32 @@ impl Core {
        kind: ShareEntryKind,
    ) -> CoreResult<()> {
        let (_ino, uid) = self.resolve(rel)?;
+        self.remove_share_entry_for_uid(&uid, id, kind)
+    }
+
+    /// [`Core::remove_share_entry`] for a node addressed through any daemon
+    /// location.
+    pub(crate) fn remove_share_entry_by_uid(
+        &self,
+        uid: &str,
+        id: &str,
+        kind: ShareEntryKind,
+    ) -> CoreResult<()> {
+        let uid = self.resolve_anywhere(uid)?;
+        self.remove_share_entry_for_uid(&uid, id, kind)
+    }
+
+    fn remove_share_entry_for_uid(
+        &self,
+        uid: &NodeUid,
+        id: &str,
+        kind: ShareEntryKind,
+    ) -> CoreResult<()> {
        match kind {
            ShareEntryKind::Member => {
                let member = self
                    .rt
-                    .block_on(self.client.list_share_members(&uid))
+                    .block_on(self.client.list_share_members(uid))
                    .map_err(|e| CoreError::from_api(&e, "list members"))?
                    .into_iter()
                    .find(|m| m.membership_id.to_string() == id)
@@ -186,7 +280,7 @@ impl Core {
            ShareEntryKind::ProtonInvite => {
                let inv = self
                    .rt
-                    .block_on(self.client.list_share_invitations(&uid))
+                    .block_on(self.client.list_share_invitations(uid))
                    .map_err(|e| CoreError::from_api(&e, "list invitations"))?
                    .into_iter()
                    .find(|i| i.invitation_id == id)
@@ -198,7 +292,7 @@ impl Core {
            ShareEntryKind::ExternalInvite => {
                let ext = self
                    .rt
-                    .block_on(self.client.list_external_invitations(&uid))
+                    .block_on(self.client.list_external_invitations(uid))
                    .map_err(|e| CoreError::from_api(&e, "list external invitations"))?
                    .into_iter()
                    .find(|i| i.invitation_id == id)
@@ -219,13 +313,33 @@ impl Core {
        expires: Option<i64>,
    ) -> CoreResult<PublicLinkInfo> {
        let (_ino, uid) = self.resolve(rel)?;
+        self.create_public_link_for_uid(&uid, role, password, expires)
+    }
+
+    /// [`Core::create_public_link`] for a node addressed through any daemon
+    /// location.
+    pub(crate) fn create_public_link_by_uid(
+        &self,
+        uid: &str,
+        role: &str,
+        password: Option<&str>,
+        expires: Option<i64>,
+    ) -> CoreResult<PublicLinkInfo> {
+        let uid = self.resolve_anywhere(uid)?;
+        self.create_public_link_for_uid(&uid, role, password, expires)
+    }
+
+    fn create_public_link_for_uid(
+        &self,
+        uid: &NodeUid,
+        role: &str,
+        password: Option<&str>,
+        expires: Option<i64>,
+    ) -> CoreResult<PublicLinkInfo> {
        let role = role_from_str(role)?;
        let link = self
            .rt
-            .block_on(
-                self.client
-                    .create_public_link(&uid, role, password, expires),
-            )
+            .block_on(self.client.create_public_link(uid, role, password, expires))
            .map_err(|e| CoreError::from_api(&e, "create public link"))?;
        Ok(public_link_info(link))
    }
@@ -233,9 +347,20 @@ impl Core {
    /// Remove the public link `id` from the node at `rel`.
    pub(crate) fn remove_public_link(&self, rel: &Path, id: &str) -> CoreResult<()> {
        let (_ino, uid) = self.resolve(rel)?;
+        self.remove_public_link_for_uid(&uid, id)
+    }
+
+    /// [`Core::remove_public_link`] for a node addressed through any daemon
+    /// location.
+    pub(crate) fn remove_public_link_by_uid(&self, uid: &str, id: &str) -> CoreResult<()> {
+        let uid = self.resolve_anywhere(uid)?;
+        self.remove_public_link_for_uid(&uid, id)
+    }
+
+    fn remove_public_link_for_uid(&self, uid: &NodeUid, id: &str) -> CoreResult<()> {
        let link = self
            .rt
-            .block_on(self.client.get_public_link(&uid))
+            .block_on(self.client.get_public_link(uid))
            .map_err(|e| CoreError::from_api(&e, "get public link"))?
            .filter(|l| l.public_link_id == id)
            .ok_or_else(|| CoreError::not_found("public link not found"))?;
@@ -259,7 +384,10 @@ impl Core {
            .rt
            .block_on(self.client.enumerate_nodes(&uids))
            .map_err(|e| CoreError::from_api(&e, "enumerate nodes"))?;
-        Ok(nodes.into_iter().map(shared_entry).collect())
+        Ok(nodes
+            .into_iter()
+            .map(|node| shared_entry_of(self, node))
+            .collect())
    }

    /// List the children of a folder shared with me, addressed by uid.
@@ -281,7 +409,10 @@ impl Core {
            .rt
            .block_on(self.client.enumerate_nodes(&child_uids))
            .map_err(|e| CoreError::from_api(&e, "enumerate nodes"))?;
-        Ok(nodes.into_iter().map(shared_entry).collect())
+        Ok(nodes
+            .into_iter()
+            .map(|node| shared_entry_of(self, node))
+            .collect())
    }

    /// Download a file shared with me into the content cache, returning its
@@ -466,15 +597,33 @@ impl Core {
    /// been seen through the mount (e.g. shared but not browsed to this session) —
    /// the caller then leaves the path empty.
    pub(crate) fn rel_path_for_uid(&self, uid: &NodeUid) -> Option<String> {
-        let st = self.state.lock();
-        let mut ino = *st.by_uid.get(uid)?;
-        let mut parts = Vec::new();
-        while ino != ROOT_INO {
-            let entry = st.entries.get(&ino)?;
-            parts.push(entry.node.name.clone());
-            ino = entry.parent;
-        }
-        parts.reverse();
-        Some(parts.join("/"))
+        // Searched across every mount: a node browsed through a sync folder is
+        // interned in that fork's inode space, so the primary state alone had no
+        // entry for it and the caller silently showed an empty path
+        // (`docs/BUGS.md` B74). The path is relative to whichever mount holds
+        // it, which is the one the user reached it through.
+        let mut path = None;
+        self.for_each_state(|st| {
+            if path.is_some() {
+                return;
+            }
+            path = walk_to_root(st, uid);
+        });
+        path
    }
 }
+
+/// Walk one inode space from `uid` up to its root, building the path. `None` if
+/// that mount has never interned the node, or if the chain breaks partway —
+/// a broken chain is a missing path, never a partial one.
+fn walk_to_root(st: &super::State, uid: &NodeUid) -> Option<String> {
+    let mut ino = *st.by_uid.get(uid)?;
+    let mut parts = Vec::new();
+    while ino != ROOT_INO {
+        let entry = st.entries.get(&ino)?;
+        parts.push(entry.node.name.clone());
+        ino = entry.parent;
+    }
+    parts.reverse();
+    Some(parts.join("/"))
+}
@@ -0,0 +1,471 @@
+//! Background conflict sweep.
+//!
+//! A `(sync-conflict <ts>)` copy is only ever a fallback: the drain and the sync
+//! engine cut one when they cannot prove a queued write is safe to apply, so the
+//! user never loses bytes. Most of those copies turn out to be byte-identical to
+//! the live file — a spurious conflict from a re-stamped revision (B16/B25) or a
+//! first-sync of an already-identical file. This sweep reconciles them after the
+//! fact:
+//!
+//! - **Identical** to the live sibling (same size *and* same content SHA-1): the
+//!   copy is redundant, so it is trashed and logged as a [`ActivityKind::Trash`].
+//! - **Divergent** (different bytes) or **orphaned** (no live sibling): left in
+//!   place and surfaced once as an [`ActivityKind::Conflict`], because only the
+//!   user can decide which version wins.
+//!
+//! Identity is proved without downloading anything: the SHA-1 comes from the
+//! revision's decrypted extended attributes, which enumeration already reads. A
+//! copy whose sibling has no recorded SHA-1 is treated as divergent — the sweep
+//! never removes a file it cannot prove is a duplicate.
+
+use std::collections::HashMap;
+use std::time::Duration;
+
+use pdfs_core::config::SweepMode;
+use pdfs_core::control::ActivityKind;
+use proton_drive_rs::proton_sdk::ids::NodeUid;
+use tracing::{debug, info, warn};
+
+use super::{Core, node_content_sha1, node_revision_id, node_size};
+
+/// Time between sweeps. Conflicts are rare and non-urgent; a slow cadence keeps
+/// the sweep off the hot path while still cleaning up within a few minutes.
+const CONFLICT_SWEEP_INTERVAL: Duration = Duration::from_secs(300);
+
+/// Delay before the first sweep, so it does not compete with the burst of work a
+/// fresh mount does at startup (hydrate, recover, initial enumeration).
+const CONFLICT_SWEEP_WARMUP: Duration = Duration::from_secs(30);
+
+/// Strip a ` (sync-conflict <stamp>)` (optionally `-<n>`) marker from `name`,
+/// returning the original file name it was a copy of. `None` when `name` is not a
+/// conflict copy. Inverse of the `conflict_name` / `conflict_path_with_suffix`
+/// formats, so the two halves of the product agree on what a conflict is.
+pub(crate) fn conflict_base_name(name: &str) -> Option<String> {
+    const MARKER: &str = " (sync-conflict ";
+    let start = name.find(MARKER)?;
+    let after = start + MARKER.len();
+    let close_rel = name[after..].find(')')?;
+    let close = after + close_rel;
+    let inner = &name[after..close];
+    // The token is `<digits>` or `<digits>-<digits>`; reject anything else so a
+    // file that merely happens to contain the phrase is not mistaken for a copy.
+    let mut parts = inner.splitn(2, '-');
+    let stamp = parts.next().unwrap_or_default();
+    let suffix = parts.next();
+    let is_digits = |s: &str| !s.is_empty() && s.bytes().all(|b| b.is_ascii_digit());
+    if !is_digits(stamp) || suffix.is_some_and(|s| !is_digits(s)) {
+        return None;
+    }
+    let mut base = String::with_capacity(start + name.len() - close);
+    base.push_str(&name[..start]);
+    base.push_str(&name[close + 1..]);
+    Some(base)
+}
+
+impl Core {
+    /// Sweep for stale conflict copies forever, on its own thread. See the module
+    /// docs for the identical/divergent policy.
+    pub(crate) fn run_conflict_sweep_loop(&self) {
+        std::thread::sleep(CONFLICT_SWEEP_WARMUP);
+        loop {
+            self.sweep_conflicts_once();
+            std::thread::sleep(CONFLICT_SWEEP_INTERVAL);
+        }
+    }
+
+    /// One sweep pass over every node the daemon currently knows.
+    fn sweep_conflicts_once(&self) {
+        let stored = match self.db.load_all() {
+            Ok(s) => s,
+            Err(e) => {
+                warn!(error = ?e, "conflict sweep: load nodes failed");
+                return;
+            }
+        };
+        let nodes: Vec<_> = stored
+            .into_iter()
+            .map(|stored| stored.node)
+            .filter(|node| self.is_own_or_virtual(&node.uid))
+            .collect();
+
+        // Index live (non-trashed) files by (parent, name) for sibling lookup.
+        let mut by_parent_name: HashMap<(String, &str), &_> = HashMap::new();
+        for node in &nodes {
+            if node.trashed || node.is_folder() {
+                continue;
+            }
+            let parent = node
+                .parent_uid
+                .as_ref()
+                .map(|u| u.to_string())
+                .unwrap_or_default();
+            by_parent_name.insert((parent, node.name.as_str()), node);
+        }
+
+        let online = self.online.load(std::sync::atomic::Ordering::Relaxed);
+        for node in &nodes {
+            if node.trashed || node.is_folder() {
+                continue;
+            }
+            let Some(base) = conflict_base_name(&node.name) else {
+                continue;
+            };
+            let parent = node
+                .parent_uid
+                .as_ref()
+                .map(|u| u.to_string())
+                .unwrap_or_default();
+            let sibling = by_parent_name.get(&(parent, base.as_str())).copied();
+
+            match decide(node, sibling, &base, self.sweep_mode) {
+                SweepAction::Remove => {
+                    // Only while online — the remote trash is the point. Offline,
+                    // it waits for a later pass.
+                    if online {
+                        self.remove_conflict_copy(node, &base);
+                    }
+                }
+                SweepAction::Flag(detail) => self.flag_conflict(&node.uid, &node.name, detail),
+            }
+        }
+    }
+
+    /// Trash a conflict copy proven identical to its live sibling, and unhook it
+    /// locally — the same sequence the interactive unlink path uses after a trash.
+    ///
+    /// `snapshot` is the node as the pass saw it, which by now is stale: the pass
+    /// enumerated every node up front and has been doing network I/O since. Before
+    /// touching anything remote this re-reads the node and refuses to act unless
+    /// it is *still* the same revision, still untrashed, still unwritten and still
+    /// unopened. Without that, a user edit landing inside the window is destroyed
+    /// — `discard_queued_ops` below drops the queued write *and its staged blob*,
+    /// which may hold the only copy of those bytes (`docs/BUGS.md` B71).
+    fn remove_conflict_copy(&self, snapshot: &proton_drive_rs::Node, base: &str) {
+        let uid = &snapshot.uid;
+        let name = snapshot.name.as_str();
+        if !self.duplicate_still_removable(snapshot) {
+            return;
+        }
+        match self
+            .rt
+            .block_on(self.client.trash_nodes(std::slice::from_ref(uid)))
+        {
+            Ok(()) => {}
+            Err(e) if super::is_gone(&e) => {}
+            Err(e) => {
+                warn!(%uid, name, error = %e, "conflict sweep: trashing duplicate failed");
+                return;
+            }
+        }
+        // Every mount, not just the primary: a conflict copy inside a sync
+        // folder lives in that fork's inode space, and leaving it hooked up
+        // there keeps a node we have just trashed remotely visible and
+        // readable there (`docs/BUGS.md` B74).
+        self.for_each_state(|st| {
+            st.forget_or_unlink(uid);
+        });
+        if let Err(error) = self.discard_queued_ops(uid) {
+            warn!(%uid, ?error, "conflict sweep: queued-op cleanup failed");
+            return;
+        }
+        self.cache.evict(uid);
+        self.evict_reader(uid);
+        if let Err(e) = self.db.delete_node(uid) {
+            warn!(%uid, error = ?e, "conflict sweep: db delete after trash failed");
+        }
+        self.invalidate_trash();
+        self.conflict_notified.lock().remove(uid);
+        self.log_activity(
+            ActivityKind::Trash,
+            name,
+            format!("auto-removed duplicate of {base}"),
+            true,
+        );
+        info!(%uid, name, base, "conflict sweep: removed identical conflict copy");
+    }
+
+    /// Re-check, immediately before the destructive call, everything the pass
+    /// decided from its stale snapshot. Any doubt means "leave it alone": a
+    /// conflict copy that survives to the next pass costs nothing, a wrongly
+    /// removed one costs the user data.
+    fn duplicate_still_removable(&self, snapshot: &proton_drive_rs::Node) -> bool {
+        let uid = &snapshot.uid;
+        let name = snapshot.name.as_str();
+
+        // A queued op means bytes are still owed an upload. `discard_queued_ops`
+        // would throw those away along with the staged blob holding them.
+        match self.db.has_any_op(&uid.to_string()) {
+            Ok(false) => {}
+            Ok(true) => {
+                debug!(%uid, name, "conflict sweep: skipping duplicate with queued ops");
+                return false;
+            }
+            // Cannot prove the queue is empty — assume it is not.
+            Err(e) => {
+                warn!(%uid, name, error = ?e, "conflict sweep: op check failed; skipping");
+                return false;
+            }
+        }
+
+        // Someone is writing to it, or holds it open. Trashing now would pull the
+        // node out from under a live handle.
+        if self.is_busy(uid) {
+            debug!(%uid, name, "conflict sweep: skipping duplicate that is open or being written");
+            return false;
+        }
+
+        // Finally, the node itself must not have moved on since the snapshot.
+        match self.db.node_by_uid(&uid.to_string()) {
+            Ok(Some(fresh)) => {
+                if fresh.trashed {
+                    return false;
+                }
+                if fresh.name != snapshot.name || fresh.parent_uid != snapshot.parent_uid {
+                    debug!(%uid, name, "conflict sweep: duplicate was renamed or moved; skipping");
+                    return false;
+                }
+                if node_revision_id(&fresh) != node_revision_id(snapshot)
+                    || node_size(&fresh) != node_size(snapshot)
+                    || node_content_sha1(&fresh) != node_content_sha1(snapshot)
+                {
+                    debug!(%uid, name, "conflict sweep: duplicate changed since the pass began");
+                    return false;
+                }
+                true
+            }
+            // Already gone locally, or unreadable — either way, not ours to remove.
+            Ok(None) => false,
+            Err(e) => {
+                warn!(%uid, name, error = ?e, "conflict sweep: re-read failed; skipping");
+                false
+            }
+        }
+    }
+
+    /// Whether a node has a write in flight or a file handle open against it.
+    /// Read-only opens use fh 0 and are not tracked, so this is specifically the
+    /// writer/holder check.
+    /// Asked across **every** mount. The sweep runs on the primary Core but
+    /// trashes nodes anywhere in the tree, and a file open inside a sync folder
+    /// is tracked in that fork's `State` — so consulting `self.state` alone
+    /// answered "idle" for every such file and let the sweep delete one with a
+    /// writer attached (`docs/BUGS.md` B74). Busy anywhere means busy.
+    fn is_busy(&self, uid: &NodeUid) -> bool {
+        let mut busy = false;
+        self.for_each_state(|st| {
+            let Some(&ino) = st.by_uid.get(uid) else {
+                return;
+            };
+            busy |=
+                st.active_writes.contains_key(&ino) || st.handles.values().any(|&held| held == ino);
+        });
+        busy
+    }
+
+    /// Surface a conflict copy that needs the user's attention, at most once per
+    /// daemon run so the activity feed is not spammed each pass.
+    fn flag_conflict(&self, uid: &NodeUid, name: &str, detail: String) {
+        if !self.conflict_notified.lock().insert(uid.clone()) {
+            return;
+        }
+        debug!(%uid, name, detail, "conflict sweep: flagged divergent conflict copy");
+        self.log_activity(ActivityKind::Conflict, name, detail, false);
+    }
+}
+
+/// What the sweep concluded about one `(sync-conflict …)` copy.
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum SweepAction {
+    /// Provably redundant: trash it, subject to the runtime interlocks in
+    /// [`Core::duplicate_still_removable`].
+    Remove,
+    /// Only the user can resolve this one; surface it with this detail.
+    Flag(String),
+}
+
+/// Decide what to do about conflict copy `node` given its live sibling (if any)
+/// and the configured `mode`.
+///
+/// Pure, so the policy that governs deletion is testable without a mount, a
+/// runtime, or an account — the same split used for `revision_changed` and
+/// `is_own_self_supersede`. Everything that can fail or race lives in the caller.
+fn decide(
+    node: &proton_drive_rs::Node,
+    sibling: Option<&proton_drive_rs::Node>,
+    base: &str,
+    mode: SweepMode,
+) -> SweepAction {
+    match sibling {
+        Some(sib) if is_identical(node, sib) => {
+            if mode.is_enforcing() {
+                SweepAction::Remove
+            } else {
+                // Report-only: say what would happen, remove nothing. The point is
+                // to accumulate field evidence that the identity check is right
+                // before it is trusted with deletion (docs/BUGS.md B71).
+                SweepAction::Flag(format!(
+                    "identical to {base}; would be removed (sweep is report-only)"
+                ))
+            }
+        }
+        Some(_) => SweepAction::Flag(format!("differs from {base}")),
+        None => SweepAction::Flag(format!("no original {base} to reconcile against")),
+    }
+}
+
+/// Whether two file nodes provably hold the same bytes: equal size and equal,
+/// present content SHA-1. A missing digest on either side is not proof, so the
+/// sweep treats it as divergent rather than risk removing a real difference.
+fn is_identical(a: &proton_drive_rs::Node, b: &proton_drive_rs::Node) -> bool {
+    if node_size(a) != node_size(b) {
+        return false;
+    }
+    match (node_content_sha1(a), node_content_sha1(b)) {
+        (Some(x), Some(y)) => x == y,
+        _ => false,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use proton_drive_rs::NodeKind;
+    use proton_drive_rs::proton_sdk::ids::{LinkId, VolumeId};
+
+    /// A file node with the two fields the sweep's identity check reads.
+    fn file(name: &str, size: i64, sha1: Option<&str>) -> proton_drive_rs::Node {
+        proton_drive_rs::Node {
+            uid: NodeUid::new(VolumeId::from("v"), LinkId::from(name)),
+            parent_uid: None,
+            kind: NodeKind::File {
+                media_type: "text/plain".into(),
+                total_size_on_storage: size,
+                active_revision_state: None,
+                active_revision_id: Some("rev".into()),
+                claimed_size: Some(size),
+                claimed_modification_time: None,
+                content_sha1: sha1.map(String::from),
+            },
+            name: name.into(),
+            creation_time: 0,
+            modification_time: 0,
+            trashed: false,
+            is_shared: false,
+            is_shared_publicly: false,
+            signature_email: None,
+            membership: None,
+            photo: None,
+            album: None,
+            verification: Default::default(),
+        }
+    }
+
+    /// The only input shape that may ever produce a removal: same size, same
+    /// present digest, live sibling, enforcing mode.
+    #[test]
+    fn removes_only_a_provably_identical_copy_when_enforcing() {
+        let copy = file("f (sync-conflict 1).txt", 100, Some("aaa"));
+        let live = file("f.txt", 100, Some("aaa"));
+        assert_eq!(
+            decide(&copy, Some(&live), "f.txt", SweepMode::Enforce),
+            SweepAction::Remove
+        );
+    }
+
+    #[test]
+    fn report_only_never_removes_but_still_says_what_it_would_do() {
+        let copy = file("f (sync-conflict 1).txt", 100, Some("aaa"));
+        let live = file("f.txt", 100, Some("aaa"));
+        // Same inputs as the removal case above; only the mode differs.
+        let SweepAction::Flag(detail) = decide(&copy, Some(&live), "f.txt", SweepMode::Report)
+        else {
+            panic!("report mode must never remove");
+        };
+        assert!(detail.contains("would be removed"), "{detail}");
+        assert!(detail.contains("report-only"), "{detail}");
+    }
+
+    #[test]
+    fn a_differing_size_is_a_real_conflict() {
+        let copy = file("f (sync-conflict 1).txt", 101, Some("aaa"));
+        let live = file("f.txt", 100, Some("aaa"));
+        assert_eq!(
+            decide(&copy, Some(&live), "f.txt", SweepMode::Enforce),
+            SweepAction::Flag("differs from f.txt".into())
+        );
+    }
+
+    #[test]
+    fn a_missing_digest_is_never_proof_of_identity() {
+        // Equal sizes are not enough: two different 100-byte files are common.
+        // A copy the sweep cannot fingerprint must survive, in either direction.
+        for (a, b) in [(None, Some("aaa")), (Some("aaa"), None), (None, None)] {
+            let copy = file("f (sync-conflict 1).txt", 100, a);
+            let live = file("f.txt", 100, b);
+            assert_eq!(
+                decide(&copy, Some(&live), "f.txt", SweepMode::Enforce),
+                SweepAction::Flag("differs from f.txt".into()),
+                "{a:?} vs {b:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn a_differing_digest_at_equal_size_is_a_real_conflict() {
+        let copy = file("f (sync-conflict 1).txt", 100, Some("aaa"));
+        let live = file("f.txt", 100, Some("bbb"));
+        assert_eq!(
+            decide(&copy, Some(&live), "f.txt", SweepMode::Enforce),
+            SweepAction::Flag("differs from f.txt".into())
+        );
+    }
+
+    #[test]
+    fn an_orphaned_copy_is_surfaced_not_removed() {
+        // No live original left to reconcile against — the copy may be the only
+        // surviving version of the file, so it is never the sweep's to remove.
+        let copy = file("f (sync-conflict 1).txt", 100, Some("aaa"));
+        assert_eq!(
+            decide(&copy, None, "f.txt", SweepMode::Enforce),
+            SweepAction::Flag("no original f.txt to reconcile against".into())
+        );
+    }
+
+    #[test]
+    fn identity_needs_both_size_and_digest_to_match() {
+        let a = file("a", 100, Some("aaa"));
+        assert!(is_identical(&a, &file("b", 100, Some("aaa"))));
+        assert!(!is_identical(&a, &file("b", 101, Some("aaa"))));
+        assert!(!is_identical(&a, &file("b", 100, Some("bbb"))));
+        assert!(!is_identical(&a, &file("b", 100, None)));
+    }
+
+    #[test]
+    fn parses_conflict_names_and_leaves_others_alone() {
+        assert_eq!(
+            conflict_base_name("test_export (sync-conflict 1784898786).xml").as_deref(),
+            Some("test_export.xml")
+        );
+        assert_eq!(
+            conflict_base_name("README (sync-conflict 42)").as_deref(),
+            Some("README")
+        );
+        // The sync engine's de-duplicated suffix form.
+        assert_eq!(
+            conflict_base_name("notes (sync-conflict 1700-3).txt").as_deref(),
+            Some("notes.txt")
+        );
+        // Not a conflict copy.
+        assert_eq!(conflict_base_name("report.xml"), None);
+        // Looks close but the token is not a stamp.
+        assert_eq!(conflict_base_name("x (sync-conflict abc).txt"), None);
+    }
+
+    #[test]
+    fn a_dotted_stem_keeps_its_inner_dots() {
+        assert_eq!(
+            conflict_base_name("archive.tar (sync-conflict 7).gz").as_deref(),
+            Some("archive.tar.gz")
+        );
+    }
+}
@@ -0,0 +1,251 @@
+//! Filesystem watcher, polling, and debounce control plane.
+
+use super::*;
+
+/// How long the watcher must go quiet before a burst counts as finished.
+///
+/// Measured from the *last* event, not the first: applications do not write a
+/// file once. An editor saves by writing a temp file and renaming it over the
+/// target; an export or a database dump writes continuously for as long as it
+/// takes. Settling a fixed interval after the first event walks the tree while
+/// the file is still growing, and uploads a torn snapshot as a real revision —
+/// corrected on the next pass, but only after spending the encrypt-and-upload
+/// on a file that was never in that state.
+const DEBOUNCE: Duration = Duration::from_secs(2);
+/// Ceiling on the settle wait, so a directory under sustained change still
+/// syncs. Without it, copying a large tree in — events arriving forever —
+/// would postpone the reconcile for as long as the copy ran.
+const MAX_SETTLE: Duration = Duration::from_secs(30);
+/// How often to re-walk remotes so changes made on other clients are pulled in.
+const POLL_INTERVAL: Duration = Duration::from_secs(120);
+/// How many uploads/downloads/folder-creations a reconcile runs at once. The
+/// per-item work is a network round-trip, so a folder with thousands of files is
+/// unusable done one-at-a-time; this bounds concurrency like the bulk-upload
+/// engine does.
+pub(super) const SYNC_CONCURRENCY: usize = 8;
+
+/// A message to the sync engine's control thread.
+pub(crate) enum SyncMsg {
+    /// Reconcile one folder by id (a local change, or a targeted `SyncNow`).
+    Reconcile(i64),
+    /// Reconcile every mirror folder (periodic poll, or startup).
+    ReconcileAll,
+    /// Re-read the folder set and adjust the filesystem watches (after add/remove).
+    Rewatch,
+}
+
+/// Start the sync engine: a control thread that owns the filesystem watcher and
+/// serialises reconcile passes, plus a periodic poll thread. The engine receives
+/// on `rx`; senders live in [`Core::sync_tx`].
+pub(crate) fn spawn(core: Core, rx: Receiver<SyncMsg>) {
+    if let Err(e) = std::thread::Builder::new()
+        .name("pdfs-sync".into())
+        .spawn(move || engine_loop(core, rx))
+    {
+        warn!(error = %e, "failed to start sync engine");
+    }
+}
+
+/// The engine control loop. Single-threaded so reconcile passes never overlap.
+fn engine_loop(core: Core, rx: Receiver<SyncMsg>) {
+    // Paths the watcher currently covers, mapped to their folder id, so an event
+    // path can be resolved back to the folder it belongs to.
+    let watched: Mutex<Vec<(PathBuf, i64)>> = Mutex::new(Vec::new());
+
+    let tx_events = core.sync_tx.clone();
+    let mut watcher =
+        match notify::recommended_watcher(move |res: notify::Result<notify::Event>| {
+            let Ok(event) = res else { return };
+            // Ignore pure metadata/access noise; content changes are what matter.
+            if matches!(event.kind, notify::EventKind::Access(_)) {
+                return;
+            }
+            let _ = tx_events.send(SyncMsg::ReconcileAll);
+        }) {
+            Ok(w) => w,
+            Err(e) => {
+                warn!(error = %e, "filesystem watcher unavailable; sync is poll-only");
+                // Still run the loop so polling and explicit SyncNow work.
+                poll_only_loop(&core, rx);
+                return;
+            }
+        };
+
+    // Periodic remote poll.
+    {
+        let tx = core.sync_tx.clone();
+        std::thread::Builder::new()
+            .name("pdfs-sync-poll".into())
+            .spawn(move || {
+                loop {
+                    std::thread::sleep(POLL_INTERVAL);
+                    if tx.send(SyncMsg::ReconcileAll).is_err() {
+                        break;
+                    }
+                }
+            })
+            .ok();
+    }
+
+    rewatch(&core, &mut watcher, &watched);
+    reconcile_all(&core);
+
+    while let Ok(msg) = rx.recv() {
+        let mut ids: HashSet<i64> = HashSet::new();
+        let mut all = false;
+        let mut do_rewatch = false;
+        classify(msg, &mut ids, &mut all, &mut do_rewatch);
+        settle(&rx, &mut ids, &mut all, &mut do_rewatch);
+
+        if do_rewatch {
+            rewatch(&core, &mut watcher, &watched);
+        }
+        if all {
+            reconcile_all(&core);
+        } else {
+            for id in ids {
+                if let Ok(Some(folder)) = core.db.sync_folder_get(id) {
+                    core.reconcile_folder(&folder);
+                }
+            }
+        }
+    }
+}
+
+/// Fallback loop when no filesystem watcher could be created: poll + SyncNow only.
+fn poll_only_loop(core: &Core, rx: Receiver<SyncMsg>) {
+    {
+        let tx = core.sync_tx.clone();
+        std::thread::spawn(move || {
+            loop {
+                std::thread::sleep(POLL_INTERVAL);
+                if tx.send(SyncMsg::ReconcileAll).is_err() {
+                    break;
+                }
+            }
+        });
+    }
+    reconcile_all(core);
+    while let Ok(msg) = rx.recv() {
+        let mut ids: HashSet<i64> = HashSet::new();
+        let mut all = false;
+        let mut do_rewatch = false;
+        classify(msg, &mut ids, &mut all, &mut do_rewatch);
+        settle(&rx, &mut ids, &mut all, &mut do_rewatch);
+        if all {
+            reconcile_all(core);
+        } else {
+            for id in ids {
+                if let Ok(Some(folder)) = core.db.sync_folder_get(id) {
+                    core.reconcile_folder(&folder);
+                }
+            }
+        }
+    }
+}
+
+/// Absorb the rest of an event burst, returning once the watcher has been quiet
+/// for `quiet` or `cap` has elapsed since the first event — whichever comes
+/// first. The caller has already classified the event that opened the burst.
+///
+/// Split out with its timings as parameters so the settling behaviour can be
+/// tested in milliseconds rather than in the tens of seconds the real constants
+/// describe.
+pub(super) fn settle_with(
+    rx: &Receiver<SyncMsg>,
+    ids: &mut HashSet<i64>,
+    all: &mut bool,
+    do_rewatch: &mut bool,
+    quiet: Duration,
+    cap: Duration,
+) {
+    let deadline = Instant::now() + cap;
+    loop {
+        let now = Instant::now();
+        if now >= deadline {
+            break;
+        }
+        // Never wait past the cap, however quiet the watcher goes.
+        let wait = quiet.min(deadline - now);
+        match rx.recv_timeout(wait) {
+            // Another event: the burst is still going, so the quiet window
+            // starts again from here.
+            Ok(m) => classify(m, ids, all, do_rewatch),
+            // Quiet for a full window: whatever was being written has stopped.
+            Err(RecvTimeoutError::Timeout) => break,
+            // Every sender is gone; the caller's loop is about to end anyway.
+            Err(RecvTimeoutError::Disconnected) => break,
+        }
+    }
+}
+
+/// [`settle_with`] at the real timings.
+fn settle(rx: &Receiver<SyncMsg>, ids: &mut HashSet<i64>, all: &mut bool, do_rewatch: &mut bool) {
+    settle_with(rx, ids, all, do_rewatch, DEBOUNCE, MAX_SETTLE);
+}
+
+pub(super) fn classify(msg: SyncMsg, ids: &mut HashSet<i64>, all: &mut bool, rewatch: &mut bool) {
+    match msg {
+        SyncMsg::Reconcile(id) => {
+            ids.insert(id);
+        }
+        SyncMsg::ReconcileAll => *all = true,
+        SyncMsg::Rewatch => *rewatch = true,
+    }
+}
+
+/// Reconcile every mirror folder in turn.
+fn reconcile_all(core: &Core) {
+    let folders = match core.db.sync_folder_list() {
+        Ok(f) => f,
+        Err(e) => {
+            warn!(error = ?e, "sync: cannot list folders");
+            return;
+        }
+    };
+    for folder in folders {
+        core.reconcile_folder(&folder);
+    }
+}
+
+/// Bring the filesystem watches in line with the current mirror-folder set:
+/// watch newly-added folders, drop removed ones.
+fn rewatch(
+    core: &Core,
+    watcher: &mut notify::RecommendedWatcher,
+    watched: &Mutex<Vec<(PathBuf, i64)>>,
+) {
+    let want: Vec<(PathBuf, i64)> = match core.db.sync_folder_list() {
+        Ok(f) => f
+            .into_iter()
+            .filter(|f| f.mode == "mirror")
+            .map(|f| (PathBuf::from(f.local_path), f.id))
+            .collect(),
+        Err(e) => {
+            warn!(error = ?e, "sync: cannot list folders to watch");
+            return;
+        }
+    };
+    let mut have = watched.lock();
+    // Drop watches no longer wanted.
+    have.retain(|(path, _)| {
+        if want.iter().any(|(p, _)| p == path) {
+            true
+        } else {
+            let _ = watcher.unwatch(path);
+            false
+        }
+    });
+    // Add newly wanted watches.
+    for (path, id) in &want {
+        if have.iter().any(|(p, _)| p == path) {
+            continue;
+        }
+        match watcher.watch(path, RecursiveMode::Recursive) {
+            Ok(()) => have.push((path.clone(), *id)),
+            Err(e) => warn!(path = %path.display(), error = %e, "sync: watch failed"),
+        }
+    }
+}
+
+// ---- reconcile ------------------------------------------------------------
@@ -0,0 +1,81 @@
+//! Local open-for-write detection used to defer torn uploads.
+
+use super::*;
+
+// ---- open-for-write detection ---------------------------------------------
+
+/// Scan `/proc/*/fd` once and return the set of **canonical** paths under
+/// `root` that any process currently holds open for writing (`O_WRONLY` or
+/// `O_RDWR`). The scan is best-effort: unreadable `/proc/*/fd` directories
+/// (other users' processes, or kernel threads) are silently skipped.
+///
+/// Cost: one `readdir` of `/proc`, then for every process one `readdir` of its
+/// `/proc/<pid>/fd/`, and one `readlink` + one `open` of `/proc/<pid>/fdinfo/<n>`
+/// per open fd that resolves under `root`. For a typical desktop with a few
+/// hundred processes and a handful of files inside the sync root, this
+/// completes in low single-digit milliseconds.
+pub(super) fn open_for_write_set(root: &Path) -> HashSet<PathBuf> {
+    let mut result = HashSet::new();
+    let Ok(root_canonical) = std::fs::canonicalize(root) else {
+        return result;
+    };
+    let Ok(proc_entries) = std::fs::read_dir("/proc") else {
+        return result;
+    };
+    for proc_entry in proc_entries.filter_map(|e| e.ok()) {
+        let pid_name = proc_entry.file_name();
+        // Skip non-numeric entries (kernel threads, /proc/self, etc.)
+        if !pid_name
+            .to_str()
+            .is_some_and(|s| s.bytes().all(|b| b.is_ascii_digit()))
+        {
+            continue;
+        }
+        let fd_dir = PathBuf::from("/proc").join(&pid_name).join("fd");
+        let Ok(fds) = std::fs::read_dir(&fd_dir) else {
+            continue;
+        };
+        for fd_entry in fds.filter_map(|e| e.ok()) {
+            // readlink on /proc/<pid>/fd/<n> gives the target path.
+            let link = fd_dir.join(fd_entry.file_name());
+            let Ok(target) = std::fs::read_link(&link) else {
+                continue;
+            };
+            // Quick prefix check before the more expensive fdinfo read.
+            if !target.starts_with(&root_canonical) {
+                continue;
+            }
+            // Read the fd's flags from /proc/<pid>/fdinfo/<n> to determine
+            // the access mode. The first line is "pos:\t<offset>", the second
+            // is "flags:\t<octal>". We only need the low two bits of flags:
+            //   0 = O_RDONLY, 1 = O_WRONLY, 2 = O_RDWR
+            let fdinfo_path = PathBuf::from("/proc")
+                .join(&pid_name)
+                .join("fdinfo")
+                .join(fd_entry.file_name());
+            if let Ok(contents) = std::fs::read_to_string(&fdinfo_path)
+                && is_write_mode(&contents)
+            {
+                result.insert(target);
+            }
+        }
+    }
+    result
+}
+
+/// Parse the `flags:` line out of a `/proc/<pid>/fdinfo/<n>` file and return
+/// true if the low two bits indicate write access (`O_WRONLY = 1` or
+/// `O_RDWR = 2`).
+pub(super) fn is_write_mode(fdinfo: &str) -> bool {
+    for line in fdinfo.lines() {
+        if let Some(rest) = line.strip_prefix("flags:\t") {
+            if let Ok(flags) = u32::from_str_radix(rest.trim_start_matches('0'), 8) {
+                let access = flags & 0o3; // O_ACCMODE
+                return access == 1 || access == 2; // O_WRONLY or O_RDWR
+            }
+            // An empty octal string ("0" stripped to "") means flags == 0 == O_RDONLY.
+            return false;
+        }
+    }
+    false
+}
@@ -0,0 +1,164 @@
+//! Reconciliation snapshots, queued operations, and pass outcomes.
+
+use super::*;
+
+pub(super) struct LocalItem {
+    pub(super) is_dir: bool,
+    pub(super) mtime: i64,
+    pub(super) size: i64,
+    /// True when another process holds this file open for writing (detected via
+    /// `/proc/*/fd`). An open-for-write file is kept in the map — so it is not
+    /// misread as a deletion — but treated as unchanged for upload purposes,
+    /// deferring the upload until the writer closes the file.
+    pub(super) open_for_write: bool,
+}
+
+/// One item found while walking a remote tree.
+pub(super) struct RemoteItem {
+    pub(super) uid: NodeUid,
+    pub(super) is_dir: bool,
+    pub(super) mtime: i64,
+    pub(super) size: i64,
+}
+
+/// The result of a reconcile pass: what it moved, how many paths were kept as
+/// conflict copies, and how many failed to apply (and so still need another
+/// pass). The counts drive both the folder's state and its activity summary.
+#[derive(Default)]
+pub(super) struct Outcome {
+    pub(super) uploaded: usize,
+    pub(super) downloaded: usize,
+    pub(super) created: usize,
+    pub(super) deleted: usize,
+    pub(super) conflicts: usize,
+    pub(super) errors: usize,
+    /// Files skipped because another process held them open for writing.
+    pub(super) deferred: usize,
+}
+
+impl Outcome {
+    /// Fold in one applied op.
+    pub(super) fn record(&mut self, applied: &Applied) {
+        match applied {
+            Applied::Dir(..) => self.created += 1,
+            Applied::Uploaded => self.uploaded += 1,
+            Applied::Downloaded => self.downloaded += 1,
+            Applied::Conflict => self.conflicts += 1,
+        }
+    }
+
+    /// Whether the pass moved nothing at all — the common case on a poll of an
+    /// unchanged folder, which should not add a line to the activity feed.
+    pub(super) fn is_empty(&self) -> bool {
+        self.uploaded == 0
+            && self.downloaded == 0
+            && self.created == 0
+            && self.deleted == 0
+            && self.conflicts == 0
+            && self.errors == 0
+            && self.deferred == 0
+    }
+
+    /// A human summary of the pass: "3 uploaded, 1 downloaded, 2 failed".
+    pub(super) fn summary(&self) -> String {
+        let mut parts = Vec::new();
+        for (n, label) in [
+            (self.uploaded, "uploaded"),
+            (self.downloaded, "downloaded"),
+            (self.created, "folder(s) created"),
+            (self.deleted, "deleted"),
+            (self.conflicts, "conflicted"),
+            (self.deferred, "deferred (open for write)"),
+            (self.errors, "failed"),
+        ] {
+            if n > 0 {
+                parts.push(format!("{n} {label}"));
+            }
+        }
+        parts.join(", ")
+    }
+}
+
+/// A network operation queued during classification and run concurrently in a
+/// per-depth batch. Parent uids are resolved up front (the parent folder is one
+/// depth shallower and already created), so tasks share nothing mutable.
+pub(super) enum Pending {
+    /// Create a new remote folder under `parent`.
+    CreateDir { rel: String, parent: NodeUid },
+    /// Upload a brand-new local file into `parent`.
+    UploadNew { rel: String, parent: NodeUid },
+    /// Upload a changed local file as a new revision of `uid`.
+    UploadRevision { rel: String, uid: NodeUid },
+    /// Download remote `uid` to the local path, stamping `mtime`. `size` is the
+    /// remote's reported size, used as the transfer's expected total.
+    Download {
+        rel: String,
+        uid: NodeUid,
+        mtime: i64,
+        size: i64,
+    },
+    /// Both sides changed: set the local copy aside, then download remote `uid`.
+    Conflict {
+        rel: String,
+        uid: NodeUid,
+        mtime: i64,
+        size: i64,
+    },
+    /// Both sides changed during a [`push pass`](Core::push_pass): upload the local
+    /// copy into `parent` under a conflict name, leaving the remote file as it is.
+    PushConflict { rel: String, parent: NodeUid },
+}
+
+impl Pending {
+    /// The path this op acts on, relative to the folder root.
+    pub(super) fn rel(&self) -> &str {
+        match self {
+            Pending::CreateDir { rel, .. }
+            | Pending::UploadNew { rel, .. }
+            | Pending::UploadRevision { rel, .. }
+            | Pending::Download { rel, .. }
+            | Pending::Conflict { rel, .. }
+            | Pending::PushConflict { rel, .. } => rel,
+        }
+    }
+
+    /// How this op reads in the activity feed.
+    pub(super) fn kind(&self) -> ActivityKind {
+        match self {
+            Pending::CreateDir { .. } => ActivityKind::CreateFolder,
+            Pending::UploadNew { .. }
+            | Pending::UploadRevision { .. }
+            | Pending::PushConflict { .. } => ActivityKind::Upload,
+            Pending::Download { .. } | Pending::Conflict { .. } => ActivityKind::Download,
+        }
+    }
+
+    /// The activity line's detail, which distinguishes ops that share a kind.
+    pub(super) fn detail(&self) -> &'static str {
+        match self {
+            Pending::CreateDir { .. } => "on Drive",
+            Pending::UploadNew { .. } => "new file",
+            Pending::UploadRevision { .. } => "new version",
+            Pending::Download { .. } => "from Drive",
+            Pending::Conflict { .. } => "local changes kept as a conflict copy",
+            Pending::PushConflict { .. } => "local changes uploaded as a conflict copy",
+        }
+    }
+}
+
+/// Why a full reconcile pass stopped without a result.
+pub(super) enum PassAbort {
+    /// An on-demand switch was queued while the pass was running. Everything left
+    /// to do is work on a local copy about to be evicted, so the pass gives up its
+    /// remaining work to a [`push pass`](Core::push_pass) instead. Not a failure —
+    /// nothing is left half-applied, because each step is applied whole.
+    Interrupted,
+    /// The pass could not establish its diff (a walk or the baseline load failed).
+    Failed(String),
+}
+
+impl From<String> for PassAbort {
+    fn from(e: String) -> Self {
+        PassAbort::Failed(e)
+    }
+}
@@ -0,0 +1,402 @@
+//! Pure reconciliation ordering, safety guards, signatures, and path rules.
+
+use super::*;
+
+/// The paths a reconcile pass will classify: the union of the local, remote,
+/// and baseline states, minus anything the ignore rules exclude, shallowest
+/// first so a parent folder is created before its children are placed in it.
+///
+/// The ignore filter belongs *here*, on the union, rather than on the local walk
+/// alone — filtering the walk alone would be actively destructive. A file synced
+/// before it became ignored is absent from `local` but present in `remote` and
+/// `baseline`, which is precisely the "local deleted, remote untouched" shape
+/// `do_reconcile` responds to by trashing the remote copy. Adding a line to
+/// `.pdfsignore` must never delete anything from Drive.
+///
+/// Ignored baseline rows are deliberately left in the database rather than
+/// removed: with the row intact, un-ignoring the path later re-adopts the
+/// existing remote file instead of reading as a brand-new local one.
+pub(super) fn classification_order<L, R, B>(
+    local: &HashMap<String, L>,
+    remote: &HashMap<String, R>,
+    baseline: &HashMap<String, B>,
+    rules: &IgnoreRules,
+) -> Vec<String>
+where
+    L: HasKind,
+    R: HasKind,
+{
+    let mut paths: HashSet<String> = HashSet::new();
+    paths.extend(local.keys().cloned());
+    paths.extend(remote.keys().cloned());
+    paths.extend(baseline.keys().cloned());
+    let mut order: Vec<String> = paths.into_iter().collect();
+    if !rules.is_empty() {
+        order.retain(|rel| {
+            // A baseline-only path has no kind recorded, so it is tested as
+            // both; see `filter_baseline` for why erring towards "ignored" is
+            // the safe direction here.
+            let kind = local
+                .get(rel)
+                .map(HasKind::is_dir)
+                .or_else(|| remote.get(rel).map(HasKind::is_dir));
+            match kind {
+                Some(is_dir) => !rules.is_ignored(rel, is_dir),
+                None => !rules.is_ignored(rel, false) && !rules.is_ignored(rel, true),
+            }
+        });
+    }
+    order.sort_by_key(|p| p.matches('/').count());
+    order
+}
+
+/// Lets [`classification_order`] ask either walk's item whether it is a
+/// directory without knowing which walk it came from.
+pub(super) trait HasKind {
+    fn is_dir(&self) -> bool;
+}
+
+impl HasKind for LocalItem {
+    fn is_dir(&self) -> bool {
+        self.is_dir
+    }
+}
+
+impl HasKind for RemoteItem {
+    fn is_dir(&self) -> bool {
+        self.is_dir
+    }
+}
+
+/// The baseline minus its ignored paths, for [`guard_local_wipe`].
+///
+/// The guard asks "did every synced path vanish locally?", and an ignored path
+/// is absent from the local walk by rule rather than by loss. Left in, a rule
+/// covering the whole tree would trip the guard on every pass and wedge that
+/// folder's sync for good.
+///
+/// A baseline row does not record whether it was a file or a folder, so a path
+/// counts as ignored if it matches as either. Erring towards "ignored" only ever
+/// shrinks the set the guard checks, which weakens a safety net rather than
+/// causing a deletion — the wrong direction to be wrong in is the other one.
+pub(super) fn filter_baseline<'a, B>(
+    baseline: &'a HashMap<String, B>,
+    rules: &IgnoreRules,
+) -> HashMap<String, &'a B> {
+    baseline
+        .iter()
+        .filter(|(rel, _)| !rules.is_ignored(rel, false) && !rules.is_ignored(rel, true))
+        .map(|(rel, entry)| (rel.clone(), entry))
+        .collect()
+}
+
+/// Refuse to run a pass whose local side has vanished in its entirety.
+///
+/// When every baseline path is absent locally, the likely cause is an unavailable
+/// mount or unreadable folder rather than a deliberate whole-tree deletion.
+/// One surviving path is enough to clear the guard.
+pub(super) fn guard_local_wipe<B, L>(
+    baseline: &HashMap<String, B>,
+    local: &HashMap<String, L>,
+) -> Result<(), String> {
+    if !baseline.is_empty() && baseline.keys().all(|rel| !local.contains_key(rel)) {
+        return Err(format!(
+            "every one of the {} synced paths is missing locally; refusing to trash \
+             them on Drive. Check that the folder is mounted and readable.",
+            baseline.len()
+        ));
+    }
+    Ok(())
+}
+
+/// The size the baseline recorded for `rel`, if its remote signature's mtime
+/// still matches `mtime`.
+pub(super) fn unchanged_remote_size(
+    baseline: &HashMap<String, StoredSyncEntry>,
+    rel: &str,
+    mtime: i64,
+) -> Option<i64> {
+    match baseline.get(rel).and_then(remote_sig) {
+        Some((recorded, size)) if recorded == mtime => Some(size),
+        _ => None,
+    }
+}
+
+/// Join a child `name` onto a walk's `prefix`, giving a rel path.
+pub(super) fn join_rel(prefix: &str, name: &str) -> String {
+    if prefix.is_empty() {
+        name.to_string()
+    } else {
+        format!("{prefix}/{name}")
+    }
+}
+
+/// The stored remote signature of a baseline row, if it has one.
+pub(super) fn remote_sig(e: &StoredSyncEntry) -> Option<(i64, i64)> {
+    match (&e.remote_rev, &e.remote_hash) {
+        (Some(m), Some(s)) => Some((m.parse().ok()?, s.parse().ok()?)),
+        _ => None,
+    }
+}
+
+/// The parent of a `/`-joined relative path (`""` for a top-level entry).
+pub(super) fn parent_rel(rel: &str) -> &str {
+    match rel.rfind('/') {
+        Some(i) => &rel[..i],
+        None => "",
+    }
+}
+
+/// The final component of a `/`-joined relative path.
+pub(crate) fn base_name(rel: &str) -> &str {
+    match rel.rfind('/') {
+        Some(i) => &rel[i + 1..],
+        None => rel,
+    }
+}
+
+/// Turn a `/`-joined relative path into an OS path (`/` is already the separator
+/// on Linux, this keeps the intent explicit).
+pub(super) fn rel_to_path(rel: &str) -> PathBuf {
+    rel.split('/').collect()
+}
+
+/// The name for a conflict copy of `path`, e.g. `notes (sync-conflict 1700000000).txt`.
+#[cfg(test)]
+pub(super) fn conflict_path(path: &Path, stamp: i64) -> PathBuf {
+    conflict_path_with_suffix(path, stamp, 0)
+}
+
+/// As [`conflict_path`], with a deterministic suffix used when that name already
+/// exists. This keeps conflict preservation from ever replacing an older copy.
+pub(super) fn conflict_path_with_suffix(path: &Path, stamp: i64, suffix: u32) -> PathBuf {
+    let stem = path.file_stem().and_then(|s| s.to_str()).unwrap_or("file");
+    let ext = path.extension().and_then(|s| s.to_str());
+    let suffix = if suffix == 0 {
+        String::new()
+    } else {
+        format!("-{suffix}")
+    };
+    let name = match ext {
+        Some(ext) => format!("{stem} (sync-conflict {stamp}{suffix}).{ext}"),
+        None => format!("{stem} (sync-conflict {stamp}{suffix})"),
+    };
+    match path.parent() {
+        Some(dir) => dir.join(name),
+        None => PathBuf::from(name),
+    }
+}
+
+/// A pure decision for one file-shaped path. Transfer identities and filesystem
+/// effects are attached by the executor after this classification.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum FilePlan {
+    Unchanged,
+    Deferred,
+    UploadNew,
+    UploadRevision,
+    Download,
+    Conflict,
+    DeleteLocal,
+    DeleteRemote,
+    ForgetBaseline,
+    /// First sync of a file that already exists on both sides with identical
+    /// content: record the baseline without transferring anything. Without this,
+    /// a folder synced for the first time cuts a `(sync-conflict)` copy of every
+    /// pre-existing file, because a missing baseline makes both sides read as
+    /// "changed" (see the mass first-sync conflict storm in docs/BUGS.md).
+    AdoptBaseline,
+}
+
+pub(super) fn plan_file(
+    local: Option<&LocalItem>,
+    remote: Option<&RemoteItem>,
+    baseline: Option<&StoredSyncEntry>,
+) -> FilePlan {
+    if local.is_some_and(|item| item.open_for_write) {
+        return FilePlan::Deferred;
+    }
+
+    let local_changed = local.is_some_and(|item| {
+        baseline.is_none_or(|base| base.local_mtime != item.mtime || base.local_size != item.size)
+    });
+    let remote_changed = remote.is_some_and(|item| {
+        baseline.is_none_or(|base| remote_sig(base) != Some((item.mtime, item.size)))
+    });
+
+    match (local, remote) {
+        (Some(l), Some(r)) => match (local_changed, remote_changed) {
+            (false, false) => FilePlan::Unchanged,
+            (true, false) => FilePlan::UploadRevision,
+            (false, true) => FilePlan::Download,
+            // With a baseline, both-changed is a genuine concurrent edit and must
+            // be preserved as a conflict. Without one, "both changed" only means
+            // this is the first sync and there was nothing to compare to: adopt
+            // the baseline when the sizes already match rather than conflict-copy
+            // an already-identical file. Divergent sizes stay a real conflict.
+            (true, true) if baseline.is_none() && l.size == r.size => FilePlan::AdoptBaseline,
+            (true, true) => FilePlan::Conflict,
+        },
+        (Some(_), None) if baseline.is_none() || local_changed => FilePlan::UploadNew,
+        (Some(_), None) => FilePlan::DeleteLocal,
+        (None, Some(_)) if baseline.is_none() || remote_changed => FilePlan::Download,
+        (None, Some(_)) => FilePlan::DeleteRemote,
+        (None, None) => FilePlan::ForgetBaseline,
+    }
+}
+
+#[cfg(test)]
+mod file_plan_tests {
+    use super::*;
+    use proton_drive_rs::proton_sdk::ids::{LinkId, VolumeId};
+
+    fn local(mtime: i64, size: i64) -> LocalItem {
+        LocalItem {
+            is_dir: false,
+            mtime,
+            size,
+            open_for_write: false,
+        }
+    }
+
+    fn remote(mtime: i64, size: i64) -> RemoteItem {
+        RemoteItem {
+            uid: NodeUid::new(VolumeId::from("v"), LinkId::from("l")),
+            is_dir: false,
+            mtime,
+            size,
+        }
+    }
+
+    fn baseline(
+        local_mtime: i64,
+        local_size: i64,
+        remote_mtime: i64,
+        remote_size: i64,
+    ) -> StoredSyncEntry {
+        StoredSyncEntry {
+            rel_path: "file".into(),
+            remote_uid: Some("v~l".into()),
+            local_mtime,
+            local_size,
+            remote_rev: Some(remote_mtime.to_string()),
+            remote_hash: Some(remote_size.to_string()),
+        }
+    }
+
+    #[test]
+    fn file_plan_covers_every_presence_and_change_shape() {
+        let same_local = local(10, 20);
+        let changed_local = local(11, 20);
+        let same_remote = remote(30, 40);
+        let changed_remote = remote(31, 40);
+        let base = baseline(10, 20, 30, 40);
+        let cases = [
+            (None, None, None, FilePlan::ForgetBaseline),
+            (None, None, Some(&base), FilePlan::ForgetBaseline),
+            (Some(&same_local), None, None, FilePlan::UploadNew),
+            (Some(&same_local), None, Some(&base), FilePlan::DeleteLocal),
+            (Some(&changed_local), None, Some(&base), FilePlan::UploadNew),
+            (None, Some(&same_remote), None, FilePlan::Download),
+            (
+                None,
+                Some(&same_remote),
+                Some(&base),
+                FilePlan::DeleteRemote,
+            ),
+            (None, Some(&changed_remote), Some(&base), FilePlan::Download),
+            (
+                Some(&same_local),
+                Some(&same_remote),
+                None,
+                FilePlan::Conflict,
+            ),
+            (
+                Some(&same_local),
+                Some(&same_remote),
+                Some(&base),
+                FilePlan::Unchanged,
+            ),
+            (
+                Some(&changed_local),
+                Some(&same_remote),
+                Some(&base),
+                FilePlan::UploadRevision,
+            ),
+            (
+                Some(&same_local),
+                Some(&changed_remote),
+                Some(&base),
+                FilePlan::Download,
+            ),
+            (
+                Some(&changed_local),
+                Some(&changed_remote),
+                Some(&base),
+                FilePlan::Conflict,
+            ),
+        ];
+
+        for (local, remote, baseline, expected) in cases {
+            assert_eq!(plan_file(local, remote, baseline), expected);
+        }
+    }
+
+    #[test]
+    fn an_open_writer_overrides_every_other_file_decision() {
+        let mut local = local(11, 20);
+        local.open_for_write = true;
+        let remote = remote(31, 40);
+        let base = baseline(10, 20, 30, 40);
+
+        for (remote, baseline) in [
+            (None, None),
+            (None, Some(&base)),
+            (Some(&remote), None),
+            (Some(&remote), Some(&base)),
+        ] {
+            assert_eq!(
+                plan_file(Some(&local), remote, baseline),
+                FilePlan::Deferred
+            );
+        }
+    }
+
+    #[test]
+    fn first_sync_of_an_identical_file_adopts_the_baseline_not_a_conflict() {
+        // No baseline yet (first sync). Same size on both sides is a pre-existing
+        // identical file, not a concurrent edit: adopt it rather than cut a
+        // conflict copy of every file in the folder.
+        let local = local(10, 40);
+        let remote = remote(30, 40);
+        assert_eq!(
+            plan_file(Some(&local), Some(&remote), None),
+            FilePlan::AdoptBaseline
+        );
+    }
+
+    #[test]
+    fn first_sync_of_differing_sizes_is_still_a_conflict() {
+        // No baseline and the sizes disagree: a genuine both-sides divergence,
+        // preserved non-destructively as a conflict.
+        let local = local(10, 20);
+        let remote = remote(30, 40);
+        assert_eq!(
+            plan_file(Some(&local), Some(&remote), None),
+            FilePlan::Conflict
+        );
+    }
+
+    #[test]
+    fn a_missing_remote_signature_is_treated_as_changed() {
+        let local = local(10, 20);
+        let remote = remote(30, 40);
+        let mut base = baseline(10, 20, 30, 40);
+        base.remote_hash = None;
+
+        assert_eq!(
+            plan_file(Some(&local), Some(&remote), Some(&base)),
+            FilePlan::Download
+        );
+    }
+}
@@ -0,0 +1,317 @@
+//! Bulk local-to-Drive upload workflow.
+
+use super::*;
+
+/// How many files the bulk uploader ships at once. Overlaps the per-file network
+/// round-trips without letting an unbounded number of block buffers pile up.
+const UPLOAD_CONCURRENCY: usize = 4;
+
+/// One file queued for bulk upload, resolved during the directory walk so the
+/// concurrent phase carries everything it needs (no shared state, no `block_on`).
+struct UploadTask {
+    /// Inode of the (already-created) remote parent folder, for interning the
+    /// uploaded node afterwards.
+    parent_ino: u64,
+    parent_uid: NodeUid,
+    name: String,
+    /// Local filesystem path to stream from.
+    path: PathBuf,
+    size: u64,
+}
+
+/// Tally of a completed [`Core::upload_paths`] batch, for the daemon log.
+#[derive(Default)]
+pub(super) struct UploadStats {
+    pub(super) uploaded: usize,
+    pub(super) failed: usize,
+    /// Total plaintext bytes of the files that uploaded successfully.
+    pub(super) bytes: u64,
+    /// Folders created (or reused) to mirror the local tree.
+    pub(super) folders: usize,
+}
+
+/// Upload every [`UploadTask`] with at most `limit` in flight at once, each
+/// streamed straight from disk and ticking its own transfer-registry guard.
+/// Returns, per file, either `(parent_ino, new_uid)` for the caller to intern or
+/// `(name, error)` to log — one failure never sinks the batch.
+///
+/// `job` counts files finished (either way: a failure is still one file the batch
+/// no longer waits on), so a front-end can show "12 of 40" over the per-file bars.
+async fn run_uploads(
+    core: Core,
+    tasks: Vec<UploadTask>,
+    limit: usize,
+    job: Arc<JobGuard>,
+) -> Vec<Result<(u64, NodeUid, u64), (String, String)>> {
+    let sem = Arc::new(tokio::sync::Semaphore::new(limit));
+    let mut set = tokio::task::JoinSet::new();
+    for t in tasks {
+        let core = core.clone();
+        let sem = sem.clone();
+        set.spawn(async move {
+            let _permit = sem.acquire_owned().await.expect("semaphore not closed");
+            let file = match std::fs::File::open(&t.path) {
+                Ok(f) => f,
+                Err(e) => return Err((t.name, format!("open {}: {e}", t.path.display()))),
+            };
+            let mtime = std::fs::metadata(&t.path)
+                .and_then(|m| m.modified())
+                .ok()
+                .and_then(|mt| mt.duration_since(std::time::UNIX_EPOCH).ok())
+                .map(|d| d.as_secs() as i64);
+            let guard = core
+                .transfers
+                .begin(&t.name, "", TransferDirection::Upload, t.size);
+            let reader = OwnedCountingReader::new(file, guard);
+            if let Err(error) = core.require_uid_writable(&t.parent_uid) {
+                return Err((
+                    t.name,
+                    format!("destination access denied: errno {}", error.code()),
+                ));
+            }
+            match core
+                .client
+                .upload_file_from(
+                    &t.parent_uid,
+                    &t.name,
+                    media_type_for(&t.name),
+                    reader,
+                    t.size as i64,
+                    Vec::new(),
+                    mtime,
+                    false,
+                )
+                .await
+            {
+                Ok(uid) => Ok((t.parent_ino, uid, t.size)),
+                Err(e) => Err((t.name, format!("upload: {e}"))),
+            }
+        });
+    }
+    let mut out = Vec::new();
+    while let Some(joined) = set.join_next().await {
+        job.step();
+        match joined {
+            Ok(result) => out.push(result),
+            Err(e) => warn!(error = %e, "upload task panicked"),
+        }
+    }
+    out
+}
+
+impl Core {
+    /// Bulk-upload local files and directory trees under `sources` into the
+    /// mountpoint-relative `parent_rel` folder. Directories are recreated (or
+    /// merged into an existing same-named folder) and walked; the resulting flat
+    /// set of files is uploaded with bounded concurrency, each ticking the
+    /// transfer registry so a front-end sees live progress. Runs on a background
+    /// thread — a large tree far outlasts the control socket's read timeout — so
+    /// it reports only a summary for the log. Individual failures are counted and
+    /// logged rather than aborting the whole batch.
+    pub(super) fn upload_paths(
+        &self,
+        parent_rel: &Path,
+        sources: &[PathBuf],
+    ) -> CoreResult<UploadStats> {
+        let (pino, parent_uid) = self.resolve(parent_rel)?;
+        self.ensure_children(pino)
+            .map_err(|e| self.errno_error(e, "enumerate"))?;
+        self.require_uid_writable(&parent_uid)
+            .map_err(|error| self.errno_error(error, "upload destination"))?;
+
+        // Phase 1 (sequential): build the remote folder skeleton and collect the
+        // flat list of files to upload. Folders must exist before their children,
+        // so this can't be parallelised. On a deep tree this is a folder-creation
+        // round-trip per directory before a single byte moves — long enough that
+        // it needs a job of its own, or the daemon looks idle for minutes.
+        let mut tasks = Vec::new();
+        let mut folders = 0usize;
+        {
+            let job = self.transfers.begin_job("Preparing upload");
+            for src in sources {
+                if let Err(e) =
+                    self.collect_uploads(pino, &parent_uid, src, &mut tasks, &mut folders, &job)
+                {
+                    warn!(source = %src.display(), error = %e, "skipping source");
+                }
+            }
+        }
+
+        // Phase 2 (concurrent): upload the files, up to UPLOAD_CONCURRENCY at once.
+        // Each file reports its own bytes; this job is the batch's "N of M files",
+        // which is the number a user actually waits on.
+        let job = Arc::new(self.transfers.begin_job(match tasks.len() {
+            1 => "Uploading 1 file".to_string(),
+            n => format!("Uploading {n} files"),
+        }));
+        job.set_total(tasks.len() as u64);
+        let outcomes = self.rt.block_on(run_uploads(
+            self.clone(),
+            tasks,
+            UPLOAD_CONCURRENCY,
+            job.clone(),
+        ));
+        drop(job);
+
+        // Phase 3 (sequential): intern each uploaded node so it shows up in the
+        // listing without a re-enumeration. fetch_node uses `block_on`, so it must
+        // run here rather than inside the async batch — and it is a round-trip per
+        // file, so it too gets a job rather than a silent tail.
+        let mut stats = UploadStats {
+            folders,
+            ..UploadStats::default()
+        };
+        let job = self.transfers.begin_job("Finishing upload");
+        job.set_total(outcomes.len() as u64);
+        for outcome in outcomes {
+            job.step();
+            match outcome {
+                Ok((parent_ino, uid, size)) => {
+                    stats.uploaded += 1;
+                    stats.bytes += size;
+                    match self.fetch_node(&uid) {
+                        Ok(node) => {
+                            let mut st = self.state.lock();
+                            let ino = st.intern(parent_ino, node);
+                            if let Some(kids) = st.children.get_mut(&parent_ino)
+                                && !kids.contains(&ino)
+                            {
+                                kids.push(ino);
+                            }
+                            drop(st);
+                            self.flush_access_changes();
+                        }
+                        // Uploaded fine but the metadata refresh failed; it will
+                        // appear on the next directory enumeration regardless.
+                        Err(e) => warn!(%uid, error = ?e, "uploaded node metadata refresh failed"),
+                    }
+                }
+                Err((name, msg)) => {
+                    stats.failed += 1;
+                    warn!(name, error = %msg, "file upload failed");
+                }
+            }
+        }
+        info!(
+            uploaded = stats.uploaded,
+            failed = stats.failed,
+            "bulk upload finished"
+        );
+        Ok(stats)
+    }
+
+    /// Resolve a remote child folder named `name` under `pino`, creating it if it
+    /// doesn't exist, and return its `(inode, uid)`. Reusing an existing same-named
+    /// folder makes re-uploading a directory merge into it rather than fail on a
+    /// duplicate name.
+    fn ensure_remote_folder(
+        &self,
+        pino: u64,
+        parent_uid: &NodeUid,
+        name: &str,
+    ) -> CoreResult<(u64, NodeUid)> {
+        if name.is_empty() || name.contains('/') {
+            return Err(CoreError::invalid(format!("invalid folder name: {name:?}")));
+        }
+        self.ensure_children(pino)
+            .map_err(|e| self.errno_error(e, "enumerate"))?;
+        let existing = {
+            let st = self.state.lock();
+            st.children.get(&pino).and_then(|kids| {
+                kids.iter().find_map(|ino| {
+                    st.entries
+                        .get(ino)
+                        .filter(|entry| entry.node.is_folder() && entry.node.name == name)
+                        .map(|entry| (*ino, entry.uid.clone()))
+                })
+            })
+        };
+        if let Some((ino, uid)) = existing {
+            self.require_uid_writable(&uid)
+                .map_err(|error| self.errno_error(error, "upload destination"))?;
+            return Ok((ino, uid));
+        }
+        self.require_uid_writable(parent_uid)
+            .map_err(|error| self.errno_error(error, "upload destination"))?;
+        let new_uid = self
+            .rt
+            .block_on(
+                self.client
+                    .create_folder(parent_uid, name, Some(now_secs())),
+            )
+            .map_err(|e| CoreError::from_api(&e, &format!("create folder {name}")))?;
+        let node = self
+            .fetch_node(&new_uid)
+            .map_err(|e| self.errno_error(e, "fetch node"))?;
+        let mut st = self.state.lock();
+        let ino = st.intern(pino, node);
+        if let Some(kids) = st.children.get_mut(&pino)
+            && !kids.contains(&ino)
+        {
+            kids.push(ino);
+        }
+        drop(st);
+        self.flush_access_changes();
+        self.require_uid_writable(&new_uid)
+            .map_err(|error| self.errno_error(error, "created upload destination"))?;
+        Ok((ino, new_uid))
+    }
+
+    /// Walk one local source path, appending its files to `tasks`. A file becomes
+    /// one task; a directory is recreated remotely and recursed into (children
+    /// sorted for a stable order). Symlinks and other special files are skipped.
+    ///
+    /// `job` narrates the walk with the folder currently being mirrored. It stays
+    /// indeterminate: nothing knows the size of the tree until the walk has ended.
+    fn collect_uploads(
+        &self,
+        pino: u64,
+        parent_uid: &NodeUid,
+        src: &Path,
+        tasks: &mut Vec<UploadTask>,
+        folders: &mut usize,
+        job: &JobGuard,
+    ) -> CoreResult<()> {
+        let meta = std::fs::symlink_metadata(src)
+            .map_err(|e| CoreError::internal(format!("stat {}: {e}", src.display())))?;
+        let name = src
+            .file_name()
+            .and_then(|n| n.to_str())
+            .ok_or_else(|| CoreError::invalid(format!("unusable name: {}", src.display())))?
+            .to_string();
+
+        if meta.is_dir() {
+            job.detail(&name);
+            let (child_ino, child_uid) = self.ensure_remote_folder(pino, parent_uid, &name)?;
+            *folders += 1;
+            let mut entries: Vec<PathBuf> = std::fs::read_dir(src)
+                .map_err(|e| CoreError::internal(format!("read dir {}: {e}", src.display())))?
+                .filter_map(|e| e.ok())
+                .map(|e| e.path())
+                .collect();
+            entries.sort();
+            for entry in entries {
+                if let Err(e) =
+                    self.collect_uploads(child_ino, &child_uid, &entry, tasks, folders, job)
+                {
+                    warn!(source = %entry.display(), error = %e, "skipping entry");
+                }
+            }
+            // Deeper folders have retitled the job by now; put this one back so the
+            // line tracks the walk's position rather than its deepest leaf.
+            job.detail(&name);
+        } else if meta.is_file() {
+            if name.contains('/') {
+                return Err(CoreError::invalid(format!("invalid file name: {name:?}")));
+            }
+            tasks.push(UploadTask {
+                parent_ino: pino,
+                parent_uid: parent_uid.clone(),
+                name,
+                path: src.to_path_buf(),
+                size: meta.len(),
+            });
+        }
+        Ok(())
+    }
+}
@@ -0,0 +1,321 @@
+//! Synthetic nodes and naming rules for the mounted shared tree.
+
+use std::collections::{HashMap, HashSet};
+use std::time::{Duration, Instant};
+
+use proton_drive_rs::proton_sdk::ids::{LinkId, NodeUid, VolumeId};
+use proton_drive_rs::{Node, NodeKind};
+
+pub(crate) const VIRTUAL_VOLUME: &str = "virtual";
+pub(crate) const SHARED_WITH_ME_LINK: &str = "sharedwithme";
+pub(crate) const SHARED_WITH_ME_BASE: &str = "Shared with me";
+const MAX_COMPONENT_BYTES: usize = 255;
+
+pub(crate) fn shared_with_me_uid() -> NodeUid {
+    NodeUid::new(
+        VolumeId::from(VIRTUAL_VOLUME),
+        LinkId::from(SHARED_WITH_ME_LINK),
+    )
+}
+
+pub(crate) fn is_virtual_uid(uid: &NodeUid) -> bool {
+    uid.volume_id.as_str() == VIRTUAL_VOLUME
+}
+
+pub(crate) fn is_own_or_virtual_uid(uid: &NodeUid, own_volume: &VolumeId) -> bool {
+    uid.volume_id == *own_volume || is_virtual_uid(uid)
+}
+
+pub(crate) fn is_primary_root_listing(
+    primary: bool,
+    folder_uid: &NodeUid,
+    primary_root_uid: &NodeUid,
+) -> bool {
+    primary && folder_uid == primary_root_uid
+}
+
+pub(crate) fn virtual_node(parent_uid: NodeUid, name: String, timestamp: i64) -> Node {
+    Node {
+        uid: shared_with_me_uid(),
+        parent_uid: Some(parent_uid),
+        name,
+        kind: NodeKind::Folder,
+        creation_time: timestamp,
+        modification_time: timestamp,
+        trashed: false,
+        is_shared: false,
+        is_shared_publicly: false,
+        signature_email: None,
+        membership: None,
+        // A synthetic folder is neither a photo nor an album.
+        photo: None,
+        album: None,
+        verification: Default::default(),
+    }
+}
+
+/// Choose the initial synthetic-root name. Once persisted, `pinned` always wins;
+/// a later real collision only controls whether the synthetic dentry is exposed.
+pub(crate) fn virtual_root_name(
+    real_names: &HashSet<String>,
+    pinned: Option<&str>,
+) -> (String, bool) {
+    if let Some(pinned) = pinned {
+        return (pinned.to_string(), !real_names.contains(pinned));
+    }
+    for n in 0usize.. {
+        let candidate = match n {
+            0 => SHARED_WITH_ME_BASE.to_string(),
+            1 => format!("{SHARED_WITH_ME_BASE} (Proton)"),
+            _ => format!("{SHARED_WITH_ME_BASE} (Proton {n})"),
+        };
+        if !real_names.contains(&candidate) {
+            return (candidate, true);
+        }
+    }
+    unreachable!("the numbered virtual-root namespace is unbounded")
+}
+
+/// Give every shared root a unique Linux component name, independent of API
+/// ordering. Literal suffix-shaped names reserve their basename before duplicate
+/// names are numbered, so `Photos (2)` is never stolen by a second `Photos`.
+pub(crate) fn disambiguate_shared_names(nodes: &mut [Node]) {
+    nodes.sort_by(|a, b| {
+        a.name
+            .cmp(&b.name)
+            .then_with(|| a.uid.to_string().cmp(&b.uid.to_string()))
+    });
+    let reserved: HashSet<String> = nodes
+        .iter()
+        .map(|node| component_with_suffix(&node.name, ""))
+        .collect();
+    let mut used = HashSet::with_capacity(nodes.len());
+
+    for node in nodes {
+        let original = node.name.clone();
+        let basename = component_with_suffix(&original, "");
+        let chosen = if used.insert(basename.clone()) {
+            basename
+        } else {
+            let mut n = 2usize;
+            loop {
+                let suffix = format!(" ({n})");
+                let candidate = component_with_suffix(&original, &suffix);
+                if !reserved.contains(&candidate) && used.insert(candidate.clone()) {
+                    break candidate;
+                }
+                n += 1;
+            }
+        };
+        node.name = chosen;
+    }
+}
+
+pub(crate) fn listing_needs_refresh(online: bool, stale: bool) -> bool {
+    online && stale
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum SharedListingPlan {
+    Resident,
+    Persisted,
+    Refresh,
+}
+
+pub(crate) fn shared_listing_plan(resident: bool, online: bool, stale: bool) -> SharedListingPlan {
+    if listing_needs_refresh(online, stale) {
+        SharedListingPlan::Refresh
+    } else if resident {
+        SharedListingPlan::Resident
+    } else {
+        SharedListingPlan::Persisted
+    }
+}
+
+pub(crate) fn refresh_generation_is_current(started: u64, current: u64) -> bool {
+    started == current
+}
+
+#[derive(Default)]
+pub(crate) struct SharedRefreshDeadlines {
+    deadlines: HashMap<String, Instant>,
+}
+
+impl SharedRefreshDeadlines {
+    pub(crate) fn is_fresh(&mut self, key: &str, now: Instant) -> bool {
+        self.deadlines.retain(|_, deadline| *deadline > now);
+        self.deadlines
+            .get(key)
+            .is_some_and(|deadline| *deadline > now)
+    }
+
+    pub(crate) fn mark(&mut self, key: &str, now: Instant, ttl: Duration) {
+        self.deadlines.insert(key.to_string(), now + ttl);
+    }
+
+    pub(crate) fn clear(&mut self) {
+        self.deadlines.clear();
+    }
+}
+
+fn component_with_suffix(name: &str, suffix: &str) -> String {
+    let keep = MAX_COMPONENT_BYTES.saturating_sub(suffix.len());
+    let mut boundary = name.len().min(keep);
+    while !name.is_char_boundary(boundary) {
+        boundary -= 1;
+    }
+    let mut out = String::with_capacity(boundary + suffix.len());
+    out.push_str(&name[..boundary]);
+    out.push_str(suffix);
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn folder(volume: &str, link: &str, name: &str) -> Node {
+        let mut node = virtual_node(
+            NodeUid::new(VolumeId::from("virtual"), LinkId::from("parent")),
+            name.to_string(),
+            1,
+        );
+        node.uid = NodeUid::new(VolumeId::from(volume), LinkId::from(link));
+        node
+    }
+
+    #[test]
+    fn virtual_uid_and_node_round_trip() {
+        let parent = NodeUid::new(VolumeId::from("own"), LinkId::from("root"));
+        let node = virtual_node(parent.clone(), SHARED_WITH_ME_BASE.into(), 42);
+        assert_eq!(node.uid.to_string(), "virtual~sharedwithme");
+        assert!(is_virtual_uid(&node.uid));
+        assert_eq!(node.parent_uid.as_ref(), Some(&parent));
+        assert!(node.is_folder());
+        let json = serde_json::to_string(&node).unwrap();
+        let restored: Node = serde_json::from_str(&json).unwrap();
+        assert_eq!(restored.uid, node.uid);
+        assert_eq!(restored.name, SHARED_WITH_ME_BASE);
+    }
+
+    #[test]
+    fn root_collision_ladder_and_pinned_collision_policy() {
+        let names = HashSet::from([
+            SHARED_WITH_ME_BASE.to_string(),
+            format!("{SHARED_WITH_ME_BASE} (Proton)"),
+            format!("{SHARED_WITH_ME_BASE} (Proton 2)"),
+        ]);
+        assert_eq!(
+            virtual_root_name(&names, None),
+            (format!("{SHARED_WITH_ME_BASE} (Proton 3)"), true)
+        );
+
+        let (name, visible) = virtual_root_name(&names, Some(SHARED_WITH_ME_BASE));
+        assert_eq!(name, SHARED_WITH_ME_BASE);
+        assert!(!visible, "a real later collision suppresses the dentry");
+
+        let cleared = HashSet::new();
+        assert_eq!(
+            virtual_root_name(&cleared, Some(SHARED_WITH_ME_BASE)),
+            (SHARED_WITH_ME_BASE.to_string(), true),
+            "the pinned name returns when the collision clears"
+        );
+    }
+
+    #[test]
+    fn duplicate_names_are_stable_under_reordering_and_reserve_suffixes() {
+        let input = vec![
+            folder("b", "2", "Photos"),
+            folder("c", "3", "Photos (2)"),
+            folder("a", "1", "Photos"),
+        ];
+        let mut forward = input.clone();
+        let mut reverse = input;
+        reverse.reverse();
+        disambiguate_shared_names(&mut forward);
+        disambiguate_shared_names(&mut reverse);
+        let summarize = |nodes: &[Node]| {
+            nodes
+                .iter()
+                .map(|node| (node.uid.to_string(), node.name.clone()))
+                .collect::<Vec<_>>()
+        };
+        assert_eq!(summarize(&forward), summarize(&reverse));
+        assert_eq!(
+            forward
+                .iter()
+                .map(|node| node.name.as_str())
+                .collect::<Vec<_>>(),
+            ["Photos", "Photos (3)", "Photos (2)"]
+        );
+    }
+
+    #[test]
+    fn disambiguation_respects_utf8_component_limit() {
+        let long = "é".repeat(200);
+        let mut nodes = vec![folder("a", "1", &long), folder("b", "2", &long)];
+        disambiguate_shared_names(&mut nodes);
+        assert!(nodes.iter().all(|node| node.name.len() <= 255));
+        assert!(
+            nodes
+                .iter()
+                .all(|node| node.name.is_char_boundary(node.name.len()))
+        );
+        assert_ne!(nodes[0].name, nodes[1].name);
+        assert!(nodes[1].name.ends_with(" (2)"));
+    }
+
+    #[test]
+    fn ttl_refresh_only_happens_online() {
+        assert!(!listing_needs_refresh(false, true));
+        assert!(!listing_needs_refresh(true, false));
+        assert!(listing_needs_refresh(true, true));
+    }
+
+    #[test]
+    fn offline_snapshot_suppresses_the_api_and_memory_deadline_suppresses_retries() {
+        assert_eq!(
+            shared_listing_plan(false, false, true),
+            SharedListingPlan::Persisted
+        );
+        assert_eq!(
+            shared_listing_plan(true, true, false),
+            SharedListingPlan::Resident
+        );
+
+        let now = Instant::now();
+        let mut deadlines = SharedRefreshDeadlines::default();
+        deadlines.mark("shared", now, Duration::from_secs(60));
+        assert!(deadlines.is_fresh("shared", now + Duration::from_secs(30)));
+        deadlines.clear();
+        assert!(!deadlines.is_fresh("shared", now + Duration::from_secs(30)));
+    }
+
+    #[test]
+    fn generation_change_rejects_an_inflight_response() {
+        assert!(refresh_generation_is_current(7, 7));
+        assert!(!refresh_generation_is_current(7, 8));
+    }
+
+    #[test]
+    fn only_the_primary_inode_space_installs_the_synthetic_root() {
+        let root = NodeUid::new(VolumeId::from("own"), LinkId::from("root"));
+        assert!(is_primary_root_listing(true, &root, &root));
+        assert!(!is_primary_root_listing(false, &root, &root));
+        assert!(!is_primary_root_listing(
+            true,
+            &NodeUid::new(VolumeId::from("own"), LinkId::from("device")),
+            &root
+        ));
+    }
+
+    #[test]
+    fn ownership_predicate_excludes_foreign_share_volumes() {
+        let own = VolumeId::from("own");
+        let own_uid = NodeUid::new(own.clone(), LinkId::from("file"));
+        let foreign = NodeUid::new(VolumeId::from("foreign"), LinkId::from("share"));
+        assert!(is_own_or_virtual_uid(&own_uid, &own));
+        assert!(is_own_or_virtual_uid(&shared_with_me_uid(), &own));
+        assert!(!is_own_or_virtual_uid(&foreign, &own));
+    }
+}
@@ -0,0 +1,89 @@
+//! Shared Drive-result activation policy for the GTK browser and quick prompt.
+//!
+//! Media should be handed to its mounted path so players can issue range reads
+//! through FUSE. Other files retain the materialize-then-open behaviour because
+//! many desktop applications expect a stable ordinary file.
+
+use std::path::{Path, PathBuf};
+
+use pdfs_core::control::PhotoKind;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum DriveActivation {
+    Folder,
+    MountedMedia,
+    Materialize,
+}
+
+pub(crate) fn drive_activation(name: &str, is_dir: bool) -> DriveActivation {
+    if is_dir {
+        DriveActivation::Folder
+    } else if is_streamable_media(name) {
+        DriveActivation::MountedMedia
+    } else {
+        DriveActivation::Materialize
+    }
+}
+
+pub(crate) fn mounted_path(mountpoint: &Path, relative_path: &str) -> PathBuf {
+    mountpoint.join(relative_path)
+}
+
+fn is_streamable_media(name: &str) -> bool {
+    if PhotoKind::classify(Some(name), None) == PhotoKind::Video {
+        return true;
+    }
+
+    let extension = Path::new(name)
+        .extension()
+        .and_then(|value| value.to_str())
+        .unwrap_or_default();
+
+    matches!(
+        extension.to_ascii_lowercase().as_str(),
+        "mp3" | "flac" | "wav" | "ogg" | "opus" | "m4a" | "aac"
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn folders_use_the_mount_regardless_of_extension() {
+        assert_eq!(
+            drive_activation("recordings.mp4", true),
+            DriveActivation::Folder
+        );
+    }
+
+    #[test]
+    fn media_extensions_use_fuse_path_case_insensitively() {
+        for name in ["movie.MKV", "voice.opus", "song.FLAC", "clip.m4v"] {
+            assert_eq!(
+                drive_activation(name, false),
+                DriveActivation::MountedMedia,
+                "{name}"
+            );
+        }
+    }
+
+    #[test]
+    fn ordinary_files_are_materialized() {
+        for name in ["report.pdf", "notes.txt", "archive.zip", "no-extension"] {
+            assert_eq!(
+                drive_activation(name, false),
+                DriveActivation::Materialize,
+                "{name}"
+            );
+        }
+    }
+
+    #[test]
+    fn mounted_paths_preserve_relative_components() {
+        assert_eq!(
+            mounted_path(Path::new("/mnt/drive"), "Videos/a movie.mkv"),
+            Path::new("/mnt/drive/Videos/a movie.mkv")
+        );
+    }
+}
@@ -1,9 +1,13 @@
+#[path = "../activation.rs"]
+pub(crate) mod activation;
 pub(crate) mod pages;
 pub(crate) mod widgets;

 use pages::activity::*;
+use pages::albums::*;
 use pages::browser::*;
 use pages::devices::*;
+use pages::locations::*;
 use pages::login::*;
 use pages::photo_viewer::*;
 use pages::photos::*;
@@ -40,13 +44,15 @@ use pdfs_core::auth;
 use pdfs_core::config::AppDirs;

 use pdfs_core::control::{
-    ActivityEntry, ActivityKind, BookmarkInfo, DeviceInfo, DirEntry, ErrorKind, InvitationInfo,
-    JobItem, PhotoItem, PhotoKind, PublicLinkInfo, RefreshScope, Request, Response,
+    ActivityEntry, ActivityKind, AlbumInfo, BookmarkInfo, DeviceInfo, DirEntry, ErrorKind,
+    InvitationInfo, JobItem, PhotoItem, PhotoKind, PublicLinkInfo, RefreshScope, Request, Response,
    RestorableFolder, RestoreItem, SearchHit, ShareEntry, ShareEntryKind, SharedItem,
    SyncFolderInfo, SyncPhase, SyncProgress, TransferDirection, TransferItem, pending_summary,
    send,
 };

+use pdfs_core::mounts::{MountAccess, MountKind, MountMode, MountSpec};
+
 use pdfs_core::service;

 const APP_ID: &str = "io.narl.proton-drive-linux";
@@ -111,6 +117,7 @@ struct Ui {
    pub(crate) shared: SharedState,
    pub(crate) shared_by_me: SharedByMeState,
    pub(crate) devices: DevicesState,
+    pub(crate) locations: LocationsState,
    pub(crate) activity: ActivityState,
 }

@@ -132,23 +139,10 @@ impl Ui {
        }
    }

-    /// The aspect ratio (w/h) to lay `uid`'s tile out at: the real one once its
-    /// thumbnail has been seen, otherwise [`RATIO_UNKNOWN`].
-    fn ratio(&self, uid: &str) -> f64 {
-        self.gallery
-            .photo_ratio
-            .borrow()
-            .get(uid)
-            .copied()
-            .unwrap_or(RATIO_UNKNOWN)
-    }
-
-    /// Remember a decoded thumbnail and the aspect ratio it revealed. Returns
-    /// true when the ratio is *new information* — the caller re-justifies the
-    /// affected rows, since they were laid out against a guess.
-    fn store_texture(&self, uid: &str, texture: gtk4::gdk::Texture) -> bool {
-        let (w, h) = (texture.width(), texture.height());
-
+    /// Remember a decoded thumbnail, evicting the oldest once the cache is full.
+    /// Scrolling back over a day then repaints from memory rather than decoding
+    /// the same JPEGs off disk again.
+    fn store_texture(&self, uid: &str, texture: gtk4::gdk::Texture) {
        let mut cache = self.gallery.photo_tex.borrow_mut();
        let mut order = self.gallery.photo_tex_order.borrow_mut();
        if cache.insert(uid.to_string(), texture).is_none() {
@@ -159,58 +153,6 @@ impl Ui {
                cache.remove(&old);
            }
        }
-        drop((cache, order));
-
-        if h <= 0 {
-            return false;
-        }
-        let ratio = f64::from(w) / f64::from(h);
-        let mut ratios = self.gallery.photo_ratio.borrow_mut();
-        match ratios.insert(uid.to_string(), ratio) {
-            // Only a *changed* ratio invalidates a layout; re-decoding a photo we
-            // already sized correctly must not trigger another pass.
-            Some(prev) if (prev - ratio).abs() < f64::EPSILON => false,
-            _ => {
-                self.gallery.photo_ratio_dirty.set(true);
-                true
-            }
-        }
-    }
-
-    /// Where the learned aspect ratios are persisted between runs.
-    fn ratio_path(&self) -> PathBuf {
-        self.dirs.cache_dir().join("photo-ratios.json")
-    }
-
-    /// Load the persisted aspect ratios. A missing or corrupt file just means the
-    /// first paint uses [`RATIO_UNKNOWN`] and re-justifies as thumbnails land.
-    fn load_ratios(&self) {
-        let path = self.ratio_path();
-        let Ok(text) = std::fs::read_to_string(&path) else {
-            return;
-        };
-        match serde_json::from_str::<HashMap<String, f64>>(&text) {
-            Ok(map) => *self.gallery.photo_ratio.borrow_mut() = map,
-            Err(e) => tracing::debug!("ignoring {}: {e}", path.display()),
-        }
-    }
-
-    /// Persist the learned aspect ratios, if any were learned since the last save.
-    fn save_ratios(&self) {
-        if !self.gallery.photo_ratio_dirty.replace(false) {
-            return;
-        }
-        let path = self.ratio_path();
-        let ratios = self.gallery.photo_ratio.borrow();
-        let write = serde_json::to_vec(&*ratios)
-            .map_err(std::io::Error::other)
-            .and_then(|bytes| {
-                std::fs::create_dir_all(path.parent().unwrap_or(Path::new("/")))?;
-                std::fs::write(&path, bytes)
-            });
-        if let Err(e) = write {
-            tracing::debug!("cannot save {}: {e}", path.display());
-        }
    }
 }

@@ -281,15 +223,23 @@ fn load_proton_theme() {
         .viewer-spinner {{ color: white; }}\n\
         .viewer-status {{ color: white; font-size: 1rem; background-color: rgba(0, 0, 0, 0.75); padding: 12px 24px; border-radius: 12px; }}\n\
         .viewer-info-panel {{ background-color: @window_bg_color; border-left: 1px solid alpha(currentColor, 0.12); }}\n\
-         .gallery-day {{ font-size: 1.05rem; font-weight: 700; padding: 2px 2px 6px 2px; }}\n\
-         .photo-tile {{ padding: 0; margin: 0; min-height: 0; min-width: 0; border-radius: 10px; background: alpha(currentColor, 0.06); box-shadow: none; transition: filter 160ms ease, box-shadow 160ms ease; }}\n\
-         .photo-tile:hover {{ filter: brightness(1.06); box-shadow: 0 4px 14px rgba(0, 0, 0, 0.35); }}\n\
+         .gallery-day {{ font-size: 0.82rem; font-weight: 700; letter-spacing: 0.04em; text-transform: uppercase; color: alpha(currentColor, 0.65); padding: 4px 2px 8px 2px; }}\n\
+         .photo-tile {{ padding: 0; margin: 0; min-height: 0; min-width: 0; border-radius: 14px; background: alpha(currentColor, 0.06); box-shadow: none; transition: box-shadow 180ms ease, background 180ms ease; }}\n\
+         .photo-tile:hover {{ box-shadow: 0 8px 22px rgba(0, 0, 0, 0.45); }}\n\
         .photo-tile:focus {{ outline: 2px solid {PROTON_PURPLE}; outline-offset: -2px; }}\n\
+         .photo-thumb {{ transition: transform 220ms ease; }}\n\
+         .photo-tile:hover .photo-thumb {{ transform: scale(1.06); }}\n\
         .photo-placeholder {{ color: alpha(currentColor, 0.35); background: alpha(currentColor, 0.07); }}\n\
-         .photo-caption {{ font-size: 0.78rem; color: white; text-shadow: 0 1px 3px rgba(0, 0, 0, 0.9); padding: 22px 10px 6px 10px; opacity: 0; transition: opacity 160ms ease; }}\n\
+         .photo-caption {{ font-size: 0.78rem; color: white; text-shadow: 0 1px 3px rgba(0, 0, 0, 0.9); padding: 22px 10px 6px 10px; opacity: 0; transition: opacity 180ms ease; }}\n\
         .photo-video-badge {{ color: white; background: rgba(0, 0, 0, 0.45); border-radius: 999px; padding: 8px; min-width: 20px; min-height: 20px; box-shadow: 0 2px 8px rgba(0, 0, 0, 0.5); transition: background 160ms ease; }}\n\
         .photo-tile:hover .photo-video-badge {{ background: alpha({PROTON_PURPLE}, 0.85); }}\n\
         .photo-tile:hover .photo-caption {{ opacity: 1; background: linear-gradient(to top, rgba(0, 0, 0, 0.55), rgba(0, 0, 0, 0)); }}\n\
+         .album-card {{ padding: 0; border-radius: 16px; transition: background 180ms ease; }}\n\
+         .album-card:hover {{ background: alpha(currentColor, 0.07); }}\n\
+         .album-cover {{ border-radius: 16px; background: alpha(currentColor, 0.06); box-shadow: 0 4px 16px rgba(0, 0, 0, 0.32); transition: box-shadow 180ms ease; }}\n\
+         .album-card:hover .album-cover {{ box-shadow: 0 10px 26px rgba(0, 0, 0, 0.5); }}\n\
+         .album-card:hover .photo-thumb {{ transform: scale(1.05); }}\n\
+         .view-switch button {{ padding-left: 18px; padding-right: 18px; }}\n\
         .card {{ border-radius: 8px; transition: transform 0.2s ease, filter 0.2s ease; margin: 4px; }}\n\
         .card:hover {{ transform: scale(1.02); filter: brightness(0.9); }}\n\
         .navigation-sidebar row {{ border-radius: 8px; margin: 2px 6px; }}\n\
@@ -331,6 +281,7 @@ fn build_window(app: &adw::Application) {
    let (shared_page, shared_widgets) = build_shared_page();
    let (shared_by_me_page, shared_by_me_widgets) = build_shared_by_me_page();
    let (devices_page, devices_widgets) = build_devices_page();
+    let (locations_page, locations_widgets) = build_locations_page();
    let (activity_page, activity_widgets) = build_activity_page();
    let (trash_page, trash_widgets) = build_trash_page();
    stack.add_named(&login_page, Some("login"));
@@ -340,6 +291,7 @@ fn build_window(app: &adw::Application) {
    stack.add_named(&shared_by_me_page, Some("sharedbyme"));
    stack.add_named(&shared_page, Some("shared"));
    stack.add_named(&devices_page, Some("devices"));
+    stack.add_named(&locations_page, Some("locations"));
    stack.add_named(&activity_page, Some("activity"));
    stack.add_named(&trash_page, Some("trash"));

@@ -454,9 +406,21 @@ fn build_window(app: &adw::Application) {
            retry: gallery_widgets.retry.clone(),
            more: gallery_widgets.more.clone(),
            upload: gallery_widgets.upload.clone(),
+            title: gallery_widgets.title.clone(),
            subtitle: gallery_widgets.subtitle.clone(),
+            albums: gallery_widgets.albums.clone(),
+            albums_stack: gallery_widgets.albums_stack.clone(),
+            albums_status: gallery_widgets.albums_status.clone(),
+            photos_btn: gallery_widgets.photos_btn.clone(),
+            albums_btn: gallery_widgets.albums_btn.clone(),
+            view_switch: gallery_widgets.view_switch.clone(),
+            albums_loading: Cell::new(false),
+            album: RefCell::new(None),
+            back: gallery_widgets.back.clone(),
+            filters: gallery_widgets.filters.clone(),
            kind: Cell::new(None),
            tabs: gallery_widgets.tabs.clone(),
+            counts: Cell::new(None),
            dates: gallery_widgets.dates.clone(),
            date_ranges: RefCell::new(vec![None]),
            range: Cell::new(None),
@@ -465,8 +429,6 @@ fn build_window(app: &adw::Application) {
            width: Cell::new(0),
            photo_tex: RefCell::new(HashMap::new()),
            photo_tex_order: RefCell::new(VecDeque::new()),
-            photo_ratio: RefCell::new(HashMap::new()),
-            photo_ratio_dirty: Cell::new(false),
            photo_nothumb: RefCell::new(HashSet::new()),
            thumb_wanted: RefCell::new(HashMap::new()),
            thumb_queue: RefCell::new(VecDeque::new()),
@@ -511,6 +473,15 @@ fn build_window(app: &adw::Application) {
            inflight: Cell::new(false),
            loaded_at: Cell::new(None),
        },
+        locations: LocationsState {
+            content: locations_widgets.content.clone(),
+            status: locations_widgets.status.clone(),
+            retry: locations_widgets.retry.clone(),
+            group: locations_widgets.group.clone(),
+            rows: RefCell::new(Vec::new()),
+            inflight: Cell::new(false),
+            loaded_at: Cell::new(None),
+        },
        activity: ActivityState {
            content: activity_widgets.content.clone(),
            status: activity_widgets.status.clone(),
@@ -521,8 +492,6 @@ fn build_window(app: &adw::Application) {
            key: RefCell::new(None),
        },
    });
-    ui.load_ratios();
-
    wire_login(&ui);
    wire_logout(&ui, &main_widgets.logout_button);
    wire_settings(
@@ -541,15 +510,12 @@ fn build_window(app: &adw::Application) {
    wire_details(&ui);
    wire_search(&ui);
    wire_gallery(&ui, &gallery_widgets.list, &gallery_widgets.scroll);
+    wire_albums(&ui);
    wire_trash(&ui, &trash_widgets.list, &trash_widgets.empty);
    wire_shared(&ui, &shared_widgets.retry, &shared_widgets.add_bookmark);
    wire_shared_by_me(&ui, &shared_by_me_widgets.retry);
-    wire_devices(
-        &ui,
-        &devices_widgets.retry,
-        &devices_widgets.add_folder,
-        &devices_widgets.restore,
-    );
+    wire_devices(&ui, &devices_widgets.retry, &devices_widgets.restore);
+    wire_locations(&ui, &locations_widgets.retry, &locations_widgets.add_folder);
    wire_activity(&ui, &activity_widgets.retry);
    wire_refresh(
        &ui,
@@ -560,6 +526,7 @@ fn build_window(app: &adw::Application) {
            &shared_widgets.refresh,
            &shared_by_me_widgets.refresh,
            &devices_widgets.refresh,
+            &locations_widgets.refresh,
            &activity_widgets.refresh,
        ],
    );
@@ -582,6 +549,8 @@ fn build_window(app: &adw::Application) {
            Some("shared") => load_shared(&ui_nav),
            Some("devices") if page_fresh(&ui_nav.devices.loaded_at) => {}
            Some("devices") => load_devices(&ui_nav),
+            Some("locations") if page_fresh(&ui_nav.locations.loaded_at) => {}
+            Some("locations") => load_locations(&ui_nav),
            // Activity is intentionally not TTL-cached: it changes out from under
            // the page as background uploads and edits complete, so it reloads on
            // every visit to stay live.
@@ -610,12 +579,10 @@ fn build_window(app: &adw::Application) {
        glib::ControlFlow::Continue
    });
    let cell = RefCell::new(Some(source));
-    let ui_close = ui.clone();
    window.connect_close_request(move |_| {
        if let Some(id) = cell.borrow_mut().take() {
            id.remove();
        }
-        ui_close.save_ratios();
        glib::Propagation::Proceed
    });

@@ -624,12 +591,13 @@ fn build_window(app: &adw::Application) {

 /// The sidebar destinations, in order: the row index is the index into this table,
 /// and each entry is `(stack page name, label, icon)`.
-const DESTINATIONS: [(&str, &str, &str); 8] = [
+const DESTINATIONS: [(&str, &str, &str); 9] = [
    ("browser", "My files", "folder-symbolic"),
    ("sharedbyme", "Shared", "emblem-shared-symbolic"),
    ("shared", "Shared with me", "system-users-symbolic"),
+    ("locations", "Locations", "drive-harddisk-symbolic"),
    ("devices", "Computers", "computer-symbolic"),
-    ("gallery", "Photos", "image-x-generic-symbolic"),
+    ("gallery", "Gallery", "image-x-generic-symbolic"),
    ("activity", "Activity", "document-open-recent-symbolic"),
    ("trash", "Trash", "user-trash-symbolic"),
    ("main", "Settings", "emblem-system-symbolic"),
@@ -732,7 +700,15 @@ fn reload_current_page(ui: &Rc<Ui>) {
            let path = ui.browser.path.borrow().clone();
            refresh_then(ui, RefreshScope::Dir { path }, load_browser);
        }
-        Some("gallery") => refresh_then(ui, RefreshScope::Photos, |ui| load_gallery(ui, false)),
+        // One scope covers the whole photos view, so Refresh reloads whichever of
+        // the two — album grid or timeline/album — is actually on screen.
+        Some("gallery") => refresh_then(ui, RefreshScope::Photos, |ui| {
+            if ui.gallery.content.visible_child_name().as_deref() == Some("albums") {
+                load_albums(ui);
+            } else {
+                load_gallery(ui, false);
+            }
+        }),
        Some("trash") => refresh_then(ui, RefreshScope::Trash, load_trash),
        Some("shared") => {
            ui.shared.loaded_at.set(None);
@@ -746,6 +722,10 @@ fn reload_current_page(ui: &Rc<Ui>) {
            ui.devices.loaded_at.set(None);
            load_devices(ui);
        }
+        Some("locations") => {
+            ui.locations.loaded_at.set(None);
+            load_locations(ui);
+        }
        Some("activity") => load_activity(ui),
        _ => {}
    }
@@ -1043,81 +1023,54 @@ fn human_bytes(bytes: u64) -> String {
 mod tests {
    use super::*;

-    /// A justified row must fill the content width exactly: tile widths plus the
-    /// gaps between them add up to the width, with nothing left ragged.
-    fn row_width(row: &[(i32, i32)]) -> i32 {
-        let gaps = TILE_GAP * (row.len().saturating_sub(1)) as i32;
-        row.iter().map(|(width, _)| *width).sum::<i32>() + gaps
+    /// The full width one row of `columns` tiles occupies, gaps included.
+    fn row_width(columns: usize, edge: i32) -> i32 {
+        edge * columns as i32 + TILE_GAP * (columns as i32 - 1)
    }

    #[test]
-    fn justified_rows_fill_the_width_exactly() {
-        let ratios = [
-            1.5, 0.75, 1.5, 1.33, 0.66, 1.5, 1.0, 2.2, 1.5, 0.8, 1.5, 1.6,
-        ];
-        let rows = plan_rows(&ratios, 180.0, 1000.0);
-
-        assert!(
-            rows.len() > 1,
-            "12 photos at 180px should need several rows"
-        );
-        // Every row but the trailing one is justified.
-        for row in &rows[..rows.len() - 1] {
-            assert_eq!(row_width(row), 1000);
+    fn the_grid_spans_the_content_width() {
+        // Whatever the width, the columns plus their gaps land on it (bar the
+        // few px integer division cannot divide), so no ragged right margin.
+        for width in [640, 900, 1000, 1440, 1920, 2560] {
+            let (columns, edge) = plan_grid(TILE_DEFAULT, width);
+            let used = row_width(columns, edge);
+            assert!(
+                used <= width && width - used < columns as i32,
+                "{columns} x {edge}px = {used}px does not span {width}px"
+            );
        }
    }

    #[test]
-    fn every_photo_lands_in_exactly_one_row() {
-        let ratios: Vec<f64> = (0..37).map(|i| 0.5 + f64::from(i % 5) * 0.4).collect();
-        let rows = plan_rows(&ratios, 180.0, 1000.0);
-        let tiles: usize = rows.iter().map(Vec::len).sum();
-        assert_eq!(tiles, ratios.len());
-    }
-
-    #[test]
-    fn tiles_keep_their_aspect_ratio() {
-        let rows = plan_rows(&[1.5, 1.5, 1.5, 1.5, 1.5, 1.5, 1.5, 1.5], 180.0, 1000.0);
-        // All but the last tile of a justified row are sized straight from the
-        // ratio, so w/h is the photo's own — no cropping needed to place it.
-        for row in &rows {
-            for (width, height) in &row[..row.len() - 1] {
-                let ratio = f64::from(*width) / f64::from(*height);
-                assert!((ratio - 1.5).abs() < 0.02, "{width}x{height} is not 3:2");
-            }
-        }
-    }
-
-    #[test]
-    fn trailing_row_is_not_stretched() {
-        // Two photos can't fill a 1000px row at 180px tall, so they must keep the
-        // target height rather than being blown up to a screen-wide row.
-        let rows = plan_rows(&[1.5, 1.5], 180.0, 1000.0);
-        assert_eq!(rows.len(), 1);
-        assert!(rows[0].iter().all(|(_, height)| *height == 180));
-        assert!(row_width(&rows[0]) < 1000);
-    }
-
-    #[test]
-    fn an_extreme_panorama_cannot_squash_its_row() {
-        // Unclamped, a 20:1 panorama would drag its whole row down to ~40px tall.
-        // Clamped at RATIO_MAX it stays a wide tile in a row of normal height.
-        let rows = plan_rows(&[20.0, 1.5, 1.5], 180.0, 1000.0);
-        let (width, height) = rows[0][0];
-        assert!(height > 120, "row squashed to {height}px");
-        assert!(width <= 1000, "tile overflows the row at {width}px");
-        assert_eq!(row_width(&rows[0]), 1000);
-    }
-
-    #[test]
-    fn narrow_widths_and_no_photos_are_survivable() {
-        assert!(plan_rows(&[], 180.0, 1000.0).is_empty());
-        // Width below the floor is clamped rather than producing zero-px tiles.
-        let rows = plan_rows(&[1.5, 1.5], 180.0, 0.0);
+    fn tiles_stay_near_the_target_size() {
+        // The column count rounds and the edge absorbs the remainder, so a tile
+        // is never more than one gap-and-a-bit away from what was asked for.
+        let (columns, edge) = plan_grid(TILE_DEFAULT, 1920);
+        assert!(columns >= 7, "1920px should hold several 220px tiles");
        assert!(
-            rows.iter()
-                .flatten()
-                .all(|(width, height)| *width > 0 && *height > 0)
+            (edge - TILE_DEFAULT).abs() < TILE_DEFAULT / 3,
+            "{edge}px is not near the {TILE_DEFAULT}px target"
        );
    }
+
+    #[test]
+    fn zooming_in_widens_the_tiles_and_drops_columns() {
+        let (wide_columns, small_edge) = plan_grid(TILE_MIN, 1200);
+        let (few_columns, big_edge) = plan_grid(TILE_MAX, 1200);
+        assert!(wide_columns > few_columns);
+        assert!(big_edge > small_edge);
+    }
+
+    #[test]
+    fn a_window_narrower_than_one_tile_still_gets_a_column() {
+        // A single column at whatever fits, rather than zero columns (which would
+        // divide by zero) or a zero-px tile.
+        let (columns, edge) = plan_grid(TILE_DEFAULT, 40);
+        assert_eq!(columns, 1);
+        assert!(edge > 0);
+        let (columns, edge) = plan_grid(TILE_DEFAULT, 0);
+        assert_eq!(columns, 1);
+        assert!(edge > 0);
+    }
 }
@@ -281,6 +281,7 @@ pub(crate) fn activity_verb(kind: ActivityKind) -> &'static str {
        ActivityKind::Share => "Shared",
        ActivityKind::PublicLink => "Linked",
        ActivityKind::Unshare => "Unshared",
+        ActivityKind::Conflict => "Conflict",
    }
 }

@@ -299,6 +300,7 @@ pub(crate) fn activity_icon(kind: ActivityKind) -> &'static str {
        ActivityKind::Restore => "edit-undo-symbolic",
        ActivityKind::Share | ActivityKind::PublicLink => "emblem-shared-symbolic",
        ActivityKind::Unshare => "action-unavailable-symbolic",
+        ActivityKind::Conflict => "dialog-warning-symbolic",
    }
 }

@@ -0,0 +1,265 @@
+//! The Albums view of the Photos page: a grid of album covers, and the album
+//! that opens when one is clicked.
+//!
+//! An open album reuses the gallery wholesale — same square grid, same
+//! on-demand thumbnails, same lightbox — by parking the album in
+//! [`GalleryState::album`] and letting [`load_gallery`] page
+//! [`Request::AlbumPhotos`] instead of the timeline. Only the header and the
+//! filter bar differ, because an album is served whole rather than filtered.
+
+use crate::*;
+
+/// Edge length in px of an album cover in the grid. Bigger than a timeline tile:
+/// there are far fewer albums than photos, and the cover is the only thing
+/// identifying one at a glance.
+const COVER_EDGE: i32 = 200;
+
+/// Show the Albums grid and (re)load it. Called when the Albums toggle goes on.
+pub(crate) fn show_albums(ui: &Rc<Ui>) {
+    close_album(ui);
+    ui.gallery.content.set_visible_child_name("albums");
+    load_albums(ui);
+}
+
+/// Ask the daemon for the album listing and rebuild the grid.
+pub(crate) fn load_albums(ui: &Rc<Ui>) {
+    if ui.gallery.albums_loading.get() {
+        return;
+    }
+    ui.gallery.albums_loading.set(true);
+    albums_status(
+        ui,
+        "view-grid-symbolic",
+        "Loading albums…",
+        "Reading your Proton Drive albums.",
+    );
+
+    let rx = spawn_request(ui.dirs.control_socket(), Request::PhotoAlbums);
+    let ui = ui.clone();
+    glib::spawn_future_local(async move {
+        let result = rx.recv().await;
+        ui.gallery.albums_loading.set(false);
+        match result {
+            Ok(Ok(Response::Albums {
+                available: false, ..
+            })) => albums_status(
+                &ui,
+                "image-missing-symbolic",
+                "No photo library",
+                "This Proton account doesn't have Photos enabled.",
+            ),
+            Ok(Ok(Response::Albums { items, .. })) if items.is_empty() => albums_status(
+                &ui,
+                "view-grid-symbolic",
+                "No albums",
+                "Albums you create in Proton Photos appear here.",
+            ),
+            Ok(Ok(Response::Albums { items, .. })) => {
+                fill_albums(&ui, &items);
+                ui.gallery.albums_stack.set_visible_child_name("grid");
+            }
+            Ok(Ok(Response::Error { message, kind })) => {
+                toast_failure(&ui, "Couldn't load albums", &message, kind);
+                albums_status(
+                    &ui,
+                    "dialog-warning-symbolic",
+                    "Couldn't load albums",
+                    &message,
+                );
+            }
+            Ok(Ok(_)) | Ok(Err(_)) | Err(_) => albums_status(
+                &ui,
+                "network-offline-symbolic",
+                "Not connected",
+                "The Proton Drive mount service didn't respond.",
+            ),
+        }
+    });
+}
+
+/// Replace the grid's cards with `albums`, in the order the daemon gave them
+/// (newest activity first).
+fn fill_albums(ui: &Rc<Ui>, albums: &[AlbumInfo]) {
+    while let Some(child) = ui.gallery.albums.first_child() {
+        ui.gallery.albums.remove(&child);
+    }
+    for album in albums {
+        ui.gallery.albums.append(&album_card(ui, album));
+    }
+    // The covers are ordinary photos as far as the daemon is concerned, so the
+    // batch that fills them is the gallery's own.
+    schedule_thumbs(ui);
+}
+
+/// One album as a clickable card: its cover, its name, and how many photos it
+/// holds. An album shared with us says so — it lives on someone else's volume,
+/// and that is worth knowing before opening it.
+fn album_card(ui: &Rc<Ui>, album: &AlbumInfo) -> gtk4::Button {
+    let picture = gtk4::Picture::builder()
+        // Fills and crops the cover square, like a timeline tile.
+        .content_fit(gtk4::ContentFit::Cover)
+        .can_shrink(true)
+        .hexpand(true)
+        .vexpand(true)
+        .build();
+    picture.add_css_class("photo-thumb");
+
+    let placeholder = gtk4::Image::builder()
+        .icon_name("view-grid-symbolic")
+        .pixel_size(32)
+        .halign(gtk4::Align::Center)
+        .valign(gtk4::Align::Center)
+        .build();
+    placeholder.add_css_class("photo-placeholder");
+
+    let cover = gtk4::Overlay::new();
+    cover.set_child(Some(&placeholder));
+    cover.add_overlay(&picture);
+    cover.set_size_request(COVER_EDGE, COVER_EDGE);
+    cover.set_overflow(gtk4::Overflow::Hidden);
+    cover.add_css_class("album-cover");
+
+    let name = gtk4::Label::builder()
+        .label(&album.name)
+        .halign(gtk4::Align::Start)
+        .xalign(0.0)
+        .ellipsize(gtk4::pango::EllipsizeMode::End)
+        .build();
+    name.add_css_class("heading");
+
+    let count = gtk4::Label::builder()
+        .label(album_subtitle(album))
+        .halign(gtk4::Align::Start)
+        .xalign(0.0)
+        .ellipsize(gtk4::pango::EllipsizeMode::End)
+        .build();
+    count.add_css_class("dim-label");
+    count.add_css_class("caption");
+
+    let card = gtk4::Box::new(gtk4::Orientation::Vertical, 4);
+    card.append(&cover);
+    card.append(&name);
+    card.append(&count);
+
+    let button = gtk4::Button::builder().child(&card).build();
+    button.add_css_class("flat");
+    button.add_css_class("album-card");
+    button.set_tooltip_text(Some(&album.name));
+
+    if let Some(uid) = album.cover_uid.clone() {
+        want_cover(ui, uid, &picture);
+    }
+
+    let ui_open = ui.clone();
+    let album = album.clone();
+    button.connect_clicked(move |_| open_album(&ui_open, album.clone()));
+    button
+}
+
+/// "12 photos", plus where the album came from when it isn't ours.
+fn album_subtitle(album: &AlbumInfo) -> String {
+    let photos = match album.photo_count {
+        1 => "1 photo".to_string(),
+        n => format!("{n} photos"),
+    };
+    if album.shared {
+        format!("{photos} · shared with me")
+    } else {
+        photos
+    }
+}
+
+/// Queue an album cover for the gallery's own thumbnail machinery: same batching,
+/// same texture cache, same decode pacing as a timeline tile.
+fn want_cover(ui: &Rc<Ui>, uid: String, picture: &gtk4::Picture) {
+    if let Some(texture) = ui.gallery.photo_tex.borrow().get(&uid) {
+        picture.set_paintable(Some(texture));
+        return;
+    }
+    if ui.gallery.photo_nothumb.borrow().contains(&uid) {
+        return;
+    }
+    ui.gallery
+        .thumb_wanted
+        .borrow_mut()
+        .insert(uid.clone(), picture.clone());
+    let mut queue = ui.gallery.thumb_queue.borrow_mut();
+    if !queue.contains(&uid) {
+        queue.push_back(uid);
+    }
+}
+
+/// Open one album in the gallery: the timeline view, paged from the album
+/// instead, with the filters that don't apply to it out of the way.
+pub(crate) fn open_album(ui: &Rc<Ui>, album: AlbumInfo) {
+    ui.gallery.title.set_label(&album.name);
+    ui.gallery.subtitle.set_label(&album_subtitle(&album));
+    ui.gallery.subtitle.set_visible(true);
+    *ui.gallery.album.borrow_mut() = Some(album);
+
+    // An album page carries no kind or date filter, and Upload targets the
+    // timeline rather than an album — hide those rather than offer controls that
+    // would silently do something else. The Photos/Albums switcher goes too: an
+    // album is a level below it, and back is the way out.
+    ui.gallery.filters.set_visible(false);
+    ui.gallery.view_switch.set_visible(false);
+    ui.gallery.upload.set_visible(false);
+    ui.gallery.back.set_visible(true);
+    // A stale kind/date filter would otherwise be sent with the album request.
+    ui.gallery.kind.set(None);
+    ui.gallery.range.set(None);
+
+    ui.gallery.content.set_visible_child_name("timeline");
+    load_gallery(ui, false);
+}
+
+/// Leave an open album, restoring the timeline's header and filters. A no-op
+/// when no album is open, so callers can use it as "make sure we're not in one".
+pub(crate) fn close_album(ui: &Rc<Ui>) {
+    if ui.gallery.album.borrow_mut().take().is_none() {
+        return;
+    }
+    ui.gallery.title.set_label("Gallery");
+    ui.gallery.filters.set_visible(true);
+    ui.gallery.view_switch.set_visible(true);
+    ui.gallery.upload.set_visible(true);
+    ui.gallery.back.set_visible(false);
+}
+
+/// Show the album grid's own status page (loading, empty, or an error).
+fn albums_status(ui: &Rc<Ui>, icon: &str, title: &str, description: &str) {
+    ui.gallery.albums_status.set_icon_name(Some(icon));
+    ui.gallery.albums_status.set_title(title);
+    ui.gallery.albums_status.set_description(Some(description));
+    ui.gallery.albums_stack.set_visible_child_name("status");
+}
+
+/// Wire the Photos/Albums switcher and the back button. The switcher swaps the
+/// whole content area; back leaves an open album for the grid it came from.
+pub(crate) fn wire_albums(ui: &Rc<Ui>) {
+    let ui_albums = ui.clone();
+    ui.gallery.albums_btn.clone().connect_toggled(move |btn| {
+        if btn.is_active() {
+            show_albums(&ui_albums);
+        }
+    });
+
+    // Only the button being switched *on* acts: the group fires `toggled` for
+    // the one going off too, and acting on both would load twice.
+    let ui_photos = ui.clone();
+    ui.gallery.photos_btn.clone().connect_toggled(move |btn| {
+        if !btn.is_active() {
+            return;
+        }
+        // The timeline is reloaded rather than restored, because an open album
+        // left the model holding its own photos.
+        close_album(&ui_photos);
+        ui_photos.gallery.content.set_visible_child_name("timeline");
+        load_gallery(&ui_photos, false);
+    });
+
+    let ui_back = ui.clone();
+    ui.gallery.back.clone().connect_clicked(move |_| {
+        show_albums(&ui_back);
+    });
+}
@@ -1,3 +1,4 @@
+use crate::activation::{DriveActivation, drive_activation, mounted_path};
 use crate::*;

 pub(crate) struct BrowserState {
@@ -493,9 +494,9 @@ pub(crate) fn show_context_menu(ui: &Rc<Ui>, entry: &DirEntry, anchor: &gtk4::Bo
    popover.set_parent(anchor);
    popover.connect_closed(|p| p.unparent());

-    // Videos lead with Play (stream from the mount, no download); the plain Open
+    // Media leads with Play (stream from the mount, no download); the plain Open
    // below still downloads a local copy for anyone who wants one.
-    if is_video_entry(entry) {
+    if is_streamable_media_entry(entry) {
        let play = menu_item("Play (stream)", "media-playback-start-symbolic");
        let ui_play = ui.clone();
        let entry_play = entry.clone();
@@ -514,8 +515,8 @@ pub(crate) fn show_context_menu(ui: &Rc<Ui>, entry: &DirEntry, anchor: &gtk4::Bo
    open.connect_clicked(move |_| {
        pop.popdown();
        // Open always means "download a local copy and hand off", even for a
-        // video — `activate_entry` would otherwise stream it.
-        if is_video_entry(&entry_open) {
+        // media file — `activate_entry` would otherwise stream it.
+        if is_streamable_media_entry(&entry_open) {
            download_and_open(&ui_open, &entry_open);
        } else {
            activate_entry(&ui_open, &entry_open);
@@ -610,14 +611,12 @@ pub(crate) fn entry_at(model: Option<&impl IsA<gio::ListModel>>, pos: u32) -> Op
    Some(entry)
 }

-/// Whether an entry's name marks it as a video, reusing the same classifier the
-/// Photos page splits on — so the file browser and the gallery agree on what a
-/// video is.
-pub(crate) fn is_video_entry(entry: &DirEntry) -> bool {
-    !entry.is_dir && PhotoKind::classify(Some(&entry.name), None) == PhotoKind::Video
+/// Whether an entry can be opened through FUSE instead of fully materialized.
+pub(crate) fn is_streamable_media_entry(entry: &DirEntry) -> bool {
+    drive_activation(&entry.name, entry.is_dir) == DriveActivation::MountedMedia
 }

-/// Stream a video straight from the mount, no download. Drive folders *are* part
+/// Stream media straight from the mount, no download. Drive folders *are* part
 /// of the FUSE mount, so a player pointed at `<mountpoint>/<rel>` reads the file
 /// through [`Core::read_range_remote`] — 4 MB blocks fetched on demand as it
 /// seeks and buffers — instead of waiting for the whole file to land like
@@ -626,11 +625,11 @@ pub(crate) fn is_video_entry(entry: &DirEntry) -> bool {
 pub(crate) fn stream_entry(ui: &Rc<Ui>, entry: &DirEntry) {
    let rel = entry_rel(ui, entry);
    let mountpoint = ui.dirs.resolved_mountpoint(&ui.dirs.load_config());
-    let abs = mountpoint.join(&rel);
+    let abs = mounted_path(&mountpoint, &rel);
    let Some(path) = abs.to_str() else {
        toast_error(
            ui,
-            "Couldn't play video",
+            "Couldn't play media",
            "The file path isn't valid UTF-8.",
        );
        return;
@@ -639,7 +638,7 @@ pub(crate) fn stream_entry(ui: &Rc<Ui>, entry: &DirEntry) {
    play_external(path);
 }

-/// Open an entry the Nautilus way: folders descend, videos stream from the mount,
+/// Open an entry the Nautilus way: folders descend, media streams from the mount,
 /// other files download-and-open.
 pub(crate) fn activate_entry(ui: &Rc<Ui>, entry: &DirEntry) {
    let rel = entry_rel(ui, entry);
@@ -651,8 +650,8 @@ pub(crate) fn activate_entry(ui: &Rc<Ui>, entry: &DirEntry) {
        }
        *ui.browser.path.borrow_mut() = rel;
        load_browser(ui);
-    } else if is_video_entry(entry) {
-        // A video streams rather than downloads: that is exactly the "play it,
+    } else if drive_activation(&entry.name, entry.is_dir) == DriveActivation::MountedMedia {
+        // Media streams rather than downloads: that is exactly the "play it,
        // don't fetch the whole thing" behaviour this is for.
        stream_entry(ui, entry);
    } else {
@@ -1443,6 +1442,7 @@ pub(crate) fn repaint_search(ui: &Rc<Ui>, hits: &[SearchHit]) {
            cached: false,
            uid: h.uid.clone(),
            path: h.path.clone(),
+            role: String::new(),
        })
        .collect();
    entries.sort_by(|a, b| {
@@ -9,6 +9,8 @@ pub(crate) struct DevicesState {
    pub(crate) group: adw::PreferencesGroup,
    pub(crate) rows: RefCell<Vec<gtk4::Widget>>,
    pub(crate) sync_group: adw::PreferencesGroup,
+    /// The single "This computer" summary row. The per-folder rows moved to the
+    /// Locations page, which owns every local path.
    pub(crate) sync_rows: RefCell<Vec<gtk4::Widget>>,
    /// "Rename" action in the "This computer" header. Insensitive until the
    /// device list identifies this machine's own device.
@@ -25,7 +27,8 @@ pub(crate) struct DevicesState {
 pub(crate) struct DevicesWidgets {
    pub(crate) content: gtk4::Stack,
    pub(crate) status: adw::StatusPage,
-    /// "This computer" — the local folders synced to this machine's device.
+    /// "This computer" — this machine's device identity and a pointer to its
+    /// folders on the Locations page.
    pub(crate) sync_group: adw::PreferencesGroup,
    /// "Rename" in the "This computer" header — renames this machine's device.
    pub(crate) rename_this: gtk4::Button,
@@ -33,7 +36,6 @@ pub(crate) struct DevicesWidgets {
    /// machine's own device is deliberately not among them; see
    /// [`repaint_devices`].
    pub(crate) group: adw::PreferencesGroup,
-    pub(crate) add_folder: gtk4::Button,
    /// "Restore Folders" — re-attach this device's remote folders to local
    /// directories after adopting it on a new machine.
    pub(crate) restore: gtk4::Button,
@@ -54,11 +56,6 @@ pub(crate) fn build_devices_page() -> (gtk4::Widget, DevicesWidgets) {
    titles.set_hexpand(true);
    titles.append(&title);

-    let add_folder = gtk4::Button::builder()
-        .label("Add Folder")
-        .valign(gtk4::Align::Center)
-        .build();
-    add_folder.add_css_class("flat");
    let restore = gtk4::Button::builder()
        .label("Restore Folders")
        .tooltip_text("Sync this computer's Drive folders back to local directories")
@@ -71,18 +68,14 @@ pub(crate) fn build_devices_page() -> (gtk4::Widget, DevicesWidgets) {
    header.append(&titles);
    header.append(&refresh);
    header.append(&restore);
-    header.append(&add_folder);

-    // The description spells out what the per-row On-demand switch does to the
-    // local copy, because the switch itself can't: turning it on *deletes* the
-    // files from this disk, which is not something to discover afterwards.
+    // This page is about device *identity* — which computer this is, which other
+    // computers back up to the account, and how to adopt one. The folders
+    // themselves are local paths, so they live on the Locations page; keeping a
+    // second copy of that list here would be two places to change the same mode.
    let sync_group = adw::PreferencesGroup::builder()
        .title("This computer")
-        .description(
-            "Local folders backed up to this device. Synced folders keep a full copy on \
-             this disk; on-demand folders keep the files in Proton Drive only and fetch \
-             them as you open them.",
-        )
+        .description("The device this machine backs up to.")
        .build();
    // Rename control for *this* machine's device, in the section header. The
    // current device is filtered out of "Other computers", so this is the only
@@ -145,7 +138,6 @@ pub(crate) fn build_devices_page() -> (gtk4::Widget, DevicesWidgets) {
            sync_group,
            rename_this,
            group,
-            add_folder,
            restore,
            retry,
            refresh,
@@ -153,20 +145,13 @@ pub(crate) fn build_devices_page() -> (gtk4::Widget, DevicesWidgets) {
    )
 }

-/// Install the Devices page's retry button and the "Add Folder" action.
-pub(crate) fn wire_devices(
-    ui: &Rc<Ui>,
-    retry: &gtk4::Button,
-    add_folder: &gtk4::Button,
-    restore: &gtk4::Button,
-) {
+/// Install the Devices page's retry button and the "Restore Folders" action.
+pub(crate) fn wire_devices(ui: &Rc<Ui>, retry: &gtk4::Button, restore: &gtk4::Button) {
    let ui_retry = ui.clone();
    retry.connect_clicked(move |_| {
        service::restart();
        load_devices(&ui_retry);
    });
-    let ui_add = ui.clone();
-    add_folder.connect_clicked(move |_| prompt_add_sync_folder(&ui_add));
    let ui_restore = ui.clone();
    restore.connect_clicked(move |_| prompt_restore_folders(&ui_restore));
    let ui_ren = ui.clone();
@@ -224,9 +209,9 @@ pub(crate) fn load_devices(ui: &Rc<Ui>) {
                return;
            }
        };
-        // Daemon reachable: show the list and paint the synced-folders section.
+        // Daemon reachable: show the list and paint the "This computer" section.
        ui.devices.content.set_visible_child_name("list");
-        repaint_sync_folders(&ui, &folders);
+        repaint_this_computer(&ui, &folders);

        let devices = match devices_reply {
            Ok(Ok(Response::Devices { items })) => items,
@@ -239,35 +224,6 @@ pub(crate) fn load_devices(ui: &Rc<Ui>) {
    });
 }

-/// Refresh just the synced-folders section, with no status flash, no spinner and
-/// no devices round-trip. Driven by the periodic tick while the Devices page is
-/// on screen: a folder's sync progress is only live if something re-reads it.
-///
-/// A hiccup leaves the page as it is — the next tick tries again, and a real
-/// outage is reported by [`load_devices`] on the next visit.
-pub(crate) fn refresh_sync_folders(ui: &Rc<Ui>) {
-    if ui.devices.inflight.get() {
-        return;
-    }
-    ui.devices.inflight.set(true);
-    let rx = spawn_request(ui.dirs.control_socket(), Request::ListSyncFolders);
-    let ui = ui.clone();
-    glib::spawn_future_local(async move {
-        let result = rx.recv().await;
-        ui.devices.inflight.set(false);
-        let Ok(Ok(Response::SyncFolders { items })) = result else {
-            return;
-        };
-        // The page may have been navigated away from, or collapsed to a status
-        // view, while the request was in flight.
-        if ui.stack.visible_child_name().as_deref() == Some("devices")
-            && ui.devices.content.visible_child_name().as_deref() == Some("list")
-        {
-            repaint_sync_folders(&ui, &items);
-        }
-    });
-}
-
 /// The daemon didn't answer the Devices page.
 pub(crate) fn devices_unreachable(ui: &Rc<Ui>) {
    if service::is_failed() || !service::is_active() {
@@ -398,137 +354,53 @@ pub(crate) fn device_subtitle(dev: &DeviceInfo) -> String {
    }
 }

-/// Rebuild the "This computer" section from a fresh synced-folders listing.
-pub(crate) fn repaint_sync_folders(ui: &Rc<Ui>, folders: &[SyncFolderInfo]) {
+/// Rebuild the "This computer" section: one row naming the device this machine
+/// backs up to, and how many folders it carries.
+///
+/// The per-folder rows (mode switch, sync now, remove) live on the Locations
+/// page. They are local paths, and Locations is the one page that owns those;
+/// two lists of the same folders would be two places to flip the same switch.
+pub(crate) fn repaint_this_computer(ui: &Rc<Ui>, folders: &[SyncFolderInfo]) {
    for row in ui.devices.sync_rows.borrow_mut().drain(..) {
        ui.devices.sync_group.remove(&row);
    }
+    let row = adw::ActionRow::builder()
+        .title("This computer")
+        .subtitle(this_computer_subtitle(folders))
+        .build();
+    row.add_prefix(&gtk4::Image::from_icon_name("computer-symbolic"));
+    let manage = gtk4::Button::builder()
+        .label("Locations")
+        .tooltip_text("Manage this computer's folders and mountpoint")
+        .valign(gtk4::Align::Center)
+        .build();
+    manage.add_css_class("flat");
+    let ui_go = ui.clone();
+    manage.connect_clicked(move |_| ui_go.stack.set_visible_child_name("locations"));
+    row.add_suffix(&manage);
+    ui.devices.sync_group.add(&row);
+    *ui.devices.sync_rows.borrow_mut() = vec![row.upcast()];
+}
+
+/// How many folders this machine backs up, and whether any of them needs
+/// attention — the one fact worth surfacing away from the folder list itself.
+pub(crate) fn this_computer_subtitle(folders: &[SyncFolderInfo]) -> String {
    if folders.is_empty() {
-        let row = adw::ActionRow::builder()
-            .title("No synced folders")
-            .subtitle("Add a folder to back it up to this device.")
-            .build();
-        row.add_prefix(&gtk4::Image::from_icon_name("folder-symbolic"));
-        ui.devices.sync_group.add(&row);
-        *ui.devices.sync_rows.borrow_mut() = vec![row.upcast()];
-        return;
+        return "No folders backed up yet — add one under Locations.".to_string();
    }
-    let mut rows: Vec<gtk4::Widget> = Vec::new();
-    for f in folders {
-        // A running pass describes itself ("Uploading photo.jpg — 12 of 40");
-        // otherwise fall back to the folder's resting state.
-        let status = match &f.progress {
-            Some(p) => sync_progress_label(p),
-            None => sync_state_label(&f.state).to_string(),
-        };
-        // A queued switch is where the folder is *going*, which is what the user
-        // just asked for and is waiting to see happen — so it leads the subtitle
-        // instead of the mode the folder is still technically in.
-        let subtitle = match (f.pending_mode.as_deref(), f.mode.as_str()) {
-            (Some("ondemand"), _) => format!("Going on-demand · {status}"),
-            (Some(_), _) => format!("Switching to synced · {status}"),
-            (None, "ondemand") => format!("On-demand · {status}"),
-            (None, _) => format!("Synced · {status}"),
-        };
-        let row = adw::ActionRow::builder()
-            .title(&f.local_path)
-            .subtitle(&subtitle)
-            .build();
-        row.add_prefix(&gtk4::Image::from_icon_name("folder-symbolic"));
-        let id = f.id;
-
-        // A pass that knows how far it has got shows it: the subtitle alone
-        // ("syncing photo.jpg — 12 of 40") never conveys that the end is near. This
-        // holds for scanning as much as applying — a big folder spends minutes there
-        // — but a folder syncing for the first time has no estimate to draw against
-        // (`total == 0`), and this row is repainted on the 2s tick, too slow for a
-        // pulse to read as motion. So it stays text-only until real counts exist.
-        if let Some(p) = &f.progress
-            && p.total > 0
-        {
-            let bar = gtk4::ProgressBar::builder()
-                .fraction((p.done as f64 / p.total.max(p.done) as f64).min(1.0))
-                .valign(gtk4::Align::Center)
-                .width_request(120)
-                .build();
-            row.add_suffix(&bar);
-        }
-
-        // Sync now — only meaningful for mirror folders (on-demand has no local
-        // copy to reconcile). The engine also syncs on file changes and on a
-        // 120s poll; this is the "don't wait" button.
-        if f.mode != "ondemand" {
-            let sync_now = gtk4::Button::builder()
-                .icon_name("view-refresh-symbolic")
-                .tooltip_text("Sync this folder now")
-                .valign(gtk4::Align::Center)
-                .build();
-            sync_now.add_css_class("flat");
-            let ui_sync = ui.clone();
-            sync_now.connect_clicked(move |_| {
-                let rx = spawn_request(
-                    ui_sync.dirs.control_socket(),
-                    Request::SyncNow { id: Some(id) },
-                );
-                let ui_sync = ui_sync.clone();
-                glib::spawn_future_local(async move {
-                    match rx.recv().await {
-                        Ok(Ok(Response::Ok { .. })) => toast(&ui_sync, "Syncing folder…"),
-                        Ok(Ok(Response::Error { message, kind })) => {
-                            toast_failure(&ui_sync, "Couldn't sync", &message, kind)
-                        }
-                        _ => toast_error(
-                            &ui_sync,
-                            "Couldn't sync",
-                            "The mount service didn't respond.",
-                        ),
-                    }
-                });
-            });
-            row.add_suffix(&sync_now);
-        }
-
-        // On-demand toggle: off = full local copy (mirror), on = FUSE mount that
-        // frees the disk. Set the state before wiring the handler so painting the
-        // current mode doesn't fire a spurious request.
-        //
-        // A queued switch paints as already flipped: the daemon accepted the
-        // request and will act on it, so snapping the switch back to the current
-        // mode would read as "it didn't take" and invite the user to toggle again.
-        let target = f.pending_mode.as_deref().unwrap_or(&f.mode);
-        let ondemand = gtk4::Switch::builder()
-            .tooltip_text(
-                "On-demand: free this disk by keeping the files in Proton Drive only, \
-                 fetching each as you open it. Turn off to download them back and keep a \
-                 full local copy.",
-            )
-            .valign(gtk4::Align::Center)
-            .active(target == "ondemand")
-            .build();
-        let ui_mode = ui.clone();
-        ondemand.connect_state_set(move |_, on| {
-            set_sync_folder_mode(&ui_mode, id, if on { "ondemand" } else { "mirror" });
-            glib::Propagation::Proceed
-        });
-        row.add_suffix(&ondemand);
-
-        let remove = gtk4::Button::builder()
-            .icon_name("user-trash-symbolic")
-            .tooltip_text("Stop syncing this folder")
-            .valign(gtk4::Align::Center)
-            .build();
-        remove.add_css_class("flat");
-        let ui_rm = ui.clone();
-        let path = f.local_path.clone();
-        // The folder's *current* mode, not a queued one: a switch that hasn't
-        // landed yet has not moved the files anywhere.
-        let ondemand = f.mode == "ondemand";
-        remove.connect_clicked(move |_| prompt_remove_sync_folder(&ui_rm, id, &path, ondemand));
-        row.add_suffix(&remove);
-        ui.devices.sync_group.add(&row);
-        rows.push(row.upcast());
+    let count = match folders.len() {
+        1 => "1 folder backed up".to_string(),
+        n => format!("{n} folders backed up"),
+    };
+    let attention = folders
+        .iter()
+        .filter(|f| f.state == "error" || f.state == "conflict")
+        .count();
+    match attention {
+        0 => format!("{count} · manage them under Locations"),
+        1 => format!("{count} · 1 needs attention"),
+        n => format!("{count} · {n} need attention"),
    }
-    *ui.devices.sync_rows.borrow_mut() = rows;
 }

 /// Human label for a synced folder's `state` column.
@@ -592,7 +464,7 @@ pub(crate) fn prompt_add_sync_folder(ui: &Rc<Ui>) {
                    // device and creating the remote folder is off-socket network
                    // work. A fixed delay here either fires too early (empty list)
                    // or too late (row flashes in). Instead let the periodic
-                    // `refresh_sync_folders` tick pick the row up whenever it
+                    // `refresh_locations` tick pick the row up whenever it
                    // actually lands, which is what keeps a running pass live too.
                    toast(&ui, "Syncing folder…");
                }
@@ -942,3 +814,47 @@ pub(crate) fn run_devices_mutation(
        }
    });
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn folder(state: &str) -> SyncFolderInfo {
+        SyncFolderInfo {
+            id: 1,
+            local_path: "/home/u/Documents".into(),
+            remote_uid: "vol~link".into(),
+            mode: "mirror".into(),
+            state: state.into(),
+            last_sync: 0,
+            pending_mode: None,
+            progress: None,
+        }
+    }
+
+    #[test]
+    fn a_machine_with_no_folders_is_told_where_to_add_one() {
+        assert_eq!(
+            this_computer_subtitle(&[]),
+            "No folders backed up yet — add one under Locations."
+        );
+    }
+
+    #[test]
+    fn folders_needing_attention_are_counted_not_hidden() {
+        // The per-folder rows moved to Locations, so this row is the only place
+        // the Computers page can surface that something is wrong.
+        assert_eq!(
+            this_computer_subtitle(&[folder("idle"), folder("idle")]),
+            "2 folders backed up · manage them under Locations"
+        );
+        assert_eq!(
+            this_computer_subtitle(&[folder("idle"), folder("error")]),
+            "2 folders backed up · 1 needs attention"
+        );
+        assert_eq!(
+            this_computer_subtitle(&[folder("conflict"), folder("error")]),
+            "2 folders backed up · 2 need attention"
+        );
+    }
+}
@@ -0,0 +1,536 @@
+//! The Locations page: every local place Proton Drive occupies on this machine.
+//!
+//! One row per [`MountSpec`] from [`Request::ListLocations`] — the primary
+//! `~/ProtonDrive` mount, plus each folder this computer backs up, whether it is
+//! a mirrored local directory or an on-demand FUSE session. The page is called
+//! *Locations* rather than *Mounts* because a mirror folder is a plain directory
+//! with no FUSE session behind it (mount-architecture.md §4).
+//!
+//! The device rows drive the same control requests the Computers page used to:
+//! mode switch, sync now, remove. What is new here is that the primary mount is
+//! listed alongside them, with the mountpoint chooser that used to live in
+//! Settings.
+
+use crate::*;
+
+pub(crate) struct LocationsState {
+    pub(crate) content: gtk4::Stack,
+    pub(crate) status: adw::StatusPage,
+    pub(crate) retry: gtk4::Button,
+    pub(crate) group: adw::PreferencesGroup,
+    pub(crate) rows: RefCell<Vec<gtk4::Widget>>,
+    pub(crate) inflight: Cell<bool>,
+    pub(crate) loaded_at: Cell<Option<Instant>>,
+}
+
+/// Widgets the Locations page's load/repaint touch.
+pub(crate) struct LocationsWidgets {
+    pub(crate) content: gtk4::Stack,
+    pub(crate) status: adw::StatusPage,
+    pub(crate) group: adw::PreferencesGroup,
+    pub(crate) retry: gtk4::Button,
+    pub(crate) refresh: gtk4::Button,
+    pub(crate) add_folder: gtk4::Button,
+}
+
+pub(crate) fn build_locations_page() -> (gtk4::Widget, LocationsWidgets) {
+    let title = gtk4::Label::builder()
+        .label("Locations")
+        .halign(gtk4::Align::Start)
+        .build();
+    title.add_css_class("title-2");
+
+    let add_folder = gtk4::Button::builder()
+        .label("Add Folder")
+        .tooltip_text("Back a local folder up to this computer's Proton Drive device")
+        .valign(gtk4::Align::Center)
+        .build();
+    add_folder.add_css_class("flat");
+    let refresh = refresh_button();
+
+    let header = gtk4::Box::new(gtk4::Orientation::Horizontal, 8);
+    let titles = gtk4::Box::new(gtk4::Orientation::Vertical, 2);
+    titles.set_hexpand(true);
+    titles.append(&title);
+    header.append(&titles);
+    header.append(&refresh);
+    header.append(&add_folder);
+    // Clamped to the same width as the rows below, or the page title floats off
+    // to the left of the list it names.
+    let header_clamp = adw::Clamp::builder().child(&header).build();
+
+    // Same warning the Computers page carried, for the same reason: the
+    // on-demand switch removes the local copy, which is not a thing to discover
+    // after the fact.
+    let group = adw::PreferencesGroup::builder()
+        .title("On this computer")
+        .description(
+            "Where Proton Drive lives on this machine. Synced folders keep a full copy on \
+             this disk; on-demand folders keep the files in Proton Drive only and fetch \
+             them as you open them.",
+        )
+        .build();
+
+    let groups = gtk4::Box::new(gtk4::Orientation::Vertical, 18);
+    groups.append(&group);
+    let clamp = adw::Clamp::builder().child(&groups).build();
+    // Never scroll sideways: a location's title is a full path, and letting the
+    // row grow to fit one pushes the controls at its end off screen. Constrained,
+    // the path ellipsizes and the switch/remove/open stay reachable.
+    let scroll = gtk4::ScrolledWindow::builder()
+        .vexpand(true)
+        .hscrollbar_policy(gtk4::PolicyType::Never)
+        .child(&clamp)
+        .build();
+
+    let retry = gtk4::Button::builder()
+        .label("Retry")
+        .halign(gtk4::Align::Center)
+        .build();
+    retry.add_css_class("pill");
+    retry.add_css_class("suggested-action");
+    retry.set_visible(false);
+    let status = adw::StatusPage::builder()
+        .icon_name("drive-harddisk-symbolic")
+        .title("Loading…")
+        .child(&retry)
+        .build();
+    // A bare `StatusPage` asks for more width than a half-screen window has, and
+    // a `Stack` is as wide as its widest child — so an unwrapped status page
+    // silently widens the *list* page too, pushing each row's controls off the
+    // right edge. Scrolling it (never horizontally) caps that demand.
+    let status_scroll = gtk4::ScrolledWindow::builder()
+        .vexpand(true)
+        .hscrollbar_policy(gtk4::PolicyType::Never)
+        .child(&status)
+        .build();
+
+    let content = gtk4::Stack::new();
+    content.add_named(&scroll, Some("list"));
+    content.add_named(&status_scroll, Some("status"));
+
+    let page = gtk4::Box::new(gtk4::Orientation::Vertical, 12);
+    page.set_margin_top(18);
+    page.set_margin_bottom(18);
+    page.set_margin_start(18);
+    page.set_margin_end(18);
+    page.append(&header_clamp);
+    page.append(&content);
+
+    let widgets = LocationsWidgets {
+        content: content.clone(),
+        status: status.clone(),
+        group: group.clone(),
+        retry: retry.clone(),
+        refresh,
+        add_folder,
+    };
+    (page.upcast(), widgets)
+}
+
+pub(crate) fn wire_locations(ui: &Rc<Ui>, retry: &gtk4::Button, add_folder: &gtk4::Button) {
+    let ui_retry = ui.clone();
+    retry.connect_clicked(move |_| {
+        ui_retry.locations.loaded_at.set(None);
+        load_locations(&ui_retry);
+    });
+    let ui_add = ui.clone();
+    add_folder.connect_clicked(move |_| prompt_add_sync_folder(&ui_add));
+}
+
+/// Show a status page in place of the locations list.
+pub(crate) fn locations_status(
+    ui: &Rc<Ui>,
+    icon: &str,
+    title: &str,
+    description: &str,
+    retry: bool,
+) {
+    ui.locations.status.set_icon_name(Some(icon));
+    ui.locations.status.set_title(title);
+    ui.locations.status.set_description(Some(description));
+    ui.locations.retry.set_visible(retry);
+    ui.locations.content.set_visible_child_name("status");
+}
+
+/// Fetch every local location and repaint the list.
+pub(crate) fn load_locations(ui: &Rc<Ui>) {
+    if ui.locations.inflight.get() {
+        return;
+    }
+    ui.locations.inflight.set(true);
+    locations_status(
+        ui,
+        "drive-harddisk-symbolic",
+        "Loading…",
+        "Reading this computer's Proton Drive locations.",
+        false,
+    );
+    ui.busy_begin();
+    let rx = spawn_request(ui.dirs.control_socket(), Request::ListLocations);
+    let ui = ui.clone();
+    glib::spawn_future_local(async move {
+        let result = rx.recv().await;
+        ui.busy_end();
+        ui.locations.inflight.set(false);
+        match result {
+            Ok(Ok(Response::Locations { items })) => {
+                ui.locations.content.set_visible_child_name("list");
+                repaint_locations(&ui, &items);
+                ui.locations.loaded_at.set(Some(Instant::now()));
+            }
+            Ok(Ok(Response::Error { message, .. })) => {
+                ui.locations.loaded_at.set(None);
+                locations_status(
+                    &ui,
+                    "dialog-warning-symbolic",
+                    "Unavailable",
+                    &message,
+                    true,
+                );
+            }
+            _ => {
+                ui.locations.loaded_at.set(None);
+                locations_unreachable(&ui);
+            }
+        }
+    });
+}
+
+/// Refresh the rows with no status flash and no spinner, from the periodic tick:
+/// a sync pass's progress is only live if something re-reads it.
+pub(crate) fn refresh_locations(ui: &Rc<Ui>) {
+    if ui.locations.inflight.get() {
+        return;
+    }
+    ui.locations.inflight.set(true);
+    let rx = spawn_request(ui.dirs.control_socket(), Request::ListLocations);
+    let ui = ui.clone();
+    glib::spawn_future_local(async move {
+        let result = rx.recv().await;
+        ui.locations.inflight.set(false);
+        let Ok(Ok(Response::Locations { items })) = result else {
+            return;
+        };
+        // The page may have been navigated away from, or collapsed to a status
+        // view, while the request was in flight.
+        if ui.stack.visible_child_name().as_deref() == Some("locations")
+            && ui.locations.content.visible_child_name().as_deref() == Some("list")
+        {
+            repaint_locations(&ui, &items);
+        }
+    });
+}
+
+/// The daemon didn't answer the Locations page.
+pub(crate) fn locations_unreachable(ui: &Rc<Ui>) {
+    if service::is_failed() || !service::is_active() {
+        locations_status(
+            ui,
+            "network-offline-symbolic",
+            "Not connected",
+            "The Proton Drive mount service isn't running.",
+            true,
+        );
+        return;
+    }
+    locations_status(
+        ui,
+        "folder-remote-symbolic",
+        "Connecting…",
+        "Waiting for the Proton Drive mount service to come up.",
+        false,
+    );
+    let ui = ui.clone();
+    glib::timeout_add_local_once(CONNECT_RETRY_INTERVAL, move || {
+        if ui.stack.visible_child_name().as_deref() == Some("locations") {
+            load_locations(&ui);
+        }
+    });
+}
+
+pub(crate) fn repaint_locations(ui: &Rc<Ui>, items: &[MountSpec]) {
+    for row in ui.locations.rows.borrow_mut().drain(..) {
+        ui.locations.group.remove(&row);
+    }
+    if items.is_empty() {
+        let row = adw::ActionRow::builder()
+            .title("No locations")
+            .subtitle("The mount service hasn't reported a mountpoint yet.")
+            .build();
+        row.add_prefix(&gtk4::Image::from_icon_name("drive-harddisk-symbolic"));
+        ui.locations.group.add(&row);
+        *ui.locations.rows.borrow_mut() = vec![row.upcast()];
+        return;
+    }
+
+    let mut rows: Vec<gtk4::Widget> = Vec::new();
+    for spec in items {
+        let row = adw::ActionRow::builder()
+            .title(&spec.local_path)
+            .subtitle(location_subtitle(spec))
+            // One line each: a wrapped path would reflow the whole list every
+            // time a sync state changed under it.
+            .title_lines(1)
+            .subtitle_lines(1)
+            .build();
+        row.add_prefix(&gtk4::Image::from_icon_name(location_icon(&spec.kind)));
+
+        // A read-only location cannot be written through even where the files are
+        // visible; saying so on the row is cheaper than letting the user find out
+        // from a save dialog.
+        if spec.access == MountAccess::Ro {
+            let badge = gtk4::Label::new(Some("Read-only"));
+            badge.add_css_class("dim-label");
+            badge.add_css_class("caption");
+            badge.set_valign(gtk4::Align::Center);
+            row.add_suffix(&badge);
+        }
+
+        // Same rule as the Computers page: a first pass has no estimate to draw
+        // against, so the bar appears only once real counts exist.
+        if let Some(p) = &spec.progress
+            && p.total > 0
+        {
+            let bar = gtk4::ProgressBar::builder()
+                .fraction((p.done as f64 / p.total.max(p.done) as f64).min(1.0))
+                .valign(gtk4::Align::Center)
+                .width_request(120)
+                .build();
+            row.add_suffix(&bar);
+        }
+
+        match &spec.kind {
+            MountKind::MyFiles => add_my_files_controls(ui, &row),
+            MountKind::Device { sync_folder_id } => {
+                add_device_controls(ui, &row, spec, *sync_folder_id)
+            }
+            // A standalone shared mount has no local mode to switch and is not
+            // this device's to remove.
+            MountKind::Shared { .. } => {}
+        }
+
+        let open = gtk4::Button::builder()
+            .icon_name("folder-open-symbolic")
+            .tooltip_text("Open this folder")
+            .valign(gtk4::Align::Center)
+            .build();
+        open.add_css_class("flat");
+        let path = spec.local_path.clone();
+        open.connect_clicked(move |_| open_path(&path));
+        row.add_suffix(&open);
+
+        ui.locations.group.add(&row);
+        rows.push(row.upcast());
+    }
+    *ui.locations.rows.borrow_mut() = rows;
+}
+
+/// The primary mount's only control: where it lives. Changing it rewrites config
+/// and offers a service restart, which is why it stays a single prompt shared
+/// with the (now removed) Settings row.
+fn add_my_files_controls(ui: &Rc<Ui>, row: &adw::ActionRow) {
+    let change = gtk4::Button::builder()
+        .label("Change")
+        .tooltip_text("Choose a different folder for the Proton Drive mount")
+        .valign(gtk4::Align::Center)
+        .build();
+    change.add_css_class("flat");
+    let ui_mp = ui.clone();
+    change.connect_clicked(move |_| prompt_mountpoint(&ui_mp));
+    row.add_suffix(&change);
+}
+
+/// Sync now (mirror only), the on-demand switch, and Remove — the same three
+/// controls, and the same handlers, the Computers page used to carry.
+fn add_device_controls(ui: &Rc<Ui>, row: &adw::ActionRow, spec: &MountSpec, id: i64) {
+    if spec.mode != MountMode::OnDemand {
+        let sync_now = gtk4::Button::builder()
+            .icon_name("view-refresh-symbolic")
+            .tooltip_text("Sync this folder now")
+            .valign(gtk4::Align::Center)
+            .build();
+        sync_now.add_css_class("flat");
+        let ui_sync = ui.clone();
+        sync_now.connect_clicked(move |_| sync_folder_now(&ui_sync, id));
+        row.add_suffix(&sync_now);
+    }
+
+    // A queued switch paints as already flipped: the daemon accepted it and will
+    // act on it, so snapping back would read as "it didn't take". The state is
+    // set before the handler is wired so painting the current mode doesn't fire
+    // a spurious request.
+    let target = spec.pending_mode.unwrap_or(spec.mode);
+    let ondemand = gtk4::Switch::builder()
+        .tooltip_text(
+            "On-demand: free this disk by keeping the files in Proton Drive only, \
+             fetching each as you open it. Turn off to download them back and keep a \
+             full local copy.",
+        )
+        .valign(gtk4::Align::Center)
+        .active(target == MountMode::OnDemand)
+        .build();
+    let ui_mode = ui.clone();
+    ondemand.connect_state_set(move |_, on| {
+        set_sync_folder_mode(&ui_mode, id, if on { "ondemand" } else { "mirror" });
+        glib::Propagation::Proceed
+    });
+    row.add_suffix(&ondemand);
+
+    let remove = gtk4::Button::builder()
+        .icon_name("user-trash-symbolic")
+        .tooltip_text("Stop syncing this folder")
+        .valign(gtk4::Align::Center)
+        .build();
+    remove.add_css_class("flat");
+    let ui_rm = ui.clone();
+    let path = spec.local_path.clone();
+    // The folder's *current* mode, not a queued one: a switch that hasn't landed
+    // yet has not moved the files anywhere.
+    let is_ondemand = spec.mode == MountMode::OnDemand;
+    remove.connect_clicked(move |_| prompt_remove_sync_folder(&ui_rm, id, &path, is_ondemand));
+    row.add_suffix(&remove);
+}
+
+/// Ask the daemon for an immediate pass over one folder.
+fn sync_folder_now(ui: &Rc<Ui>, id: i64) {
+    let rx = spawn_request(ui.dirs.control_socket(), Request::SyncNow { id: Some(id) });
+    let ui = ui.clone();
+    glib::spawn_future_local(async move {
+        match rx.recv().await {
+            Ok(Ok(Response::Ok { .. })) => toast(&ui, "Syncing folder…"),
+            Ok(Ok(Response::Error { message, kind })) => {
+                toast_failure(&ui, "Couldn't sync", &message, kind)
+            }
+            _ => toast_error(&ui, "Couldn't sync", "The mount service didn't respond."),
+        }
+    });
+}
+
+pub(crate) fn location_icon(kind: &MountKind) -> &'static str {
+    match kind {
+        MountKind::MyFiles => "folder-remote-symbolic",
+        MountKind::Device { .. } => "folder-symbolic",
+        MountKind::Shared { .. } => "system-users-symbolic",
+    }
+}
+
+/// One line describing what a location *is* and what it is doing.
+///
+/// Ordered by how likely it is to be what the user came to check: a queued mode
+/// switch leads (they just asked for it), then the resting mode, then the sync
+/// state, then — only when it is surprising — the fact that no session owns the
+/// path. A mirror folder is a plain directory with no FUSE session, so "not
+/// mounted" is its normal state and saying it would be noise.
+pub(crate) fn location_subtitle(spec: &MountSpec) -> String {
+    let mut parts: Vec<String> = Vec::new();
+    match &spec.kind {
+        MountKind::MyFiles => parts.push("My files".to_string()),
+        MountKind::Shared { .. } => parts.push("Shared folder".to_string()),
+        MountKind::Device { .. } => match (spec.pending_mode, spec.mode) {
+            (Some(MountMode::OnDemand), _) => parts.push("Going on-demand".to_string()),
+            (Some(MountMode::Mirror), _) => parts.push("Switching to synced".to_string()),
+            (Some(MountMode::Unknown) | None, MountMode::OnDemand) => {
+                parts.push("On-demand".to_string())
+            }
+            (Some(MountMode::Unknown) | None, _) => parts.push("Synced".to_string()),
+        },
+    }
+    if matches!(spec.kind, MountKind::Device { .. }) {
+        parts.push(match &spec.progress {
+            Some(p) => sync_progress_label(p),
+            None => sync_state_label(&spec.state).to_string(),
+        });
+    }
+    // Only the locations that are supposed to have a session report its absence:
+    // a mirror folder never has one.
+    let expects_session = !matches!(spec.kind, MountKind::Device { .. })
+        || spec.mode == MountMode::OnDemand
+        || spec.pending_mode == Some(MountMode::OnDemand);
+    if expects_session && !spec.mounted {
+        parts.push("not mounted".to_string());
+    }
+    parts.join(" · ")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn spec(kind: MountKind, mode: MountMode, mounted: bool) -> MountSpec {
+        MountSpec {
+            id: 1,
+            kind,
+            local_path: "/home/u/ProtonDrive".into(),
+            root_uid: "vol~link".into(),
+            root_share_id: "share".into(),
+            mode,
+            access: MountAccess::Rw,
+            state: "idle".into(),
+            last_sync: 0,
+            pending_mode: None,
+            mounted,
+            progress: None,
+        }
+    }
+
+    #[test]
+    fn a_mirror_folder_is_never_reported_as_unmounted() {
+        // It is a plain local directory: no FUSE session is expected, so saying
+        // "not mounted" would describe every healthy mirror folder as broken.
+        let spec = spec(
+            MountKind::Device { sync_folder_id: 7 },
+            MountMode::Mirror,
+            false,
+        );
+        assert_eq!(location_subtitle(&spec), "Synced · up to date");
+    }
+
+    #[test]
+    fn an_on_demand_folder_without_a_session_says_so() {
+        let spec = spec(
+            MountKind::Device { sync_folder_id: 7 },
+            MountMode::OnDemand,
+            false,
+        );
+        assert_eq!(
+            location_subtitle(&spec),
+            "On-demand · up to date · not mounted"
+        );
+    }
+
+    #[test]
+    fn a_queued_switch_leads_the_subtitle() {
+        let mut spec = spec(
+            MountKind::Device { sync_folder_id: 7 },
+            MountMode::Mirror,
+            true,
+        );
+        spec.pending_mode = Some(MountMode::OnDemand);
+        assert!(location_subtitle(&spec).starts_with("Going on-demand"));
+        spec.mode = MountMode::OnDemand;
+        spec.pending_mode = Some(MountMode::Mirror);
+        assert!(location_subtitle(&spec).starts_with("Switching to synced"));
+    }
+
+    /// An unrecognised persisted mode must not silently read as "Synced" *and*
+    /// must not lose the rest of the line.
+    #[test]
+    fn the_primary_mount_reports_only_its_own_facts() {
+        let mut spec = spec(MountKind::MyFiles, MountMode::OnDemand, true);
+        assert_eq!(location_subtitle(&spec), "My files");
+        spec.mounted = false;
+        assert_eq!(location_subtitle(&spec), "My files · not mounted");
+    }
+
+    #[test]
+    fn sync_state_reaches_the_subtitle() {
+        let mut spec = spec(
+            MountKind::Device { sync_folder_id: 2 },
+            MountMode::Mirror,
+            true,
+        );
+        spec.state = "conflict".into();
+        assert_eq!(location_subtitle(&spec), "Synced · needs attention");
+    }
+}
@@ -1,6 +1,8 @@
 pub(crate) mod activity;
+pub(crate) mod albums;
 pub(crate) mod browser;
 pub(crate) mod devices;
+pub(crate) mod locations;
 pub(crate) mod login;
 pub(crate) mod photo_viewer;
 pub(crate) mod photos;
@@ -8,24 +8,53 @@ pub(crate) struct GalleryState {
    /// The day sections rendered by the Photos ListView, rebuilt from
    /// [`Self::model`] by [`repaint_gallery`].
    pub(crate) groups: gio::ListStore,
-    /// Target row height in px, retuned by Ctrl+scroll / Ctrl+± (see
-    /// [`zoom_gallery`]). Each tile keeps its own aspect ratio; rows are
-    /// justified to the content width around this height.
+    /// Target tile edge in px, retuned by Ctrl+scroll / Ctrl+± (see
+    /// [`zoom_gallery`]). The grid fits as many square tiles of about this size
+    /// as the content width holds.
    pub(crate) tile: Cell<i32>,
-    /// Swaps the Photos content area between the timeline and its status page.
+    /// Swaps the Photos content area between the timeline, its status page, and
+    /// the Albums grid.
    pub(crate) content: gtk4::Stack,
    pub(crate) status: adw::StatusPage,
    pub(crate) retry: gtk4::Button,
    pub(crate) more: gtk4::Button,
    pub(crate) upload: gtk4::Button,
+    /// "Photos", or the album's name while one is open.
+    pub(crate) title: gtk4::Label,
    /// "1,204 photos" under the page title.
    pub(crate) subtitle: gtk4::Label,
+    /// The album grid, and the stack that swaps it for its own status page.
+    pub(crate) albums: gtk4::FlowBox,
+    pub(crate) albums_stack: gtk4::Stack,
+    pub(crate) albums_status: adw::StatusPage,
+    /// The Photos/Albums switcher, and the box holding it — hidden while an
+    /// album is open, where the back button leads instead.
+    pub(crate) photos_btn: gtk4::ToggleButton,
+    pub(crate) albums_btn: gtk4::ToggleButton,
+    pub(crate) view_switch: gtk4::Box,
+    /// True while the album listing is in flight, so a re-entry into the Albums
+    /// view can't stack requests.
+    pub(crate) albums_loading: Cell<bool>,
+    /// The album currently open, or `None` when the timeline is showing. Set by
+    /// [`open_album`]; read by [`load_gallery`], which pages that album instead
+    /// of the timeline while it is set.
+    pub(crate) album: RefCell<Option<AlbumInfo>>,
+    /// Leaves an open album for the grid it was opened from. Visible only while
+    /// an album is open.
+    pub(crate) back: gtk4::Button,
+    /// The kind toggles and the date jump, hidden while an album is open — an
+    /// album page is served whole, not filtered.
+    pub(crate) filters: gtk4::Box,
    /// Which tab (Photos / Videos / Raw) the timeline is filtered to, or `None`
    /// for All. Read by [`load_gallery`] and set by the filter toggles.
    pub(crate) kind: Cell<Option<PhotoKind>>,
    /// The filter toggles, index-aligned with [`kind_for_tab`], kept so their
    /// labels can carry live per-kind counts.
    pub(crate) tabs: [gtk4::ToggleButton; 4],
+    /// Whole-timeline `(photos, videos, raw)` counts from the last page that
+    /// carried them, so the subtitle can say how big the library *is* rather
+    /// than how much of it has been paged in.
+    pub(crate) counts: Cell<Option<(usize, usize, usize)>>,
    /// The date-jump dropdown ("All dates" then a month per timeline entry), and
    /// the `[from, to)` window each of its rows selects (index-aligned; `None` is
    /// "All dates"). Selecting a row loads that month via [`load_gallery`].
@@ -40,21 +69,14 @@ pub(crate) struct GalleryState {
    /// True while a timeline page is in flight, so the scroll-to-the-end paging
    /// can't fire a second request for the page already coming.
    pub(crate) loading: Cell<bool>,
-    /// Content width the sections are currently justified to. Updated when the
-    /// ListView is resized, which re-justifies the visible sections.
+    /// Content width the grid is currently laid out to. Updated when the
+    /// ListView is resized, which re-flows the visible sections.
    pub(crate) width: Cell<i32>,
    /// Decoded thumbnails by photo uid, with the insertion order that evicts the
    /// oldest past [`TEXTURE_CACHE_MAX`]. Scrolling back over a day therefore
    /// repaints from memory instead of re-decoding from disk.
    pub(crate) photo_tex: RefCell<HashMap<String, gtk4::gdk::Texture>>,
    pub(crate) photo_tex_order: RefCell<VecDeque<String>>,
-    /// Aspect ratio (w/h) per uid, learned when a thumbnail is decoded and
-    /// persisted to disk, so a relaunch justifies its rows correctly on the first
-    /// frame instead of reflowing as thumbnails arrive.
-    pub(crate) photo_ratio: RefCell<HashMap<String, f64>>,
-    /// Ratios learned since the last save, so the ratio file is only rewritten
-    /// when it actually changed.
-    pub(crate) photo_ratio_dirty: Cell<bool>,
    /// Photos the daemon reported as having no thumbnail at all, so a tile that
    /// can never be filled isn't requested again on every scroll past it.
    pub(crate) photo_nothumb: RefCell<HashSet<String>>,
@@ -75,46 +97,33 @@ pub(crate) struct GalleryState {
    pub(crate) decode_queue: RefCell<VecDeque<(String, String)>>,
    pub(crate) decode_idle: Cell<bool>,
    /// Pending debounce timers for the thumbnail queue flush and the section
-    /// re-justify, replaced on each new trigger so only the last one fires.
+    /// re-flow, replaced on each new trigger so only the last one fires.
    pub(crate) thumb_source: RefCell<Option<glib::SourceId>>,
    pub(crate) relayout_source: RefCell<Option<glib::SourceId>>,
    /// The day sections currently realised by the ListView, by their index in
-    /// [`Self::groups`]. A learned ratio or a resize re-justifies these
-    /// in place — rebuilding the ListStore instead would reset the scroll
-    /// position out from under the user.
+    /// [`Self::groups`]. A resize or a zoom step re-flows these in place —
+    /// rebuilding the ListStore instead would reset the scroll position out from
+    /// under the user.
    pub(crate) bound: RefCell<HashMap<u32, gtk4::Box>>,
 }

 /// How many photos to pull per [`Request::PhotosTimeline`] page.
 pub(crate) const PHOTOS_PAGE: usize = 60;

-/// Gallery row height in px: the zoom range, its default, and the step one
-/// Ctrl+scroll notch (or Ctrl+±) moves it by. Rows are justified to the full
-/// content width, so this is the *target* height a row lands near, not an exact
-/// tile size (see [`justify_rows`]).
+/// Gallery tile edge in px: the zoom range, its default, and the step one
+/// Ctrl+scroll notch (or Ctrl+±) moves it by. The grid divides the content width
+/// evenly, so this is the *target* a tile lands near rather than its exact size
+/// (see [`plan_grid`]).
 pub(crate) const TILE_MIN: i32 = 90;

 pub(crate) const TILE_MAX: i32 = 340;

-pub(crate) const TILE_DEFAULT: i32 = 220;
+pub(crate) const TILE_DEFAULT: i32 = 180;

 pub(crate) const TILE_STEP: i32 = 30;

 /// Gap between tiles, horizontally and vertically.
-pub(crate) const TILE_GAP: i32 = 6;
-
-/// Aspect ratio (w/h) assumed for a photo whose thumbnail hasn't been decoded
-/// yet, so a tile can be laid out before its image exists. Landscape 3:2, the
-/// commonest camera/phone ratio; once the thumbnail lands the real ratio
-/// replaces it and the section re-justifies in place.
-pub(crate) const RATIO_UNKNOWN: f64 = 1.5;
-
-/// Aspect ratios are clamped to this range before a row is packed: one absurd
-/// panorama, or a sliver of a portrait, must not be able to squash the row it
-/// lands in down to nothing. The tile still shows the whole image.
-pub(crate) const RATIO_MIN: f64 = 0.4;
-
-pub(crate) const RATIO_MAX: f64 = 3.5;
+pub(crate) const TILE_GAP: i32 = 8;

 /// How many thumbnails one on-demand [`Request::PhotoThumbs`] batch asks for.
 /// Small, so the first tiles on screen fill in quickly rather than the whole
@@ -134,7 +143,7 @@ pub(crate) const THUMB_RETRY: Duration = Duration::from_secs(4);
 /// this caps the gallery's footprint while covering several screens of scroll.
 pub(crate) const TEXTURE_CACHE_MAX: usize = 600;

-/// Pause after a resize/zoom before the visible sections are re-justified.
+/// Pause after a resize/zoom before the visible sections are re-flowed.
 pub(crate) const RELAYOUT_DEBOUNCE: Duration = Duration::from_millis(80);

 /// One day-section of the photos timeline: a heading plus the photos captured
@@ -153,9 +162,11 @@ pub(crate) struct GalleryWidgets {
    pub(crate) model: gio::ListStore,
    /// Day sections rendered by the ListView, derived from `model`.
    pub(crate) groups: gio::ListStore,
-    /// Swaps between the timeline and the empty/loading/error status page.
+    /// Swaps between the timeline, the empty/loading/error status page, and the
+    /// Albums grid.
    pub(crate) content: gtk4::Stack,
    pub(crate) status: adw::StatusPage,
+    pub(crate) title: gtk4::Label,
    pub(crate) subtitle: gtk4::Label,
    pub(crate) more: gtk4::Button,
    pub(crate) list: gtk4::ListView,
@@ -163,6 +174,17 @@ pub(crate) struct GalleryWidgets {
    pub(crate) retry: gtk4::Button,
    pub(crate) upload: gtk4::Button,
    pub(crate) refresh: gtk4::Button,
+    /// The Albums grid, its own status page and the stack between them, plus the
+    /// Photos/Albums switcher and the back button out of an album.
+    pub(crate) albums: gtk4::FlowBox,
+    pub(crate) albums_stack: gtk4::Stack,
+    pub(crate) albums_status: adw::StatusPage,
+    pub(crate) photos_btn: gtk4::ToggleButton,
+    pub(crate) albums_btn: gtk4::ToggleButton,
+    pub(crate) view_switch: gtk4::Box,
+    pub(crate) back: gtk4::Button,
+    /// The kind toggles and date jump, as one box so an album view can hide them.
+    pub(crate) filters: gtk4::Box,
    /// The All / Photos / Videos / Raw filter toggles, in that order (index maps
    /// to [`kind_for_tab`]).
    pub(crate) tabs: [gtk4::ToggleButton; 4],
@@ -217,7 +239,7 @@ pub(crate) fn build_gallery_page() -> (gtk4::Widget, GalleryWidgets) {
    more.add_css_class("pill");
    more.set_visible(false);

-    // Horizontal scrolling is never wanted: rows are justified to the viewport
+    // Horizontal scrolling is never wanted: the grid is sized to the viewport
    // width, and a stray hscrollbar would fight the layout.
    let scroll = gtk4::ScrolledWindow::builder()
        .vexpand(true)
@@ -226,7 +248,7 @@ pub(crate) fn build_gallery_page() -> (gtk4::Widget, GalleryWidgets) {
        .build();

    let title_label = gtk4::Label::builder()
-        .label("Photos")
+        .label("Gallery")
        .halign(gtk4::Align::Start)
        .build();
    title_label.add_css_class("title-2");
@@ -243,6 +265,17 @@ pub(crate) fn build_gallery_page() -> (gtk4::Widget, GalleryWidgets) {
    titles.append(&title_label);
    titles.append(&subtitle);

+    // Leaves an open album for the grid it came from. Only an open album shows
+    // it — the Albums toggle is what leaves the grid itself.
+    let back = gtk4::Button::builder()
+        .icon_name("go-previous-symbolic")
+        .tooltip_text("Back to albums")
+        .valign(gtk4::Align::Center)
+        .visible(false)
+        .build();
+    back.add_css_class("flat");
+    back.add_css_class("circular");
+
    let upload = gtk4::Button::builder()
        .label("Upload")
        .icon_name("list-add-symbolic")
@@ -253,6 +286,7 @@ pub(crate) fn build_gallery_page() -> (gtk4::Widget, GalleryWidgets) {
    let refresh = refresh_button();

    let header_box = gtk4::Box::new(gtk4::Orientation::Horizontal, 8);
+    header_box.append(&back);
    header_box.append(&titles);
    header_box.append(&refresh);
    header_box.append(&upload);
@@ -287,23 +321,73 @@ pub(crate) fn build_gallery_page() -> (gtk4::Widget, GalleryWidgets) {
    dates.add_css_class("pill");
    dates.set_tooltip_text(Some("Jump to a month"));

-    let filter_bar = gtk4::Box::new(gtk4::Orientation::Horizontal, 8);
-    filter_bar.append(&tab_group);
+    // The kind toggles and the date jump travel together: they filter the
+    // timeline, and neither applies to the album grid or to an open album.
+    let filters = gtk4::Box::new(gtk4::Orientation::Horizontal, 8);
+    filters.set_hexpand(true);
+    filters.append(&tab_group);
    let spacer = gtk4::Box::new(gtk4::Orientation::Horizontal, 0);
    spacer.set_hexpand(true);
-    filter_bar.append(&spacer);
-    filter_bar.append(&dates);
+    filters.append(&spacer);
+    filters.append(&dates);
+
+    // The page's two views, as one segmented control under the title: the
+    // timeline, and the albums. This is navigation, not a filter — which is why
+    // it sits above the filter row rather than beside the kind toggles.
+    let photos_btn = gtk4::ToggleButton::builder()
+        .label("Photos")
+        .active(true)
+        .build();
+    let albums_btn = gtk4::ToggleButton::builder().label("Albums").build();
+    albums_btn.set_group(Some(&photos_btn));
+    let view_switch = gtk4::Box::new(gtk4::Orientation::Horizontal, 0);
+    view_switch.add_css_class("linked");
+    view_switch.add_css_class("view-switch");
+    view_switch.set_halign(gtk4::Align::Start);
+    for btn in [&photos_btn, &albums_btn] {
+        btn.add_css_class("pill");
+        view_switch.append(btn);
+    }
+
+    let filter_bar = gtk4::Box::new(gtk4::Orientation::Horizontal, 8);
+    filter_bar.append(&filters);

    // The timeline (plus its pager) or the status page, never both.
    let timeline = gtk4::Box::new(gtk4::Orientation::Vertical, 12);
    timeline.append(&scroll);
    timeline.append(&more);

+    // The album grid: cover-first cards that flow to the width they are given.
+    let albums = gtk4::FlowBox::builder()
+        .selection_mode(gtk4::SelectionMode::None)
+        .homogeneous(true)
+        .row_spacing(TILE_GAP as u32 * 2)
+        .column_spacing(TILE_GAP as u32 * 2)
+        .min_children_per_line(2)
+        .max_children_per_line(8)
+        .valign(gtk4::Align::Start)
+        .build();
+    let albums_scroll = gtk4::ScrolledWindow::builder()
+        .vexpand(true)
+        .hscrollbar_policy(gtk4::PolicyType::Never)
+        .child(&albums)
+        .build();
+    let albums_status = adw::StatusPage::builder()
+        .icon_name("view-grid-symbolic")
+        .vexpand(true)
+        .build();
+    albums_status.add_css_class("compact");
+    let albums_stack = gtk4::Stack::new();
+    albums_stack.set_vexpand(true);
+    albums_stack.add_named(&albums_scroll, Some("grid"));
+    albums_stack.add_named(&albums_status, Some("status"));
+
    let content = gtk4::Stack::new();
    content.set_vexpand(true);
    content.set_transition_type(gtk4::StackTransitionType::Crossfade);
    content.add_named(&timeline, Some("timeline"));
    content.add_named(&status, Some("status"));
+    content.add_named(&albums_stack, Some("albums"));

    let inner = gtk4::Box::new(gtk4::Orientation::Vertical, 12);
    inner.set_margin_top(12);
@@ -311,6 +395,7 @@ pub(crate) fn build_gallery_page() -> (gtk4::Widget, GalleryWidgets) {
    inner.set_margin_start(12);
    inner.set_margin_end(12);
    inner.append(&header_box);
+    inner.append(&view_switch);
    inner.append(&filter_bar);
    inner.append(&content);

@@ -321,6 +406,7 @@ pub(crate) fn build_gallery_page() -> (gtk4::Widget, GalleryWidgets) {
            groups,
            content,
            status,
+            title: title_label,
            subtitle,
            more,
            list,
@@ -330,6 +416,14 @@ pub(crate) fn build_gallery_page() -> (gtk4::Widget, GalleryWidgets) {
            refresh,
            tabs,
            dates,
+            albums,
+            albums_stack,
+            albums_status,
+            photos_btn,
+            albums_btn,
+            view_switch,
+            back,
+            filters,
        },
    )
 }
@@ -416,16 +510,31 @@ pub(crate) fn refresh_photo_months(ui: &Rc<Ui>) {
 /// behind it is disabled — you can't filter to an empty set — but the currently
 /// selected one stays clickable so you can always switch back off it.
 pub(crate) fn update_gallery_tabs(ui: &Rc<Ui>, counts: (usize, usize, usize)) {
+    ui.gallery.counts.set(Some(counts));
    let (photos, videos, raw) = counts;
    let totals = [photos + videos + raw, photos, videos, raw];
    for (index, tab) in ui.gallery.tabs.iter().enumerate() {
        let name = ["All", "Photos", "Videos", "Raw"][index];
        let n = totals[index];
-        tab.set_label(&format!("{name} {n}"));
+        tab.set_label(&format!("{name}  {}", thousands(n)));
        tab.set_sensitive(n > 0 || tab.is_active());
    }
 }

+/// `1422` as `1,422`. Six-figure libraries are ordinary, and an unseparated run
+/// of digits in a tab label is unreadable at a glance.
+pub(crate) fn thousands(n: usize) -> String {
+    let digits = n.to_string();
+    let mut out = String::with_capacity(digits.len() + digits.len() / 3);
+    for (i, c) in digits.chars().enumerate() {
+        if i > 0 && (digits.len() - i).is_multiple_of(3) {
+            out.push(',');
+        }
+        out.push(c);
+    }
+    out
+}
+
 /// Wire the gallery: install the section factory, the zoom gestures, the pager
 /// and the upload button. Activating a thumbnail downloads the photo and opens it
 /// in the in-app lightbox.
@@ -485,8 +594,8 @@ pub(crate) fn wire_gallery(ui: &Rc<Ui>, list: &gtk4::ListView, scroll: &gtk4::Sc
    });
    list.set_factory(Some(&factory));

-    // Rows are justified to the content width, so a resize re-justifies whatever
-    // is on screen (offscreen sections pick the new width up when they bind).
+    // The grid divides the content width, so a resize re-flows whatever is on
+    // screen (offscreen sections pick the new width up when they bind).
    let ui_width = ui.clone();
    list.connect_notify_local(Some("width"), move |list, _| {
        let width = list.width();
@@ -673,114 +782,55 @@ pub(crate) fn wire_gallery(ui: &Rc<Ui>, list: &gtk4::ListView, scroll: &gtk4::Sc
    });
 }

-/// One tile in a justified row: the photo, and the pixel size it was justified to.
+/// One tile of the grid: the photo, and the square edge it was sized to.
 pub(crate) struct Tile {
    pub(crate) photo: PhotoItem,
-    pub(crate) width: i32,
-    pub(crate) height: i32,
+    pub(crate) edge: i32,
 }

-/// Break one day's photos into rows that each fill `width` exactly, at heights
-/// near [`Ui::gallery_tile`] — the layout every modern photo gallery uses, and
-/// the reason nothing here has to be cropped: each tile keeps its own aspect
-/// ratio, and it is the row *height* that flexes to make the widths add up.
+/// Break one day's photos into rows of equal square tiles that span `width` —
+/// the layout a phone gallery uses, and the reason a day holding two photos
+/// looks like every other day rather than like a mistake.
 ///
-/// Greedy, one pass: keep adding photos to the row: the more photos share it, the
-/// shorter it has to be to fit. The moment that height drops to the target, the
-/// row is as full as it should be and is emitted. The trailing row keeps the
-/// target height instead of being stretched, so a day with three photos doesn't
-/// blow them up to fill a screen-wide row.
-///
-/// Photos whose thumbnail hasn't been decoded yet are laid out at
-/// [`RATIO_UNKNOWN`]; [`Ui::store_texture`] reports the real ratio when it lands
-/// and the section is re-justified in place.
-pub(crate) fn justify_rows(ui: &Rc<Ui>, photos: &[PhotoItem], width: i32) -> Vec<Vec<Tile>> {
-    let ratios: Vec<f64> = photos.iter().map(|photo| ui.ratio(&photo.uid)).collect();
-    let target = f64::from(ui.gallery.tile.get());
-    let plan = plan_rows(&ratios, target, f64::from(width));
-
-    let mut photos = photos.iter();
-    plan.into_iter()
+/// Each tile is centre-cropped to its square (the full frame is one click away
+/// in the lightbox), so nothing here depends on knowing a photo's aspect ratio
+/// and a row never has to be re-flowed when a thumbnail finally lands.
+pub(crate) fn grid_rows(ui: &Rc<Ui>, photos: &[PhotoItem], width: i32) -> Vec<Vec<Tile>> {
+    let (columns, edge) = plan_grid(ui.gallery.tile.get(), width);
+    photos
+        .chunks(columns)
        .map(|row| {
-            row.into_iter()
-                .filter_map(|(width, height)| {
-                    photos.next().map(|photo| Tile {
-                        photo: photo.clone(),
-                        width,
-                        height,
-                    })
+            row.iter()
+                .map(|photo| Tile {
+                    photo: photo.clone(),
+                    edge,
                })
                .collect()
        })
        .collect()
 }

-/// The row-packing math behind [`justify_rows`], over nothing but aspect ratios:
-/// takes each photo's ratio (w/h) in order and returns the pixel `(width,
-/// height)` of every tile, grouped into rows.
-pub(crate) fn plan_rows(ratios: &[f64], target: f64, width: f64) -> Vec<Vec<(i32, i32)>> {
-    let avail = width.max(f64::from(TILE_MIN));
-    let gap = f64::from(TILE_GAP);
-
-    // The height a row of `n` photos with `sum_ratio` total ratio must take for
-    // its widths (plus gaps) to add up to exactly `avail`.
-    let row_height = |sum_ratio: f64, n: usize| {
-        let gaps = gap * (n.saturating_sub(1)) as f64;
-        (avail - gaps) / sum_ratio
-    };
-
-    let mut rows: Vec<Vec<(i32, i32)>> = Vec::new();
-    let mut row: Vec<f64> = Vec::new();
-    let mut sum_ratio = 0.0;
-
-    for ratio in ratios {
-        let ratio = ratio.clamp(RATIO_MIN, RATIO_MAX);
-        row.push(ratio);
-        sum_ratio += ratio;
-
-        let height = row_height(sum_ratio, row.len());
-        if height <= target {
-            rows.push(size_row(&row, height, avail, true));
-            row.clear();
-            sum_ratio = 0.0;
-        }
-    }
-    if !row.is_empty() {
-        let height = row_height(sum_ratio, row.len()).min(target);
-        rows.push(size_row(&row, height, avail, false));
-    }
-    rows
+/// The grid math: how many columns fit in `width` at roughly `target` px per
+/// tile, and the exact square edge that divides the width between them.
+///
+/// The column count is what rounds — the edge then absorbs the remainder, so the
+/// grid spans the full width at every window size instead of leaving a ragged
+/// margin. Never fewer than one column, however narrow the window gets.
+pub(crate) fn plan_grid(target: i32, width: i32) -> (usize, i32) {
+    let avail = width.max(TILE_MIN);
+    let target = target.clamp(TILE_MIN, TILE_MAX);
+    // A row of n tiles occupies n*edge + (n-1)*gap, so n tiles of the target size
+    // fit while n*(target + gap) - gap <= avail.
+    let columns = ((avail + TILE_GAP) / (target + TILE_GAP)).max(1) as usize;
+    let gaps = TILE_GAP * (columns as i32 - 1);
+    let edge = ((avail - gaps) / columns as i32).max(1);
+    (columns, edge)
 }

-/// Size one row's tiles at `height`. A `justified` row is nudged so its widths
-/// plus gaps hit `avail` exactly — rounding each width independently leaves a
-/// few px of ragged right edge, so the last tile absorbs the remainder.
-pub(crate) fn size_row(
-    ratios: &[f64],
-    height: f64,
-    avail: f64,
-    justified: bool,
-) -> Vec<(i32, i32)> {
-    let height = height.round().max(1.0);
-    let mut sizes: Vec<(i32, i32)> = ratios
-        .iter()
-        .map(|ratio| ((ratio * height).round().max(1.0) as i32, height as i32))
-        .collect();
-
-    if justified {
-        let gaps = TILE_GAP * (sizes.len().saturating_sub(1)) as i32;
-        let used: i32 = sizes.iter().rev().skip(1).map(|(width, _)| *width).sum();
-        if let Some(last) = sizes.last_mut() {
-            last.0 = (avail as i32 - gaps - used).max(1);
-        }
-    }
-    sizes
-}
-
-/// (Re)build a bound day-section's tiles: justify this day's photos to the
+/// (Re)build a bound day-section's tiles: lay this day's photos out to the
 /// current content width and hand each tile whatever thumbnail is already in
 /// memory, queueing the rest. Replaces the section's rows in place, leaving the
-/// heading — so a re-justify never touches the ListView's model or scroll.
+/// heading — so a re-flow never touches the ListView's model or scroll.
 pub(crate) fn fill_section(ui: &Rc<Ui>, section: &gtk4::Box, photos: &[PhotoItem]) {
    let Some(heading) = section.first_child() else {
        return;
@@ -791,8 +841,11 @@ pub(crate) fn fill_section(ui: &Rc<Ui>, section: &gtk4::Box, photos: &[PhotoItem

    let width = gallery_width(ui);
    let rows = gtk4::Box::new(gtk4::Orientation::Vertical, TILE_GAP);
-    for row in justify_rows(ui, photos, width) {
+    for row in grid_rows(ui, photos, width) {
        let row_box = gtk4::Box::new(gtk4::Orientation::Horizontal, TILE_GAP);
+        // A short last row stays left-aligned at the same tile size rather than
+        // stretching: an even grid is the whole point of the square layout.
+        row_box.set_halign(gtk4::Align::Start);
        for tile in row {
            row_box.append(&photo_tile(ui, tile));
        }
@@ -802,8 +855,8 @@ pub(crate) fn fill_section(ui: &Rc<Ui>, section: &gtk4::Box, photos: &[PhotoItem
    schedule_thumbs(ui);
 }

-/// The width justified rows are laid out to: the ListView's own width, less a
-/// couple of px so a rounding error can't push a row into a horizontal overflow.
+/// The width the grid is laid out to: the ListView's own width, less a couple of
+/// px so a rounding error can't push a row into a horizontal overflow.
 /// Falls back to a sane guess before the first allocation.
 pub(crate) fn gallery_width(ui: &Rc<Ui>) -> i32 {
    match ui.gallery.width.get() {
@@ -822,12 +875,17 @@ pub(crate) fn gallery_width(ui: &Rc<Ui>) -> i32 {
 /// one keeps an image glyph instead of an empty rectangle.
 pub(crate) fn photo_tile(ui: &Rc<Ui>, tile: Tile) -> gtk4::Button {
    let picture = gtk4::Picture::builder()
-        // The tile is exactly the thumbnail's own aspect ratio, so Cover scales
-        // it and crops nothing; it only bites during the brief window where the
-        // ratio is still a guess, and the re-justify then fixes the tile.
+        // Cover fills the square and crops the overflow, so a portrait photo
+        // sits flush in its tile instead of floating in letterbox bars. The
+        // expands are what make the picture take the whole overlay: without
+        // them it is allocated its natural size and the crop never happens.
        .content_fit(gtk4::ContentFit::Cover)
        .can_shrink(true)
+        .hexpand(true)
+        .vexpand(true)
        .build();
+    // Zoomed on hover by the stylesheet; the tile clips the overflow.
+    picture.add_css_class("photo-thumb");

    let placeholder = gtk4::Image::builder()
        .icon_name("image-x-generic-symbolic")
@@ -871,8 +929,8 @@ pub(crate) fn photo_tile(ui: &Rc<Ui>, tile: Tile) -> gtk4::Button {

    let button = gtk4::Button::builder()
        .child(&overlay)
-        .width_request(tile.width)
-        .height_request(tile.height)
+        .width_request(tile.edge)
+        .height_request(tile.edge)
        .tooltip_text(format_capture_time(tile.photo.capture_time))
        .build();
    button.add_css_class("photo-tile");
@@ -1052,7 +1110,6 @@ pub(crate) fn schedule_decode(ui: &Rc<Ui>) {
            let mut queue = ui.gallery.decode_queue.borrow_mut();
            (0..4).filter_map(|_| queue.pop_front()).collect()
        };
-        let mut relayout = false;
        for (uid, path) in batch {
            let texture = match gtk4::gdk::Texture::from_filename(&path) {
                Ok(texture) => texture,
@@ -1062,28 +1119,23 @@ pub(crate) fn schedule_decode(ui: &Rc<Ui>) {
                    continue;
                }
            };
-            // A ratio we hadn't seen means the tile was sized against a guess.
-            relayout |= ui.store_texture(&uid, texture.clone());
+            ui.store_texture(&uid, texture.clone());
            if let Some(picture) = ui.gallery.thumb_wanted.borrow_mut().remove(&uid) {
                picture.set_paintable(Some(&texture));
            }
        }
-        if relayout {
-            schedule_relayout(&ui);
-        }

        if ui.gallery.decode_queue.borrow().is_empty() {
            ui.gallery.decode_idle.set(false);
-            ui.save_ratios();
            return glib::ControlFlow::Break;
        }
        glib::ControlFlow::Continue
    });
 }

-/// Re-justify the sections on screen shortly. Debounced, because the triggers
-/// (a window resize, a zoom step, a burst of decoded thumbnails) all arrive in
-/// floods and only the final state matters.
+/// Re-flow the sections on screen shortly. Debounced, because the triggers (a
+/// window resize, a zoom step) arrive in floods and only the final state
+/// matters.
 pub(crate) fn schedule_relayout(ui: &Rc<Ui>) {
    if let Some(id) = ui.gallery.relayout_source.borrow_mut().take() {
        id.remove();
@@ -1097,9 +1149,8 @@ pub(crate) fn schedule_relayout(ui: &Rc<Ui>) {
 }

 /// Rebuild the tiles of the day sections currently on screen, at the current
-/// width, zoom and set of known aspect ratios. Sections that are *not* realised
-/// need no work: they justify themselves against the current state when the
-/// ListView binds them.
+/// width and zoom. Sections that are *not* realised need no work: they lay
+/// themselves out against the current state when the ListView binds them.
 pub(crate) fn relayout_gallery(ui: &Rc<Ui>) {
    let bound: Vec<(u32, gtk4::Box)> = ui
        .gallery
@@ -1120,12 +1171,12 @@ pub(crate) fn relayout_gallery(ui: &Rc<Ui>) {
    }
 }

-/// Step the row height by `delta` px and re-justify, clamped to the zoom range.
+/// Step the tile size by `delta` px and re-flow, clamped to the zoom range.
 pub(crate) fn zoom_gallery(ui: &Rc<Ui>, delta: i32) {
    set_gallery_tile(ui, ui.gallery.tile.get() + delta);
 }

-/// Set the row height (clamped) and re-justify the visible sections at it.
+/// Set the tile size (clamped) and re-flow the visible sections at it.
 pub(crate) fn set_gallery_tile(ui: &Rc<Ui>, tile: i32) {
    let tile = tile.clamp(TILE_MIN, TILE_MAX);
    if tile == ui.gallery.tile.get() {
@@ -1175,17 +1226,35 @@ pub(crate) fn repaint_gallery(ui: &Rc<Ui>) {
        store.splice(len, store.n_items() - len, &[] as &[BoxedAnyObject]);
    }

-    let count = ui.gallery.model.n_items();
-    ui.gallery.subtitle.set_visible(count > 0);
+    let loaded = ui.gallery.model.n_items() as usize;
+    ui.gallery.subtitle.set_visible(loaded > 0);
+    // An album counts what the server says it holds, not how much of it has been
+    // paged in — the subtitle would otherwise climb as the user scrolls.
+    if ui.gallery.album.borrow().is_some() {
+        return;
+    }
    // The noun tracks the active filter, so a Videos tab doesn't count "photos".
-    let (one, many) = match ui.gallery.kind.get() {
+    let kind = ui.gallery.kind.get();
+    let (one, many) = match kind {
        Some(PhotoKind::Video) => ("video", "videos"),
        Some(PhotoKind::Raw) => ("raw photo", "raw photos"),
        _ => ("photo", "photos"),
    };
-    ui.gallery.subtitle.set_label(&match count {
+    // The whole library for this filter, not the page count — the subtitle sits
+    // next to tabs carrying the same totals, and the two disagreeing reads as a
+    // bug. A date jump is the exception: there the window is the subject.
+    let total = match (ui.gallery.range.get(), ui.gallery.counts.get()) {
+        (None, Some((photos, videos, raw))) => match kind {
+            Some(PhotoKind::Photo) => photos,
+            Some(PhotoKind::Video) => videos,
+            Some(PhotoKind::Raw) => raw,
+            None => photos + videos + raw,
+        },
+        _ => loaded,
+    };
+    ui.gallery.subtitle.set_label(&match total {
        1 => format!("1 {one}"),
-        n => format!("{n} {many}"),
+        n => format!("{} {many}", thousands(n)),
    });
 }

@@ -1272,6 +1341,9 @@ pub(crate) fn load_gallery(ui: &Rc<Ui>, append: bool) {
    if ui.gallery.loading.get() {
        return;
    }
+    // An open album pages itself instead of the timeline; everything downstream —
+    // the model, the sections, the thumbnails, the lightbox — is the same.
+    let album = ui.gallery.album.borrow().as_ref().map(|a| a.uid.clone());
    if !append {
        // Fresh load: clear the timeline and show Loading until the first page lands.
        ui.gallery.model.remove_all();
@@ -1284,8 +1356,9 @@ pub(crate) fn load_gallery(ui: &Rc<Ui>, append: bool) {
        );
        // Rebuild the date jump for the current kind, but only for a full-span
        // load — a jump *to* a month sets a range and reloads, and refreshing the
-        // dropdown then would fight the selection the user just made.
-        if ui.gallery.range.get().is_none() {
+        // dropdown then would fight the selection the user just made. An album
+        // has no date jump at all.
+        if album.is_none() && ui.gallery.range.get().is_none() {
            refresh_photo_months(ui);
        }
    }
@@ -1294,15 +1367,20 @@ pub(crate) fn load_gallery(ui: &Rc<Ui>, append: bool) {
    ui.gallery.more.set_sensitive(false);

    ui.busy_begin();
-    let rx = spawn_request(
-        ui.dirs.control_socket(),
-        Request::PhotosTimeline {
+    let request = match album {
+        Some(uid) => Request::AlbumPhotos {
+            uid,
+            offset,
+            limit: PHOTOS_PAGE,
+        },
+        None => Request::PhotosTimeline {
            offset,
            limit: PHOTOS_PAGE,
            kind: ui.gallery.kind.get(),
            range: ui.gallery.range.get(),
        },
-    );
+    };
+    let rx = spawn_request(ui.dirs.control_socket(), request);
    let ui = ui.clone();
    glib::spawn_future_local(async move {
        let result = rx.recv().await;
@@ -1329,20 +1407,13 @@ pub(crate) fn load_gallery(ui: &Rc<Ui>, append: bool) {
                if let Some(counts) = counts {
                    update_gallery_tabs(&ui, counts);
                }
-                // Take the daemon's word on ratios and thumbnail verdicts before
-                // anything is laid out: it persists both, so the very first frame
-                // justifies its rows correctly instead of guessing RATIO_UNKNOWN
-                // and reflowing as the images land.
+                // Take the daemon's word on which photos can never have a
+                // thumbnail, so their tiles show a placeholder from the first
+                // frame instead of queueing a request that can only fail.
                {
-                    let mut ratios = ui.gallery.photo_ratio.borrow_mut();
                    let mut nothumb = ui.gallery.photo_nothumb.borrow_mut();
-                    for item in &items {
-                        if let Some(ratio) = item.ratio {
-                            ratios.insert(item.uid.clone(), ratio);
-                        }
-                        if item.no_thumb {
-                            nothumb.insert(item.uid.clone());
-                        }
+                    for item in items.iter().filter(|item| item.no_thumb) {
+                        nothumb.insert(item.uid.clone());
                    }
                }
                for item in &items {
@@ -1350,13 +1421,15 @@ pub(crate) fn load_gallery(ui: &Rc<Ui>, append: bool) {
                }
                repaint_gallery(&ui);
                if ui.gallery.model.n_items() == 0 {
-                    gallery_status(
-                        &ui,
-                        "image-x-generic-symbolic",
-                        "No photos yet",
-                        "Photos you upload to Proton Drive appear here.",
-                        false,
-                    );
+                    let (title, description) = if ui.gallery.album.borrow().is_some() {
+                        ("Empty album", "This album has no photos in it.")
+                    } else {
+                        (
+                            "No photos yet",
+                            "Photos you upload to Proton Drive appear here.",
+                        )
+                    };
+                    gallery_status(&ui, "image-x-generic-symbolic", title, description, false);
                    return;
                }
                ui.gallery.content.set_visible_child_name("timeline");
@@ -298,8 +298,15 @@ fn shared_entry_row(ui: &Rc<Ui>, entry: &DirEntry) -> adw::ActionRow {
        .title(&entry.name)
        .activatable(true)
        .build();
-    if !entry.is_dir {
-        row.set_subtitle(&human_bytes(entry.size));
+    let subtitle = shared_row_subtitle(entry);
+    if !subtitle.is_empty() {
+        row.set_subtitle(&subtitle);
+    }
+    // What I am allowed to do with someone else's file is the thing this page
+    // cannot leave implicit: a viewer share is browsable and unwritable, and
+    // that is only visible if it is said.
+    if let Some(badge) = role_badge(&entry.role) {
+        row.add_suffix(&badge);
    }
    row.add_prefix(&gtk4::Image::from_icon_name(if entry.is_dir {
        "folder-symbolic"
@@ -325,6 +332,43 @@ fn shared_entry_row(ui: &Rc<Ui>, entry: &DirEntry) -> adw::ActionRow {
    row
 }

+/// A shared row's subtitle: its size (files only), and where it can be reached
+/// in the local mount once the synthetic `Shared with me/` directory has interned
+/// it. An unlisted share has no local path yet, and says nothing rather than
+/// pointing at a directory that is not there.
+pub(crate) fn shared_row_subtitle(entry: &DirEntry) -> String {
+    let mut parts: Vec<String> = Vec::new();
+    if !entry.is_dir {
+        parts.push(human_bytes(entry.size));
+    }
+    if !entry.path.is_empty() {
+        parts.push(format!("in {}", entry.path));
+    }
+    parts.join(" · ")
+}
+
+/// The display name for a wire role, or `None` when there is nothing to show:
+/// owned content carries no role, and a role the API did not report is not
+/// guessed at (the SDK's `from_permissions_exact` returns `None` for an
+/// unrecognised mask rather than degrading it to viewer).
+pub(crate) fn role_label(role: &str) -> Option<&'static str> {
+    match role {
+        "viewer" => Some("Viewer"),
+        "editor" => Some("Editor"),
+        "admin" => Some("Admin"),
+        _ => None,
+    }
+}
+
+/// A dim role pill for a share I did not create.
+pub(crate) fn role_badge(role: &str) -> Option<gtk4::Label> {
+    let badge = gtk4::Label::new(Some(role_label(role)?));
+    badge.add_css_class("dim-label");
+    badge.add_css_class("caption");
+    badge.set_valign(gtk4::Align::Center);
+    Some(badge)
+}
+
 /// Download a file shared with me into the daemon's cache and hand it to the
 /// user's default application — the shared-item twin of the browser's
 /// download-and-open, addressed by uid because the file lives outside the mount.
@@ -663,3 +707,52 @@ pub(crate) fn run_shared_mutation(
        }
    });
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn entry(is_dir: bool, path: &str, role: &str) -> DirEntry {
+        DirEntry {
+            name: "Budget.ods".into(),
+            is_dir,
+            size: 2048,
+            modified: 0,
+            pinned: false,
+            cached: false,
+            uid: "vol~link".into(),
+            path: path.into(),
+            role: role.into(),
+        }
+    }
+
+    #[test]
+    fn a_share_with_no_local_path_says_nothing_about_one() {
+        // Before the synthetic directory has been listed, the daemon cannot
+        // resolve a path — pointing at one that isn't there would be worse than
+        // silence.
+        assert_eq!(shared_row_subtitle(&entry(true, "", "viewer")), "");
+        assert_eq!(
+            shared_row_subtitle(&entry(false, "", "viewer")),
+            human_bytes(2048)
+        );
+    }
+
+    #[test]
+    fn a_resident_share_reports_where_it_can_be_reached() {
+        let subtitle = shared_row_subtitle(&entry(true, "Shared with me/Team Budget", "editor"));
+        assert_eq!(subtitle, "in Shared with me/Team Budget");
+    }
+
+    #[test]
+    fn only_a_known_role_becomes_a_badge() {
+        // "" is owned content (no role applies) and an unrecognised mask is
+        // deliberately not guessed at — `from_permissions_exact` returns None
+        // rather than degrading to viewer, and this must not undo that.
+        for role in ["viewer", "editor", "admin"] {
+            assert!(role_label(role).is_some(), "{role} should have a label");
+        }
+        assert!(role_label("").is_none());
+        assert!(role_label("inherited").is_none());
+    }
+}
@@ -236,19 +236,18 @@ pub(crate) fn repaint_shared_by_me(ui: &Rc<Ui>, items: &[SharedItem]) {
            row.add_suffix(&open);
        }

-        // Manage opens the per-node Share dialog — only when the node's path is
-        // known (it has been browsed to this session); the dialog is path-keyed.
-        if !item.path.is_empty() {
-            let manage = gtk4::Button::builder()
-                .label("Manage")
-                .valign(gtk4::Align::Center)
-                .build();
-            manage.add_css_class("flat");
-            let ui_manage = ui.clone();
-            let entry = shared_item_as_entry(item);
-            manage.connect_clicked(move |_| open_share_dialog(&ui_manage, &entry));
-            row.add_suffix(&manage);
-        }
+        // Manage opens the per-node Share dialog. It used to be offered only for
+        // an item whose path the daemon could resolve; the dialog now addresses a
+        // pathless node by uid, so every shared item can be managed from here.
+        let manage = gtk4::Button::builder()
+            .label("Manage")
+            .valign(gtk4::Align::Center)
+            .build();
+        manage.add_css_class("flat");
+        let ui_manage = ui.clone();
+        let entry = shared_item_as_entry(item);
+        manage.connect_clicked(move |_| open_share_dialog(&ui_manage, &entry));
+        row.add_suffix(&manage);

        ui.shared_by_me.group.add(&row);
        rows.push(row.upcast());
@@ -295,5 +294,7 @@ pub(crate) fn shared_item_as_entry(item: &SharedItem) -> DirEntry {
        cached: false,
        uid: item.uid.clone(),
        path: item.path.clone(),
+        // Shared *by* me: I own it, so there is no role of mine to report.
+        role: String::new(),
    }
 }
@@ -31,8 +31,8 @@ pub(crate) struct StatusState {
    /// Cache-budget editor (GiB). Populated once from config; user edits drive a
    /// `SetCacheBudget` round-trip. Guarded by [`Self::settings_suppress`].
    pub(crate) budget_row: adw::SpinRow,
-    /// Shows the active mountpoint in its subtitle; updated when the user picks a
-    /// new folder.
+    /// Shows where the primary mount lives; the folder itself is managed on the
+    /// Locations page, which owns every local path.
    pub(crate) mountpoint_row: adw::ActionRow,
    /// Set while a settings widget is being populated programmatically, so its
    /// change handler skips the IPC/systemd side effect.
@@ -100,7 +100,8 @@ pub(crate) struct MainWidgets {
    pub(crate) budget_row: adw::SpinRow,
    /// Purges all unpinned cached content.
    pub(crate) purge_button: gtk4::Button,
-    /// Shows the active mountpoint; its suffix button opens a folder chooser.
+    /// Shows the active mountpoint; its suffix button opens the Locations page,
+    /// which is where the folder is changed.
    pub(crate) mountpoint_row: adw::ActionRow,
    pub(crate) mountpoint_button: gtk4::Button,
 }
@@ -215,12 +216,17 @@ pub(crate) fn build_main_page() -> (gtk4::Widget, MainWidgets) {
        .subtitle("Mount Proton Drive automatically when you log in.")
        .build();
    system_group.add(&autostart_row);
+    // The mountpoint is a *location*, and every other local path this client
+    // owns is managed on the Locations page. Keeping a second chooser here would
+    // be a second source of truth for the same setting, so this row reports the
+    // path and hands the change over.
    let mountpoint_row = adw::ActionRow::builder()
        .title("Mountpoint")
        .subtitle("—")
        .build();
    let mountpoint_button = gtk4::Button::builder()
-        .label("Change")
+        .label("Locations")
+        .tooltip_text("Manage this computer's Proton Drive locations")
        .valign(gtk4::Align::Center)
        .build();
    mountpoint_button.add_css_class("flat");
@@ -372,10 +378,10 @@ pub(crate) fn wire_settings(
        }
    });

-    // Mountpoint: pick a folder, persist it, and offer to restart the mount so
-    // the change takes effect (the daemon reads the path on mount).
+    // Mountpoint: the chooser lives on the Locations page, next to every other
+    // local path; this button is the way there.
    let ui_mp = ui.clone();
-    mountpoint_button.connect_clicked(move |_| prompt_mountpoint(&ui_mp));
+    mountpoint_button.connect_clicked(move |_| ui_mp.stack.set_visible_child_name("locations"));
 }

 /// Run a settings control-socket round-trip (budget / purge) on a worker thread,
@@ -423,6 +429,12 @@ pub(crate) fn prompt_mountpoint(ui: &Rc<Ui>) {
            return;
        }
        ui.status.mountpoint_row.set_subtitle(&path_str);
+        // The Locations page shows the same path as a row title; its cached rows
+        // are now stale whether or not it is the visible page.
+        ui.locations.loaded_at.set(None);
+        if ui.stack.visible_child_name().as_deref() == Some("locations") {
+            load_locations(&ui);
+        }

        // The daemon only reads the mountpoint at mount time, so offer a restart.
        let confirm = adw::AlertDialog::builder()
@@ -503,7 +515,7 @@ pub(crate) fn refresh(ui: &Rc<Ui>) {
    // they are on screen. Every other page loads on navigation only.
    match ui.stack.visible_child_name().as_deref() {
        Some("main") => refresh_quota(ui),
-        Some("devices") => refresh_sync_folders(ui),
+        Some("locations") => refresh_locations(ui),
        Some("activity") => refresh_activity(ui),
        _ => {}
    }
@@ -109,10 +109,10 @@ fn extract_token(raw: &str) -> Option<String> {
    let mut value: serde_json::Value = serde_json::from_str(raw).ok()?;
    // If the message was stringified twice (e.g. raw is a double-quoted JSON string),
    // parse the inner string.
-    if let Some(inner) = value.as_str() {
-        if let Ok(parsed) = serde_json::from_str(inner) {
-            value = parsed;
-        }
+    if let Some(inner) = value.as_str()
+        && let Ok(parsed) = serde_json::from_str(inner)
+    {
+        value = parsed;
    }
    // The payload is nested under `payload` and the message names itself in
    // `type`; both spellings of the success type have shipped.
@@ -21,13 +21,117 @@ pub(crate) fn role_wire_to_index(role: &str) -> u32 {
    }
 }

+/// How an open Share dialog addresses its node.
+///
+/// A node the browser is showing has a mountpoint-relative path. A node reached
+/// from Shared or Shared-with-me may not: it can live under a device folder's
+/// own inode space, or on someone else's volume, neither of which the primary
+/// mount's path space can name. Those carry a uid instead, and the daemon
+/// resolves it with `Core::resolve_anywhere` (mount-architecture.md P4).
+///
+/// The two are separate request variants rather than one request with an
+/// optional field on purpose: an older daemon that ignored `uid` would resolve
+/// the empty path to the *mount root* and act on the wrong node.
+pub(crate) enum ShareTarget {
+    Path(String),
+    Uid(String),
+}
+
+impl ShareTarget {
+    fn list(&self) -> Request {
+        match self {
+            ShareTarget::Path(path) => Request::ListShare { path: path.clone() },
+            ShareTarget::Uid(uid) => Request::ListShareByUid { uid: uid.clone() },
+        }
+    }
+
+    fn invite(&self, emails: Vec<String>, role: String, message: Option<String>) -> Request {
+        match self {
+            ShareTarget::Path(path) => Request::ShareNode {
+                path: path.clone(),
+                emails,
+                role,
+                message,
+            },
+            ShareTarget::Uid(uid) => Request::ShareNodeByUid {
+                uid: uid.clone(),
+                emails,
+                role,
+                message,
+            },
+        }
+    }
+
+    fn update_role(&self, id: String, kind: ShareEntryKind, role: String) -> Request {
+        match self {
+            ShareTarget::Path(path) => Request::UpdateShareRole {
+                path: path.clone(),
+                id,
+                kind,
+                role,
+            },
+            ShareTarget::Uid(uid) => Request::UpdateShareRoleByUid {
+                uid: uid.clone(),
+                id,
+                kind,
+                role,
+            },
+        }
+    }
+
+    fn remove_entry(&self, id: String, kind: ShareEntryKind) -> Request {
+        match self {
+            ShareTarget::Path(path) => Request::RemoveShareEntry {
+                path: path.clone(),
+                id,
+                kind,
+            },
+            ShareTarget::Uid(uid) => Request::RemoveShareEntryByUid {
+                uid: uid.clone(),
+                id,
+                kind,
+            },
+        }
+    }
+
+    fn create_link(&self, role: String, password: Option<String>) -> Request {
+        match self {
+            ShareTarget::Path(path) => Request::CreatePublicLink {
+                path: path.clone(),
+                role,
+                password,
+                expires: None,
+            },
+            ShareTarget::Uid(uid) => Request::CreatePublicLinkByUid {
+                uid: uid.clone(),
+                role,
+                password,
+                expires: None,
+            },
+        }
+    }
+
+    fn remove_link(&self, id: String) -> Request {
+        match self {
+            ShareTarget::Path(path) => Request::RemovePublicLink {
+                path: path.clone(),
+                id,
+            },
+            ShareTarget::Uid(uid) => Request::RemovePublicLinkByUid {
+                uid: uid.clone(),
+                id,
+            },
+        }
+    }
+}
+
 /// The mutable state behind an open Share dialog, so the invite/role/link
 /// handlers can rebuild the people and link sections after each change without
 /// tearing the whole dialog down.
 pub(crate) struct ShareDialog {
    pub(crate) ui: Rc<Ui>,
-    /// The node's mountpoint-relative path — how every request addresses it.
-    pub(crate) rel: String,
+    /// How every request from this dialog addresses the node.
+    pub(crate) target: ShareTarget,
    pub(crate) people: adw::PreferencesGroup,
    pub(crate) link_group: adw::PreferencesGroup,
    pub(crate) people_rows: RefCell<Vec<gtk4::Widget>>,
@@ -41,7 +145,13 @@ pub(crate) fn open_share_dialog(ui: &Rc<Ui>, entry: &DirEntry) {
        toast_error(ui, "Can't share", "Proton Drive isn't connected.");
        return;
    }
-    let rel = entry_rel(ui, entry);
+    // A node with no path is not a bug here: Shared and Shared-with-me list
+    // nodes that the primary mount never interned. Address those by uid.
+    let target = if entry.path.is_empty() {
+        ShareTarget::Uid(entry.uid.clone())
+    } else {
+        ShareTarget::Path(entry_rel(ui, entry))
+    };

    let toolbar = adw::ToolbarView::new();
    let header = adw::HeaderBar::new();
@@ -110,7 +220,7 @@ pub(crate) fn open_share_dialog(ui: &Rc<Ui>, entry: &DirEntry) {

    let state = Rc::new(ShareDialog {
        ui: ui.clone(),
-        rel,
+        target,
        people,
        link_group,
        people_rows: RefCell::new(Vec::new()),
@@ -144,12 +254,7 @@ pub(crate) fn open_share_dialog(ui: &Rc<Ui>, entry: &DirEntry) {
        let msg_clear = message_row.clone();
        share_dialog_op(
            &state_inv,
-            Request::ShareNode {
-                path: state_inv.rel.clone(),
-                emails,
-                role,
-                message,
-            },
+            state_inv.target.invite(emails, role, message),
            "Invitations sent",
            "Couldn't send invitations",
            Some(Box::new(move || {
@@ -165,12 +270,7 @@ pub(crate) fn open_share_dialog(ui: &Rc<Ui>, entry: &DirEntry) {

 /// Re-fetch the node's share and rebuild the people + public-link sections.
 pub(crate) fn share_dialog_reload(state: &Rc<ShareDialog>) {
-    let rx = spawn_request(
-        state.ui.dirs.control_socket(),
-        Request::ListShare {
-            path: state.rel.clone(),
-        },
-    );
+    let rx = spawn_request(state.ui.dirs.control_socket(), state.target.list());
    let state = state.clone();
    glib::spawn_future_local(async move {
        match rx.recv().await {
@@ -232,12 +332,11 @@ pub(crate) fn repaint_share_people(state: &Rc<ShareDialog>, entries: &[ShareEntr
            drop.connect_selected_notify(move |d| {
                share_dialog_op(
                    &state_role,
-                    Request::UpdateShareRole {
-                        path: state_role.rel.clone(),
-                        id: id.clone(),
+                    state_role.target.update_role(
+                        id.clone(),
                        kind,
-                        role: role_index_to_wire(d.selected()).to_string(),
-                    },
+                        role_index_to_wire(d.selected()).to_string(),
+                    ),
                    "Role updated",
                    "Couldn't update the role",
                    None,
@@ -265,11 +364,7 @@ pub(crate) fn repaint_share_people(state: &Rc<ShareDialog>, entries: &[ShareEntr
        remove.connect_clicked(move |_| {
            share_dialog_op(
                &state_rm,
-                Request::RemoveShareEntry {
-                    path: state_rm.rel.clone(),
-                    id: id.clone(),
-                    kind,
-                },
+                state_rm.target.remove_entry(id.clone(), kind),
                "Access removed",
                "Couldn't remove access",
                None,
@@ -332,10 +427,7 @@ pub(crate) fn repaint_share_link(state: &Rc<ShareDialog>, link: Option<&PublicLi
            remove.connect_clicked(move |_| {
                share_dialog_op(
                    &state_rm,
-                    Request::RemovePublicLink {
-                        path: state_rm.rel.clone(),
-                        id: id.clone(),
-                    },
+                    state_rm.target.remove_link(id.clone()),
                    "Public link removed",
                    "Couldn't remove the link",
                    None,
@@ -407,12 +499,7 @@ pub(crate) fn share_dialog_create_link(
 ) {
    let rx = spawn_request(
        state.ui.dirs.control_socket(),
-        Request::CreatePublicLink {
-            path: state.rel.clone(),
-            role,
-            password,
-            expires: None,
-        },
+        state.target.create_link(role, password),
    );
    let state = state.clone();
    glib::spawn_future_local(async move {
@@ -1,11 +1,11 @@
 //! `pdfs-prompt` — the launcher: one search field over both Proton Drive and the
 //! files on this machine, styled after Google Drive's search overlay.
 //!
-//! Bind it to a system shortcut (e.g. in Hyprland) for a quick HUD search. It is
-//! a short-lived process: it must draw *now*, so nothing here blocks the main
-//! loop. Every daemon round-trip runs on a worker thread and lands back through
-//! an async channel; the two searches (Drive and local) are fired in parallel and
-//! each section renders as its own reply arrives.
+//! Bind it to a system shortcut (e.g. in Hyprland) for a quick HUD search. The
+//! application is single-instance and keeps its window alive between summons,
+//! so repeat activations only reset and present the existing widget tree. Every
+//! daemon round-trip runs on a worker thread and lands back through an async
+//! channel. Drive and local lookup share one request so a result set paints once.

 use std::cell::{Cell, RefCell};
 use std::path::{Path, PathBuf};
@@ -17,7 +17,12 @@ use adw::prelude::*;
 use gtk4::{gio, glib};

 use pdfs_core::config::AppDirs;
-use pdfs_core::control::{LocalHit, Request, Response, SearchHit, send};
+use pdfs_core::control::{
+    LocalHit, Request, Response, SearchFilters, SearchHit, SearchKind, SearchSource, send,
+};
+
+mod activation;
+use activation::{DriveActivation, drive_activation, mounted_path};

 const APP_ID: &str = "io.narl.proton-drive-linux-prompt";

@@ -60,6 +65,16 @@ impl Filter {
            Filter::Media => !is_dir && is_media(name),
        }
    }
+
+    fn search_kind(self) -> SearchKind {
+        match self {
+            Self::All => SearchKind::All,
+            Self::Folders => SearchKind::Folders,
+            Self::Documents => SearchKind::Documents,
+            Self::Images => SearchKind::Images,
+            Self::Media => SearchKind::Media,
+        }
+    }
 }

 fn extension(name: &str) -> String {
@@ -174,6 +189,13 @@ impl Hit {
        matches!(self, Hit::Drive(h) if h.pinned)
    }

+    fn score(&self) -> i64 {
+        match self {
+            Self::Drive(hit) => hit.score,
+            Self::Local(hit) => hit.score,
+        }
+    }
+
    /// Stable identity used to preserve the keyboard cursor across re-renders.
    /// The bool keeps a Drive and a local hit at the same path distinct.
    fn key(&self) -> (bool, String) {
@@ -184,6 +206,15 @@ impl Hit {
    }
 }

+fn rank_hits(hits: &mut [Hit]) {
+    hits.sort_by(|a, b| {
+        b.score()
+            .cmp(&a.score())
+            .then_with(|| a.name().cmp(b.name()))
+            .then_with(|| a.key().cmp(&b.key()))
+    });
+}
+
 /// Everything the window needs to render and act, in one place so the many
 /// callbacks below capture a single `Rc` instead of a dozen clones each.
 struct Ui {
@@ -195,6 +226,7 @@ struct Ui {
    stack: gtk4::Stack,
    scroller: gtk4::ScrolledWindow,
    results: gtk4::Box,
+    search_section: Section,
    drive_section: Section,
    local_section: Section,
    placeholder: adw::StatusPage,
@@ -217,8 +249,7 @@ struct Ui {
    /// Monotonic query id. A reply whose id is stale (the user typed again while
    /// it was in flight) is dropped instead of overwriting fresher results.
    query_id: Cell<u64>,
-    /// In-flight searches for the current query id, so the spinner stops only
-    /// once both sections have answered.
+    /// In-flight requests for the current query id.
    pending: Cell<u8>,
    /// True once a Drive open is running: the window is about to close, so
    /// further input is ignored.
@@ -229,6 +260,10 @@ struct Ui {
    /// against the selected row once the fresh results settle, rather than being
    /// dropped — so a plain "type, Enter" always opens something.
    open_pending: Cell<bool>,
+    /// Prevent lifecycle-driven entry resets from also scheduling the normal
+    /// debounced empty-query request; activation performs one explicit daemon
+    /// bootstrap instead.
+    suppress_entry_change: Cell<bool>,
    /// The window, so a deferred open (above) can reach it from `render`.
    window: RefCell<Option<adw::ApplicationWindow>>,
 }
@@ -301,17 +336,33 @@ fn main() -> glib::ExitCode {
        .init();

    let app = adw::Application::builder().application_id(APP_ID).build();
+    // GtkApplication normally remains active while it owns a window, including
+    // when that window is hidden. Hold it explicitly as well: residency is a
+    // product requirement here, not an incidental window-lifetime side effect.
+    let _resident = app.hold();
    app.connect_startup(|_| load_css());
-    app.connect_activate(build_window);
+    let prompt: Rc<RefCell<Option<Rc<Ui>>>> = Rc::new(RefCell::new(None));
+    app.connect_activate(move |app| {
+        let ui = if let Some(ui) = prompt.borrow().clone() {
+            ui
+        } else {
+            let Some(ui) = build_window(app) else {
+                return;
+            };
+            *prompt.borrow_mut() = Some(ui.clone());
+            ui
+        };
+        ui.activate();
+    });
    app.run()
 }

-fn build_window(app: &adw::Application) {
+fn build_window(app: &adw::Application) -> Option<Rc<Ui>> {
    let dirs = match AppDirs::new() {
        Ok(d) => d,
        Err(e) => {
            tracing::error!("cannot resolve app dirs: {e}");
-            return;
+            return None;
        }
    };

@@ -362,8 +413,10 @@ fn build_window(app: &adw::Application) {
    let results = gtk4::Box::new(gtk4::Orientation::Vertical, 0);
    results.add_css_class("results");

+    let search_section = Section::new("Best matches", "system-search-symbolic");
    let drive_section = Section::new("Proton Drive", "folder-remote-symbolic");
    let local_section = Section::new("This computer", "drive-harddisk-symbolic");
+    search_section.attach(&results);
    drive_section.attach(&results);
    local_section.attach(&results);

@@ -430,6 +483,7 @@ fn build_window(app: &adw::Application) {
        stack,
        scroller,
        results,
+        search_section,
        drive_section,
        local_section,
        placeholder,
@@ -446,6 +500,7 @@ fn build_window(app: &adw::Application) {
        opening: Cell::new(false),
        indexing: Cell::new(false),
        open_pending: Cell::new(false),
+        suppress_entry_change: Cell::new(false),
        window: RefCell::new(None),
    });
    *ui.window.borrow_mut() = Some(window.clone());
@@ -477,15 +532,17 @@ fn build_window(app: &adw::Application) {
        (&ui.local_section.list, true),
    ] {
        let ui_row = ui.clone();
-        let window_row = window.clone();
        list.connect_row_activated(move |_, row| {
            let offset = if is_local { ui_row.drive_count() } else { 0 };
-            ui_row.open(offset + row.index() as usize, &window_row);
+            ui_row.open(offset + row.index() as usize);
        });
    }
+    let ui_row = ui.clone();
+    ui.search_section
+        .list
+        .connect_row_activated(move |_, row| ui_row.open(row.index() as usize));

    let ui_key = ui.clone();
-    let window_key = window.clone();
    let keys = gtk4::EventControllerKey::new();
    keys.connect_key_pressed(move |_, key, _, state| {
        if ui_key.opening.get() {
@@ -496,7 +553,7 @@ fn build_window(app: &adw::Application) {
                // Spotlight-style: first Escape clears a non-empty query, a
                // second (or an already-empty box) dismisses the launcher.
                if ui_key.entry.text().is_empty() {
-                    window_key.close();
+                    ui_key.dismiss();
                } else {
                    ui_key.entry.set_text("");
                }
@@ -532,19 +589,41 @@ fn build_window(app: &adw::Application) {
    // focused entry is never reached. Enter with focus in the list is covered by
    // `row_activated` above.
    let ui_activate = ui.clone();
-    let window_activate = window.clone();
    entry.connect_activate(move |_| {
        if ui_activate.opening.get() {
            return;
        }
        // Fall back to the top row when nothing is explicitly selected (e.g.
        // results haven't rendered yet); `open` guards the rest.
-        ui_activate.open(ui_activate.cursor.get().unwrap_or(0), &window_activate);
+        ui_activate.open(ui_activate.cursor.get().unwrap_or(0));
    });

+    // Some GTK/input-method combinations consume the physical Return binding in
+    // GtkText without emitting Entry::activate. Capture only Return ahead of the
+    // text widget and leave every other key to normal GTK/IME handling. Stopping
+    // propagation also prevents the activate signal above from opening twice;
+    // that signal remains the programmatic/accessibility activation path.
+    let ui_return = ui.clone();
+    let return_key = gtk4::EventControllerKey::new();
+    return_key.set_propagation_phase(gtk4::PropagationPhase::Capture);
+    return_key.connect_key_pressed(move |_, key, _, _| {
+        if matches!(key, gtk4::gdk::Key::Return | gtk4::gdk::Key::KP_Enter) {
+            if !ui_return.opening.get() {
+                ui_return.open(ui_return.cursor.get().unwrap_or(0));
+            }
+            glib::Propagation::Stop
+        } else {
+            glib::Propagation::Proceed
+        }
+    });
+    entry.add_controller(return_key);
+
    let debounce: Rc<RefCell<Option<glib::SourceId>>> = Rc::new(RefCell::new(None));
    let ui_changed = ui.clone();
    entry.connect_changed(move |entry| {
+        if ui_changed.suppress_entry_change.get() {
+            return;
+        }
        // A fresh keystroke supersedes any Enter that was waiting on results:
        // the user is still refining the query, not asking to open yet.
        ui_changed.open_pending.set(false);
@@ -564,22 +643,59 @@ fn build_window(app: &adw::Application) {
    let ui_retry = ui.clone();
    retry.connect_clicked(move |_| ui_retry.connect());

-    // A launcher is modal by convention: losing focus dismisses it.
-    window.connect_is_active_notify(|w| {
-        if !w.is_active() {
-            w.close();
-        }
+    // Keep the widget tree alive when the compositor asks the window to close.
+    // This also avoids running GTK's destruction path while async replies still
+    // hold references to prompt widgets.
+    let ui_close = ui.clone();
+    window.connect_close_request(move |_| {
+        ui_close.dismiss();
+        glib::Propagation::Stop
    });
    let entry_map = entry.clone();
    window.connect_map(move |_| {
        entry_map.grab_focus();
    });

-    ui.connect();
-    window.present();
+    Some(ui)
 }

 impl Ui {
+    /// Reset and present the resident prompt in response to GApplication
+    /// activation. A second invocation while a file is materialising merely
+    /// raises the progress window; it must not make the in-flight open mutable.
+    fn activate(self: &Rc<Self>) {
+        let Some(window) = self.window.borrow().clone() else {
+            return;
+        };
+        if !self.opening.get() {
+            // Supersede replies from the previous showing before clearing the
+            // query. The daemon work may finish, but it can no longer repaint
+            // the newly activated prompt with stale rows.
+            self.query_id.set(self.query_id.get() + 1);
+            self.pending.set(0);
+            self.open_pending.set(false);
+            self.spinner.stop();
+            self.spinner.set_visible(false);
+            self.suppress_entry_change.set(true);
+            self.entry.set_text("");
+            self.suppress_entry_change.set(false);
+            self.set_filter(Filter::All);
+            self.connect();
+        }
+        window.present();
+        self.entry.grab_focus();
+    }
+
+    /// Dismiss without destroying the application window. GTK continues to
+    /// associate the hidden window with the single application instance, so a
+    /// later desktop shortcut invocation is a cheap `activate` round-trip.
+    fn dismiss(&self) {
+        self.open_pending.set(false);
+        if let Some(window) = self.window.borrow().as_ref() {
+            window.set_visible(false);
+        }
+    }
+
    /// Ask the daemon for status and, if it answers, load the suggested (pinned)
    /// files. Runs off-thread: a dead daemon must not freeze the first frame.
    fn connect(self: &Rc<Self>) {
@@ -640,6 +756,8 @@ impl Ui {
                        modified: 0,
                        pinned: true,
                        uid: pin.uid,
+                        mounted_path: None,
+                        score: 0,
                    })
                    .collect(),
                _ => Vec::new(),
@@ -650,32 +768,41 @@ impl Ui {
        });
    }

-    /// Fire both searches for `query` in parallel. An empty query falls back to
-    /// the suggestions view.
+    /// Search Drive and local metadata in one daemon round-trip. An empty query
+    /// falls back to the suggestions view.
    fn search(self: &Rc<Self>, query: &str) {
        if query.is_empty() {
            self.load_suggestions();
            return;
        }

-        let id = self.begin_query(2);
-
-        let drive = spawn_request(
+        let id = self.begin_query(1);
+        let search = spawn_request(
            self.socket.clone(),
-            Request::Search {
+            Request::SearchV2 {
                query: query.to_string(),
                limit: SEARCH_LIMIT,
+                filters: SearchFilters {
+                    sources: vec![SearchSource::Drive, SearchSource::Local],
+                    kind: self.filter.get().search_kind(),
+                },
            },
        );
        let ui = self.clone();
        glib::spawn_future_local(async move {
-            let reply = drive.recv().await;
+            let reply = search.recv().await;
            if !ui.finish_query(id) {
                return;
            }
            match reply {
-                Ok(Ok(Response::SearchResults { hits })) => {
-                    *ui.drive_hits.borrow_mut() = hits;
+                Ok(Ok(Response::SearchResultsV2 {
+                    drive_hits,
+                    local_hits,
+                    local_indexing,
+                })) => {
+                    *ui.drive_hits.borrow_mut() = drive_hits;
+                    *ui.local_hits.borrow_mut() = local_hits;
+                    ui.indexing.set(local_indexing);
                    ui.render();
                }
                // Transport failure: the daemon is gone. Don't paint "No
@@ -683,32 +810,6 @@ impl Ui {
                Ok(Err(_)) | Err(_) => ui.go_offline(),
                _ => {
                    ui.drive_hits.borrow_mut().clear();
-                    ui.render();
-                }
-            }
-        });
-
-        let local = spawn_request(
-            self.socket.clone(),
-            Request::SearchLocal {
-                query: query.to_string(),
-                limit: SEARCH_LIMIT,
-            },
-        );
-        let ui = self.clone();
-        glib::spawn_future_local(async move {
-            let reply = local.recv().await;
-            if !ui.finish_query(id) {
-                return;
-            }
-            match reply {
-                Ok(Ok(Response::LocalResults { hits, indexing })) => {
-                    ui.indexing.set(indexing);
-                    *ui.local_hits.borrow_mut() = hits;
-                    ui.render();
-                }
-                Ok(Err(_)) | Err(_) => ui.go_offline(),
-                _ => {
                    ui.local_hits.borrow_mut().clear();
                    ui.render();
                }
@@ -751,7 +852,12 @@ impl Ui {
        for (chip_filter, chip) in self.chips.borrow().iter() {
            chip.set_active(*chip_filter == filter);
        }
-        self.render();
+        let query = self.entry.text().trim().to_string();
+        if query.is_empty() {
+            self.render();
+        } else {
+            self.search(&query);
+        }
    }

    fn cycle_filter(self: &Rc<Self>, backwards: bool) {
@@ -776,9 +882,8 @@ impl Ui {
            .count()
    }

-    /// Rebuild both sections from the last replies under the active chip, then
-    /// restore the cursor to the top. Every state change funnels through here, so
-    /// the list, the placeholder, and the footer can never disagree.
+    /// Rebuild suggestions or the globally-ranked search section, preserving the
+    /// selected identity when a result survives the update.
    fn render(self: &Rc<Self>) {
        let filter = self.filter.get();

@@ -808,17 +913,24 @@ impl Ui {

        let query = self.entry.text().trim().to_string();
        let searching = !query.is_empty();
-        let drive_title = if searching {
-            "Proton Drive"
-        } else {
-            "Pinned in Proton Drive"
-        };
-        self.drive_section.set_rows(&drive, Some(drive_title));
-        self.local_section.set_rows(&local, None);
-
        let total = drive.len() + local.len();
        let mut visible = drive;
        visible.extend(local);
+        if searching {
+            rank_hits(&mut visible);
+            self.search_section.set_rows(&visible, Some("Best matches"));
+            self.drive_section.set_rows(&[], None);
+            self.local_section.set_rows(&[], None);
+        } else {
+            self.search_section.set_rows(&[], None);
+            let drive_count = visible
+                .iter()
+                .take_while(|hit| matches!(hit, Hit::Drive(_)))
+                .count();
+            self.drive_section
+                .set_rows(&visible[..drive_count], Some("Pinned in Proton Drive"));
+            self.local_section.set_rows(&visible[drive_count..], None);
+        }

        // Find where the previously-selected row landed in the rebuilt list.
        let restored = selected_key.and_then(|key| visible.iter().position(|hit| hit.key() == key));
@@ -854,8 +966,8 @@ impl Ui {
        // so it lands on the final list, not a half-populated one.
        if self.open_pending.get() && self.pending.get() == 0 {
            self.open_pending.set(false);
-            if let (Some(index), Some(window)) = (self.cursor.get(), self.window.borrow().clone()) {
-                self.open(index, &window);
+            if let Some(index) = self.cursor.get() {
+                self.open(index);
            }
        }
    }
@@ -892,6 +1004,19 @@ impl Ui {
    /// section owns it, clear the other section's selection, and scroll it into
    /// view. Focus stays in the entry so typing never breaks.
    fn select(self: &Rc<Self>, index: usize) {
+        if !self.rendered_query.borrow().is_empty() {
+            self.drive_section.list.unselect_all();
+            self.local_section.list.unselect_all();
+            let Some(row) = self.search_section.list.row_at_index(index as i32) else {
+                return;
+            };
+            self.search_section.list.select_row(Some(&row));
+            self.cursor.set(Some(index));
+            self.scroll_into_view(&row);
+            return;
+        }
+
+        self.search_section.list.unselect_all();
        let drive_count = self.drive_count();
        let (list, other, local_index) = if index < drive_count {
            (
@@ -938,7 +1063,7 @@ impl Ui {
    /// straight to the desktop; a Drive hit must first be hydrated into the cache
    /// by the daemon (`OpenFile`), which can take a moment — the window stays up,
    /// with the spinner running, until the path comes back.
-    fn open(self: &Rc<Self>, index: usize, window: &adw::ApplicationWindow) {
+    fn open(self: &Rc<Self>, index: usize) {
        if self.opening.get() {
            return;
        }
@@ -957,15 +1082,36 @@ impl Ui {
        match hit {
            Hit::Local(local) => {
                xdg_open(Path::new(&local.path));
-                window.close();
-            }
-            // A Drive folder exists in the mount — open it in the file manager
-            // rather than downloading anything.
-            Hit::Drive(drive) if drive.is_dir => {
-                xdg_open(&self.mountpoint.borrow().join(&drive.path));
-                window.close();
+                self.dismiss();
            }
            Hit::Drive(drive) => {
+                // Empty-query rows come from ListPins, whose `recursive` flag is
+                // pin policy rather than reliable node kind metadata. Every pin
+                // already has a mounted path, so activate that path directly;
+                // this handles non-recursively pinned folders without mistaking
+                // them for files and sending an invalid OpenFile request.
+                if self.rendered_query.borrow().is_empty() {
+                    let path = drive.mounted_path.as_deref().map_or_else(
+                        || mounted_path(&self.mountpoint.borrow(), &drive.path),
+                        PathBuf::from,
+                    );
+                    xdg_open(&path);
+                    self.dismiss();
+                    return;
+                }
+                match drive_activation(&drive.name, drive.is_dir) {
+                    DriveActivation::Folder | DriveActivation::MountedMedia => {
+                        let path = drive.mounted_path.as_deref().map_or_else(
+                            || mounted_path(&self.mountpoint.borrow(), &drive.path),
+                            PathBuf::from,
+                        );
+                        xdg_open(&path);
+                        self.dismiss();
+                        return;
+                    }
+                    DriveActivation::Materialize => {}
+                }
+
                self.opening.set(true);
                self.spinner.set_visible(true);
                self.spinner.start();
@@ -978,7 +1124,6 @@ impl Ui {
                    },
                );
                let ui = self.clone();
-                let window = window.clone();
                glib::spawn_future_local(async move {
                    let reply = rx.recv().await;
                    ui.spinner.stop();
@@ -987,7 +1132,7 @@ impl Ui {
                    match reply {
                        Ok(Ok(Response::FilePath { path })) => {
                            xdg_open(Path::new(&path));
-                            window.close();
+                            ui.dismiss();
                        }
                        Ok(Ok(Response::Error { message, .. })) => {
                            ui.hint.set_label(&format!("Could not open: {message}"));
@@ -1288,3 +1433,37 @@ fn load_css() {
        );
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn ranked_hits_merge_sources_on_one_score_scale() {
+        let mut hits = vec![
+            Hit::Drive(SearchHit {
+                name: "alpha.pdf".into(),
+                path: "Drive/alpha.pdf".into(),
+                is_dir: false,
+                size: 1,
+                modified: 1,
+                pinned: false,
+                uid: "v~a".into(),
+                mounted_path: None,
+                score: 100,
+            }),
+            Hit::Local(LocalHit {
+                name: "better.pdf".into(),
+                path: "/home/me/better.pdf".into(),
+                is_dir: false,
+                size: 1,
+                modified: 1,
+                score: 300,
+            }),
+        ];
+
+        rank_hits(&mut hits);
+        assert!(matches!(&hits[0], Hit::Local(hit) if hit.name == "better.pdf"));
+        assert!(matches!(&hits[1], Hit::Drive(hit) if hit.name == "alpha.pdf"));
+    }
+}
@@ -30,10 +30,10 @@ graph TD

 | Crate | Primary Role | Key Components | State Management |
 |---|---|---|---|
-| [`pdfs-core`](file:///home/narl/dev/private/proton-drive-linux/crates/pdfs-core) | Core Infrastructure & Services | Cache Bookkeeping, Database migrations/schemas, IPC protocol payloads. | Holds the unified SQLite DB (`Db`) connection and the on-disk cache metadata (`ContentCache`). |
-| [`pdfs-fuse`](file:///home/narl/dev/private/proton-drive-linux/crates/pdfs-fuse) | VFS Layer & Reconciliation | FUSE callbacks, background upload queue (`drain`), two-way sync runner. | Manages in-memory inode maps (`State`), active descriptors (`WriteHandle`), and background task threads. |
-| [`pdfs-cli`](file:///home/narl/dev/private/proton-drive-linux/crates/pdfs-cli) | Command Line Interface | Command routing, daemon launcher, IPC client wrapper. | Stateless; communicates with daemon over IPC control socket. |
-| [`pdfs-gui`](file:///home/narl/dev/private/proton-drive-linux/crates/pdfs-gui) | Graphical Interface | GTK Page timelines (Files, Photos, Shares, Status). | Stateless; polls daemon for status and lists timelines via IPC socket. |
+| [`pdfs-core`](../crates/pdfs-core) | Core Infrastructure & Services | Cache bookkeeping, database migrations/schemas, IPC protocol payloads, and shared search relevance scoring. | Holds the unified SQLite DB (`Db`) connection and the on-disk cache metadata (`ContentCache`). |
+| [`pdfs-fuse`](../crates/pdfs-fuse) | VFS Layer & Reconciliation | FUSE callbacks, background upload queue (`drain`), two-way sync runner. | Manages in-memory inode maps (`State`), active descriptors (`WriteHandle`), and background task threads. |
+| [`pdfs-cli`](../crates/pdfs-cli) | Command Line Interface | Command routing, daemon launcher, IPC client wrapper. | Stateless; communicates with daemon over IPC control socket. |
+| [`pdfs-gui`](../crates/pdfs-gui) | Graphical Interface | GTK pages, tray, and the resident quick-search prompt. | Keeps UI state only; all durable state and Drive access remain behind the IPC socket. |

 ---

@@ -76,6 +76,31 @@ sequenceDiagram
    FUSE-->>User: returns child inode metadata (attributes, TTL)
 ```

+### Access Classification and Enforcement
+
+Every `Entry` carries an `Access` (`Owner | Editor | Viewer | Unknown`), inherited from its parent at intern time rather than resolved per node — a child is always interned from its parent's listing, so one edge lookup answers it. A known share root takes its access from the persisted `share_access` table instead, which is also what makes the classification correct offline.
+
+Two rules decide the cases inheritance cannot:
+
+* **Not under a share, no role → `Owner` (fail open).** My Files and device folders are owned content; regressing this denies ordinary writes.
+* **Under a share with no usable role → `Viewer` (fail closed).** An unrecognised permission mask is never degraded into a guess.
+
+A node whose parent is not resident is the awkward case: a device folder's parent is the device root, which is never persisted as a node, so the whole subtree hydrates parentless. It resolves the way the persisted authority (`Db::effective_node_access`) does — a recorded share row above it wins, otherwise fail open on the mount's own volume and closed on a foreign one (`docs/BUGS.md` B79).
+
+Enforcement is three layers, and only the third closes B34:
+
+1. **Mode bits.** `attr()` returns `0o555`/`0o444` for a non-writable entry, and both mount paths set `MountOption::DefaultPermissions`, so the *kernel* refuses `open(O_WRONLY)`, `access(W_OK)` and namespace operations for any non-root process.
+2. **Handler gates.** `EACCES` in `create`/`mkdir`/`unlink`/`rmdir`/`rename` (parent-writable; both parents for a rename) and in `open`-for-write/`write`/`setattr`/`fallocate`. Covers root and stale attribute TTLs.
+3. **Queue guards.** `Core::require_uid_writable` admits a mutation only when the persisted authority *and* every live inode space agree the uid is writable. Nothing reaches `pending_op` otherwise, so the perpetual failing drain that B34 describes cannot occur even if a handler check is missed. The intersection is across mounts because a uid may be resident in more than one inode space.
+
+`EACCES`, not `EROFS`, for a read-only subtree inside a read-write mount: `EROFS` means "read-only filesystem" and misleads the heuristics in `cp`, `rsync` and `git`.
+
+### Local Locations
+
+`mount` is a presentation table: one row per local place this client occupies — the primary My Files session, and each device folder in mirror or on-demand mode. `sync_folder` remains the sync engine's own table (`sync_entry` is FK'd to it) and `MountKind::Device { sync_folder_id }` is the join. `Request::ListLocations` serves the table to `pdfs locations` and the GUI's Locations page.
+
+A mirror folder is a plain local directory with no FUSE session, so a row can legitimately describe a location that is not mounted — which is why the page is called *Locations* rather than *Mounts*. The primary mountpoint stays in `AppConfig`, with its `mount` row written at daemon start as a projection of it, so there are not two sources of truth for that path.
+
 ---

 ## 3. Read Path & Block Caching Pipeline
@@ -127,9 +152,9 @@ Because Proton Drive does not support partial byte writes, modified files must b
 1. **Staging writes (`WriteHandle`):** Writes are stored locally in a `scratch` file. The daemon tracks modified regions using `Intervals` (which holds ranges of edited bytes).
 2. **Close/Release (`queue_revision`):** When the application closes the file descriptor, the daemon:
   - Fetches any untouched gaps from the remote base file to compile the full file.
-   - Moves the scratch file to `staging` under a `{uid}-{millis}-{counter}` name, so a staged blob can be tied back to its node without consulting the database.
-   - Queues a pending database operation (`PendingOp`).
-3. **Async Drain Thread (`run_pending_drain`):** The background drain worker picks up the database operations queue, handles revisions uploads, resolves conflicts, and cleans up staging files.
+   - Durably publishes the scratch data and authored-range sidecar into `staging` under a `{uid}-{millis}-{counter}` name. Temporary data and metadata are synced before atomic rename, and their directory is synced before the source is removed.
+   - Transactionally queues or supersedes a pending database operation (`PendingOp`), so insertion failure cannot erase the previously acknowledged upload. For `OP_REVISION` ops, execution is debounced by 2 seconds (`DRAIN_REVISION_DEBOUNCE = 2s`) to give rapid follow-up writes (e.g. `aria2c` preallocation followed by writing) time to supersede the staged blob before network transmission.
+3. **Async Drain Thread (`run_pending_drain`):** The background drain worker picks up the database operations queue, handles revision uploads, resolves conflicts, and cleans up staging files. Upon landing a revision upload (`refresh_after_upload`), it rebaselines both still-queued ops (`rebaseline_pending`) and open write handles targeting the same node to prevent false self-conflict copies on subsequent writes.

 ```mermaid
 sequenceDiagram
@@ -170,7 +195,7 @@ sequenceDiagram
 The sync engine handles offline-capable, bidirectional synchronization between the local disk and Proton Drive for directories marked in `mirror` mode.

 ### Lifecycle of a Sync Pass
-1. **Walk Local:** Walks the local directory tree recursively, scanning sizes and modification times.
+1. **Walk Local:** Walks the local directory tree recursively, scanning sizes and modification times while carrying a completeness result. A `readdir`, metadata, permission, or transient I/O failure makes the pass non-destructive instead of turning omitted paths into deletions.
 2. **Walk Remote:** Walks the remote database representation. If remote file modification times are updated, it calls the API to decrypt their sizes.
 3. **Load Baseline:** Loads the `sync_entry` database table, which contains the snapshot of both sides during the *last successful sync*.
 4. **Permutation Diffing:** The loop compares the three states (`local`, `remote`, `baseline`) to classify items:
@@ -192,7 +217,7 @@ graph TD
 ```

 5. **Depth-Ascending Batching:** Folders are processed first to ensure hierarchies exist before files are placed. Work is executed concurrently up to a set limit.
-6. **Post-Sync Settle:** On success, baseline entries are upserted, timestamps updated, and any pending mode switches (e.g. going on-demand) are evaluated.
+6. **Safety Gate and Settle:** Destructive plans are rejected when the scan is incomplete. Total-wipe protection applies to every non-empty baseline, including a single-entry folder. On success, baseline entries are upserted, timestamps updated, and any pending mode switches (e.g. going on-demand) are evaluated. Failed local deletion or conflict preservation retains the previous baseline and prevents remote content from overwriting the local source.

 ---

@@ -202,11 +227,18 @@ The CLI and GUI front-ends do not access database files or make network calls di

 * **Transport:** IPC over Unix Stream Socket.
 * **Framing:** Line-delimited JSON payloads.
+* **Resource limits:** Requests are limited to 1 MiB, must end with a newline, and must arrive within 10 seconds. At most 64 connection handlers are active at once.
 * **Control Protocol:**
  * Client sends a single JSON line (`Request`).
  * Daemon parses, handles the request, and replies with a single JSON line (`Response`).
  * Timeout durations are separated: **2 seconds** for writes (avoids hangs on defunct sockets) and **120 seconds** for reads (accommodates heavy transfers).

+### Unified Search
+
+`SearchV2` is the shared search boundary for the resident prompt. One request carries the query, result limit, requested sources (`Drive`, `Local`), and content kind. The daemon queries Drive metadata and the local home-directory index, then applies [`pdfs_core::search::relevance_score`](../crates/pdfs-core/src/search.rs) to both result sets. Exact and prefix matches rank above substring, abbreviation, and bounded typo matches; all query terms must match either the basename or parent path. Returning scores on one scale lets the GUI merge both sources into a deterministic **Best matches** list.
+
+The prompt is a single-instance GTK application. It retains and hides its window between activations, resets its query state when summoned, and ignores stale asynchronous replies. Folder and streamable audio/video results open through the FUSE mount so applications can issue range reads; ordinary Drive files use the daemon's materialize-then-open path.
+
 ---

 ## 7. Subsystem Interaction & Thread Map
@@ -215,9 +247,10 @@ The background daemon relies on the following thread topology:

 1. **Main Thread / Dispatch Loop:** Blocks on `fuser::Session` loop. Reads kernel FUSE events and hands off network-bound VFS work to the FUSE workers pool.
 2. **FUSE Workers Pool (11 threads, two lanes):** Bounded thread pool handling network operations. Split into 3 threads reserved for metadata (`lookup`, `readdir`) and 8 general threads that serve transfers (block reads) and fall back to metadata when no transfer is waiting. Reserved threads never accept a transfer — that is what keeps a directory listing from queuing behind saturated downloads (audit A6).
-3. **IPC listener Thread:** Listens on Unix socket connections, spawning a lightweight task per connection to serve front-end status/configuration requests.
+3. **IPC listener Thread:** Listens on the Unix socket and admits at most 64 concurrent, timeout-bound handlers for front-end status/configuration requests.
 4. **Sync Engine Loop Thread:** Serializes sync runs. Wakes on debounced local inotify filesystem changes, remote polling intervals, or manual user requests.
 5. **Drain Queue Worker Thread:** Processes staged writes (`PendingOp`) sequentially, uploading revisions and retrying with exponential backoff on failures.
+6. **Conflict Sweep Thread (`pdfs-conflict-sweep`, optional):** Reconciles leftover `(sync-conflict …)` copies — 30 s warmup, then one pass every 5 minutes. A copy proven identical to its live sibling (equal size **and** equal `content_sha1`) is redundant; anything it cannot prove identical is surfaced to the activity feed and left alone. Governed by `AppConfig.conflict_sweep` / `PDFS_CONFLICT_SWEEP` (`SweepMode`): **report-only by default**, `off` skips the thread entirely, and only `enforce` lets it trash. Because it deletes, the enforcing path re-verifies revision id, size, digest, name, parent, queued ops and open handles immediately before acting rather than trusting its own pass-start snapshot. See `docs/BUGS.md` B69 and B71.

 ---

@@ -261,13 +294,13 @@ Two exposures this client does **not** currently mitigate, stated plainly rather
 - **Swap.** Content keys, session keys, and decrypted buffers live in ordinary heap memory. Nothing calls `mlock(2)`, so under memory pressure they may be paged out. Raising `LimitMEMLOCK` in the systemd unit would *not* change this — there is no locking to permit. The effective mitigation is encrypted swap (dm-crypt / `systemd-cryptsetup`), which is standard on a LUKS install.
 - **Kernel page cache.** Plaintext returned through FUSE is cached by the kernel like any other file data, and is likewise swappable. Defeating this would mean `direct_io` on every read, forfeiting the readahead and caching that make the mount usable. The trade is taken deliberately in favour of performance.

-### 8.5 File modes: currently inherited, not enforced
+### 8.5 Enforced ownership and file modes

-**The daemon does not set restrictive permissions on anything it creates.** Cache and state directories come from `create_dir_all`, and `control.sock` from a plain `UnixListener::bind` — all subject to the process umask, which on a typical desktop yields `0755` directories and a `0755` socket.
+On every start, `AppDirs::ensure` verifies that the state, cache, and configuration paths are real directories owned by the effective user, rejects symlink substitution or the wrong owner, and enforces mode `0700`. Both Unix sockets are changed to `0600` immediately after binding; failure is fatal rather than falling back to an unguarded daemon.

-What protects them today is the mode of the XDG parents (`~/.cache`, `~/.local/state`), which are conventionally `0700` — but that is a property of the user's system, not something this client establishes or verifies. On a machine where the home directory is group- or world-traversable, the consequences differ by artifact:
+These checks protect the artifacts even when the surrounding home or XDG parent is traversable:

-| Artifact | Exposure if the parent is traversable |
+| Artifact | Why access is restricted |
 |---|---|
 | `content/` | Another local user can read cached plaintext file content |
 | `cache.db` | Another local user can read the full decrypted name/structure index |
@@ -275,14 +308,14 @@ What protects them today is the mode of the XDG parents (`~/.cache`, `~/.local/s

 The socket is the sharpest of the three, because it is an authority boundary rather than a data one — connecting to it confers the daemon's authenticated session without any credential.

-**Fixed (bugs.md B6):** `AppDirs::ensure` now sets `0700` on the state, cache, and config directories on every start — not only at creation, so a directory that already exists with a permissive mode is tightened — and `config::restrict_socket` sets `0600` on both sockets immediately after `bind`. The directories are restricted *before* the socket is bound, which closes the window between `bind` and `chmod`. A control socket whose mode cannot be set takes the daemon down rather than serving unguarded.
+Configuration publication follows the same fail-closed model: a restricted temporary file is written and synced, atomically renamed, and followed by a directory sync. A malformed existing configuration is reported and preserved rather than overwritten with defaults.

 See [RECOVERY.md](RECOVERY.md) for what a lost machine means for the plaintext described in this section, and what to revoke.

 ### 8.6 Implications for deployment

 - Treat the cache and state directories as being as sensitive as the Drive contents themselves.
- Multi-user machines warrant checking `~/.cache` and `~/.local/state` are `0700` until §8.5 is addressed.
+- Restored or manually copied profiles must remain owned by the user. The daemon refuses to start against wrong-owner or symlinked sensitive directories.
 - Purging the cache (`pdfs` settings, or `PurgeCache` over IPC) removes content but **not** `cache.db`, and deliberately never removes undrained `staging/` or `recovery/` blobs.

 ---
@@ -343,4 +376,3 @@ sequenceDiagram
   This ensures compatibility with all versions of Proton's client verification scripts.
 3. **SRP Handshake Reset:** Because a gated login burns the SRP handshake on the API side, the client cannot simply resume the previous request. Instead, `auth::login_interactive` restarts the SRP process from scratch with the verification credentials attached, keeping the complex handshake details isolated from the front-end.
 4. **CLI Fallback:** Since the CLI has no native web browser engine, hitting the CAPTCHA gate fails immediately with a user-friendly message directing the user to sign in once via the GUI (`pdfs-app`) to persist the authenticated session keys to the system keyring.
-
@@ -0,0 +1,152 @@
+# Development and Verification Status for 1.0
+
+This document summarizes the work still pending after the 1.0.0 release branch and records the most important recently completed changes. [`BUGS.md`](BUGS.md) is the authoritative issue ledger; [`TESTING.md`](TESTING.md) defines the acceptance commands.
+
+---
+
+## 1. Core Feature Roadmap (Horizon Tasks)
+Consolidated from the historical feature roadmap; current bug status lives in [`BUGS.md`](BUGS.md).
+
+* **Local Cache & Metadata Encryption at Rest (Priority 5 / Horizon 1)**: Encrypt the SQLite database `cache.db` on disk using SQLCipher (`rusqlite` feature `bundled-sqlcipher`), and encrypt raw content cache blocks (`content/blocks/` and `content/scratch/`) using a fast symmetric scheme like AES-GCM or ChaCha20-Poly1305. The encryption key should be derived from the OS Keyring.
+* **Active Bandwidth Throttling & Traffic Shaping (Horizon 1)**: Add speed governors for daemon uploads and downloads. Support configuration variables `max_upload_rate_kbps` and `max_download_rate_kbps` in `config.json` that can be dynamically adjusted over the Unix control socket.
+* **Interactive & Policy-Based Conflict Resolution (Horizon 1)**: Implement configurable conflict resolution policies (`rename-local`, `rename-remote`, `prefer-local`, `prefer-remote`, `interactive`). Add a "Conflicts" tab to the GUI to notify the user, block sync, and launch external visual diff tools (like Meld or KDiff3).
+* **Multi-Account / Multi-Profile Support (Horizon 3)**: Enable running multiple profiles concurrently. Support separate configuration namespaces (e.g. `profiles/<profile_name>/`), independent SQLite databases, distinct mount paths (e.g. `~/ProtonDrive/Personal` and `~/ProtonDrive/Work`), and multiple daemon processes.
+* **Custom FUSE Mount Options (Horizon 1)**: Expose custom mounting parameters in configuration (e.g. `ro` for read-only, `direct_io` to bypass kernel caching, `allow_other`). Auto-generate systemd user mount units upon sync folder configuration.
+* **Symbolic Link & Hard Link Virtualization (Horizon 2)**: Add symbolic link virtualization inside the metadata store (`NodeType::Symlink`) by intercepting `readlink(2)` and `symlink(2)`. Targets should sync remotely as small encrypted metadata placeholder files on Drive (`proton-vfs-symlink: <target>`).
+* **Desktop File Manager Integration (Horizon 2)**: Develop shell extension plugins for popular Linux file managers (Nautilus Python plugin, Dolphin Service Menus, Thunar custom actions) to offer context-menu shortcuts ("Pin", "Unpin", "Copy Share Link", "View Version History") and file overlay sync badges.
+* **Integrated Photo Gallery Enhancements (Horizon 2)**: Extract and display Exif metadata (camera model, exposure, coordinates) from photos locally, support creating and editing Proton Photo Albums, build a date-based timeline scrollbar, and create an auto-upload Pictures folder pipeline.
+* **Random-Access Media Streaming seek support (Horizon 2)**: Intercept out-of-order sparse reads (player seeks) in `pdfs-fuse` and prioritize downloading blocks around the seek offset, aborting/postponing sequential pre-fetches.
+* **Dynamic Sync Dashboard & Queue Visualization (Horizon 2)**: GUI real-time transfer list (progress bars, speed, ETA), sync history feed, storage usage breakdown, and global pause/resume sync controls.
+* **Interactive Terminal UI (TUI) Mode (Horizon 3)**: Implement `pdfs tui` using the `ratatui` crate to show transfer speed, sync status, active transfer queue with progress bars, and scrolling daemon logs.
+* **Shutdown Safety & Write Queue Visibility (Horizon 1 / P4)**: Register systemd inhibitor locks in `pdfs-fuse` when there are outstanding staging writes to prevent shutdown or sleep, pop up warnings when exiting the GUI, and build a blocking `pdfs sync flush` command.
+* **Block-Level Deduplication (Horizon 3)**: Transition to a Content-Addressable block cache where cached blocks are stored on disk by their SHA-256 hash. Map logical ranges in the database: `(node_uid, block_idx) -> block_hash` to avoid storing or downloading identical blocks.
+* **Pre-emptive Sync Debouncing & File System Events (Horizon 3)**: Group filesystem write events on paths and delay sync queue insertion until a quiet period has elapsed (e.g. 5 seconds of inactivity) to prevent thrashing the Proton API.
+* **File Version History (Horizon 2)**: Expose past file revisions and version history inside the GUI browser tabs.
+
+---
+
+## 2. Performance, Correctness & Robustness Items
+Consolidated from the performance and media-streaming audit notes.
+
+* **B6. Debounce the LRU access touch**: Keep last-touch times in memory and flush them in batches (debounce window of 30-60 seconds) to avoid performing a SQLite `UPDATE` to the `cache_entries` table on every cache hit.
+* **E12. Client in-flight cap shape**: Address the lock discrepancy between `MAX_CONCURRENT_BLOCK_DOWNLOADS = 10` (per-file) and `DEFAULT_MAX_INFLIGHT_BLOCKS = 12` (global client-wide). Either raise the global cap, lower the per-file window, or dynamically calculate the window to prevent single files from starving concurrent transfers.
+* **Pipeline `enumerate_nodes_detail` (P2.8 / 8)**: Introduce pipelined node enumeration to speed up directory listings.
+* **Local ancestor-chain walk (P3.4 / 4)**: Optimize recursive path lookups where full batching is impossible.
+* **Name Search for Photos/Videos**: Add search by photo/video name (deferred from Phase 3 gallery implementation).
+* **Sequential-Read Prefetch for Media Streaming**: Implement sequential read prefetch for media files to avoid stalls when buffering.
+* **Minor sweep items (Phase F)**:
+  * **F1. `StreamRing.tags` Leak**: Clean up tag entries in `StreamRing.tags` when blocks are evicted. Currently, it only shrinks on `drop_node` (revision mismatch), leading to tag accumulation.
+  * **F2. Non-saturating bytes subtraction**: Use `saturating_sub` in `lib.rs:382` (`self.bytes -= dropped.len()`) to prevent release mode panics/wrapping if accounting drifts.
+  * **F3. Short block yields a short read / EOF**: Address the kernel EOF interpretation on short block reads. Either pad the block or fail loudly rather than silently serving short data.
+  * **F4. `stream_readahead` check-then-spawn race**: Prevent duplicate concurrent readahead tasks for the same block. Check-then-spawn is currently racey.
+  * **F5. `refresh_blocks` permit lock (SDK)**: Ensure URL refreshing (`refresh_blocks`) does not hold an in-flight block permit, preventing expired URLs from pinning client permits.
+  * **F7. Document temporary cache file safety**: Add explanatory comment to `cache.rs:362` explaining why `with_extension("tmp")` is safe there but not in `store_thumbnail`.
+
+---
+
+## 3. Open & Unverified Bugs
+Derived from: [`BUGS.md`](BUGS.md)
+
+* **B2. Unattributed Trash Origin**: Investigate why deleted/moved files are occasionally sent to trash instead of vanishing on older rename operations.
+* **B10. GLib Critical Warning on HUD Close**: Assertion failure `g_list_store_remove: assertion '!g_sequence_iter_is_end (it)' failed` when prompt window closes during active launch (`xdg-open`). Needs investigation under `G_DEBUG=fatal-criticals`.
+* **B15. Empty-but-listed folders and duplicate UIDs**: Investigate folder-identity issues (e.g. duplicate remote folders like `Music` with different UIDs) and how folders obtain `listed = 1` in the database without matching child rows.
+* **B8 (CAPTCHA sign-in bridge)**: Verify a real gated sign-in using Webkit CAPTCHA completion.
+* **Draft Revision Upload loop**: Verify SDK-side deletion and retry logic when a conflicting draft revision exists under the same client UID.
+* **Optimistic Size Loss on Restart**: Verify that pending uploads retain their optimistic sizes across a daemon restart.
+* **B48 — stale listing after unlink**: Session tombstones and authoritative empty listings are implemented; run focused live verification against eventually consistent remote enumeration.
+* **B49–B55 — data-safety fixes**: Conflict preservation, orphan/staging durability, transactional supersession, one-entry wipe protection, and incomplete-scan handling have regression coverage but still require the fault, power-loss, and live mode-matrix cases recorded in `BUGS.md`.
+* **B56–B60 — fail-closed state and IPC fixes**: Future schemas, event cursor advancement, socket limits, private-directory validation, and atomic config saves are implemented. Malformed-schema, database-full, connection-flood, wrong-owner, and concurrent/faulted-save verification remains.
+* **B61 — credential rotation persistence**: Surface and retry keyring persistence failures so a rotated single-use refresh token cannot be lost on restart.
+* **B62–B65 — release assurance**: Clean-install package verification, complete version/protocol identity, recovery sign-off, advisory/license policy, SBOM, provenance, checksums, and signatures remain.
+* **B66–B67 — lifecycle and recovery**: Add queue flush/shutdown protection and explicit device adoption during fresh-state restore.
+* **B68/B78 — profile backup**: the destination is fixed and verified live — `profile.json` now lives in `.proton-drive-linux/` under the device root, since the API refuses file creation at the root itself. What remains from B68 is making backup *health* visible (today a failure is a `WARN` in the log and nothing in the UI) and re-running the replacement-machine restore end to end.
+* **B79 — cross-mount permission classification**: fixed and verified live; the standing guard is the `regression B79` acceptance case. The second-account cases it neighbours (`regression B34`) still cannot run — see below.
+
+---
+
+## 4. Testing, Verification & Disaster Recovery Drills
+Derived from: [`TESTING.md`](TESTING.md) and [`RECOVERY.md`](RECOVERY.md)
+
+* **IPC Memory and Performance Stress Tests (Phase 3)**: Verify memory allocations do not balloon when sending large `UploadPhoto` JSON payloads. Test control socket timeout behaviors under long-running block operations.
+* **Fault Injection and Resiliency Tests (Phase 4)**:
+  * **Network degradation**: Verify that interrupted uploads leave readable staging buffers and result in clean backoff retries.
+  * **Disk full (ENOSPC)**: Verify that write staging and gap-filling report correct errors to FUSE and preserve staged work.
+  * **Concurrent reader starvation**: Test that parallel sequential reads do not freeze directory lookups or metadata handlers.
+* **Disaster Recovery Drill (P5 / Phase 5)**: Execute a complete manual disaster recovery test:
+  1. Register a device.
+  2. Sync a folder and upload data.
+  3. Wipe the local state directory and SQLite cache.
+  4. Restart the daemon.
+  5. Run `pdfs sync restore` and assert the recovered filesystem matches the source byte-for-byte.
+* **Second-account sharing run (mount-architecture.md P7)**: The only outstanding verification for the mount/sharing work. One account covers `context_share_id`, the shared-with-me listing, sharing from device folders and the Locations page — all confirmed. A **second account** is required for the shared-tree rendering under a foreign volume, `accept_invitation`, `update_member_role`, the `regression B34` viewer cases (which skip cleanly today), and above all an **editor-role write into a foreign share**, the only thing that validates `membership_address_for`.
+* **Managed live mode matrix**: Before release, run `scripts/fuse-acceptance.sh --managed-live <empty-a> <empty-b>` with `PDFS_ACCEPTANCE_ONLY` unset. It validates on-demand/on-demand, on-demand/mirror, mirror/on-demand, and mirror/mirror transitions.
+* **Crash-consistency matrix**: Inject failure after scratch/sidecar sync, each staging rename, directory sync, pending-op insert/commit, and source deletion; prove that a complete discoverable copy and either the old or new queue record always survives.
+
+---
+
+## 5. Fixed & Resolved Bugs
+Derived from: [`BUGS.md`](BUGS.md)
+
+### Completely Fixed & Verified
+* **B1 — FUSE rename loses the file (data loss)**: In `rename`, the node's database row was deleted while only updating the in-memory state, causing the file to vanish on next listing sync. Fixed by correctly calling `st.invalidate_listing(newparent)` to refresh SQLite cache states.
+* **B4 — `invalidate_listing` silently skipped non-resident folders**: Folders not loaded in memory were being skipped during listing invalidation, leaving stale cache flags in the DB. Fixed by removing the residency check guard.
+* **B5 — `ls -l` costs a network round trip per file (thumbnail xattr probes)**: File listings triggered blocking network checks for thumbnails on unsupported files. Fixed by caching negative thumbnail results and restricting xattr advertisement to supported image/media files.
+* **B6 — Daemon sets no file modes: `control.sock` is an unguarded authority**: The Unix control socket was created without restricting file permissions, exposing daemon controls to other local users. Fixed by applying proper creation permission masks.
+* **B7 — renamed directory reads as missing until the entry TTL expires**: Kernel cache maps remained stale after a FUSE directory re-anchor. Fixed by proactively sending entry invalidation notifications to the kernel.
+* **B9 — Enter did not open the selected result in the launcher**: Hooked up keyboard execution (Enter key) in `pdfs-prompt` search HUD to launch the selected item using `xdg-open`.
+* **B11 — a file moved while its create is still queued reads as empty**: Reconciling a local rename on a file that had not finished uploading yet uploaded empty blocks. Fixed by carrying over and staging the correct logical file size.
+* **B12 — cold enumeration is slow per entry, and goes superlinear past ~500**: S2K decryption and thumbnail resolution loops were serial. Fixed by parallelizing key derivations and caching metadata.
+* **B13 — `rename` over an existing destination fails instead of replacing it**: Fixed POSIX rename target overwrite behavior to replace existing destinations.
+* **B14 — provisional (ciphertext) sizes make rsync read short and abort the file**: Adjusted size reporting to align logical and ciphertext sizing, preventing premature EOF.
+* **B45 — truncate over a queued rewrite**: Path-based and handle-based truncate now compose over the complete pending blob; shrink, growth, and sparse I/O are live-verified.
+* **B46 — combined cross-directory move and rename**: The desired end state is durably queued and reconciles partially completed remote operations; replacement and combined cases are live-verified.
+* **B47 — overlong/invalid names**: All name-taking callbacks share a validator for `NAME_MAX`, reserved components, and UTF-8; managed-live verification passed.
+
+### Implemented in 1.0 (Further Fault Verification Pending)
+
+* **Unified search and resident prompt**: `SearchV2` combines Drive and local lookup with shared relevance scoring and content/source filters. The prompt reuses its window and opens streamable media through FUSE.
+* **Durable write publication**: Scratch sidecars and staged blobs use synced temporary files, atomic renames, and directory synchronization; orphan rescue retains its source on failure.
+* **Transactional pending operations**: Superseding a queued operation cannot delete the old durable record unless the replacement commits.
+* **Safer mirror reconciliation**: Conflict-copy failure aborts publication, incomplete scans are non-destructive, and total-wipe protection includes one-entry baselines.
+* **Bounded IPC**: Control requests are limited to 1 MiB and 10 seconds, with at most 64 active handlers.
+* **Private local state**: Sensitive directories require correct ownership, real-directory identity, and `0700`; sockets use `0600`; config saves are atomic and malformed input is preserved.
+* **Release gates**: Tag/workspace/package versions are checked and formatting, lint, tests, and offline FUSE acceptance run before packaging.
+
+### Code Fixed / Implemented (Pending Verification)
+* **B8 — no way to complete a CAPTCHA, so a gated sign-in is unrecoverable**: Implemented a Webkit-based bridge to prompt the user to resolve interactive CAPTCHAs during gated logins. (Needs verification on a real gate request).
+
+### Closed / Not a Bug
+* **B3 — Activity log timestamps written in seconds, read as milliseconds**: Closed as investigator error (timestamps are consistent).
+
+---
+
+## 6. Recently Implemented Features
+
+### Open-for-Write Deferral for Mirror Sync (Implemented)
+**File**: [`sync.rs`](../crates/pdfs-fuse/src/sync.rs)
+
+The mirror folder sync engine now defers uploading any file that is currently held open for writing by another process, matching the guarantee the FUSE mount path already provides (where uploads are deferred until `close(fd)`).
+
+**Problem**: Previously, the mirror sync path relied solely on a 2-second trailing-edge debounce (with a 30-second ceiling) to avoid uploading files mid-write. This was insufficient for slow continuous writers (e.g., database dumps, large exports, or editors that keep files open for extended periods), which could have their incomplete state uploaded as a real revision.
+
+**Solution**: Before each reconcile pass, the sync engine scans `/proc/*/fd` once to build a set of canonical paths within the sync root that any process holds open for writing (`O_WRONLY` or `O_RDWR`). Files in this set are:
+
+- **Kept in the local walk** — so they are not misclassified as deletions
+- **Treated as unchanged** — so no upload is queued for them
+- **Counted as `deferred`** — so the activity summary reports them (e.g., "3 uploaded, 1 deferred (open for write)")
+- **Picked up on the next pass** — after the writer has closed the file
+
+**How it works**:
+1. `open_for_write_set(root)` reads `/proc/*/fd` → `readlink` for each fd → prefix-checks against the sync root → reads `/proc/<pid>/fdinfo/<n>` to check the `flags:` line's low two bits (O_ACCMODE)
+2. `walk_local` sets `LocalItem.open_for_write = true` for matching files
+3. Both `do_reconcile` and `push_pass` skip upload classification for flagged files
+4. `Outcome.deferred` tracks the count for the activity summary
+
+**Performance**: The `/proc` scan completes in low single-digit milliseconds on a typical desktop. Only fds whose `readlink` target falls under the sync root incur the `fdinfo` read.
+
+**Tests added**: 8 unit tests covering `is_write_mode` parsing of various fdinfo flag combinations, and `Outcome` summary formatting with deferred counts.
+
+| Sync Path | Open-for-write protection | Mechanism |
+|---|---|---|
+| FUSE mount | ✅ Perfect | Upload deferred until `close(fd)` |
+| Mirror folders | ✅ Perfect | `/proc/*/fd` scan per reconcile pass |
@@ -0,0 +1,210 @@
+# Testing
+
+The normal Rust suite exercises the metadata database, sync planner, offline
+queue, write staging, cache, and FUSE handler state without requiring a Proton
+account:
+
+```console
+cargo test --workspace
+cargo clippy --workspace --all-targets -- -D warnings
+```
+
+## Filesystem API and live FUSE acceptance suite
+
+The account-free suite exercises the filesystem syscall contract against a
+temporary local directory. This validates the runner and covers creation/open
+flags, positioned and vectored I/O, truncation and sparse files, `mmap`,
+`sendfile`, `copy_file_range`, durability barriers, namespace/error semantics,
+`renameat2` flags, open-file lifetime, names and enumeration, readdir stability
+under concurrent mutation, metadata updates, extended attributes, allocation and
+punched holes, refusal semantics for unimplemented operations, concurrent I/O,
+and real application workloads. It never reads application state or contacts
+Proton:
+
+```console
+scripts/fuse-acceptance.sh --offline-only
+```
+
+Kernel/FUSE behavior and remote convergence need a real mount. Live testing is
+explicitly opt-in and always runs the account-free contract first. It runs
+destructive POSIX operations only below a fresh `pdfs-acceptance-*` directory.
+It refuses paths that are not FUSE mounts and removes its directory on success,
+failure, or interruption.
+
+Use a dedicated test account without irreplaceable data:
+
+```console
+scripts/fuse-acceptance.sh --live /mnt/on-demand-testmount
+```
+
+### The mount is diffed against an ordinary filesystem
+
+The local reference run is not only a self-test of the runner. Every case
+records the facts it established, and a live run is compared against those
+recordings, so a case fails when the mount *differs* from an ordinary
+filesystem — not only when it raises. The report names the exact key:
+
+```
+  [DIVERGENCE] live FUSE /mnt/testmount does not match the reference filesystem:
+    ! creation and open flags.truncated.size: live=6 reference=0
+```
+
+Facts are recorded in one of two ways, chosen in the test body:
+
+- **compared** — a claim about filesystem semantics. The mount must agree.
+- **noted** — context that legitimately differs: inode numbers, block counts,
+  reported mode bits, and which optional syscalls exist at all. Reported under
+  `[capabilities]`, never a failure.
+
+Because the choice is made at each call site, the set of accepted divergences
+is visible in the test that accepts it. There is no separate allowlist to drift
+out of date. When adding a case, prefer `record`; reach for `note` only when an
+ordinary filesystem can do something a network filesystem genuinely cannot.
+
+### Operations the filesystem does not implement
+
+`git`, `rsync`, `cp -a`, `tar`, `df` and most installers probe for symlinks,
+hard links, FIFOs, device nodes, `statfs`, file locks, `copy_file_range`,
+`O_DIRECT` and `SEEK_HOLE` whether or not a filesystem offers them. The suite
+asserts that each either works or is *refused cleanly* — a recognised errno,
+never `EIO` and never a hang. A refusal that is merely unimplemented is fine;
+one that is dirty breaks software that never asked for the feature.
+
+### Regressions from the bug ledger
+
+Cases named `regression B<n>` reproduce a bug from `docs/BUGS.md` so it stays
+fixed. B69 (identical rewrite must not fork a `(sync-conflict …)` copy), B70 (an
+in-flight `.crdownload` must not be sealed as a revision) and B74 (a file
+renamed after close must keep its content) need a real mount and a reachable
+daemon; they are skipped, not failed, without one.
+
+B74 is currently **failing** — it is a live data-loss defect, not a regression
+guard, and it was found by exactly this mechanism: the B70 case failed, and
+narrowing it produced a smaller reproduction that has its own case now. Expect a
+red run against a real mount until it is fixed.
+
+**B79** (an on-demand device folder accepts writes) discovers its target from
+`pdfs locations --json` and skips when this machine has no mounted on-demand
+folder. It is the cheap standing guard against a *cross-mount* permission
+regression: the primary mount holds device-folder nodes too, and the queue guard
+intersects what every live inode space says about a uid, so a fail-closed
+classification in one mount denies writes in another.
+
+**B34** (a viewer-role share is read-only) and **B34b** (an editor-role share
+still writes) locate their subject through `pdfs shared-with-me --json`, which
+now carries `role` and a mount-relative `path`. Both skip when the account has no
+accepted share at that role — B34 needs a **second account** to have shared a
+folder read-only, which is the one part of the sharing suite that cannot be
+self-served. B34b degrades gracefully in the other direction: a shared *file*
+gets its mode bits and `W_OK` checked but is never written to, because it is
+someone else's document.
+
+B34's fourth assertion is the load-bearing one: `pending_uploads` and
+`pending_changes` must be **unchanged** across the refused writes. Mode bits
+alone would pass a fix that still admitted the write into `pending_op`, which is
+the actual harm — a background drain failing 403 forever.
+
+**Synthetic `Shared with me/` directory contract** asserts the virtual directory
+enumerates, reports `0555`, and refuses `mkdir`/`rmdir`/`rename`. It skips when
+the directory is absent (an account with no accepted shares).
+
+A regression case asserts against the *remote* outcome, so it must wait for the
+queue to drain before reading. Reading straight back through the mount proves
+nothing: the local attribute and content caches will happily return the bytes
+that were just written even when nothing reached Drive, which is precisely how
+B74 stayed invisible.
+
+### Timeouts, reports, and hung mounts
+
+A wedged FUSE operation cannot be interrupted from Python, so each case runs
+under a soft alarm (`--timeout`, default 180s) that reports the case and lets
+cleanup run, backed by a hard stop that dumps every thread's stack and exits.
+That backstop is the only way to learn *where* a mount hung. A timeout ends the
+run: later cases against a wedged mount produce noise, not information.
+
+```console
+scripts/fuse-acceptance.sh --live /mnt/testmount \
+  --timeout 300 --report-junit results.xml --budget 30
+```
+
+`--report-json` also writes every recorded observation, which is what to attach
+to a bug report. `--budget SECONDS` flags cases that pass but got slower —
+B5 was a 186 ms-per-call regression that a pass/fail suite could not see.
+`--list` prints every case and which targets it runs against, and `--fail-fast`
+stops at the first failure.
+
+`--journal-check` fails the run if `proton-drive.service` logged any error while
+it ran. A suite can pass every assertion while the daemon logs failures behind
+it; that has happened, and it was caught only by reading the journal by hand.
+
+Abandoned `pdfs-acceptance-*` roots from a crashed run are removed at startup,
+but only if they match the exact generated name and are over an hour old
+(`PDFS_ACCEPTANCE_REAP_AGE`), so a concurrent run is never disturbed.
+
+### Automated mode matrix
+
+The managed live runner accepts two existing, empty, unmounted directories. It
+registers both as new sync folders, waits for initial synchronization, then
+tests all four pairs in order: on-demand/on-demand, on-demand/mirror,
+mirror/on-demand, and mirror/mirror. Every transition must become idle, and an
+on-demand folder must actually appear as a mount before its contract runs.
+
+```console
+mkdir -p /mnt/pdfs-test-a /mnt/pdfs-test-b
+scripts/fuse-acceptance.sh --managed-live /mnt/pdfs-test-a /mnt/pdfs-test-b
+```
+
+This creates remote folders and permanently deletes those test remotes during
+cleanup. It refuses non-empty paths, existing mounts, and paths already present
+in `pdfs sync list`. Use `PDFS_ACCEPTANCE_SYNC_TIMEOUT` to extend transition
+timeouts and `PDFS_ACCEPTANCE_PDFS` to select a non-installed CLI binary, for
+example `target/debug/pdfs`.
+
+### Durability drill
+
+`--durability` restarts `proton-drive.service` in the middle of the suite and
+re-verifies the bytes written before it. `staging/` and `recovery/` can hold the
+only copy of a file whose upload has not finished, so this is the case that
+proves the queue is persistent rather than in-memory. It is opt-in because it
+interrupts a running daemon; `PDFS_ACCEPTANCE_UNIT` selects a different unit.
+
+### Selecting cases
+
+During development, `PDFS_ACCEPTANCE_ONLY` runs tests whose descriptive name
+contains the supplied text (for example `PDFS_ACCEPTANCE_ONLY=namespace`). A
+release acceptance run must leave it unset so the complete contract executes.
+
+A filter naming a live-only case (every `regression B<n>` is one) selects nothing
+in the account-free reference run, which is not an error — that target simply has
+nothing to do. Only a filter matching *no case at all* fails, as the typo it is.
+
+Passing more paths runs the same filesystem suite independently against each.
+The first path must be the FUSE mount under test; later paths may be another
+FUSE mount or a normal local mirror filesystem:
+
+```console
+PDFS_ACCEPTANCE_SYNC_TIMEOUT=180 \
+  scripts/fuse-acceptance.sh --live /mnt/on-demand-testmount /mnt/testmount
+```
+
+If two paths really are views of the **same remote folder**, enable an
+additional byte-for-byte convergence check explicitly:
+
+```console
+PDFS_ACCEPTANCE_CONVERGENCE=1 \
+  scripts/fuse-acceptance.sh --live /mnt/first-view /mnt/second-view
+```
+
+Do not enable that flag merely because two sync folders belong to the same
+account. Their configured remote UIDs must be identical.
+
+Normally the live suite applies the same API contract independently to each
+supplied mount. In convergence mode it exercises the primary once and verifies
+that the resulting bytes appear through every secondary view. A pass is
+strong evidence for those paths, not a blanket data-loss guarantee. Before a
+release, also run the recovery drills in `docs/RECOVERY.md` and inspect
+`docs/BUGS.md` for live-verification items.
+
+The runner accepts already-mounted paths instead of starting a daemon. This
+keeps authentication and keyring setup explicit and prevents it from silently
+reusing or replacing the normal application state directory.
@@ -9,7 +9,7 @@
 # Build + install:   cd packaging && makepkg -fi

 pkgname=proton-drive-linux
-pkgver=0.7.0
+pkgver=1.3.0
 pkgrel=1
 pkgdesc="Proton Drive client for Linux: FUSE files-on-demand mount, CLI, GTK4 app + tray"
 arch=('x86_64')
@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# Filesystem syscall contract, with optional tests against mounted Drive views.
+set -Eeuo pipefail
+
+usage() {
+    cat >&2 <<'EOF'
+usage: scripts/fuse-acceptance.sh [--offline-only] [OPTION ...]
+       scripts/fuse-acceptance.sh --live MOUNTPOINT [MOUNTPOINT ...] [OPTION ...]
+       scripts/fuse-acceptance.sh --managed-live EMPTY_DIR EMPTY_DIR [OPTION ...]
+       scripts/fuse-acceptance.sh MOUNTPOINT [MOUNTPOINT ...]  # compatibility
+
+The local reference suite always runs first and requires no account; the mount
+is then diffed against its recorded behaviour. --live runs the same contract on
+each mount. Set PDFS_ACCEPTANCE_CONVERGENCE=1 only when all live mountpoints
+show the same remote folder.
+
+Options are forwarded to the Python runner. The useful ones:
+  --list                  print every case and the targets it runs against
+  --timeout SECONDS       per-case limit (default 180); a hung case dumps stacks
+  --fail-fast             stop at the first failure instead of continuing
+  --report-json PATH      machine-readable results and recorded observations
+  --report-junit PATH     JUnit XML for CI
+  --budget SECONDS        report any case slower than this
+  --journal-check         fail if the daemon logs errors during the run
+  --durability            restart the daemon mid-suite and re-verify bytes
+EOF
+    exit 2
+}
+
+command -v python3 >/dev/null || { echo "python3 is required" >&2; exit 2; }
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+runner=(python3 -u "$script_dir/fuse-acceptance.py")
+
+mountpoints=()
+passthrough=()
+# Paths come first and options after them, so the first dash-prefixed argument
+# ends the path list and everything from there is forwarded untouched.
+collect_paths() {
+    while (( $# > 0 )) && [[ "$1" != -* ]]; do
+        mountpoints+=("$1")
+        shift
+    done
+    passthrough=("$@")
+}
+
+case "${1:-}" in
+    -h|--help) usage ;;
+    --offline-only|"")
+        shift || true
+        exec "${runner[@]}" "$@"
+        ;;
+    --live)
+        shift
+        collect_paths "$@"
+        (( ${#mountpoints[@]} > 0 )) || usage
+        ;;
+    --managed-live)
+        shift
+        (( $# >= 2 )) || usage
+        first="$1"; second="$2"; shift 2
+        exec "${runner[@]}" --managed-live "$first" "$second" "$@"
+        ;;
+    --*)
+        # Bare options with no mode: an offline run with those options.
+        exec "${runner[@]}" "$@"
+        ;;
+    *)
+        collect_paths "$@"
+        ;;
+esac
+
+command -v findmnt >/dev/null || { echo "findmnt is required for --live" >&2; exit 2; }
+for mountpoint in "${mountpoints[@]}"; do
+    [[ -d "$mountpoint" ]] || { echo "not a directory: $mountpoint" >&2; exit 2; }
+done
+fstype="$(findmnt -T "${mountpoints[0]}" -n -o FSTYPE | head -n 1)"
+[[ "$fstype" == fuse* ]] || {
+    echo "refusing primary non-FUSE path ${mountpoints[0]} (type: ${fstype:-unknown})" >&2
+    exit 2
+}
+
+exec "${runner[@]}" --live "${mountpoints[@]}" "${passthrough[@]}"
Author	SHA1	Message	Date
nvrl	2336ad9e87	added album to photos, renamed gallery view	2026-07-31 20:31:25 +02:00
nvrl	d988236bfa	wired new locations into gui, fuse acceptance with new permission based mounts	2026-07-31 19:37:12 +02:00
nvrl	d78ddeab8e	cargo fmt	2026-07-31 10:18:30 +02:00
nvrl	b04cce3a23	fixed B78	2026-07-31 10:15:13 +02:00
nvrl	7e8403936b	fixed permission error on on-demand mounts	2026-07-31 09:46:51 +02:00
nvrl	866a174c7a	fixed rpm signing	2026-07-30 02:55:15 +02:00
nvrl	352117e806	fixed rpm signing	2026-07-30 02:23:49 +02:00
nvrl	4b5666eacb	added .deb signing + version bump	2026-07-30 02:13:07 +02:00
nvrl	9bbd8eb982	fixed a migration bug where ProtonDrive becomse unwritable	2026-07-30 02:11:23 +02:00
nvrl	77198ed261	version bumped to 1.2	2026-07-29 21:36:24 +02:00
nvrl	0d79c46729	version bumped to 1.2	2026-07-29 21:30:10 +02:00
nvrl	a8210ce8fd	implemented shared with me + verification	2026-07-29 21:29:07 +02:00
nvrl	551e14b644	implemented shared id permissions	2026-07-29 19:26:57 +02:00
nvrl	7de667b386	implemented primary mount shared with me	2026-07-29 17:04:42 +02:00
nvrl	295bbeadac	implemented share_access, POSIX read-only mode	2026-07-29 14:57:56 +02:00
nvrlandClaude Opus 5	32817870a5	chore(packaging): bump PKGBUILD pkgver to 1.1.1 Version bump in `b93e41e` updated Cargo.toml only, so the release workflow's tag/manifest/PKGBUILD agreement check failed on v1.1.1. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BEWKS8smdPfLMZacgDXjAR	2026-07-27 03:25:56 +02:00
nvrl	b93e41efc5	version bump to 1.1.1	2026-07-26 20:18:45 +02:00
nvrl	082ef8522a	fixed refresh pull bug for trash	2026-07-26 20:17:59 +02:00
nvrl	2e95655244	Merge pull request #19 from narrrl/release/1.1.0 release 1.1.0	2026-07-26 19:03:00 +02:00
nvrl	942cb9f583	fixed concurrency bugs + performance	2026-07-26 19:01:48 +02:00
nvrl	8470662c54	fixed race conditions + extendet test suite	2026-07-26 15:56:58 +02:00
nvrl	a091c2f34f	implemented sweep mode and better conflict handling	2026-07-26 02:06:58 +02:00
nvrlandClaude Opus 5	bca0fe34bc	fix(fuse,core): key conflict detection on revision id, stop transient-name seals (B69, B70) B69 — spurious `(sync-conflict)` copies came from `(mtime, size)` being used as a revision identity. The server re-stamps a sealed revision with its own commit time, so the drain diverted a write into a conflict copy of its own base; and `plan_file` classified a no-baseline (local, remote) pair as `Conflict`, forking every pre-existing file on first reconcile. - `Baseline` carries `revision_id` (from the SDK's new `active_revision_id`), captured at write-open and preserved across supersede/rebaseline. `revision_changed` trusts the id and only falls back to `(mtime, size)` for old sidecars. - Planner gains `FilePlan::AdoptBaseline`: equal-size no-baseline pairs are recorded, not conflicted. Divergent sizes stay a real conflict. - New `sweep.rs` (`pdfs-conflict-sweep`, 5-min cadence) removes conflict copies proven identical by size + `content_sha1` and surfaces divergent ones once as an `ActivityKind::Conflict` entry. Never removes what it cannot prove. B70 — browsers downloading into an on-demand mount had their in-flight temps sealed as canonical revisions, exiling the finished file to a conflict copy. `syncignore::is_transient_name` now recognises download/scratch temps, and the on-demand `release`/`rename` paths hold them (`set_create_hold`) instead of sealing until the name is finalized. Workspace deps bumped to proton-sdk/proton-drive-rs 0.2.2 (registry, no patch). Live validation against a real account still pending for both. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V8P42asymU158CPnhjRwri	2026-07-25 15:24:31 +02:00
nvrl	6df757006a	updated documentation + readme	2026-07-22 15:29:34 +02:00
nvrl	6f70eca78e	Merge pull request #18 from narrrl/release/1.0.0 release/1.0.0	2026-07-22 15:18:00 +02:00
nvrl	0d8a474442	version bump	2026-07-22 15:11:33 +02:00
nvrl	8be0f04b61	fixed fuse bugs from BUGS.md - Durable scratch/staging publication and preservation on failure. - Transactional pending-operation supersession. - Conflict copies cannot overwrite older copies or lose the source. - Single-entry wipe protection and incomplete-scan aborts. - Failed local deletion retains its baseline. - Downloads are fsynced before baseline settlement. - Future database schemas are refused. - Event cursors advance only after successful invalidation and persistence. - IPC frame, timeout, and concurrency limits. - Atomic config saves; malformed configs are preserved. - Sensitive directories require correct ownership, real directories, and 0700. - Debian package now includes service and tray autostart files. - Release workflow enforces versions, tests, lint, formatting, and offline acceptance. - CI now runs offline filesystem acceptance.	2026-07-22 14:49:06 +02:00
nvrl	d5165b36a2	Merge pull request #17 from narrrl/feature/testing Feature/testing	2026-07-22 14:29:39 +02:00
nvrl	a76f36bdff	fixed fs bugs + compleance test for fuse fs	2026-07-22 14:24:40 +02:00
nvrl	e9009dd47c	Merge pull request #16 from narrrl/fix/prompt Fix/prompt	2026-07-22 11:51:43 +02:00
nvrl	d0b49d3c8c	fixed a truncate defect	2026-07-22 11:50:58 +02:00
nvrl	25f578161d	added more comprehensive testing	2026-07-22 11:43:17 +02:00
nvrl	ea56818a80	prompt refactor	2026-07-22 11:27:57 +02:00
nvrl	39ab4aae48	prompt refactor	2026-07-22 09:50:42 +02:00
nvrl	6cba77d3cb	Merge pull request #15 from narrrl/fix/ioctl-handler Fix/ioctl handler	2026-07-22 03:07:30 +02:00
nvrl	26375885ed	updated workflow	2026-07-22 03:04:59 +02:00
nvrl	544d0913e8	added fuse compliance testing	2026-07-22 03:04:40 +02:00
nvrl	714b3048dc	Merge pull request #14 from narrrl/fix/ioctl-handler filesystem fixes, critical + feature implementations	2026-07-22 02:30:57 +02:00
nvrl	bef39f75cf	sync refactor	2026-07-22 02:22:40 +02:00
nvrl	0a1fa95eb4	refactor	2026-07-22 02:17:19 +02:00
nvrl	242a28bb8f	refactor from monolithic structure	2026-07-22 02:02:26 +02:00
nvrl	bd17d506f8	fixed rm before online del, mirror bug	2026-07-22 01:52:10 +02:00
nvrl	1cd6a26be3	fix(fuse,core): remediate audit bugs B23, B26-B29, B33 and update BUGS tracking - B23: Generate synthetic StagedWrite sidecars in rescue_scratch when sidecar is corrupted - B26: Add open_count and unlinked state fields to defer node removal and cache eviction on unlinked open files until release - B27: Discard orphaned write revisions for local UIDs unlinked prior to upload - B28: Add emergency_evict to ContentCache for LRU blob eviction upon ENOSPC - B29: Implement FUSE forget handler and forget_lookup in state to prune unreferenced inodes - B33: Quarantine failing drain ops on HTTP 40x / max retries to unblock offline sync queue - docs: Track audit items B18-B36 in docs/BUGS.md with fix details and verification results	2026-07-22 01:18:35 +02:00
nvrl	fe75998cea	fix(filesystem): resolve critical data loss, POSIX non-compliance, and deadlock vulnerabilities - Standardize POSIX unlink (EISDIR) and rmdir (ENOTDIR/ENOTEMPTY) checks - Defer local directory eviction in mode switch until FUSE mount verification succeeds - Enforce fsync before atomic renames in ContentCache store operations - Add directory ancestor loop check in rename (EINVAL) - Implement punch_hole interval tracking in fallocate - Purge un-created local node write revisions on unlink - Fix control socket permission race with octal umask 0o77 - Add unit tests for state, DB, and FUSE POSIX logic (208/208 tests passing)	2026-07-22 00:23:55 +02:00
nvrl	9d55ffb9f6	fixed io lock with alloced files from for example aria2c	2026-07-21 23:23:20 +02:00
nvrl	2275004f79	impplemented fallocate	2026-07-21 22:39:35 +02:00
nvrl	914ff2b5ae	added ioctl handler	2026-07-21 16:42:41 +02:00
nvrl	01677f2670	updated documentation on bugs/features	2026-07-21 10:35:53 +02:00
nvrl	3f9d36607a	updated readme	2026-07-21 02:12:50 +02:00
nvrl	f1399aa661	Merge pull request #13 from narrrl/feature/selective-sync Feature/selective sync + diagnostics	2026-07-20 23:09:47 +02:00