fix(cli): give journald each log line's priority

journald stored every daemon line at info, so journalctl -p warning,
which TROUBLESHOOTING.md asks reporters for, was always empty (B258).
When fd 1 is the journal stream, prefix lines with <N> and drop colours.

crates/pdfs-cli/src/journal.rs

@@ -0,0 +1,122 @@
+//! Log priorities for journald.
+//!
+//! journald files each line a service writes at the unit's default priority,
+//! info, unless the line opens with a syslog `<N>` prefix. Without one every
+//! WARN and ERROR the daemon logs is stored as info, and the
+//! `journalctl -p warning` that the troubleshooting guide asks for shows
+//! nothing (`docs/BUGS.md` B258).
+
+use std::fmt;
+use std::os::unix::fs::MetadataExt;
+
+use tracing::{Event, Level, Subscriber};
+use tracing_subscriber::fmt::format::Writer;
+use tracing_subscriber::fmt::{FmtContext, FormatEvent, FormatFields};
+use tracing_subscriber::registry::LookupSpan;
+
+/// Whether standard output is the journal stream systemd connected this
+/// process to.
+///
+/// `JOURNAL_STREAM` alone does not say so: a terminal started from a user unit
+/// inherits it, and every `pdfs` run in that terminal would print the
+/// prefixes. systemd sets it to the stream's `device:inode`, so it is compared
+/// against what fd 1 actually is.
+pub(crate) fn stdout_is_journal() -> bool {
+    let Some(stream) = std::env::var_os("JOURNAL_STREAM") else {
+        return false;
+    };
+    let Ok(stdout) = std::fs::metadata("/proc/self/fd/1") else {
+        return false;
+    };
+    stream
+        .to_str()
+        .is_some_and(|value| names_stream(value, stdout.dev(), stdout.ino()))
+}
+
+/// Whether a `JOURNAL_STREAM` value names the file `dev`:`ino`.
+fn names_stream(value: &str, dev: u64, ino: u64) -> bool {
+    value
+        .split_once(':')
+        .is_some_and(|(d, i)| d.parse() == Ok(dev) && i.parse() == Ok(ino))
+}
+
+/// The syslog priority journald should file a `level` line at.
+fn priority(level: &Level) -> u8 {
+    match *level {
+        Level::ERROR => 3,
+        Level::WARN => 4,
+        Level::INFO => 6,
+        Level::DEBUG | Level::TRACE => 7,
+    }
+}
+
+/// An event format that opens each line with its `<N>` priority, then writes
+/// the line as `F` would.
+pub(crate) struct Prioritized<F>(pub(crate) F);
+
+impl<S, N, F> FormatEvent<S, N> for Prioritized<F>
+where
+    S: Subscriber + for<'a> LookupSpan<'a>,
+    N: for<'a> FormatFields<'a> + 'static,
+    F: FormatEvent<S, N>,
+{
+    fn format_event(
+        &self,
+        ctx: &FmtContext<'_, S, N>,
+        mut writer: Writer<'_>,
+        event: &Event<'_>,
+    ) -> fmt::Result {
+        write!(writer, "<{}>", priority(event.metadata().level()))?;
+        self.0.format_event(ctx, writer, event)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io;
+    use std::sync::{Arc, Mutex};
+
+    #[derive(Clone)]
+    struct Buf(Arc<Mutex<Vec<u8>>>);
+
+    impl io::Write for Buf {
+        fn write(&mut self, bytes: &[u8]) -> io::Result<usize> {
+            self.0.lock().unwrap().extend_from_slice(bytes);
+            Ok(bytes.len())
+        }
+        fn flush(&mut self) -> io::Result<()> {
+            Ok(())
+        }
+    }
+
+    #[test]
+    fn each_line_opens_with_the_priority_of_its_level() {
+        let buf = Buf(Arc::new(Mutex::new(Vec::new())));
+        let writer = buf.clone();
+        let subscriber = tracing_subscriber::fmt()
+            .with_max_level(Level::DEBUG)
+            .with_ansi(false)
+            .with_writer(move || writer.clone())
+            .event_format(Prioritized(tracing_subscriber::fmt::format()))
+            .finish();
+        tracing::subscriber::with_default(subscriber, || {
+            tracing::error!("e");
+            tracing::warn!("w");
+            tracing::info!("i");
+            tracing::debug!("d");
+        });
+        let out = String::from_utf8(buf.0.lock().unwrap().clone()).unwrap();
+        let prefixes: Vec<&str> = out.lines().map(|line| &line[..3]).collect();
+        assert_eq!(prefixes, ["<3>", "<4>", "<6>", "<7>"]);
+    }
+
+    #[test]
+    fn journal_stream_must_name_the_same_file() {
+        assert!(names_stream("8:12345", 8, 12345));
+        assert!(!names_stream("8:12345", 8, 54321));
+        assert!(!names_stream("9:12345", 8, 12345));
+        assert!(!names_stream("8", 8, 12345));
+        assert!(!names_stream("", 8, 12345));
+    }
+}

crates/pdfs-cli/src/main.rs

@@ -20,6 +20,8 @@ use pdfs_core::control::{
 use pdfs_core::db::Db;
 use pdfs_core::service;
 
+mod journal;
+
 /// `println!` for this binary, shadowing std's, which panics when stdout is
 /// closed: `pdfs ls | head` ended in a "Broken pipe" panic once `head` had its
 /// lines. This one hands the failure to [`stdout_written`] instead.
@@ -879,15 +881,22 @@ fn cli_error(kind: ErrorKind, message: &str) -> String {
 }
 
 fn main() -> Result<()> {
-    tracing_subscriber::fmt()
-        .with_env_filter(
-            tracing_subscriber::EnvFilter::try_from_default_env()
-                // `pgp` logs a benign WARN when it re-serializes a Proton secret-key
-                // packet with a longer (but equivalent) length encoding than the
-                // original; drop it to error so normal runs stay quiet.
-                .unwrap_or_else(|_| "info,pgp=error".into()),
-        )
-        .init();
+    let filter = tracing_subscriber::EnvFilter::try_from_default_env()
+        // `pgp` logs a benign WARN when it re-serializes a Proton secret-key
+        // packet with a longer (but equivalent) length encoding than the
+        // original; drop it to error so normal runs stay quiet.
+        .unwrap_or_else(|_| "info,pgp=error".into());
+    if journal::stdout_is_journal() {
+        // journalctl colours lines by the priority the prefix gives them, so
+        // the escape codes would only be noise in the stored text.
+        tracing_subscriber::fmt()
+            .with_env_filter(filter)
+            .with_ansi(false)
+            .event_format(journal::Prioritized(tracing_subscriber::fmt::format()))
+            .init();
+    } else {
+        tracing_subscriber::fmt().with_env_filter(filter).init();
+    }
 
     let cli = Cli::parse();
     JSON_OUTPUT.store(cli.json, std::sync::atomic::Ordering::Relaxed);

crates/pdfs-fuse/src/devices.rs

@@ -989,9 +989,15 @@ impl Core {
                     .db
                     .sync_entries(id)
                     .map_err(|e| SwitchBlocked::Failed(format!("db: {e:?}")))?;
-                if let Some(reason) =
-                    sync::mirror_tree_unsynced(&local, &baseline, &self.ignore_rules(&local))
-                {
+                let rules = self.ignore_rules(&local);
+                // Emptied before any pass saw it, the folder is still `idle`, and
+                // the check below would refuse the switch for good. The push pass
+                // of a queued switch forgets those paths instead (`docs/BUGS.md`
+                // B255).
+                if sync::mirror_tree_gone(&local, &baseline, &rules) {
+                    return Err(SwitchBlocked::NotNow);
+                }
+                if let Some(reason) = sync::mirror_tree_unsynced(&local, &baseline, &rules) {
                     return Err(SwitchBlocked::Failed(format!(
                         "going online-only would delete what is only on this computer: {reason}"
                     )));

crates/pdfs-fuse/src/sim/daemon.rs

@@ -3002,4 +3002,69 @@ mod tests {
         assert!(matches!(daemon.stop(), Ok(MountOutcome::Shutdown)));
         let _ = std::fs::remove_dir_all(&dir);
     }
+
+    /// Emptied before any pass saw it, the folder is still `idle`, and the
+    /// switch was refused for good: every path read as "deleted here but not on
+    /// Proton Drive yet" (B255, found by the account run).
+    #[test]
+    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse sim:: -- --ignored`"]
+    fn a_folder_emptied_before_any_pass_still_goes_on_demand() {
+        let drive = FakeDrive::new();
+        let dir = scratch("ondemand-emptied-idle");
+        let daemon = Daemon::start(&dir, drive.client(1, Faults::lan())).unwrap();
+        let local = dir.join("docs");
+        let id = sync_folder(&daemon, &local, "mirror");
+        std::fs::create_dir(local.join("sub")).unwrap();
+        std::fs::write(local.join("sub/a.txt"), b"alpha").unwrap();
+        std::fs::write(local.join("sub/b.txt"), b"beta").unwrap();
+        daemon.request(&Request::SyncNow { id: Some(id) }).unwrap();
+        let on_drive = |name: &str, content: &[u8]| {
+            drive.tree().iter().any(|(path, entry)| {
+                path.ends_with(name) && *entry == Entry::File(Arc::new(content.to_vec()))
+            })
+        };
+        assert!(
+            wait_until(Duration::from_secs(30), || on_drive("sub/a.txt", b"alpha")
+                && on_drive("sub/b.txt", b"beta")
+                && listed_folder(&daemon, id).is_some_and(|f| f.state == "idle")),
+            "the folder synced: {:?}",
+            listed_folder(&daemon, id)
+        );
+
+        // In one rename, so no pass sees half of it, and asked at once, well
+        // inside the watcher's debounce, so no pass sees it empty either.
+        std::fs::rename(local.join("sub"), dir.join("moved-away")).unwrap();
+        let asked = daemon.request(&Request::SetSyncFolderMode {
+            id,
+            mode: "ondemand".into(),
+        });
+        assert!(
+            matches!(asked, Ok(Response::Ok { .. })),
+            "the switch was refused: {asked:?}"
+        );
+        assert!(
+            listed_folder(&daemon, id)
+                .is_some_and(|f| f.pending_mode.as_deref() == Some("ondemand")),
+            "the switch waits for a pass: {:?}",
+            listed_folder(&daemon, id)
+        );
+
+        assert!(
+            wait_until(Duration::from_secs(30), || listed_folder(&daemon, id)
+                .is_some_and(|f| f.mode == "ondemand" && f.pending_mode.is_none())
+                && is_mounted(&local)),
+            "the queued switch landed: {:?}",
+            listed_folder(&daemon, id)
+        );
+        assert_eq!(std::fs::read(local.join("sub/a.txt")).unwrap(), b"alpha");
+        assert_eq!(std::fs::read(local.join("sub/b.txt")).unwrap(), b"beta");
+        assert!(
+            on_drive("sub/a.txt", b"alpha") && on_drive("sub/b.txt", b"beta"),
+            "nothing was trashed on Drive: {:?}",
+            drive.tree().keys().collect::<Vec<_>>()
+        );
+
+        assert!(matches!(daemon.stop(), Ok(MountOutcome::Shutdown)));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
 }

crates/pdfs-fuse/src/sync.rs

@@ -2253,6 +2253,27 @@ pub(crate) fn mirror_tree_unsynced(
         .map(|r| format!("{r} was deleted here but not on Proton Drive yet"))
 }
 
+/// Whether a mirror folder's local copy is gone in full: the folder is still
+/// there, but not one tracked path of its baseline is.
+///
+/// [`mirror_tree_unsynced`] reads that as deletions not carried up yet, which
+/// would refuse the switch to on-demand for good. It is the wipe guard's case
+/// instead, which the push pass a queued switch runs settles without trashing
+/// anything on Drive (#46), so the switch waits for that pass.
+pub(crate) fn mirror_tree_gone(
+    root: &Path,
+    baseline: &HashMap<String, StoredSyncEntry>,
+    rules: &IgnoreRules,
+) -> bool {
+    let tracked = filter_baseline(baseline, rules);
+    root.is_dir()
+        && !tracked.is_empty()
+        && tracked.keys().all(|rel| {
+            std::fs::symlink_metadata(root.join(rel_to_path(rel)))
+                .is_err_and(|e| e.kind() == std::io::ErrorKind::NotFound)
+        })
+}
+
 /// The walk behind both checks. `rules`, when given, only names an ignored
 /// path as such in the reason; it is still something only this disk has.
 fn unsynced_local(
@@ -3538,6 +3559,26 @@ mod tests {
         assert!(reason.unwrap().contains("link"));
     }
 
+    /// Emptied before any pass saw it, the folder waits for the push pass that
+    /// forgets those paths, instead of being refused for good (B255).
+    #[test]
+    fn only_a_local_copy_gone_in_full_counts_as_gone() {
+        let (root, baseline) = synced_subtree("evict-gone");
+        let rules = rules_for(&[]);
+        let whole = mirror_tree_gone(&root, &baseline, &rules);
+        std::fs::remove_dir_all(root.join("dir/sub")).unwrap();
+        let partly = mirror_tree_gone(&root, &baseline, &rules);
+        std::fs::remove_dir_all(root.join("dir")).unwrap();
+        let emptied = mirror_tree_gone(&root, &baseline, &rules);
+        let none_synced = mirror_tree_gone(&root, &HashMap::new(), &rules);
+        std::fs::remove_dir_all(&root).unwrap();
+        let no_root = mirror_tree_gone(&root, &baseline, &rules);
+        assert!(!whole && !partly, "a deletion with survivors is a real one");
+        assert!(emptied);
+        assert!(!none_synced, "an empty baseline has nothing to lose");
+        assert!(!no_root, "a missing folder is the pass's error to report");
+    }
+
     /// The same rule one level up: if the sync root itself cannot be read, the
     /// pass sees nothing, and "nothing" must never mean "delete everything".
     #[test]

docs/BUGS.md

@@ -68,6 +68,21 @@ original wording.
 
 | Entry | Title | What is left |
 |---|---|---|
+| [B273](#b273--a-restore-proposes-another-computers-paths-when-the-two-share-a-hostname) | A restore proposes another computer's paths when the two share a hostname | Not fixed |
+| [B272](#b272--after-a-folder-is-removed-and-added-again-its-file-events-go-to-the-old-id) | After a folder is removed and added again, its file events go to the old id | Not fixed |
+| [B271](#b271--one-failed-listing-makes-a-large-first-sync-start-over-from-nothing) | One failed listing makes a large first sync start over from nothing | Not fixed |
+| [B270](#b270--one-file-left-in-a-mirror-folder-clears-the-wipe-guard-for-all-the-others) | One file left in a mirror folder clears the wipe guard for all the others | Not fixed |
+| [B269](#b269--a-restore-that-skipped-every-folder-reports-success) | A restore that skipped every folder reports success | Not fixed |
+| [B268](#b268--pdfs-diagnose-says-no-problems-found-while-sync-is-stuck) | `pdfs diagnose` says "No problems found" while sync is stuck | Not fixed |
+| [B267](#b267--a-key-failure-at-a-start-from-a-warm-cache-shows-as-offline-for-good) | A key failure at a start from a warm cache shows as offline for good | Not fixed |
+| [B266](#b266--pin-unpin-search-and-node-loads-report-a-database-error-as-offline) | Pin, unpin, search and node loads report a database error as "offline" | Not fixed |
+| [B265](#b265--address-keys-whose-token-is-for-an-inactive-account-key-never-open) | Address keys whose token is for an inactive account key never open | Needs an SDK change; not reproduced |
+| [B264](#b264--a-mount-that-fails-after-starting-its-workers-leaves-them-running) | A mount that fails after starting its workers leaves them running | Not fixed |
+| [B263](#b263--a-mount-that-can-never-succeed-retries-every-5-s-and-tells-only-the-journal) | A mount that can never succeed retries every 5 s and tells only the journal | Not fixed |
+| [B262](#b262--watching-a-large-synced-folder-holds-up-the-sync-engine-and-a-failed-watch-is-never-retried) | Watching a large synced folder holds up the sync engine, and a failed watch is never retried | Not fixed |
+| [B261](#b261--a-folder-that-has-never-synced-reads-up-to-date) | A folder that has never synced reads "up to date" | Not fixed |
+| [B260](#b260--the-poll-pushes-a-new-folders-first-sync-behind-every-other-folder) | The poll pushes a new folder's first sync behind every other folder | Not fixed |
+| [B259](#b259--the-sync-engine-can-die-or-hang-and-nothing-shows-it-until-a-restart) | The sync engine can die or hang, and nothing shows it until a restart | Not fixed; the trigger in #53 is not known |
 | [B134](#b134--a-file-deleted-online-while-the-drain-checks-its-write-is-kept-as-a-conflict-copy) | A file deleted online while the drain checks its write is kept as a conflict copy | Only with `local_first` off |
 | [B91](#b91--the-daemon-hung-overnight-and-nothing-could-say-what-it-was-waiting-on) | The daemon hung overnight, and nothing could say what it was waiting on | The cause is not diagnosed; the daemon now reports where it is stuck and is restarted |
 | [B67](#b67--fresh-state-restore-can-silently-select-a-new-device-high-22) | Fresh-state restore can silently select a new device (HIGH-22) | An ambiguous device after a loss of local state is not asked about |
@@ -100,6 +115,7 @@ a live account since.
 
 | Entry | Title |
 |---|---|
+| [B258](#b258--journalctl--p-warning-shows-nothing-whatever-the-daemon-logged) | `journalctl -p warning` shows nothing, whatever the daemon logged |
 | [B256](#b256--pdfs-copy-right-after-a-save-copies-the-old-version) | `pdfs copy` right after a save copies the old version |
 | [B255](#b255--a-synced-folder-whose-files-are-all-gone-here-is-stuck-for-good) | A synced folder whose files are all gone here is stuck for good |
 | [B254](#b254--an-edit-in-the-same-second-as-a-new-upload-never-arrives) | An edit in the same second as a new upload never arrives |
@@ -359,6 +375,368 @@ a live account since.
 
 Newest first.
 
+### B273 — A restore proposes another computer's paths when the two share a hostname
+
+**Status:** Open
+**Found:** 2026-10-31, code audit after issue #46.
+**Where:** `saved_folder` in `crates/pdfs-core/src/profile.rs`
+
+**Repro:** Two computers with the same hostname, for example both left at a distribution's
+default `archlinux`, sync the same device. Restore a folder on one of them. The proposed local
+path and mode come from whichever of the two profiles is found first, not from this computer's.
+
+**Cause.** `saved_folder` prefers the profile whose `hostname` matches. The machine id that
+B252 added tells computers apart, but this lookup does not use it.
+
+**Fix.** Not done. Match on the machine id first, then fall back to the hostname for profiles
+written before it existed.
+
+---
+
+### B272 — After a folder is removed and added again, its file events go to the old id
+
+**Status:** Open
+**Found:** 2026-10-31, code audit after issue #53.
+**Where:** `rewatch` in `crates/pdfs-fuse/src/sync/engine.rs`
+
+**Repro:** Remove a synced folder and add the same path again before the engine handles the
+first `Rewatch`, so both land in one burst. Edits in the folder are not synced until the
+two-minute poll, and the same goes for every later edit until the daemon restarts.
+
+**Cause.** `rewatch` matches the watches it has against the ones it wants by path alone. The
+path is still wanted, so the old entry stays with the removed folder's id. Its events become
+`Reconcile(old id)`, `sync_folder_get` finds no row, and the request is dropped.
+
+**Fix.** Not done. Compare `(path, id)` pairs, and update the id of a path that is still
+watched.
+
+---
+
+### B271 — One failed listing makes a large first sync start over from nothing
+
+**Status:** Open
+**Found:** 2026-10-31, code audit after issue #46: a folder of about 19,900 items restored on a
+second computer sat at `scanning…` with nothing downloaded, and the journal showed
+`RequestTimeout (http 408)`.
+**Where:** `walk_remote` in `crates/pdfs-fuse/src/sync.rs`
+
+**Repro:** Restore or add a mirror folder with tens of thousands of items on Drive, on a link
+that drops a request now and then. The pass walks the whole remote tree before it downloads
+anything. When one folder's listing fails after the SDK's retries, the pass fails, and the
+next one walks the whole tree again. On a slow enough link it never gets past the walk.
+
+**Cause.** Each `enumerate_folder_children_node_uids`, `enumerate_nodes_light` and
+`enumerate_nodes` call in the walk ends the whole walk through `?`. Nothing is applied until
+the walk is done. Files that did download keep their baseline rows, so only the walk is lost,
+but on a first sync that is all of it. Progress is also counted only after a folder's full
+listing, so a large folder shows `scanning…` with 0 checked for a long time.
+
+**Fix.** Not done. Record a failed subtree as a gap, as undecryptable nodes already are: no
+deletions under it, and the rest of the pass still applies.
+
+---
+
+### B270 — One file left in a mirror folder clears the wipe guard for all the others
+
+**Status:** Open
+**Found:** 2026-10-31, code audit after issue #46, whose reporter emptied a synced folder
+several times.
+**Where:** `guard_local_wipe` and `guard_remote_wipe` in `crates/pdfs-fuse/src/sync/planner.rs`
+
+**Repro:** Sync a mirror folder with many files. Make all of them but one unavailable here: a
+half-mounted disk, a restored backup that brought back one file, or a script that emptied the
+folder and wrote one file back. The next pass trashes every other file on Drive. On a device
+that two computers sync, the other computer then deletes its copies too.
+
+**Cause.** The guard refuses a pass only when every baseline path is missing. One surviving
+path is enough to clear it, so it guards against an empty folder and nothing short of that.
+The remote guard has the same shape.
+
+**Fix.** Not done. Also refuse when most of a large baseline is missing at once, and leave the
+choice to the user: delete on the other side, or sync from scratch.
+
+---
+
+### B269 — A restore that skipped every folder reports success
+
+**Status:** Open
+**Found:** 2026-10-31, code audit after issue #46: the journal showed `restore complete
+restored=0 skipped=1` several times, and the user saw nothing.
+**Where:** the `RestoreSyncFolders` and `RestoreDeviceFolders` handler in
+`crates/pdfs-fuse/src/control.rs`; `restore_sync_folders` in `crates/pdfs-fuse/src/profile.rs`
+
+**Repro:** Restore a folder from another computer to a path that is already a sync root here,
+for example a folder left over from an earlier attempt. `pdfs devices join` prints `restoring
+folders`, and the app shows the same. Nothing downloads, and no error appears anywhere.
+
+**Cause.** The daemon acks before it works, because a restore outlasts the socket timeout. The
+result, `restored 0 folder(s); skipped: …`, is then logged as a successful activity, so the
+reason is only in the activity text and the journal. When the database insert fails partway,
+the `?` also skips the `Rewatch` for the folders already restored.
+
+**Fix.** Not done. Log a restore that skipped folders as a failure, name the reason in the app
+and the CLI, and offer to replace or reset the folder in the way. Send the `Rewatch` on every
+exit path.
+
+---
+
+### B268 — `pdfs diagnose` says "No problems found" while sync is stuck
+
+**Status:** Open
+**Found:** 2026-10-31, issue #53: a folder that never synced, and `diagnose` found nothing.
+**Where:** `diagnose` in `crates/pdfs-cli/src/main.rs`
+
+**Repro:** Leave a synced folder in `error`, or have queued writes that keep failing, or pause
+sync. `pdfs diagnose` reports every check `[ok]` and exits 0.
+
+**Cause.** The `Status` reply is matched with `..`, which drops `failing_ops`, `failing_error`,
+`parked_uploads`, `staged_oldest_secs` and `paused`. `diagnose` never asks for the synced
+folders or for `Diagnostics`, so a folder in error and a stalled worker are not seen. A
+control socket file with no daemon behind it is also reported `[ok]`; only the next line says
+the daemon does not answer.
+
+**Fix.** Not done. Warn on failing or parked writes, a pause, old staged data and folders in
+error, and report the sync engine's state once B259 exposes it.
+
+---
+
+### B267 — A key failure at a start from a warm cache shows as offline for good
+
+**Status:** Open
+**Found:** 2026-10-31, code audit after issue #40. B202 fixed the same path for a refused
+session only.
+**Where:** `fetch_or_recall_root` in `crates/pdfs-fuse/src/mount.rs`; `run_online_probe` in
+`crates/pdfs-fuse/src/link.rs`
+
+**Repro:** Sign in once so the cache holds the My Files root. Then start the daemon in a state
+where the root cannot be decrypted, for example the address-key failure of B265. The mount
+comes up "offline", the app says you are offline, and it stays so while the network is fine.
+
+**Cause.** Any error from `get_my_files_folder` other than a revoked session becomes
+`Start::Offline` when a cached root exists. The online probe then retries the same call and
+logs its failures at debug level, so the journal at the default level says nothing.
+
+**Fix.** Not done. Use `Start::Offline` only for an error `is_network_error` accepts, and
+report the others as their own state through `Status`.
+
+---
+
+### B266 — Pin, unpin, search and node loads report a database error as "offline"
+
+**Status:** Open
+**Found:** 2026-10-31, code audit after issue #38. B205 fixed the photo upload path only.
+**Where:** `CoreError::from_api` in `crates/pdfs-core/src/error.rs`; its callers in
+`crates/pdfs-fuse/src/lib.rs` (`pin`, `unpin`, the searches, `load node`)
+
+**Repro:** Pin a folder while the cache database is locked or full. The app says "You're
+offline" and drops the reason.
+
+**Cause.** `from_api` classifies any error that is not a `ProtonError` as `Offline`, because
+it was written for SDK calls, where that means a transport error. These callers pass it
+`pdfs_core::Error` values from the cache and the database. A `ProtonError` wrapped in
+`pdfs_core::Error::Proton` also misses the downcast, since the source chain is not walked.
+
+**Fix.** Not done. Use `CoreError::internal` at the database callers, and walk the source
+chain in `from_api` before falling back.
+
+---
+
+### B265 — Address keys whose token is for an inactive account key never open
+
+**Status:** Open
+**Found:** 2026-10-31, code audit after issue #40: a Duo account whose mount failed on every
+start with `fetch My Files root: cryptography error: failed to decrypt: missing key`, after three
+`failed to decrypt address key token` warnings. The web app worked. B210's fix does not apply,
+because the account has an active volume.
+**Where:** `user_keys` and `decrypt_address` in `proton-sdk` (`crates/proton-sdk/src/account.rs`
+in `proton-sdk-rs`)
+
+**Repro:** Not reproduced. An account whose address-key tokens are encrypted to an account key
+that is no longer active cannot open those address keys, and so cannot open the My Files share.
+
+**Cause.** `user_keys` skips every inactive account key, even one the password opens, and the
+address-key tokens are decrypted only with what it returns. `keycheck.rs` in this repository
+already reports "token is for inactive account key", so the case is known. Separately,
+`addresses()` fails as a whole through `?` when one address has no usable primary key, which
+takes the working addresses down with it.
+
+**Fix.** Not done, and it belongs in the SDK. Use every account key that opens for decrypting
+tokens, and only the active ones for signing. Skip and log an address that cannot be opened.
+
+---
+
+### B264 — A mount that fails after starting its workers leaves them running
+
+**Status:** Open
+**Found:** 2026-10-31, code audit after issue #40.
+**Where:** `run_mount` in `crates/pdfs-fuse/src/mount.rs`
+
+**Repro:** Make the mount fail after the workers start: a busy mountpoint, or a control socket
+whose permissions cannot be set. The daemon retries every 5 s, and the drain, sync, sweep,
+probe and index threads of the failed attempt keep running beside the next one.
+
+**Cause.** The early returns after the workers are spawned (the `?` on the socket bind, the
+permission check, a `spawn_session` error, and a `?` on a later thread spawn) skip
+`stop_workers`. The threads hold a `Core`, and the `Core` holds the database. If that keeps
+the `flock` held, every later attempt fails with "another daemon is using cache.db" instead
+of the real error. That part is inferred from the code and not observed.
+
+**Fix.** Not done. Bind the socket and check the mountpoint before any worker starts, and stop
+the workers on every error path.
+
+---
+
+### B263 — A mount that can never succeed retries every 5 s and tells only the journal
+
+**Status:** Open
+**Found:** 2026-10-31, issue #40: the app showed "Connecting… waiting for the Proton Drive
+service" for days, `pdfs diagnose` only reported the control socket missing, and the reporter
+uninstalled.
+**Where:** the mount loop in `crates/pdfs-cli/src/main.rs`; `run_mount` in
+`crates/pdfs-fuse/src/mount.rs`
+
+**Repro:** Start the daemon with a session whose keys cannot open My Files (B265). The journal
+shows `mount failed; retrying in 5s` forever. The app and the tray wait for the service, and
+nothing says why.
+
+**Cause.** Every mount error gets the same 5 s retry, whether it is a network error or one that
+no retry fixes, such as a key or a 4xx answer. Each attempt builds a new client and sends about
+four requests, so a broken account sends tens of thousands a day, which may also feed
+Proton's sign-in blocks (#39). The control socket is bound only after the mount succeeds, and
+the error is written nowhere a front end can read it.
+
+**Fix.** Not done. Back off exponentially, treat key, `KeysLocked` and 4xx errors as permanent
+with a long back-off, and write the last error where the app, the tray and `diagnose` can
+show it (a state file, and `STATUS=` to systemd).
+
+---
+
+### B262 — Watching a large synced folder holds up the sync engine, and a failed watch is never retried
+
+**Status:** Open
+**Found:** 2026-10-31, code audit after issue #53.
+**Where:** `rewatch` and `engine_loop` in `crates/pdfs-fuse/src/sync/engine.rs`
+
+**Repro:** Add a synced folder with many subfolders, or one that holds a symlink to a large
+tree, on a system near `fs.inotify.max_user_watches`. The new folder's first pass waits until
+the recursive watch is set up. When the watch fails, the journal has one `sync: watch failed`
+line, the folder is never watched, and later changes are found only by the two-minute poll.
+
+**Cause.**
+- `rewatch` runs on the engine thread before the reconcile, and notify's recursive watch walks
+  the whole tree, at startup for every folder.
+- notify follows symlinks by default, and the local walk does not.
+- When `watch` fails partway, the watches added before the failure stay registered, but the
+  folder is not recorded as watched. Their events match no folder and become `ReconcileAll`,
+  and they use up watches the next folder needs.
+- Errors the watcher reports later are dropped in its callback.
+
+**Fix.** Not done. Reconcile first, unwatch after a partial failure and retry with a back-off,
+turn off symlink following, and show a watch failure in the folder's state.
+
+---
+
+### B261 — A folder that has never synced reads "up to date"
+
+**Status:** Open
+**Found:** 2026-10-31, issue #53: "In Computers I add the folder. It appears as synced."
+**Where:** `sync_folder` in `crates/pdfs-core/src/db/migrations.rs`; `sync_state_label` in
+`crates/pdfs-gui/src/app/pages/devices.rs`; the location rows in
+`crates/pdfs-gui/src/app/pages/locations.rs`
+
+**Repro:** Add a synced folder. Until its first pass starts, the app shows it as up to date.
+The same happens after a switch from on-demand to mirror, after **Sync From Scratch…**, and for
+every folder while sync is paused for the whole account.
+
+**Cause.** The `state` column defaults to `idle`, and every state the label does not know reads
+"up to date". `last_sync` is 0 for a folder that has never synced, but the rows do not look at
+it, and a test pins the label for that case. The rows only show a folder's own pause, not the
+account-wide one.
+
+**Fix.** Not done. Show "waiting for first sync" when `last_sync` is 0, and show the
+account-wide pause on the folder rows.
+
+---
+
+### B260 — The poll pushes a new folder's first sync behind every other folder
+
+**Status:** Open
+**Found:** 2026-10-31, code audit after issue #53.
+**Where:** `engine_loop` in `crates/pdfs-fuse/src/sync/engine.rs`
+
+**Repro:** Sync a few large mirror folders whose passes take longer than two minutes, then add
+another folder. Its first pass waits until every other folder has been walked again, each
+time.
+
+**Cause.** The poll sends `ReconcileAll` every two minutes whether or not a pass is still
+running. When a burst holds both a `ReconcileAll` and a folder's `Reconcile(id)`, the loop runs
+only `reconcile_all`, which goes in id order. A new folder has the highest id, so it always
+goes last.
+
+**Fix.** Not done. Run the folders asked for by id before the rest, and don't queue a poll
+while a pass runs.
+
+---
+
+### B259 — The sync engine can die or hang, and nothing shows it until a restart
+
+**Status:** Open
+**Found:** 2026-10-31, issue #53: a newly added folder did not sync until the reporter restarted
+the app. All FUSE workers were idle, nothing was queued, and the warning-level journal was
+empty (B258).
+**Where:** `spawn` and `engine_loop` in `crates/pdfs-fuse/src/sync/engine.rs`;
+`reconcile_pass` in `crates/pdfs-fuse/src/sync.rs`; `crates/pdfs-fuse/src/diagnostics.rs`
+
+**Repro:** Not reproduced. Make one pass panic, or block in a call that does not return. Every
+later add, `pdfs sync now`, file event and poll is dropped without a word. The folder that was
+syncing stays `syncing` with its last progress. A restart runs a pass over every folder, which
+is why it helps.
+
+**Cause.**
+- The engine is one thread, and nothing catches a panic in a pass. When it unwinds, the
+  receiver is gone and every `let _ = sync_tx.send(..)` fails silently. The poll thread stops
+  at its first failed send.
+- The thread's `JoinHandle` is checked only at shutdown.
+- A pass has no overall deadline. Each request is bounded, but a pass is not; B165 dealt with
+  the stop only.
+- Nothing logs a pass starting, or ending without changes. `Diagnostics` covers the FUSE
+  workers and the request queue, not this thread, so "workers idle, nothing queued" says
+  nothing about sync.
+- A database error when the engine reads a folder drops that folder's request without a log.
+
+**Fix.** Not done. Catch a panic per pass, end its progress and set the folder to `error`. Have
+the supervisor restart a finished engine thread. Log passes at info, and report the folder,
+the pass age and the queue in `Diagnostics`.
+
+---
+
+### B258 — `journalctl -p warning` shows nothing, whatever the daemon logged
+
+**Status:** Fixed, not verified live
+**Found:** 2026-10-31, issue #53: the reporter ran `journalctl --user -u proton-drive.service -b
+-p warning`, as `docs/TROUBLESHOOTING.md` tells them to, and got `-- No entries --`.
+**Where:** `main` in `crates/pdfs-cli/src/main.rs`; `packaging/proton-drive.service`
+
+**Repro:** Make the daemon log a warning, then run the command above. It prints no entries.
+Without `-p` the warning is there.
+
+**Cause.** The daemon logs with plain `tracing_subscriber::fmt()` to standard output. journald
+stores every line of a service's output at the unit's default priority, info, unless the line
+starts with a `<N>` prefix. So every `WARN` and `ERROR` line is stored as info, and the
+troubleshooting guide's filter hides all of them.
+
+**Fix.** When standard output is the journal stream (`JOURNAL_STREAM` names the same
+device and inode as fd 1), each line starts with the `<N>` prefix for its level, and ANSI colours
+are off. A terminal that merely inherited `JOURNAL_STREAM` keeps the plain format
+(`crates/pdfs-cli/src/journal.rs`).
+
+**Test:** `each_line_opens_with_the_priority_of_its_level` and
+`journal_stream_must_name_the_same_file` in `pdfs-cli`. On 2026-10-31, `pdfs diagnose` run with
+`RUST_LOG=debug` under `systemd-run --user -p StandardOutput=journal` stored its debug lines at
+`PRIORITY=7` and its report at 6.
+
+---
+
 ### B256 — `pdfs copy` right after a save copies the old version
 
 **Status:** Fixed, not verified live
@@ -402,14 +780,20 @@ folder lost its files is not known yet.
 
 **Fix.** The push pass for a switch to on-demand forgets the baseline rows of a local copy that
 is gone in full, instead of trashing them on Drive, so the switch goes ahead and the mount shows
-what Drive has. **Sync From Scratch…** in the app and `pdfs sync reset ID` clear a mirror
+what Drive has. A switch asked for before any pass saw the folder empty found it still `idle`,
+and the check for what only this computer has refused it at once: every path read as "deleted
+here but not on Proton Drive yet". The account run found that. Such a switch now waits for the
+same push pass (`mirror_tree_gone` in `crates/pdfs-fuse/src/sync.rs`, checked in
+`apply_sync_folder_mode`). **Sync From Scratch…** in the app and `pdfs sync reset ID` clear a mirror
 folder's baseline, so the next pass compares both sides as on the first sync: one-sided files
 are copied across, files that differ keep both versions, and nothing is deleted. Restore now
 logs why it skipped a folder.
 
 **Test:** The simulations `a_folder_whose_local_copy_is_gone_still_goes_on_demand` (which
-failed in exactly the reported state before the fix) and
-`a_folder_whose_local_copy_is_gone_downloads_again_after_a_reset`.
+failed in exactly the reported state before the fix),
+`a_folder_emptied_before_any_pass_still_goes_on_demand` (which failed with the account run's
+error) and `a_folder_whose_local_copy_is_gone_downloads_again_after_a_reset`; the acceptance case
+"an emptied mirror folder switches to on-demand".
 
 ---
 
@@ -1517,6 +1901,8 @@ what it holds. What was synced in it is still deleted.
 ### B210 — After a password reset, the mount retries "missing key" forever
 
 **Status:** Fixed, not verified live
+**See also:** B265. The account in issue #40 has an active volume, so this fix does not run for
+it; its "missing key" comes from address keys that do not open.
 **Found:** 2026-10-15, issue #40: on a fresh 3.4.0 install the sign-in worked, but the daemon
 logged `mount failed: fetch My Files root: cryptography error: failed to decrypt: missing key`
 every 5 seconds. The app stayed on "Connecting…" because the daemon never got far enough to
@@ -1662,6 +2048,7 @@ front-end is the stale one, and restarting the service would not help.
 ### B205 — A photo upload the SDK refuses says "You're offline"
 
 **Status:** Fixed, not verified live
+**See also:** B266, the same misclassification on the pin, unpin, search and node-load paths.
 **Found:** 2026-10-11, issue #38: uploading an image from the Photos page showed "You're offline"
 while other uploads went through. Each `upload_photo` failed about 5 µs after it started, with no
 request sent, and the journal gave no reason.
@@ -1746,6 +2133,7 @@ taken as this session's, so the daemon keeps writing its later rotations.
 ### B202 — A refused session shows as offline forever, and nothing says to sign in again
 
 **Status:** Fixed, not verified live
+**See also:** B267. Other errors at a start from a warm cache still mount as offline.
 **Found:** 2026-10-09, issue #35: the tray and `pdfs diagnose` said "offline, 3 queued", and
 diagnose also said "keyring session: ok", while every call in the log failed with
 `InvalidRefreshToken (http 400)`. `pdfs sync now` and restarting the service changed nothing.
@@ -2687,6 +3075,8 @@ fix).
 ### B165 — A stop waits on a stuck thread until systemd kills the daemon
 
 **Status:** Fixed (unverified).
+**See also:** B259. A pass still has no deadline while the daemon runs, and a stuck or dead
+sync engine is not reported.
 **Found:** 2026-10-04, by the account run on 2.10.0 (cleanup after on-demand pairing 2). The
 daemon was stopped at 15:53:04 and logged "control socket closing", but never "sync engine
 stopping" or "daemon stopping". systemd killed it 15 s later (`TimeoutStopSec`). The run's

docs/CHANGELOG.md

@@ -70,9 +70,10 @@ Schema: **44**, unchanged.
 
 - **A synced folder whose files were all gone from this computer no longer gets stuck** (#46).
   The sync still refuses to delete everything on Proton Drive, but a switch to online only now
-  goes ahead and shows what Proton Drive has, instead of waiting for good. To download the
-  files again instead, sync the folder from scratch. Restoring folders also logs why it
-  skipped a folder.
+  goes ahead and shows what Proton Drive has, instead of waiting for good. This includes a
+  switch asked for right after the files went, which was refused with "… was deleted here but
+  not on Proton Drive yet". To download the files again instead, sync the folder from scratch.
+  Restoring folders also logs why it skipped a folder.
 
 - **The first sync of a folder shows how far its scan got** (#46). Before anything downloads,
   the first pass reads every item on Proton Drive, which takes many minutes for a large folder.

packaging/aur/proton-drive-for-linux-bin/.SRCINFO

@@ -1,6 +1,6 @@
 pkgbase = proton-drive-for-linux-bin
 	pkgdesc = Unofficial Proton Drive client: FUSE files-on-demand mount, CLI, GTK4 app, tray (binaries)
-	pkgver = 3.5.0
+	pkgver = 3.6.0
 	pkgrel = 1
 	url = https://proton-drive.narl.io
 	install = proton-drive.install
@@ -22,21 +22,21 @@ pkgbase = proton-drive-for-linux-bin
 	optdepends = xdg-utils: "Open folder" action in the tray menu
 	optdepends = fzf: search-as-you-type launcher (pdfs-prompt --fzf)
 	optdepends = foot: terminal that hosts pdfs-prompt --fzf when started from a keybinding
-	provides = proton-drive-for-linux=3.5.0
-	provides = proton-drive-linux=3.5.0
+	provides = proton-drive-for-linux=3.6.0
+	provides = proton-drive-linux=3.6.0
 	provides = pdfs
 	conflicts = proton-drive-linux
 	conflicts = proton-drive-for-linux
 	conflicts = proton-drive-for-linux-git
 	options = !strip
 	options = !debug
-	source = proton-drive-linux-3.5.0-x86_64.tar.gz::https://github.com/narrrl/proton-drive-linux/releases/download/v3.5.0/proton-drive-linux-3.5.0-x86_64.tar.gz
-	source = io.narl.proton-drive-linux-3.5.0.desktop::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.5.0/packaging/io.narl.proton-drive-linux.desktop
-	source = io.narl.proton-drive-linux-tray-3.5.0.desktop::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.5.0/packaging/io.narl.proton-drive-linux-tray.desktop
-	source = io.narl.proton-drive-linux-3.5.0.svg::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.5.0/packaging/io.narl.proton-drive-linux.svg
-	source = proton-drive-3.5.0.service::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.5.0/packaging/proton-drive.service
-	source = LICENSE-3.5.0::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.5.0/LICENSE
-	sha256sums = 902f60de5f471cb15c84d0ecb29cb4644a0ac52ce36d2be54c16b4befeba8de0
+	source = proton-drive-linux-3.6.0-x86_64.tar.gz::https://github.com/narrrl/proton-drive-linux/releases/download/v3.6.0/proton-drive-linux-3.6.0-x86_64.tar.gz
+	source = io.narl.proton-drive-linux-3.6.0.desktop::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.6.0/packaging/io.narl.proton-drive-linux.desktop
+	source = io.narl.proton-drive-linux-tray-3.6.0.desktop::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.6.0/packaging/io.narl.proton-drive-linux-tray.desktop
+	source = io.narl.proton-drive-linux-3.6.0.svg::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.6.0/packaging/io.narl.proton-drive-linux.svg
+	source = proton-drive-3.6.0.service::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.6.0/packaging/proton-drive.service
+	source = LICENSE-3.6.0::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.6.0/LICENSE
+	sha256sums = 8e9b76b0df238af1c8978c33b4c27c0c548e1faa81b368d0d271ed564d0a76c7
 	sha256sums = d190d6771fff0b975271fb62fd3fb0fa8bbf17d7278c10853c18557855b0c123
 	sha256sums = 1d95e250370220e3bb6aead6ce34d1d6cc759f42c4803b75f1667e78ff47c6c0
 	sha256sums = e598a93c2715c3a9fdc7fb937902083d4a1135e8fbdfe6fe7e37f0383ebbd828

packaging/aur/proton-drive-for-linux-bin/PKGBUILD

@@ -1,7 +1,7 @@
 # Maintainer: Nils Pukropp <contact@narl.io>
 
 pkgname=proton-drive-for-linux-bin
-pkgver=3.5.0
+pkgver=3.6.0
 pkgrel=1
 pkgdesc="Unofficial Proton Drive client: FUSE files-on-demand mount, CLI, GTK4 app, tray (binaries)"
 arch=('x86_64')
@@ -36,7 +36,7 @@ source=("proton-drive-linux-$pkgver-x86_64.tar.gz::$_repo/releases/download/$_ta
         "io.narl.proton-drive-linux-$pkgver.svg::$_raw/packaging/io.narl.proton-drive-linux.svg"
         "proton-drive-$pkgver.service::$_raw/packaging/proton-drive.service"
         "LICENSE-$pkgver::$_raw/LICENSE")
-sha256sums=('902f60de5f471cb15c84d0ecb29cb4644a0ac52ce36d2be54c16b4befeba8de0'
+sha256sums=('8e9b76b0df238af1c8978c33b4c27c0c548e1faa81b368d0d271ed564d0a76c7'
             'd190d6771fff0b975271fb62fd3fb0fa8bbf17d7278c10853c18557855b0c123'
             '1d95e250370220e3bb6aead6ce34d1d6cc759f42c4803b75f1667e78ff47c6c0'
             'e598a93c2715c3a9fdc7fb937902083d4a1135e8fbdfe6fe7e37f0383ebbd828'

packaging/aur/proton-drive-for-linux-git/.SRCINFO

@@ -1,6 +1,6 @@
 pkgbase = proton-drive-for-linux-git
 	pkgdesc = Unofficial Proton Drive client: FUSE files-on-demand mount, CLI, GTK4 app, tray (git)
-	pkgver = 3.5.0.r0.geb25c16
+	pkgver = 3.6.0.r0.g2720191
 	pkgrel = 1
 	url = https://proton-drive.narl.io
 	install = proton-drive.install
@@ -25,8 +25,8 @@ pkgbase = proton-drive-for-linux-git
 	optdepends = xdg-utils: "Open folder" action in the tray menu
 	optdepends = fzf: search-as-you-type launcher (pdfs-prompt --fzf)
 	optdepends = foot: terminal that hosts pdfs-prompt --fzf when started from a keybinding
-	provides = proton-drive-for-linux=3.5.0.r0.geb25c16
-	provides = proton-drive-linux=3.5.0.r0.geb25c16
+	provides = proton-drive-for-linux=3.6.0.r0.g2720191
+	provides = proton-drive-linux=3.6.0.r0.g2720191
 	provides = pdfs
 	conflicts = proton-drive-linux
 	conflicts = proton-drive-for-linux

packaging/aur/proton-drive-for-linux-git/PKGBUILD

@@ -1,7 +1,7 @@
 # Maintainer: Nils Pukropp <contact@narl.io>
 
 pkgname=proton-drive-for-linux-git
-pkgver=3.5.0.r0.geb25c16
+pkgver=3.6.0.r0.g2720191
 pkgrel=1
 pkgdesc="Unofficial Proton Drive client: FUSE files-on-demand mount, CLI, GTK4 app, tray (git)"
 arch=('x86_64')

packaging/aur/proton-drive-for-linux/.SRCINFO

@@ -1,6 +1,6 @@
 pkgbase = proton-drive-for-linux
 	pkgdesc = Unofficial Proton Drive client: files-on-demand FUSE mount, CLI, GTK4 app and tray
-	pkgver = 3.5.0
+	pkgver = 3.6.0
 	pkgrel = 1
 	url = https://proton-drive.narl.io
 	install = proton-drive.install
@@ -24,13 +24,13 @@ pkgbase = proton-drive-for-linux
 	optdepends = xdg-utils: "Open folder" action in the tray menu
 	optdepends = fzf: search-as-you-type launcher (pdfs-prompt --fzf)
 	optdepends = foot: terminal that hosts pdfs-prompt --fzf when started from a keybinding
-	provides = proton-drive-linux=3.5.0
+	provides = proton-drive-linux=3.6.0
 	provides = pdfs
 	conflicts = proton-drive-linux
 	conflicts = proton-drive-for-linux-bin
 	conflicts = proton-drive-for-linux-git
 	options = !lto
-	source = proton-drive-for-linux-3.5.0.tar.gz::https://github.com/narrrl/proton-drive-linux/archive/refs/tags/v3.5.0.tar.gz
-	sha256sums = 5eb0e001ec2301ffb8b2b8429e907fab32810d6eba541bf978a0ea97867d8bc9
+	source = proton-drive-for-linux-3.6.0.tar.gz::https://github.com/narrrl/proton-drive-linux/archive/refs/tags/v3.6.0.tar.gz
+	sha256sums = d9b16b1027816a379d6a11c6396d779f751a6f94becaa16b17439420f561d13d
 
 pkgname = proton-drive-for-linux

packaging/aur/proton-drive-for-linux/PKGBUILD

@@ -1,7 +1,7 @@
 # Maintainer: Nils Pukropp <contact@narl.io>
 
 pkgname=proton-drive-for-linux
-pkgver=3.5.0
+pkgver=3.6.0
 pkgrel=1
 pkgdesc="Unofficial Proton Drive client: files-on-demand FUSE mount, CLI, GTK4 app and tray"
 arch=('x86_64')
@@ -26,7 +26,7 @@ options=('!lto')
 # Stops the running daemon before removal, so the mount stops mirroring deletes.
 install=proton-drive.install
 source=("$pkgname-$pkgver.tar.gz::$_repo/archive/refs/tags/v$pkgver.tar.gz")
-sha256sums=('5eb0e001ec2301ffb8b2b8429e907fab32810d6eba541bf978a0ea97867d8bc9')
+sha256sums=('d9b16b1027816a379d6a11c6396d779f751a6f94becaa16b17439420f561d13d')
 
 _srcname="proton-drive-linux-$pkgver"
 

scripts/fuse-acceptance.py

@@ -787,7 +787,9 @@ def test_server_copy_never_copies_an_old_version(ctx: Context) -> None:
     root = ctx.root
     path = root / "being-written.txt"
     write_durable(path, b"first version")
-    dest = root / "copies"
+    # Its own folder: every case of a run shares the root, and "pdfs copy"
+    # already made "copies" there.
+    dest = root / "b256-copies"
     dest.mkdir()
     daemon.wait_for_queue()
 
@@ -4012,30 +4014,36 @@ class Janitor:
         return [
             f"{name} ({entry['uid']}) is still in the trash"
             for entry in matches
-            if not self.purge(entry["uid"], name)
+            if not self.purge(entry["uid"], name, listed=True)
         ]
 
-    def purge(self, uid: str, name: str) -> bool:
+    def purge(self, uid: str, name: str, listed: bool = False) -> bool:
         """Permanently delete one trashed node the run owns, by uid.
 
         By uid and never by name: a name can match something of the user's, a
         uid cannot. The node has to show up in the trash first, which is also
         what proves the trash step before it worked, and it has to be gone from
-        a fresh listing afterwards.
+        a fresh listing afterwards. `listed` says the caller just found it in
+        the trash.
 
         The server's own answer comes first, though: it only deletes a node
         that is in the trash, and it answers per uid. A listing is a whole-trash
         enumeration, which on a large trash can time out on every attempt and
         would otherwise keep a folder the server would delete on request.
         """
-        with contextlib.suppress(Exception):
+        last_error = ""
+        try:
             reply = self.daemon.command("delete-forever", uid, stdin="yes\n")
             if re.search(r"\bpermanently deleted 1 item", reply):
                 print(f"[cleanup] permanently deleted {name}")
                 return True
+        except Exception as error:  # noqa: BLE001 - retried, then reported
+            last_error = f": {error}"
         deadline = time.monotonic() + self.daemon.timeout
-        attempted = False
-        last_error = ""
+        # A node seen in the trash before that delete and gone after it was
+        # deleted by it, whatever it answered. Counting it as never sent kept
+        # waiting for a node that was already gone, and failed the run.
+        attempted = listed
         while True:
             try:
                 if self.daemon.trashed(uid):
@@ -4147,7 +4155,7 @@ class Janitor:
         for entry in trashed:
             if STALE_ROOT.match(entry["name"]) and entry["name"] not in live_names:
                 print(f"[reap] permanently deleting an abandoned root from the trash: {entry['name']}")
-                if not orphan.purge(entry["uid"], entry["name"]):
+                if not orphan.purge(entry["uid"], entry["name"], listed=True):
                     leftovers.append(f"{entry['name']} ({entry['uid']}) is still in the trash")
         return leftovers