release(1.8.1)

Cargo.lock

@@ -2200,6 +2200,25 @@ dependencies = [
  "system-deps",
 ]
 
+[[package]]
+name = "h2"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
 [[package]]
 name = "half"
 version = "2.7.1"
@@ -2367,6 +2386,7 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-core",
+ "h2",
  "http",
  "http-body",
  "httparse",
@@ -3518,7 +3538,7 @@ checksum = "35fb2e5f958ec131621fdd531e9fc186ed768cbe395337403ae56c17a74c68ec"
 
 [[package]]
 name = "pdfs-cli"
-version = "1.3.0"
+version = "1.8.1"
 dependencies = [
  "anyhow",
  "clap 4.6.4",
@@ -3533,8 +3553,9 @@ dependencies = [
 
 [[package]]
 name = "pdfs-core"
-version = "1.3.0"
+version = "1.8.1"
 dependencies = [
+ "async-trait",
  "directories",
  "ignore",
  "keyring",
@@ -3553,9 +3574,10 @@ dependencies = [
 
 [[package]]
 name = "pdfs-fuse"
-version = "1.3.0"
+version = "1.8.1"
 dependencies = [
  "fuser",
+ "futures",
  "image",
  "libc",
  "notify",
@@ -3569,7 +3591,7 @@ dependencies = [
 
 [[package]]
 name = "pdfs-gui"
-version = "1.3.0"
+version = "1.8.1"
 dependencies = [
  "anyhow",
  "async-channel",
@@ -3830,9 +3852,9 @@ dependencies = [
 
 [[package]]
 name = "proton-drive-rs"
-version = "0.3.2"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06f6b2b3aaaf90cd3eab823e3c13a4ff784693f183f7fde97f865378c4d3e0bd"
+checksum = "fe0e39da5b61ceb862af2f4406870b9c1d9a1554889e8d40a32fff13882ec690"
 dependencies = [
  "async-trait",
  "base64",
@@ -3857,9 +3879,9 @@ dependencies = [
 
 [[package]]
 name = "proton-sdk"
-version = "0.3.2"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1037a17f8951cf3ade40a8d2a8230720caf6136383eecc7d61e89636e229793e"
+checksum = "97cde8cf8e3099d1dbb56302462a632a12e0ff818c012b9c9b0a7a5200544fd6"
 dependencies = [
  "aes-gcm 0.11.0",
  "async-trait",
@@ -4250,6 +4272,7 @@ dependencies = [
  "bytes",
  "futures-core",
  "futures-util",
+ "h2",
  "http",
  "http-body",
  "http-body-util",
@@ -5108,6 +5131,7 @@ dependencies = [
  "bytes",
  "futures-core",
  "futures-sink",
+ "libc",
  "pin-project-lite",
  "tokio",
 ]

Cargo.toml

@@ -3,15 +3,15 @@ resolver = "2"
 members = ["crates/pdfs-core", "crates/pdfs-fuse", "crates/pdfs-cli", "crates/pdfs-gui"]
 
 [workspace.package]
-version = "1.3.0"
+version = "1.8.1"
 edition = "2024"
 license = "MIT"
 authors = ["Nils Pukropp <contact@narl.io>"]
 rust-version = "1.96"
 
 [workspace.dependencies]
-proton-sdk = { version = "0.3.2" }
+proton-sdk = { version = "0.6.0" }
-proton-drive-rs = { version = "0.3.2" }
+proton-drive-rs = { version = "0.6.0" }
 
 # Internal crates.
 pdfs-core = { path = "crates/pdfs-core" }
@@ -40,5 +40,7 @@ rusqlite = { version = "0.32", features = ["bundled"] }
 keyring = { version = "3", features = ["sync-secret-service", "crypto-rust"] }
 clap = { version = "4", features = ["derive"] }
 rpassword = "7"
+async-trait = "0.1"
+futures = "0.3"
 fuser = "0.17"
 libc = "0.2"

README.md

@@ -14,6 +14,8 @@ A fast, unofficial Proton Drive client for Linux. This client features an advanc
 - **Unified Search Launcher (HUD)**: A resident Google Drive-style launcher (`pdfs-prompt`) that searches Proton Drive and local files together, ranks the best matches, tolerates abbreviations and typos, and is ideal for a system-wide hotkey.
 - **Secure Credential Storage**: Integrates with the system Secret Service (GNOME Keyring, KWallet, etc.) with smart in-memory credential caching to avoid UI thread blockages.
 - **Proton Photos Support**: Access your Proton Photos timeline, view thumbnails, and download backed-up media natively (available in the GUI as a navigation tab and via the CLI).
+- **File Version History**: Every revision Proton Drive still holds for a file, from the browser's details pane (**Versions**) or `pdfs versions list|restore|save|rm`. Restoring is server-side — no re-upload — and an old version can be written out to a local file without touching the live one.
+- **Photo Favourites**: Star a photo in the lightbox, filter the gallery to favourites, or use `pdfs favorite <uid>` / `pdfs photos --favorites`.
 - **Photo Albums**: Browse your albums — including the ones shared with you — from the Albums view of the Photos page, or with `pdfs albums` / `pdfs album <uid>`. Album contents open in the same gallery as the timeline.
 - **Human Verification (CAPTCHA) Recovery**: Detects sign-in gates (VPN/new IP challenges) and launches an embedded `WebKitWebView` dialog to safely complete the challenge, transparently retrying authentication with the earned token.
 - **Selective Sync (`.pdfsignore`)**: Keep build trees, dependency directories, and editor leftovers out of synced folders using gitignore-style rules.
@@ -25,6 +27,80 @@ A fast, unofficial Proton Drive client for Linux. This client features an advanc
 
 The prompt stays resident after its first launch, so invoking the shortcut again reuses and resets the existing window. Drive folders open from the mount. Audio and video results also open through FUSE, allowing media players to seek and request ranges without downloading the entire file first; ordinary Drive files are materialized into the local cache before opening.
 
+### Using your own launcher (fuzzel, rofi, wofi, …)
+
+`pdfs-prompt --dmenu` runs the same search through an external dmenu-style
+launcher instead of the built-in window, so the HUD matches the rest of a
+tiling-WM desktop:
+
+```bash
+pdfs-prompt --dmenu                                   # fuzzel/rofi/wofi/tofi/bemenu/dmenu, whichever is installed
+pdfs-prompt --dmenu --menu 'fuzzel --dmenu --width 60'
+pdfs-prompt --dmenu --query invoice                   # skip straight to a search
+```
+
+A launcher filters a fixed list — it cannot ask for a new one per keystroke — so
+searching takes two steps, and the prompt says which step you are on:
+
+- `Search Drive ›` lists your pinned files. Type anything that isn't one of them
+  and press Enter to search for it.
+- `Drive: invoice ›` lists the results. Enter opens one; typing something else
+  and pressing Enter searches again. Escape closes.
+
+`--query` skips the first step. fuzzel and rofi also get file-type icons.
+
+To make an existing keybinding use it without re-binding, and to pin the
+launcher command, set them in `config.json`:
+
+```json
+{
+  "prompt": {
+    "mode": "dmenu",
+    "menu": ["fuzzel", "--dmenu", "--width", "60"],
+    "menu_limit": 50
+  }
+}
+```
+
+`--gtk` overrides `"mode": "dmenu"` for one invocation. A `{prompt}` token
+anywhere in `menu` is replaced by the prompt text; without one, the launcher's
+own prompt flag is appended.
+
+## Choosing How Files Open
+
+By default every result is handed to `xdg-open`. An `open_with` block in
+`config.json` overrides that per file type — for instance opening text in
+Neovim inside Alacritty, while everything else still goes to the desktop:
+
+```json
+{
+  "open_with": {
+    "terminal": ["alacritty", "-e"],
+    "rules": [
+      { "match": ["@text"], "command": ["nvim"], "terminal": true },
+      { "match": ["*.png", "*.jpg"], "command": ["imv"] }
+    ]
+  }
+}
+```
+
+- `match` takes file-name globs (`*.md`, `notes-*.txt`) or the classes `@dir`,
+  `@text`, `@document`, `@image`, `@media`, `@any`. First matching rule wins.
+- `command` is argv, not a shell line. A `{}` token is replaced by the path;
+  without one the path is appended. `$VAR` tokens expand from the environment,
+  so `["$EDITOR"]` follows your editor.
+- `"terminal": true` wraps the command in `terminal`. When that is unset, the
+  terminal comes from `$PDFS_TERMINAL`, then `$TERMINAL`, then the first known
+  emulator on `PATH`; a bare name like `TERMINAL=alacritty` gains the right
+  "run this" flag automatically.
+- `"default": [...]` replaces `xdg-open` for everything unmatched.
+
+The rules apply to the prompt (both front ends) and to the GTK browser, so a
+file opens the same way wherever it was picked. Patterns are matched against the
+Drive name — a downloaded file is stored in the cache under its content hash,
+which says nothing about its type, so matching that would send everything to
+`xdg-open`.
+
 ## Selective Sync (`.pdfsignore`)
 
 Two-way synced folders skip paths matched by ignore rules, so syncing a project

crates/pdfs-cli/src/main.rs

@@ -144,6 +144,17 @@ enum Command {
         /// Skip this many photos from the start of the timeline.
         #[arg(long, default_value_t = 0)]
         offset: usize,
+        /// List only favourited photos.
+        #[arg(long)]
+        favorites: bool,
+    },
+    /// Add or remove a photo's favourite mark.
+    Favorite {
+        /// Photo node uid in `volume~link` form (from `pdfs photos`).
+        uid: String,
+        /// Remove the mark instead of adding it.
+        #[arg(long)]
+        remove: bool,
     },
     /// List the photo albums (including ones shared with this account).
     Albums,
@@ -286,6 +297,11 @@ enum Command {
         /// Entry kind: member, proton or external.
         kind: ShareKindArg,
     },
+    /// Inspect and restore a file's earlier versions.
+    Versions {
+        #[command(subcommand)]
+        action: VersionCmd,
+    },
     /// Manage a node's public link.
     PublicLink {
         #[command(subcommand)]
@@ -380,6 +396,43 @@ impl ShareKindArg {
     }
 }
 
+/// `pdfs versions …` — a file's revision history.
+#[derive(Subcommand)]
+enum VersionCmd {
+    /// List a file's versions, newest first.
+    List {
+        /// File path, inside the mountpoint or relative to it.
+        path: PathBuf,
+    },
+    /// Make an earlier version the file's current content.
+    ///
+    /// The server applies this in the background, so the new content may take a
+    /// moment to show up in the mount.
+    Restore {
+        /// File path, inside the mountpoint or relative to it.
+        path: PathBuf,
+        /// Version id, from `pdfs versions list`.
+        id: String,
+    },
+    /// Write an earlier version to a local file, leaving the file untouched.
+    Save {
+        /// File path, inside the mountpoint or relative to it.
+        path: PathBuf,
+        /// Version id, from `pdfs versions list`.
+        id: String,
+        /// Where to write it. Must not already exist.
+        dest: PathBuf,
+    },
+    /// Permanently delete an earlier version. The content is unrecoverable, and
+    /// the version that is currently active cannot be deleted.
+    Rm {
+        /// File path, inside the mountpoint or relative to it.
+        path: PathBuf,
+        /// Version id, from `pdfs versions list`.
+        id: String,
+    },
+}
+
 #[derive(Subcommand)]
 enum DeviceCmd {
     /// List registered devices.
@@ -529,7 +582,12 @@ fn main() -> Result<()> {
         Command::Unpin { path } => cmd_unpin(path),
         Command::Pins => cmd_pins(),
         Command::Ls { path } => cmd_ls(path),
-        Command::Photos { limit, offset } => cmd_photos(limit, offset),
+        Command::Photos {
+            limit,
+            offset,
+            favorites,
+        } => cmd_photos(limit, offset, favorites),
+        Command::Favorite { uid, remove } => cmd_favorite(uid, remove),
         Command::Albums => cmd_albums(),
         Command::Album { uid, limit, offset } => cmd_album(uid, limit, offset),
         Command::OpenPhoto { uid } => cmd_open_photo(uid),
@@ -561,6 +619,7 @@ fn main() -> Result<()> {
             role,
         } => cmd_share_role(path, id, kind, role),
         Command::Unshare { path, id, kind } => cmd_unshare(path, id, kind),
+        Command::Versions { action } => cmd_versions(action),
         Command::PublicLink { action } => cmd_public_link(action),
         Command::Shared => cmd_shared(),
         Command::SharedWithMe { uid } => cmd_shared_with_me(uid),
@@ -788,6 +847,71 @@ fn cmd_share(
     })?)
 }
 
+fn cmd_versions(action: VersionCmd) -> Result<()> {
+    match action {
+        VersionCmd::List { path } => {
+            let response = control_request(CtlRequest::ListRevisions {
+                path: path_arg(&path)?,
+            })?;
+            if emit_json(&response)? {
+                return Ok(());
+            }
+            match response {
+                CtlResponse::Revisions { items } if items.is_empty() => {
+                    println!("No versions.");
+                }
+                CtlResponse::Revisions { items } => {
+                    for r in items {
+                        // The claimed plaintext size is what the user recognises;
+                        // the storage size is ciphertext and always larger.
+                        let size = r
+                            .claimed_size
+                            .filter(|size| *size >= 0)
+                            .unwrap_or(r.size_on_storage)
+                            .max(0) as u64;
+                        let mark = if r.is_active { "*" } else { " " };
+                        let by = r
+                            .signed_by
+                            .map(|email| format!("  {email}"))
+                            .unwrap_or_default();
+                        println!(
+                            "{mark} {:<20}  {:>10}  {}{by}",
+                            r.id,
+                            human_bytes(size),
+                            format_epoch(r.created),
+                        );
+                    }
+                    println!("(* = current)");
+                }
+                CtlResponse::Error { message, kind } => bail!("{}", cli_error(kind, &message)),
+                other => bail!("unexpected response: {other:?}"),
+            }
+            Ok(())
+        }
+        VersionCmd::Restore { path, id } => {
+            ok_or_bail(control_request(CtlRequest::RestoreRevision {
+                path: path_arg(&path)?,
+                revision_id: id,
+            })?)
+        }
+        VersionCmd::Save { path, id, dest } => {
+            // The daemon writes the file, so it needs a path that means the same
+            // thing in its process as in this one.
+            let dest = std::path::absolute(&dest)
+                .with_context(|| format!("resolve {}", dest.display()))?;
+            ok_or_bail(control_request(CtlRequest::SaveRevisionAs {
+                path: path_arg(&path)?,
+                revision_id: id,
+                dest: dest.to_string_lossy().into_owned(),
+            })?)
+        }
+        VersionCmd::Rm { path, id } => ok_or_bail(control_request(CtlRequest::DeleteRevision {
+            path: path_arg(&path)?,
+            revision_id: id,
+        })?),
+    }
+}
+
 fn cmd_members(path: PathBuf) -> Result<()> {
     match control_request(CtlRequest::ListShare {
         path: path_arg(&path)?,
@@ -1212,6 +1336,11 @@ fn cmd_status() -> Result<()> {
             online,
             pending_uploads,
             pending_changes,
+            parked_uploads,
+            failing_ops,
+            failing_error,
+            staged_bytes,
+            staged_oldest_secs,
             ..
         }) => {
             let state = if online { "" } else { ", offline" };
@@ -1220,6 +1349,25 @@ fn cmd_status() -> Result<()> {
                 None => String::new(),
             };
             println!("Mounted at {mountpoint} ({pinned} pinned{state}{queued})");
+            // Everything below is a queue that is not making progress on its
+            // own. Printed only when it exists, because in the ordinary case
+            // there is nothing to say.
+            if staged_bytes > 0 {
+                println!(
+                    "Staged     {} not yet uploaded (oldest {})",
+                    human_bytes(staged_bytes),
+                    human_age(staged_oldest_secs),
+                );
+            }
+            if parked_uploads > 0 {
+                println!("Parked     {parked_uploads} upload(s) waiting for a final filename");
+            }
+            if failing_ops > 0 {
+                println!(
+                    "Stuck      {failing_ops} queued operation(s) keep failing: {}",
+                    failing_error.as_deref().unwrap_or("no error recorded"),
+                );
+            }
         }
         Ok(other) => println!("Mount: unexpected response {other:?}"),
         Err(_) => println!("Mount: not running."),
@@ -1487,12 +1635,13 @@ fn cmd_ls(path: Option<PathBuf>) -> Result<()> {
     Ok(())
 }
 
-fn cmd_photos(limit: usize, offset: usize) -> Result<()> {
+fn cmd_photos(limit: usize, offset: usize, favorites: bool) -> Result<()> {
     match control_request(CtlRequest::PhotosTimeline {
         offset,
         limit,
         kind: None,
         range: None,
+        favorites,
     })? {
         CtlResponse::Photos {
             available: false, ..
@@ -1511,6 +1660,13 @@ fn cmd_photos(limit: usize, offset: usize) -> Result<()> {
 ///
 /// A timeline or album reply only carries thumbnails already in the cache, so
 /// the rest of the page's are pulled in one batch rather than left blank.
+fn cmd_favorite(uid: String, remove: bool) -> Result<()> {
+    ok_or_bail(control_request(CtlRequest::SetPhotoFavorite {
+        uid,
+        favorite: !remove,
+    })?)
+}
+
 fn print_photo_page(items: Vec<pdfs_core::control::PhotoItem>) -> Result<()> {
     let uids: Vec<String> = items.iter().map(|p| p.uid.clone()).collect();
     let thumbs: HashMap<String, Option<String>> =
@@ -1524,7 +1680,8 @@ fn print_photo_page(items: Vec<pdfs_core::control::PhotoItem>) -> Result<()> {
             .and_then(|p| p.as_deref())
             .or(p.thumb_path.as_deref())
             .unwrap_or("(no thumbnail)");
-        println!("{}  {}  {thumb}", p.capture_time, p.uid);
+        let fav = if p.favorite { "*" } else { " " };
+        println!("{fav} {}  {}  {thumb}", p.capture_time, p.uid);
     }
     Ok(())
 }
@@ -1753,6 +1910,18 @@ fn path_arg(path: &Path) -> Result<String> {
         .ok_or_else(|| anyhow!("path is not valid UTF-8"))
 }
 
+/// Format an age in seconds for a report line, coarsely — the point of the
+/// number is whether it is minutes or weeks.
+fn human_age(secs: u64) -> String {
+    const UNITS: [(&str, u64); 4] = [("d", 86_400), ("h", 3_600), ("m", 60), ("s", 1)];
+    for (unit, scale) in UNITS {
+        if secs >= scale {
+            return format!("{}{unit}", secs / scale);
+        }
+    }
+    "just now".to_string()
+}
+
 /// Format a byte count for a report line.
 fn human_bytes(bytes: u64) -> String {
     const UNITS: [(&str, f64); 4] = [
@@ -1792,6 +1961,32 @@ fn cmd_cache(action: CacheCmd) -> Result<()> {
     }
 }
 
+/// Ask for a deep integrity check and wait for it to finish.
+///
+/// The daemon answers the request immediately and runs the check on a thread —
+/// it holds the single database connection for as long as it takes, which would
+/// otherwise stall the mount — so a caller that needs the verdict polls for it.
+/// `pdfs doctor` is that caller: it is a diagnostic the user is watching, so
+/// waiting is right, and the bound is generous enough for a large database
+/// without hanging forever if the daemon never finishes.
+fn await_integrity_check() -> Result<CtlResponse> {
+    const POLL: std::time::Duration = std::time::Duration::from_secs(1);
+    const GIVE_UP_AFTER: std::time::Duration = std::time::Duration::from_secs(120);
+
+    let started = std::time::Instant::now();
+    loop {
+        let response = control_request(CtlRequest::CacheInspect { deep: true })?;
+        match &response {
+            CtlResponse::CacheReport {
+                integrity_running: true,
+                integrity_checked: false,
+                ..
+            } if started.elapsed() < GIVE_UP_AFTER => std::thread::sleep(POLL),
+            _ => return Ok(response),
+        }
+    }
+}
+
 fn cmd_cache_inspect(deep: bool) -> Result<()> {
     let response = control_request(CtlRequest::CacheInspect { deep })?;
     if emit_json(&response)? {
@@ -1807,6 +2002,7 @@ fn cmd_cache_inspect(deep: bool) -> Result<()> {
             cache_budget,
             integrity_problems,
             integrity_checked,
+            integrity_running,
         } => {
             println!(
                 "Database   schema v{schema_version}, {}",
@@ -1839,6 +2035,11 @@ fn cmd_cache_inspect(deep: bool) -> Result<()> {
                         println!("  {problem}");
                     }
                 }
+            } else if integrity_running {
+                // The daemon runs the check on a thread rather than holding its
+                // only database connection for the length of it, so the answer
+                // belongs to a later request.
+                println!("\nIntegrity  checking in the background — run this again for the result");
             } else {
                 println!("\nIntegrity  not checked (pass --deep)");
             }
@@ -2076,14 +2277,24 @@ fn cmd_diagnose() -> Result<()> {
                     format!("{pending} waiting to upload")
                 },
             );
-            match control_request(CtlRequest::CacheInspect { deep: true }) {
+            match await_integrity_check() {
                 Ok(CtlResponse::CacheReport {
-                    integrity_problems, ..
+                    integrity_problems,
+                    integrity_checked: true,
+                    ..
                 }) if integrity_problems.is_empty() => report.finding(
                     DiagnoseLevel::Ok,
                     "  database integrity",
                     "SQLite integrity_check passed",
                 ),
+                Ok(CtlResponse::CacheReport {
+                    integrity_checked: false,
+                    ..
+                }) => report.finding(
+                    DiagnoseLevel::Warn,
+                    "  database integrity",
+                    "still checking — run `pdfs cache inspect --deep` for the result",
+                ),
                 Ok(CtlResponse::CacheReport {
                     integrity_problems, ..
                 }) => report.finding(

crates/pdfs-core/Cargo.toml

@@ -21,4 +21,5 @@ sha2.workspace = true
 rusqlite.workspace = true
 keyring.workspace = true
 parking_lot.workspace = true
+async-trait.workspace = true
 libc.workspace = true

crates/pdfs-core/src/auth.rs

@@ -9,8 +9,10 @@
 use keyring::Entry;
 use proton_drive_rs::{KeySalt, ProtonDriveClient};
 use proton_sdk::api::{HumanVerification, HumanVerificationCredential};
+use proton_sdk::cache::EncryptedCacheRepository;
 use proton_sdk::config::ProtonClientConfiguration;
 use proton_sdk::session::{PasswordMode, ProtonApiSession, ResumeParameters};
+use proton_sdk::telemetry::TracingTelemetry;
 use serde::{Deserialize, Serialize};
 
 use crate::config::{APP_VERSION, AppDirs, KEYRING_SERVICE, USER_AGENT};
@@ -220,6 +222,21 @@ pub fn load() -> Result<StoredSession> {
 
 /// Forget the persisted session (best-effort; absent entry is not an error).
 pub fn logout() -> Result<()> {
+    // The persisted entity cache describes the account being logged out of. It
+    // is encrypted under that account's mailbox password, but leaving it behind
+    // would also mean the next account inherits a store it can only ever read as
+    // misses. Best-effort: failing to remove a cache must not block the logout.
+    if let Ok(dirs) = AppDirs::new() {
+        let path = dirs.state_dir().join("sdk_cache.db");
+        if let Some(cache) = crate::sdkcache::SdkCache::opened()
+            && let Err(e) = cache.clear_now()
+        {
+            tracing::warn!(error = %e, "clearing the SDK entity cache on logout failed");
+        }
+        for suffix in ["", "-wal", "-shm"] {
+            let _ = std::fs::remove_file(format!("{}{suffix}", path.display()));
+        }
+    }
     match keyring_entry()?.delete_credential() {
         Ok(()) | Err(keyring::Error::NoEntry) => Ok(()),
         Err(e) => Err(e.into()),
@@ -259,10 +276,50 @@ pub async fn resume_client() -> Result<(ProtonDriveClient, ProtonApiSession)> {
 
     register_refresh_handler(&session, password.clone(), key_salts.clone());
 
-    let client = ProtonDriveClient::with_key_salts(&session, password.into_bytes(), key_salts);
+    let client = tune(
+        ProtonDriveClient::with_key_salts(&session, password.clone().into_bytes(), key_salts),
+        password.as_bytes(),
+    );
     Ok((client, session))
 }
 
+/// The client settings every front-end wants, applied wherever a
+/// [`ProtonDriveClient`] is built for real work.
+///
+/// - **Telemetry** into `tracing`, so the SDK's own spans (transfers, block
+///   storage, per-request timings) land in the daemon's log next to the
+///   daemon's, instead of being dropped by the default no-op sink.
+/// - **Small-file uploads**: a file that fits in one block is uploaded as a
+///   single atomic request instead of the multi-step draft/block/commit dance.
+///   The SDK makes this opt-in because it has no remote feature-flag provider;
+///   the drain queue writes plenty of small files, and the shorter path is one
+///   failure point per write instead of three.
+/// - **A persistent entity cache** ([`crate::sdkcache`]), so a restart does not
+///   re-fetch and re-decrypt the tree the previous run already walked. It is
+///   wrapped in the SDK's [`EncryptedCacheRepository`] keyed by the mailbox
+///   password, so the decrypted node names it holds are not readable from the
+///   file alone — and a password change simply reads as a cold cache, since the
+///   SDK treats an undecryptable entry as a miss and clears the store.
+///
+///   Opening it is best-effort: a store this process cannot open costs cache
+///   hits, not the session, so the client falls back to the SDK's in-memory
+///   default.
+fn tune(client: ProtonDriveClient, mailbox_password: &[u8]) -> ProtonDriveClient {
+    let client = client
+        .with_telemetry(TracingTelemetry::shared())
+        .with_small_file_upload(true);
+    match AppDirs::new().and_then(|dirs| crate::sdkcache::SdkCache::shared(&dirs)) {
+        Ok(cache) => client.with_entity_repository(EncryptedCacheRepository::shared(
+            cache,
+            mailbox_password.to_vec(),
+        )),
+        Err(e) => {
+            tracing::warn!(error = %e, "persistent SDK entity cache unavailable; using memory");
+            client
+        }
+    }
+}
+
 /// Write the session's current tokens back to the keyring.
 ///
 /// The session does not carry the mailbox password (it is only needed to rebuild

crates/pdfs-core/src/batch.rs

@@ -0,0 +1,84 @@
+//! Per-node outcomes of the SDK's batch node operations.
+//!
+//! `trash_nodes`, `restore_nodes`, `delete_nodes` and `move_nodes` report one
+//! outcome per node instead of failing the whole call: a node the server
+//! rejects leaves the rest of the batch applied. The daemon's callers fall into
+//! two shapes, and both are here so neither has to re-derive the fold:
+//!
+//! - one node in, one answer out — [`into_unit`], which collapses the single
+//!   outcome back to a `Result`;
+//! - a user-supplied list — [`split`], which keeps the successes and hands back
+//!   the failures to report.
+
+use proton_sdk::error::ProtonError;
+use proton_sdk::ids::NodeUid;
+
+/// One node's outcome, as the SDK batch operations report it.
+pub type Outcome = (NodeUid, Result<(), ProtonError>);
+
+/// Collapse a batch result to the first per-node failure, for the callers that
+/// pass exactly one node and want the old all-or-nothing answer.
+///
+/// An empty outcome list is `Ok`: the server accepted the request and reported
+/// on nothing, which is not an error the caller can act on.
+pub fn into_unit(outcomes: Vec<Outcome>) -> Result<(), ProtonError> {
+    for (_, outcome) in outcomes {
+        outcome?;
+    }
+    Ok(())
+}
+
+/// Split a batch result into the nodes that succeeded and the ones that failed.
+pub fn split(outcomes: Vec<Outcome>) -> (Vec<NodeUid>, Vec<(NodeUid, ProtonError)>) {
+    let mut done = Vec::with_capacity(outcomes.len());
+    let mut failed = Vec::new();
+    for (uid, outcome) in outcomes {
+        match outcome {
+            Ok(()) => done.push(uid),
+            Err(e) => failed.push((uid, e)),
+        }
+    }
+    (done, failed)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use proton_sdk::ids::{LinkId, VolumeId};
+
+    fn uid(link: &str) -> NodeUid {
+        NodeUid::new(VolumeId::new("vol"), LinkId::new(link))
+    }
+
+    fn failure() -> ProtonError {
+        ProtonError::invalid_operation("nope")
+    }
+
+    #[test]
+    fn into_unit_is_ok_when_every_node_succeeded() {
+        assert!(into_unit(vec![(uid("a"), Ok(())), (uid("b"), Ok(()))]).is_ok());
+        assert!(
+            into_unit(Vec::new()).is_ok(),
+            "nothing reported is not a failure"
+        );
+    }
+
+    #[test]
+    fn into_unit_surfaces_a_failed_node() {
+        let outcomes = vec![(uid("a"), Ok(())), (uid("b"), Err(failure()))];
+        assert!(into_unit(outcomes).is_err());
+    }
+
+    #[test]
+    fn split_keeps_successes_and_failures_apart() {
+        let outcomes = vec![
+            (uid("a"), Ok(())),
+            (uid("b"), Err(failure())),
+            (uid("c"), Ok(())),
+        ];
+        let (done, failed) = split(outcomes);
+        assert_eq!(done, vec![uid("a"), uid("c")]);
+        assert_eq!(failed.len(), 1);
+        assert_eq!(failed[0].0, uid("b"));
+    }
+}

crates/pdfs-core/src/cache.rs

@@ -16,17 +16,20 @@
 //! [`AppDirs::cache_dir`]: crate::config::AppDirs::cache_dir
 //! [`Node`]: proton_drive_rs::Node
 
-use std::collections::{BTreeMap, HashSet};
+use std::collections::{BTreeMap, HashMap, HashSet};
 use std::fmt;
 use std::io::{Read, Seek, SeekFrom};
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
-use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
 use std::time::{SystemTime, UNIX_EPOCH};
 
 use proton_drive_rs::proton_sdk::ids::NodeUid;
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
+use tracing::debug;
+
+use parking_lot::Mutex;
 
 use crate::db::{CacheEntryInput, Db};
 use crate::error::{Error, Result};
@@ -74,6 +77,22 @@ fn now_millis() -> i64 {
 /// `download_range` fetch with no straddling.
 pub const BLOCK_SIZE: u64 = 1 << 22;
 
+/// Buffered LRU touches that trigger a flush. Sized so a sequential read of a
+/// large file flushes a few times rather than per block, while an idle cache
+/// never holds more than a few hundred pending keys.
+const TOUCH_FLUSH_AT: usize = 256;
+
+/// How long block `idx` of a file of `size` bytes must be: a full
+/// [`BLOCK_SIZE`] except for the last one, which holds the remainder.
+///
+/// Public because it is the *contract* a block has to satisfy, not a detail of
+/// this cache: the network read path validates against it too, so a block that
+/// comes back short is refused before it can truncate a file (bugs.md B84).
+pub fn block_len(size: u64, idx: u64) -> u64 {
+    let start = idx.saturating_mul(BLOCK_SIZE);
+    size.saturating_sub(start).min(BLOCK_SIZE)
+}
+
 /// How many eviction candidates to pull per batch when a pool is over budget.
 /// Large enough that a normal overshoot (a store or two past the cap) is settled
 /// in one query, small enough that a badly-over-budget cache does not read its
@@ -102,6 +121,16 @@ pub struct Pin {
     /// file. Defaulted so a legacy `pins.json` (file pins only) still parses.
     #[serde(default)]
     pub recursive: bool,
+    /// Whether the pinned node is a folder, when the node cache knows.
+    ///
+    /// `recursive` is pin *policy*, not node kind: a folder pinned
+    /// non-recursively has `recursive: false`, and a front-end reading it as
+    /// "this is a file" draws a file icon and sends an invalid `OpenFile`. This
+    /// is resolved from the `nodes` row at list time, so it is `None` for a pin
+    /// whose node is not cached — and absent from an older daemon's reply,
+    /// which is why it is defaulted.
+    #[serde(default)]
+    pub is_dir: Option<bool>,
 }
 
 /// The legacy JSON pin registry, kept only to import a pre-P5 `pins.json` into
@@ -121,6 +150,19 @@ struct PinFile {
 /// in the gaps. Uploading that as-is would silently corrupt the file.
 /// `authored` says which ranges are real; `complete` says whether the file can
 /// be uploaded as it stands.
+/// What `staging/` currently holds, from [`ContentCache::staging_usage`].
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct StagingUsage {
+    /// Bytes across every staged blob.
+    pub bytes: u64,
+    /// Staged blobs, not counting their sidecars.
+    pub files: u64,
+    /// Age of the oldest staged blob, in seconds. Zero when there are none —
+    /// what makes a figure here interesting is it being *large*, which is the
+    /// shape of a write that is never going to drain by itself.
+    pub oldest_secs: u64,
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct StagedWrite {
     /// Node the write targeted, in `volume~link` display form.
@@ -253,6 +295,23 @@ pub struct ContentCache {
     /// store/read/evict updates it, and the budget enforcers query it instead of
     /// scanning the cache directories (plan.md P4).
     db: Arc<Db>,
+    /// LRU touches not yet written to `cache_entries`, keyed by cache key.
+    ///
+    /// A cache hit only reorders eviction candidates, so it does not have to be
+    /// durable — but as one write transaction per hit it was 32 transactions per
+    /// 4 MiB block delivered, taken on the read path, under the connection mutex
+    /// every `lookup` also needs. Buffered here and flushed in one transaction
+    /// once [`TOUCH_FLUSH_AT`] have accumulated, and always before an eviction
+    /// pass reads the ordering these describe.
+    touches: Mutex<HashMap<String, i64>>,
+    /// Whether `recovery/` may hold a write the daemon has not queued yet.
+    ///
+    /// The drain asks for recovered writes on every idle pass — a `read_dir` of
+    /// a directory that is empty in every run that did not crash. The directory
+    /// gains entries in exactly two places (the rescue at open, and the release
+    /// path that parks a still-authoritative scratch file), both of which set
+    /// this; a scan that finds nothing actionable clears it.
+    recovery_pending: AtomicBool,
 }
 
 impl ContentCache {
@@ -315,6 +374,9 @@ impl ContentCache {
             block_bytes: AtomicU64::new(0),
             thumb_bytes: AtomicU64::new(0),
             db,
+            touches: Mutex::new(HashMap::new()),
+            // The rescue above has already run, so start by looking once.
+            recovery_pending: AtomicBool::new(true),
         };
         cache.reconcile()?;
         // After reconcile, so the totals describe the index that now describes
@@ -463,7 +525,7 @@ impl ContentCache {
         let blob = self.valid_blob(uid, mtime, size)?;
         // Record the access for LRU in the cache index. Best effort — a failed
         // update only makes eviction order slightly less accurate.
-        let _ = self.db.cache_accessed(&Self::key(uid), now_millis());
+        self.touch(Self::key(uid));
         let mut f = std::fs::File::open(&blob).ok()?;
         if offset >= size {
             return Some(Vec::new());
@@ -553,22 +615,38 @@ impl ContentCache {
             .join(format!("{}.b{idx}.meta", Self::key(uid)))
     }
 
+    /// Whether block `idx` of `uid` is cached and fresh for `(mtime, size)`,
+    /// without reading it. For a caller deciding whether a block is worth
+    /// *fetching* — reading 4 MiB to answer that would defeat the point.
+    pub fn has_block(&self, uid: &NodeUid, mtime: i64, size: u64, idx: u64) -> bool {
+        self.block_tag(uid, idx) == Some(Meta { mtime, size })
+            && std::fs::metadata(self.block_blob(uid, idx))
+                .is_ok_and(|m| m.len() == block_len(size, idx))
+    }
+
+    /// The `(mtime, size)` a cached block claims to belong to, from its sidecar.
+    fn block_tag(&self, uid: &NodeUid, idx: u64) -> Option<Meta> {
+        serde_json::from_slice(&std::fs::read(self.block_meta(uid, idx)).ok()?).ok()
+    }
+
     /// Serve cached block `idx` (a [`BLOCK_SIZE`]-aligned chunk) of `uid`, or
     /// `None` on miss/stale. Validated against `(mtime, size)` like a whole-file
     /// blob, so a new revision (which bumps the mtime) is detected. Bumps the
     /// block's mtime for LRU, best effort.
     pub fn cached_block(&self, uid: &NodeUid, mtime: i64, size: u64, idx: u64) -> Option<Vec<u8>> {
-        let want = Meta { mtime, size };
+        if self.block_tag(uid, idx)? != (Meta { mtime, size }) {
-        let meta: Meta =
-            serde_json::from_slice(&std::fs::read(self.block_meta(uid, idx)).ok()?).ok()?;
-        if meta != want {
             return None;
         }
         let mut f = std::fs::File::open(self.block_blob(uid, idx)).ok()?;
-        // LRU touch in the cache index (best effort).
+        // The blob is not fsynced on the way in (see `store_block`), so a crash
-        let _ = self
+        // can leave a short one behind the sidecar that describes it. Length is
-            .db
+        // what makes that detectable, the same check `valid_blob` applies to a
-            .cache_accessed(&self.block_key(uid, idx), now_millis());
+        // whole-file blob.
+        if f.metadata().ok()?.len() != block_len(size, idx) {
+            return None;
+        }
+        // LRU touch, buffered rather than written (see `touch`).
+        self.touch(self.block_key(uid, idx));
         let mut buf = Vec::new();
         f.read_to_end(&mut buf).ok()?;
         Some(buf)
@@ -577,6 +655,12 @@ impl ContentCache {
     /// Store `bytes` as cached block `idx` of `uid`, tagged `(mtime, size)`.
     /// Temp-file-then-rename like [`store`](Self::store); meta written last so a
     /// crash mid-store fails validation. Enforces the block-cache LRU budget.
+    ///
+    /// The caller owes it a block of exactly [`block_len`] bytes; anything else
+    /// reads back as a miss ([`cached_block`](Self::cached_block) checks), so a
+    /// bad block cannot escape this cache even though this does not check.
+    /// Validating a block is the *reader's* job, at the point it is fetched —
+    /// see `Core::read_block` (bugs.md B84).
     pub fn store_block(
         &self,
         uid: &NodeUid,
@@ -593,7 +677,10 @@ impl ContentCache {
             let mut f = std::fs::File::create(&tmp)?;
             use std::io::Write;
             f.write_all(bytes)?;
-            f.sync_all()?;
+            // Deliberately not fsynced. This runs inline on the thread a kernel
+            // read is waiting on, and the block cache is disposable: the worst a
+            // crash can do is leave a short blob, which `cached_block` rejects
+            // on length and refetches.
         }
         std::fs::rename(&tmp, &blob)?;
         std::fs::write(
@@ -612,6 +699,40 @@ impl ContentCache {
         Ok(())
     }
 
+    /// Record a cache hit for LRU ordering, without touching the database.
+    ///
+    /// Later touches of the same key overwrite earlier ones — only the most
+    /// recent matters — so a hot file costs one map entry however many times it
+    /// is read.
+    fn touch(&self, key: String) {
+        let flush = {
+            let mut touches = self.touches.lock();
+            touches.insert(key, now_millis());
+            touches.len() >= TOUCH_FLUSH_AT
+        };
+        if flush {
+            self.flush_touches();
+        }
+    }
+
+    /// Write the buffered LRU touches out. Best effort: losing them costs
+    /// eviction accuracy, nothing else.
+    ///
+    /// Public because eviction ordering is only as good as what has been
+    /// flushed, and the daemon flushes on its idle passes as well as here.
+    pub fn flush_touches(&self) {
+        let batch: Vec<(String, i64)> = {
+            let mut touches = self.touches.lock();
+            if touches.is_empty() {
+                return;
+            }
+            touches.drain().collect()
+        };
+        if let Err(error) = self.db.cache_accessed_batch(&batch) {
+            debug!(?error, "flushing cache LRU touches failed");
+        }
+    }
+
     /// Re-read every pool total from the cache index, which is authoritative.
     fn reseed_totals(&self) {
         for kind in [KIND_BLOB, KIND_BLOCK, KIND_THUMB] {
@@ -679,7 +800,10 @@ impl ContentCache {
             return; // the common case: one atomic load, no query
         }
 
-        // Over budget by the running count — now do the accurate work.
+        // Over budget by the running count — now do the accurate work. The
+        // buffered hits are what say which entries are cold, so they have to
+        // reach the index before it is asked.
+        self.flush_touches();
         let mut running = match self.db.cache_total_bytes(kind) {
             Ok(n) => n,
             Err(_) => return,
@@ -717,6 +841,70 @@ impl ContentCache {
         self.reseed_totals();
     }
 
+    /// Duplicate `src` onto `dst`, preferring a reflink.
+    ///
+    /// The caller is copying a staged revision — a whole file, up to whatever
+    /// the user stores — so the difference between the three strategies is the
+    /// difference between instant and minutes:
+    ///
+    /// 1. `FICLONE` shares the extents copy-on-write. On btrfs, XFS with
+    ///    `reflink=1`, and bcachefs this is O(1) and consumes no extra space.
+    /// 2. `copy_file_range` still copies, but entirely inside the kernel — no
+    ///    round trip through a user-space buffer.
+    /// 3. `std::fs::copy` is the portable fallback, and what this used to
+    ///    always do.
+    ///
+    /// `dst` is truncated. Returns the number of bytes the destination ends up
+    /// holding.
+    pub fn clone_or_copy(src: &Path, dst: &Path) -> Result<u64> {
+        use std::os::fd::AsRawFd as _;
+
+        // `_IOW(0x94, 9, int)` — the whole-file reflink ioctl.
+        const FICLONE: libc::c_ulong = 0x4004_9409;
+
+        let source = std::fs::File::open(src)?;
+        let len = source.metadata()?.len();
+        let target = std::fs::OpenOptions::new()
+            .write(true)
+            .create(true)
+            .truncate(true)
+            .open(dst)?;
+
+        // SAFETY: both descriptors are owned and open; FICLONE takes the source
+        // fd by value and writes nothing back through the pointer-shaped arg.
+        if unsafe { libc::ioctl(target.as_raw_fd(), FICLONE, source.as_raw_fd()) } == 0 {
+            return Ok(len);
+        }
+
+        let mut copied = 0u64;
+        while copied < len {
+            let want = (len - copied) as usize;
+            // SAFETY: owned descriptors; null offsets advance the file offsets,
+            // which is what a whole-file copy wants.
+            let n = unsafe {
+                libc::copy_file_range(
+                    source.as_raw_fd(),
+                    std::ptr::null_mut(),
+                    target.as_raw_fd(),
+                    std::ptr::null_mut(),
+                    want,
+                    0,
+                )
+            };
+            if n <= 0 {
+                break;
+            }
+            copied += n as u64;
+        }
+        if copied == len {
+            return Ok(len);
+        }
+        // A short or refused `copy_file_range` (cross-filesystem on older
+        // kernels, an unsupported fs) leaves a partial destination; the
+        // portable copy truncates and rewrites it from scratch.
+        Ok(std::fs::copy(src, dst)?)
+    }
+
     /// Create a fresh, empty read-write scratch file for a disk-backed write
     /// handle. Returns the open file and its path (for cleanup on release).
     pub fn create_scratch(&self) -> Result<(std::fs::File, PathBuf)> {
@@ -796,8 +984,9 @@ impl ContentCache {
         let _ = std::fs::remove_file(Self::scratch_sidecar(scratch));
     }
 
-    /// Move every scratch file that carries a readable sidecar into `recovery`,
+    /// Move every scratch file that carries a sidecar into `recovery`, before the
-    /// before the caller empties the scratch directory.
+    /// caller empties the scratch directory. A sidecar that does not parse is
+    /// dropped and its blob moved anyway, unaccompanied — see below.
     ///
     /// Blob first, then sidecar: a blob in recovery without its sidecar is
     /// dropped on the next open (indistinguishable from rubbish), whereas a
@@ -818,43 +1007,28 @@ impl ContentCache {
                 // Not marked durable, or durability marker was explicitly cleared on release
                 continue;
             }
-            // Parsed if valid; if sidecar exists but is corrupted, build synthetic StagedWrite
+            // A sidecar that does not parse describes nothing, and inventing one
+            // is worse than having none: a fabricated uid parses, so recovery
+            // would queue an op against a node that does not exist and retry it
+            // forever, while a fabricated `complete: true` claims the blob is the
+            // whole file and stops any gap-fill. The blob still moves to
+            // recovery — sidecar-less, which `recovered_writes` skips and so
+            // leaves on disk for a human, the right outcome for bytes we cannot
+            // describe.
             let has_valid_sidecar = std::fs::read(&side)
                 .ok()
                 .and_then(|b| serde_json::from_slice::<StagedWrite>(&b).ok())
                 .is_some();
-            if !has_valid_sidecar {
-                if let Ok(meta) = std::fs::metadata(&blob)
-                    && meta.len() > 0
-                {
-                    let blob_name = blob
-                        .file_name()
-                        .map(|n| n.to_string_lossy().to_string())
-                        .unwrap_or_default();
-                    let synthetic = StagedWrite {
-                        uid: format!("recovered~{blob_name}"),
-                        len: meta.len(),
-                        base_size: meta.len(),
-                        base_mtime: 0,
-                        authored: vec![(0, meta.len())],
-                        complete: true,
-                        based_on: None,
-                    };
-                    if let Ok(data) = serde_json::to_vec(&synthetic) {
-                        let _ = std::fs::write(&side, data);
-                    } else {
-                        continue;
-                    }
-                } else {
-                    continue;
-                }
-            }
             let Some(name) = blob.file_name() else {
                 continue;
             };
             if std::fs::rename(&blob, recovery_dir.join(name)).is_err() {
                 continue;
             }
+            if !has_valid_sidecar {
+                let _ = std::fs::remove_file(&side);
+                continue;
+            }
             let Some(side_name) = side.file_name() else {
                 continue;
             };
@@ -909,7 +1083,14 @@ impl ContentCache {
     /// daemon to hand to the upload queue. A blob whose sidecar did not survive
     /// is not actionable automatically, but is retained for manual recovery:
     /// unexplained bytes are never evidence that user data is disposable.
+    ///
+    /// Asked for on every idle drain pass, so the usual answer — a directory
+    /// that has been empty since the last clean shutdown — costs an atomic load
+    /// rather than a `read_dir` (see [`recovery_pending`](Self::recovery_pending)).
     pub fn recovered_writes(&self) -> Vec<(PathBuf, StagedWrite)> {
+        if !self.recovery_pending.load(Ordering::Relaxed) {
+            return Vec::new();
+        }
         let Ok(entries) = std::fs::read_dir(&self.recovery_dir) else {
             return Vec::new();
         };
@@ -926,6 +1107,39 @@ impl ContentCache {
                 out.push((blob, meta));
             }
         }
+        // Blobs whose sidecar did not survive stay here for a human and are
+        // never actionable, so "nothing to queue" is the condition that stops
+        // the polling — not "the directory is empty".
+        if out.is_empty() {
+            self.recovery_pending.store(false, Ordering::Relaxed);
+        }
+        out
+    }
+
+    /// Every blob in `staging/`, paired with its sidecar when it has a readable
+    /// one.
+    ///
+    /// For the startup reconcile: staging holds the only copy of writes the
+    /// kernel has already been told succeeded, and three failure paths can
+    /// leave one there with no `pending_op` row pointing at it. Nothing walked
+    /// this directory, so those bytes were invisible to the daemon and to the
+    /// user both — `hydrate_pending` walks the op table and
+    /// [`recovered_writes`](Self::recovered_writes) walks `recovery/`.
+    pub fn staged_writes(&self) -> Vec<(PathBuf, Option<StagedWrite>)> {
+        let Ok(entries) = std::fs::read_dir(&self.staging_dir) else {
+            return Vec::new();
+        };
+        let mut out = Vec::new();
+        for entry in entries.flatten() {
+            let blob = entry.path();
+            if blob.extension().is_some_and(|e| e == "json") {
+                continue;
+            }
+            let meta = std::fs::read(Self::scratch_sidecar(&blob))
+                .ok()
+                .and_then(|b| serde_json::from_slice::<StagedWrite>(&b).ok());
+            out.push((blob, meta));
+        }
         out
     }
 
@@ -1096,6 +1310,10 @@ impl ContentCache {
                         if std::fs::rename(scratch, &recovery).is_ok() {
                             let _ = std::fs::File::open(&self.recovery_dir)
                                 .and_then(|dir| dir.sync_all());
+                            // These bytes are unaccompanied, but re-arm the
+                            // scan anyway: the flag exists to skip a directory
+                            // nothing has written to, and something just did.
+                            self.recovery_pending.store(true, Ordering::Relaxed);
                             return Err(retained(
                                 &recovery,
                                 Error::Other(format!(
@@ -1200,9 +1418,7 @@ impl ContentCache {
         // Record the access for LRU, as the blob and block readers do. Without
         // it the pool evicts in insertion order, so scrolling back up a gallery
         // would drop exactly the tiles being looked at.
-        let _ = self
+        self.touch(self.thumb_key(uid, ttype));
-            .db
-            .cache_accessed(&self.thumb_key(uid, ttype), now_millis());
         Some(bytes)
     }
 
@@ -1233,9 +1449,7 @@ impl ContentCache {
         if !blob.exists() {
             return None;
         }
-        let _ = self
+        self.touch(self.thumb_key(uid, ttype));
-            .db
-            .cache_accessed(&self.thumb_key(uid, ttype), now_millis());
         Some(blob)
     }
 
@@ -1348,10 +1562,11 @@ impl ContentCache {
             .pin_list()
             .unwrap_or_default()
             .into_iter()
-            .map(|(uid, path, recursive)| Pin {
+            .map(|row| Pin {
-                uid,
+                uid: row.uid,
-                path,
+                path: row.path,
-                recursive,
+                recursive: row.recursive,
+                is_dir: row.is_dir,
             })
             .collect()
     }
@@ -1377,6 +1592,44 @@ impl ContentCache {
             .sum()
     }
 
+    /// Bytes and file count held in `staging/`, with the age of the oldest
+    /// entry in seconds.
+    ///
+    /// Staging is not part of [`usage`](Self::usage) and is not subject to the
+    /// budget — it holds the *only* copy of writes that have not been uploaded,
+    /// so nothing here may ever be evicted to reclaim space. That is precisely
+    /// why it has to be reportable: a parked transient create (three abandoned
+    /// 4 GiB downloads, say) otherwise occupies disk with nothing in any UI
+    /// accounting for it.
+    ///
+    /// A `read_dir` per call, which is fine for the callers it has: a status
+    /// request, polled every couple of seconds against a directory that is
+    /// empty whenever the queue is drained.
+    pub fn staging_usage(&self) -> StagingUsage {
+        let Ok(entries) = std::fs::read_dir(&self.staging_dir) else {
+            return StagingUsage::default();
+        };
+        let mut usage = StagingUsage::default();
+        let now = std::time::SystemTime::now();
+        for entry in entries.flatten() {
+            // Sidecars describe the blob beside them; counting both would double
+            // the file count and report metadata as user bytes.
+            if entry.path().extension().is_some_and(|e| e == "json") {
+                continue;
+            }
+            let Ok(meta) = entry.metadata() else { continue };
+            usage.files += 1;
+            usage.bytes += meta.len();
+            if let Ok(age) = meta.modified().and_then(|m| {
+                now.duration_since(m)
+                    .map_err(|_| std::io::Error::other("modified in the future"))
+            }) {
+                usage.oldest_secs = usage.oldest_secs.max(age.as_secs());
+            }
+        }
+        usage
+    }
+
     /// Configured soft byte cap (`0` = unlimited), for display alongside
     /// [`usage`](Self::usage). This is the whole-cache figure; internally it is
     /// divided between the pools (see [`SPLIT_BLOB`]), but the user set one
@@ -1993,45 +2246,91 @@ mod tests {
     fn block_store_then_read() {
         let (c, _d) = cache();
         let u = uid("a");
-        c.store_block(&u, 100, 4096, 0, b"block-zero").unwrap();
+        // A 10-byte file is one block of 10 bytes: the length a reader expects
-        assert_eq!(c.cached_block(&u, 100, 4096, 0).unwrap(), b"block-zero");
+        // is derived from the file size, so the fixture has to be geometrically
+        // real or the torn-write check rejects it.
+        c.store_block(&u, 100, 10, 0, b"block-zero").unwrap();
+        assert_eq!(c.cached_block(&u, 100, 10, 0).unwrap(), b"block-zero");
         // A different index is a separate cache entry, absent here.
-        assert!(c.cached_block(&u, 100, 4096, 1).is_none());
+        assert!(c.cached_block(&u, 100, 10, 1).is_none());
         // A new revision (mtime/size bump) invalidates the block.
-        assert!(c.cached_block(&u, 101, 4096, 0).is_none());
+        assert!(c.cached_block(&u, 101, 10, 0).is_none());
         assert!(c.cached_block(&u, 100, 5000, 0).is_none());
     }
 
+    /// The geometry the whole read path validates against, here and over the
+    /// network (bugs.md B84): full blocks, then whatever is left.
+    #[test]
+    fn block_len_is_full_blocks_then_the_remainder() {
+        let size = BLOCK_SIZE * 2 + 17;
+        assert_eq!(block_len(size, 0), BLOCK_SIZE);
+        assert_eq!(block_len(size, 1), BLOCK_SIZE);
+        assert_eq!(block_len(size, 2), 17);
+        // Past the end there is no block, not a short one.
+        assert_eq!(block_len(size, 3), 0);
+        // An exact multiple has no short tail at all.
+        assert_eq!(block_len(BLOCK_SIZE, 0), BLOCK_SIZE);
+        assert_eq!(block_len(BLOCK_SIZE, 1), 0);
+    }
+
+    /// A block of the wrong length cannot escape the cache even though the
+    /// store does not check: the read validates it and reports a miss, so the
+    /// next read refetches rather than serving a hole (bugs.md B84).
+    #[test]
+    fn a_block_of_the_wrong_length_reads_as_a_miss() {
+        let (c, _d) = cache();
+        let u = uid("a");
+        // A 10-byte file's only block is 10 bytes; 5 is not a short tail.
+        c.store_block(&u, 100, 10, 0, b"block").unwrap();
+        assert!(c.cached_block(&u, 100, 10, 0).is_none());
+        assert!(!c.has_block(&u, 100, 10, 0));
+    }
+
+    /// The block cache is written without an fsync, so a crash can leave a blob
+    /// shorter than the sidecar beside it claims. Serving that as content would
+    /// hand the reader a hole; it has to read as a miss.
+    #[test]
+    fn a_truncated_block_reads_as_a_miss() {
+        let (c, _d) = cache();
+        let u = uid("a");
+        c.store_block(&u, 100, 10, 0, b"block-zero").unwrap();
+        std::fs::write(c.block_blob(&u, 0), b"block").unwrap();
+        assert!(c.cached_block(&u, 100, 10, 0).is_none());
+    }
+
     #[test]
     fn evict_drops_blocks() {
         let (c, _d) = cache();
         let u = uid("a");
-        c.store_block(&u, 1, 8, 0, b"aaaa").unwrap();
+        // Both blocks are stored at their real geometry (a 4-byte file is one
-        c.store_block(&u, 1, 8, 1, b"bbbb").unwrap();
+        // block), so this fails if `evict` misses them rather than because the
+        // fixture was unreadable to begin with.
+        c.store_block(&u, 1, 4, 0, b"aaaa").unwrap();
+        assert!(c.cached_block(&u, 1, 4, 0).is_some());
         c.evict(&u);
-        assert!(c.cached_block(&u, 1, 8, 0).is_none());
+        assert!(c.cached_block(&u, 1, 4, 0).is_none());
-        assert!(c.cached_block(&u, 1, 8, 1).is_none());
     }
 
     #[test]
     fn block_budget_evicts_lru() {
-        // Block pool fits two 4-byte blocks but not three.
+        // Block pool fits two 4-byte blocks but not three. One block per file,
+        // so each fixture is a geometrically real single-block file.
         let (c, _d) = cache_with_pool_cap(KIND_BLOCK, 8);
-        let u = uid("a");
+        let (a, b, d) = (uid("a"), uid("b"), uid("d"));
-        c.store_block(&u, 1, 12, 0, b"aaaa").unwrap();
+        c.store_block(&a, 1, 4, 0, b"aaaa").unwrap();
         std::thread::sleep(std::time::Duration::from_millis(10));
-        c.store_block(&u, 1, 12, 1, b"bbbb").unwrap();
+        c.store_block(&b, 1, 4, 0, b"bbbb").unwrap();
-        // Touch block 0 so block 1 is the least-recently-used.
+        // Touch a's block so b's is the least-recently-used.
         std::thread::sleep(std::time::Duration::from_millis(10));
-        assert!(c.cached_block(&u, 1, 12, 0).is_some());
+        assert!(c.cached_block(&a, 1, 4, 0).is_some());
         std::thread::sleep(std::time::Duration::from_millis(10));
-        c.store_block(&u, 1, 12, 2, b"cccc").unwrap();
+        c.store_block(&d, 1, 4, 0, b"cccc").unwrap();
         assert!(
-            c.cached_block(&u, 1, 12, 0).is_some(),
+            c.cached_block(&a, 1, 4, 0).is_some(),
             "recently-read survives"
         );
-        assert!(c.cached_block(&u, 1, 12, 1).is_none(), "LRU block evicted");
+        assert!(c.cached_block(&b, 1, 4, 0).is_none(), "LRU block evicted");
-        assert!(c.cached_block(&u, 1, 12, 2).is_some(), "newest survives");
+        assert!(c.cached_block(&d, 1, 4, 0).is_some(), "newest survives");
     }
 
     /// A failed upload must never cost the user their bytes (offline.md Phase 2):
@@ -2174,6 +2473,39 @@ mod tests {
         drop(reopened);
     }
 
+    /// `clone_or_copy` has three strategies and only the last one is portable,
+    /// so what matters is that the destination is byte-identical whichever the
+    /// filesystem under `/tmp` happens to take — including when it already held
+    /// longer content, which a reflink or a short `copy_file_range` must not
+    /// leave a tail of.
+    #[test]
+    fn clone_or_copy_reproduces_the_source_over_any_existing_destination() {
+        let dir = TempDir::new();
+        let src = dir.path().join("src");
+        let dst = dir.path().join("dst");
+        std::fs::write(&src, b"the new content").unwrap();
+        std::fs::write(&dst, vec![b'x'; 4096]).unwrap();
+
+        let len = ContentCache::clone_or_copy(&src, &dst).unwrap();
+
+        assert_eq!(len, 15);
+        assert_eq!(std::fs::read(&dst).unwrap(), b"the new content");
+    }
+
+    /// An empty staged blob is a real case — a file truncated to zero and
+    /// closed — and `FICLONE` of a zero-length source is a documented `EINVAL`.
+    #[test]
+    fn clone_or_copy_handles_an_empty_source() {
+        let dir = TempDir::new();
+        let src = dir.path().join("empty");
+        let dst = dir.path().join("dst");
+        std::fs::write(&src, b"").unwrap();
+        std::fs::write(&dst, b"stale").unwrap();
+
+        assert_eq!(ContentCache::clone_or_copy(&src, &dst).unwrap(), 0);
+        assert!(std::fs::read(&dst).unwrap().is_empty());
+    }
+
     /// A2: `fsync(2)` promises the bytes survive a crash, but queueing happens
     /// at `release`. A scratch file marked durable must therefore outlive the
     /// open that clears the scratch directory — and an unmarked one must not,

crates/pdfs-core/src/config.rs

@@ -6,6 +6,8 @@ use directories::ProjectDirs;
 use serde::{Deserialize, Serialize};
 
 use crate::error::{Error, Result};
+use crate::menu::PromptConfig;
+use crate::opener::OpenWith;
 use crate::syncignore::DEFAULT_IGNORE_PATTERNS;
 
 /// Proton requires `external-drive-{name}@{semver}-{channel}` (channel ∈
@@ -106,6 +108,17 @@ pub struct AppConfig {
     /// the field, and overridable at runtime via [`CONFLICT_SWEEP_ENV`].
     #[serde(default)]
     pub conflict_sweep: Option<SweepMode>,
+    /// How files opened from the prompt/browser are launched. `None` means
+    /// "hand everything to `xdg-open`", which is what the client did before
+    /// this existed. See [`crate::opener`]. Defaulted for configs predating the
+    /// field.
+    #[serde(default)]
+    pub open_with: Option<OpenWith>,
+    /// `pdfs-prompt` behaviour, including the external launcher used by
+    /// `--dmenu`. See [`crate::menu`]. Defaulted for configs predating the
+    /// field.
+    #[serde(default)]
+    pub prompt: Option<PromptConfig>,
 }
 
 impl Default for AppConfig {
@@ -118,6 +131,8 @@ impl Default for AppConfig {
             ignore_patterns: None,
             device_uid: None,
             conflict_sweep: None,
+            open_with: None,
+            prompt: None,
         }
     }
 }
@@ -129,6 +144,18 @@ impl AppConfig {
         self.cache_budget.unwrap_or(DEFAULT_CACHE_BUDGET_BYTES)
     }
 
+    /// The effective opener policy: the user's rules, or the all-`xdg-open`
+    /// default. Cloned rather than borrowed because callers hold it for the
+    /// life of a window, long after the config value is gone.
+    pub fn resolved_open_with(&self) -> OpenWith {
+        self.open_with.clone().unwrap_or_default()
+    }
+
+    /// The effective prompt settings, defaulted when the section is absent.
+    pub fn resolved_prompt(&self) -> PromptConfig {
+        self.prompt.clone().unwrap_or_default()
+    }
+
     /// The effective conflict-sweep mode: the [`CONFLICT_SWEEP_ENV`] override if
     /// it parses, then the user's stored choice, then [`SweepMode::default`].
     ///
@@ -448,6 +475,8 @@ mod tests {
             ignore_patterns: Some(vec!["build/".to_string()]),
             device_uid: Some("dev-uid".to_string()),
             conflict_sweep: Some(SweepMode::Enforce),
+            open_with: None,
+            prompt: None,
         };
         let json = serde_json::to_string(&config).unwrap();
         let decoded: AppConfig = serde_json::from_str(&json).unwrap();

crates/pdfs-core/src/control.rs

@@ -63,6 +63,10 @@ pub enum Request {
         /// timeline. Like `kind`, the offset is relative to the filtered set.
         #[serde(default)]
         range: Option<(i64, i64)>,
+        /// Restrict the page to favourited photos. Older front-ends omit it and
+        /// get the whole timeline, as before.
+        #[serde(default)]
+        favorites: bool,
     },
     /// The months the timeline spans (newest first, with per-month counts) so a
     /// front-end can build a date scrubber without paging the whole library.
@@ -91,6 +95,14 @@ pub enum Request {
     PhotoThumbs { uids: Vec<String> },
     /// Download a photo's full content into the cache; replies with its path.
     OpenPhoto { uid: String },
+    /// Add or remove Proton's `Favorite` tag on a photo. Replies with
+    /// [`Response::Ok`].
+    ///
+    /// Favouriting a photo that is *not* on this account's own photos volume —
+    /// one shared with us, or one that lives only in an album — needs it
+    /// re-encrypted for our timeline, which the SDK does not implement yet; the
+    /// daemon reports that as an error rather than silently doing nothing.
+    SetPhotoFavorite { uid: String, favorite: bool },
     /// Upload the photo at `source_path` under the given name and media type.
     ///
     /// A path, not the bytes: this protocol is line-delimited JSON, and
@@ -108,7 +120,18 @@ pub enum Request {
     /// Download a Drive file's full content into the cache; replies with the
     /// on-disk path so the front-end can open it with the default app. `path`
     /// is mountpoint-relative.
-    OpenFile { path: String },
+    ///
+    /// `uid` addresses the same node directly and is preferred when present: a
+    /// search hit's path comes from the metadata index, which also indexes
+    /// nodes the primary mount's tree does not expose (an on-demand sync
+    /// folder, a mirror), and walking such a path from the mount root fails
+    /// with "no such file or folder". Defaulted for wire-compat with clients
+    /// predating the field; the daemon falls back to `path` without it.
+    OpenFile {
+        path: String,
+        #[serde(default)]
+        uid: Option<String>,
+    },
     /// Full-text search node names against the daemon's local metadata index.
     /// `limit` caps the number of hits returned. Replies with [`Response::SearchResults`].
     Search { query: String, limit: usize },
@@ -325,6 +348,39 @@ pub enum Request {
     /// The by-uid twin of [`Request::RemovePublicLink`].
     RemovePublicLinkByUid { uid: String, id: String },
 
+    // ---- revisions --------------------------------------------------------
+    /// List the version history of the file at mountpoint-relative `path`,
+    /// newest first. Replies with [`Response::Revisions`].
+    ListRevisions { path: String },
+    /// The by-uid twin of [`Request::ListRevisions`].
+    ListRevisionsByUid { uid: String },
+    /// Make revision `revision_id` of the file at `path` current again. The
+    /// server applies this asynchronously, so the restored content may take a
+    /// moment to appear. Replies with [`Response::Ok`].
+    RestoreRevision { path: String, revision_id: String },
+    /// The by-uid twin of [`Request::RestoreRevision`].
+    RestoreRevisionByUid { uid: String, revision_id: String },
+    /// Permanently delete revision `revision_id` of the file at `path`. The
+    /// content is unrecoverable, and the server refuses to delete the revision
+    /// that is currently active. Replies with [`Response::Ok`].
+    DeleteRevision { path: String, revision_id: String },
+    /// The by-uid twin of [`Request::DeleteRevision`].
+    DeleteRevisionByUid { uid: String, revision_id: String },
+    /// Write revision `revision_id` of the file at `path` to the absolute local
+    /// path `dest`, leaving the file's current content untouched. Replies with
+    /// [`Response::Ok`].
+    SaveRevisionAs {
+        path: String,
+        revision_id: String,
+        dest: String,
+    },
+    /// The by-uid twin of [`Request::SaveRevisionAs`].
+    SaveRevisionAsByUid {
+        uid: String,
+        revision_id: String,
+        dest: String,
+    },
+
     // ---- shared by me -----------------------------------------------------
     /// List the nodes I have shared with others — collaborative shares that still
     /// have members, pending invitations or a public link. Replies with
@@ -608,6 +664,36 @@ pub struct SharedItem {
     pub link: Option<PublicLinkInfo>,
 }
 
+/// One entry of a file's version history (in [`Response::Revisions`]).
+///
+/// The size and modification time are the ones the *uploader* claimed in the
+/// revision's extended attributes, so an old client that wrote none leaves them
+/// `None`; `size_on_storage` is always known but counts ciphertext, which is
+/// larger than the file. A front-end shows the claimed size when it has one and
+/// falls back to the storage size.
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RevisionInfo {
+    /// Server-assigned id — the handle for [`Request::RestoreRevision`],
+    /// [`Request::DeleteRevision`] and [`Request::SaveRevisionAs`].
+    pub id: String,
+    /// True for the revision that is the file's current content. It cannot be
+    /// deleted, and restoring it is a no-op.
+    pub is_active: bool,
+    /// When the revision was created, epoch seconds.
+    pub created: i64,
+    /// Encrypted size on Proton's storage, in bytes.
+    pub size_on_storage: i64,
+    /// Plaintext size as claimed by the uploader, when it wrote one.
+    pub claimed_size: Option<i64>,
+    /// Modification time as claimed by the uploader (ISO-8601, verbatim).
+    pub claimed_modified: Option<String>,
+    /// The address that signed the revision, when it was not signed anonymously
+    /// by the node key.
+    pub signed_by: Option<String>,
+    /// Whether the revision carries thumbnails.
+    pub has_thumbnails: bool,
+}
+
 /// What happened, in an [`ActivityEntry`]. Kept coarse: a front-end maps each to
 /// an icon and a verb, and the human detail lives in the entry's fields.
 #[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq)]
@@ -1014,6 +1100,11 @@ pub struct PhotoItem {
     /// the split omit it; a front-end then treats everything as a still photo.
     #[serde(default = "default_photo_kind")]
     pub kind: PhotoKind,
+    /// Whether the photo is favourited. Older daemons omit it, which a front-end
+    /// reads as "not favourited" — the same thing it would show for a photo whose
+    /// tags it has not learned yet.
+    #[serde(default)]
+    pub favorite: bool,
 }
 
 /// A daemon too old to classify a timeline entry is assumed to have served a
@@ -1102,6 +1193,28 @@ pub enum Response {
         /// calling a queued `mkdir` an upload is a lie.
         #[serde(default)]
         pending_changes: u64,
+        /// Queued writes held back because the file still wears a transient
+        /// name (a browser's `*.crdownload`, an editor's `*.swp`). They are not
+        /// waiting on the network and will not drain until the finalising
+        /// rename, so they are counted apart from `pending_uploads`.
+        #[serde(default)]
+        parked_uploads: u64,
+        /// Queued ops that have failed enough times to be considered stuck.
+        /// They keep retrying forever — correctly, since their staged bytes are
+        /// the only copy — which is why they have to be visible.
+        #[serde(default)]
+        failing_ops: u64,
+        /// The most recent error from a stuck op, when there is one.
+        #[serde(default)]
+        failing_error: Option<String>,
+        /// Bytes held in `staging/`: writes accepted from the kernel whose only
+        /// copy is on local disk. Never evictable, never counted against the
+        /// cache budget — hence reported separately.
+        #[serde(default)]
+        staged_bytes: u64,
+        /// Age of the oldest staged write, in seconds.
+        #[serde(default)]
+        staged_oldest_secs: u64,
     },
     /// A human-readable success message.
     Ok { message: String },
@@ -1126,6 +1239,12 @@ pub enum Response {
         /// Whether the integrity check actually ran, so an empty problem list
         /// is not mistaken for a clean bill of health it never gave.
         integrity_checked: bool,
+        /// Whether a deep check is running right now. It reads every page of
+        /// the database under the daemon's only connection, so it is answered
+        /// asynchronously: this says "ask again shortly", which is a different
+        /// thing to say than either of the two above.
+        #[serde(default)]
+        integrity_running: bool,
     },
     /// The pin registry.
     Pins { pins: Vec<Pin> },
@@ -1209,6 +1328,9 @@ pub enum Response {
     AccountQuota { max_space: i64, used_space: i64 },
     /// Nodes I have shared with others (reply to [`Request::ListSharedByMe`]).
     SharedByMe { items: Vec<SharedItem> },
+    /// A file's version history, newest first (reply to
+    /// [`Request::ListRevisions`]).
+    Revisions { items: Vec<RevisionInfo> },
     /// The daemon's recent activity, newest first (reply to
     /// [`Request::ListActivity`]).
     Activity { items: Vec<ActivityEntry> },
@@ -1858,6 +1980,101 @@ mod tests {
         );
     }
 
+    /// The revision requests come in path and by-uid pairs like the share ones,
+    /// and carry a revision id that must survive the round-trip verbatim: acting
+    /// on the wrong revision deletes content the user meant to keep.
+    #[test]
+    fn revision_requests_roundtrip_in_both_addressing_forms() {
+        let cases = [
+            (
+                Request::ListRevisions { path: "a/b".into() },
+                r#"{"ListRevisions":{"path":"a/b"}}"#,
+            ),
+            (
+                Request::ListRevisionsByUid {
+                    uid: "vol~link".into(),
+                },
+                r#"{"ListRevisionsByUid":{"uid":"vol~link"}}"#,
+            ),
+            (
+                Request::RestoreRevision {
+                    path: "a/b".into(),
+                    revision_id: "rev-1".into(),
+                },
+                r#"{"RestoreRevision":{"path":"a/b","revision_id":"rev-1"}}"#,
+            ),
+            (
+                Request::RestoreRevisionByUid {
+                    uid: "vol~link".into(),
+                    revision_id: "rev-1".into(),
+                },
+                r#"{"RestoreRevisionByUid":{"uid":"vol~link","revision_id":"rev-1"}}"#,
+            ),
+            (
+                Request::DeleteRevision {
+                    path: "a/b".into(),
+                    revision_id: "rev-2".into(),
+                },
+                r#"{"DeleteRevision":{"path":"a/b","revision_id":"rev-2"}}"#,
+            ),
+            (
+                Request::DeleteRevisionByUid {
+                    uid: "vol~link".into(),
+                    revision_id: "rev-2".into(),
+                },
+                r#"{"DeleteRevisionByUid":{"uid":"vol~link","revision_id":"rev-2"}}"#,
+            ),
+            (
+                Request::SaveRevisionAs {
+                    path: "a/b".into(),
+                    revision_id: "rev-3".into(),
+                    dest: "/tmp/out.bin".into(),
+                },
+                r#"{"SaveRevisionAs":{"path":"a/b","revision_id":"rev-3","dest":"/tmp/out.bin"}}"#,
+            ),
+            (
+                Request::SaveRevisionAsByUid {
+                    uid: "vol~link".into(),
+                    revision_id: "rev-3".into(),
+                    dest: "/tmp/out.bin".into(),
+                },
+                r#"{"SaveRevisionAsByUid":{"uid":"vol~link","revision_id":"rev-3","dest":"/tmp/out.bin"}}"#,
+            ),
+        ];
+        for (request, wire) in cases {
+            assert_eq!(serde_json::to_string(&request).unwrap(), wire);
+            let decoded: Request = serde_json::from_str(wire).unwrap();
+            assert_eq!(serde_json::to_string(&decoded).unwrap(), wire);
+        }
+    }
+
+    /// A front-end that predates the favourites filter sends no `favorites`
+    /// field, and must keep getting the whole timeline rather than an empty page.
+    #[test]
+    fn timeline_requests_without_the_favorites_filter_still_decode() {
+        let decoded: Request =
+            serde_json::from_str(r#"{"PhotosTimeline":{"offset":0,"limit":50}}"#).unwrap();
+        assert!(matches!(
+            decoded,
+            Request::PhotosTimeline {
+                favorites: false,
+                kind: None,
+                range: None,
+                ..
+            }
+        ));
+
+        let wire = serde_json::to_string(&Request::SetPhotoFavorite {
+            uid: "vol~link".into(),
+            favorite: true,
+        })
+        .unwrap();
+        assert_eq!(
+            wire,
+            r#"{"SetPhotoFavorite":{"uid":"vol~link","favorite":true}}"#
+        );
+    }
+
     #[test]
     fn path_share_requests_keep_their_existing_wire_shape() {
         let cases = [
@@ -1995,6 +2212,24 @@ mod tests {
         }
     }
 
+    #[test]
+    fn open_file_accepts_a_request_from_a_client_predating_the_uid_field() {
+        let legacy = r#"{"OpenFile":{"path":"Documents/ONBOARDING.md"}}"#;
+        let Request::OpenFile { path, uid } = serde_json::from_str::<Request>(legacy).unwrap()
+        else {
+            panic!("decoded into the wrong variant");
+        };
+        assert_eq!(path, "Documents/ONBOARDING.md");
+        assert_eq!(uid, None);
+
+        let with_uid = serde_json::to_string(&Request::OpenFile {
+            path: "Documents/ONBOARDING.md".into(),
+            uid: Some("vol~link".into()),
+        })
+        .unwrap();
+        assert!(with_uid.contains("vol~link"));
+    }
+
     #[test]
     fn legacy_daemons_reject_new_by_uid_variants() {
         #[allow(dead_code)]

crates/pdfs-core/src/db/activity.rs

@@ -33,7 +33,7 @@ impl Db {
     /// whose stored `kind` no longer parses (written by an older build) are
     /// skipped rather than failing the whole read.
     pub fn activity_list(&self, limit: usize) -> Result<Vec<ActivityEntry>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let mut stmt = conn.prepare(
             "SELECT time, kind, target, detail, ok FROM activity
              ORDER BY id DESC LIMIT ?1",

crates/pdfs-core/src/db/albums.rs

@@ -76,7 +76,7 @@ impl Db {
 
     /// The persisted album listing, in stored order.
     pub fn albums_list(&self) -> Result<Vec<StoredAlbum>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let mut stmt = conn.prepare(
             "SELECT uid, name, photo_count, cover_uid, last_activity, shared
              FROM albums ORDER BY seq",
@@ -98,7 +98,7 @@ impl Db {
 
     /// Number of albums in the persisted listing.
     pub fn albums_count(&self) -> Result<usize> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let n: i64 = conn.query_row("SELECT COUNT(*) FROM albums", [], |r| r.get(0))?;
         Ok(n.max(0) as usize)
     }
@@ -164,7 +164,7 @@ impl Db {
         offset: usize,
         limit: usize,
     ) -> Result<Vec<StoredPhoto>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let mut stmt = conn.prepare(
             "SELECT uid, capture_time, name, ratio, thumb_state, kind FROM album_photos
              WHERE album_uid = ?1 ORDER BY seq LIMIT ?2 OFFSET ?3",
@@ -178,6 +178,10 @@ impl Db {
                     ratio: r.get(3)?,
                     thumb_state: r.get(4)?,
                     kind: crate::control::PhotoKind::from_i64(r.get(5)?),
+                    // Album rows have no favourite state of their own: an album
+                    // photo on someone else's volume is not in our timeline, and
+                    // favouriting one is not supported yet anyway.
+                    favorite: false,
                 })
             })?
             .collect::<rusqlite::Result<_>>()?;
@@ -186,7 +190,7 @@ impl Db {
 
     /// How many photos of `album_uid` are persisted.
     pub fn album_photos_count(&self, album_uid: &str) -> Result<usize> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let n: i64 = conn.query_row(
             "SELECT COUNT(*) FROM album_photos WHERE album_uid = ?1",
             [album_uid],
@@ -203,7 +207,7 @@ impl Db {
         if uids.is_empty() {
             return Ok(Vec::new());
         }
-        let conn = self.conn.lock();
+        let conn = self.read();
         let placeholders = vec!["?"; uids.len()].join(",");
         let mut stmt = conn.prepare(&format!(
             "SELECT uid, capture_time, name, ratio, thumb_state, kind FROM album_photos
@@ -218,6 +222,10 @@ impl Db {
                     ratio: r.get(3)?,
                     thumb_state: r.get(4)?,
                     kind: crate::control::PhotoKind::from_i64(r.get(5)?),
+                    // Album rows have no favourite state of their own: an album
+                    // photo on someone else's volume is not in our timeline, and
+                    // favouriting one is not supported yet anyway.
+                    favorite: false,
                 })
             })?
             .collect::<rusqlite::Result<_>>()?;

crates/pdfs-core/src/db/cache.rs

@@ -42,6 +42,30 @@ impl Db {
         Ok(())
     }
 
+    /// Bump `last_accessed` for many keys in one transaction.
+    ///
+    /// The read path touches a key per 128 KiB the kernel asks for — 32 times
+    /// per 4 MiB block — and each of those was its own write transaction under
+    /// the single connection mutex, contending with every `lookup` and
+    /// `readdir`. Callers accumulate touches in memory and flush them here.
+    pub fn cache_accessed_batch(&self, touches: &[(String, i64)]) -> Result<()> {
+        if touches.is_empty() {
+            return Ok(());
+        }
+        let mut conn = self.conn.lock();
+        let tx = conn.transaction()?;
+        {
+            let mut stmt = tx.prepare_cached(
+                "UPDATE cache_entries SET last_accessed = ?2 WHERE cache_key = ?1",
+            )?;
+            for (key, at) in touches {
+                stmt.execute(params![key, at])?;
+            }
+        }
+        tx.commit()?;
+        Ok(())
+    }
+
     /// Drop a single cache-entry row (one evicted blob or block).
     pub fn cache_remove(&self, key: &str) -> Result<()> {
         let conn = self.conn.lock();
@@ -75,7 +99,7 @@ impl Db {
     /// because `enforce_block_budget` runs on every cached block — once per
     /// 4 MiB of every cold read — while holding the shared connection.
     pub fn cache_total_bytes(&self, kind: &str) -> Result<u64> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let total: i64 = conn.query_row(
             "SELECT COALESCE(SUM(size_bytes), 0) FROM cache_entries WHERE kind = ?1",
             params![kind],
@@ -95,7 +119,7 @@ impl Db {
         kind: &str,
         limit: usize,
     ) -> Result<Vec<(String, u64)>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let mut stmt = conn.prepare_cached(
             "SELECT cache_key, size_bytes FROM cache_entries
              WHERE kind = ?1 ORDER BY last_accessed ASC LIMIT ?2",
@@ -115,7 +139,7 @@ impl Db {
     /// (`clear_unpinned`); incremental eviction wants
     /// [`cache_eviction_candidates`](Self::cache_eviction_candidates).
     pub fn cache_entries_by_kind(&self, kind: &str) -> Result<Vec<(String, u64)>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let mut stmt = conn.prepare(
             "SELECT cache_key, size_bytes FROM cache_entries
              WHERE kind = ?1 ORDER BY last_accessed ASC",

crates/pdfs-core/src/db/devices.rs

@@ -15,7 +15,7 @@ pub struct StoredDevice {
 
 impl Db {
     pub fn device_get(&self) -> Result<Option<StoredDevice>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         conn.query_row(
             "SELECT uid, share_id, root_uid, name, created FROM device LIMIT 1",
             [],

crates/pdfs-core/src/db/local.rs

@@ -41,32 +41,43 @@ impl Db {
         Ok(next)
     }
 
-    /// Write one batch of walked entries under scan generation `generation`. The
+    /// Write one batch of walked entries under scan generation `generation`,
-    /// FTS index is *not* touched here — it is rebuilt once in
+    /// keeping the FTS index in step with them.
-    /// [`local_finish_scan`](Self::local_finish_scan).
+    ///
+    /// The index is maintained incrementally rather than rebuilt at the end of
+    /// the scan, because a rebuild reads and re-tokenises every row in the table
+    /// — trigrams over a few hundred thousand paths — inside one transaction on
+    /// the single shared connection, which stalls the whole mount for as long as
+    /// it takes. Incremental maintenance is possible here for a reason specific
+    /// to this table: `local_fts` covers `name` and `path`, `path` is the
+    /// table's key, and `name` is derived from it, so an existing row's indexed
+    /// content can never change. Only insertions and deletions touch the index;
+    /// a re-scan that finds the same files does no index work at all.
+    ///
+    /// Hence the update-then-insert shape below rather than an upsert: the
+    /// distinction between "already indexed" and "new row" is exactly what
+    /// decides whether the index needs a write.
     pub fn local_upsert_batch(&self, generation: i64, entries: &[LocalEntry]) -> Result<()> {
         let mut conn = self.conn.lock();
         let tx = conn.transaction()?;
         {
-            let mut stmt = tx.prepare_cached(
+            let mut update = tx.prepare_cached(
-                "INSERT INTO local_files (path, name, is_dir, size, mtime, scan_gen)
+                "UPDATE local_files
-                 VALUES (?1, ?2, ?3, ?4, ?5, ?6)
+                    SET name = ?2, is_dir = ?3, size = ?4, mtime = ?5, scan_gen = ?6
-                 ON CONFLICT(path) DO UPDATE SET
+                  WHERE path = ?1",
-                   name     = excluded.name,
-                   is_dir   = excluded.is_dir,
-                   size     = excluded.size,
-                   mtime    = excluded.mtime,
-                   scan_gen = excluded.scan_gen",
             )?;
+            let mut insert = tx.prepare_cached(
+                "INSERT INTO local_files (path, name, is_dir, size, mtime, scan_gen)
+                 VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
+            )?;
+            let mut index =
+                tx.prepare_cached("INSERT INTO local_fts (rowid, name, path) VALUES (?1, ?2, ?3)")?;
             for e in entries {
-                stmt.execute(params![
+                let row = params![e.path, e.name, e.is_dir as i64, e.size, e.mtime, generation];
-                    e.path,
+                if update.execute(row)? == 0 {
-                    e.name,
+                    insert.execute(row)?;
-                    e.is_dir as i64,
+                    index.execute(params![tx.last_insert_rowid(), e.name, e.path])?;
-                    e.size,
+                }
-                    e.mtime,
-                    generation
-                ])?;
             }
         }
         tx.commit()?;
@@ -74,16 +85,25 @@ impl Db {
     }
 
     /// Close scan generation `generation`: drop every row an older scan wrote
-    /// (those paths are gone from disk), rebuild the FTS index over what remains,
+    /// (those paths are gone from disk), drop their FTS entries, and stamp the
-    /// and stamp the completion time. Returns the number of indexed entries.
+    /// completion time. Returns the number of indexed entries.
+    ///
+    /// The FTS deletes name the old values explicitly, which is how an
+    /// external-content FTS5 table is told to retract a row — see
+    /// [`local_upsert_batch`](Self::local_upsert_batch) for why this is done
+    /// per-row instead of by rebuilding the index.
     pub fn local_finish_scan(&self, generation: i64, finished_at: i64) -> Result<i64> {
         let mut conn = self.conn.lock();
         let tx = conn.transaction()?;
+        tx.execute(
+            "INSERT INTO local_fts (local_fts, rowid, name, path)
+             SELECT 'delete', id, name, path FROM local_files WHERE scan_gen != ?1",
+            params![generation],
+        )?;
         tx.execute(
             "DELETE FROM local_files WHERE scan_gen != ?1",
             params![generation],
         )?;
-        tx.execute_batch("INSERT INTO local_fts(local_fts) VALUES('rebuild');")?;
         tx.execute(
             "INSERT INTO sync_state (key, value) VALUES ('local_indexed_at', ?1)
              ON CONFLICT(key) DO UPDATE SET value = excluded.value",
@@ -98,7 +118,7 @@ impl Db {
     /// has never been built. The daemon uses this to decide whether a fresh mount
     /// needs an immediate rescan or can serve the existing index.
     pub fn local_indexed_at(&self) -> Result<Option<i64>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         Ok(conn
             .query_row(
                 "SELECT value FROM sync_state WHERE key = 'local_indexed_at'",
@@ -118,7 +138,7 @@ impl Db {
         if query.is_empty() {
             return Ok(Vec::new());
         }
-        let conn = self.conn.lock();
+        let conn = self.read();
         let mut stmt;
         let rows = if query.chars().count() < TRIGRAM_MIN {
             let pat = format!("%{}%", like_escape(query));
@@ -157,7 +177,7 @@ impl Db {
         if query.is_empty() || limit == 0 {
             return Ok(Vec::new());
         }
-        let conn = self.conn.lock();
+        let conn = self.read();
         let terms = candidate_trigrams(query);
         let lane_limit = limit.div_ceil(2);
         let mut rows: Vec<LocalFileHit> = if terms.is_empty() {
@@ -182,16 +202,36 @@ impl Db {
         if !terms.is_empty()
             && let Some(first) = query.chars().next()
         {
-            let prefix = format!("{}%", like_escape(&first.to_string()));
+            // Trigram rank says nothing about how well a name *starts* with the
-            let mut stmt = conn.prepare(
+            // query, so on a home directory full of dependency trees the pool
-                "SELECT path, name, is_dir, size, mtime FROM local_files
+            // fills with vendored files before the obvious answer is reached
-                 WHERE name COLLATE NOCASE LIKE ?1 ESCAPE '\\'
+            // (measured: 73% of the 500 best-ranked candidates for "test" came
-                 ORDER BY name COLLATE NOCASE LIMIT ?2",
+            // from one Go module cache). Give whole-query prefix matches their
-            )?;
+            // own lane, newest first, and keep the single-character lane —
-            let fallback = stmt
+            // which recovers a typo that destroyed every trigram — behind it.
-                .query_map(params![prefix, lane_limit as i64], local_hit)?
+            let mut lanes = vec![(
-                .collect::<std::result::Result<Vec<_>, _>>()?;
+                format!("{}%", like_escape(query)),
-            for hit in fallback {
+                "ORDER BY mtime DESC LIMIT ?2",
+            )];
+            lanes.push((
+                format!("{}%", like_escape(&first.to_string())),
+                "ORDER BY name COLLATE NOCASE LIMIT ?2",
+            ));
+            let mut extra = Vec::new();
+            for (pattern, order) in lanes {
+                let mut stmt = conn.prepare(&format!(
+                    "SELECT path, name, is_dir, size, mtime FROM local_files
+                     WHERE name COLLATE NOCASE LIKE ?1 ESCAPE '\\' {order}"
+                ))?;
+                extra.extend(
+                    stmt.query_map(params![pattern, lane_limit as i64], local_hit)?
+                        .collect::<std::result::Result<Vec<_>, _>>()?,
+                );
+            }
+            // Prefix hits go in front: `rows` is truncated to `limit` below, and
+            // the lane exists precisely because trigram rank was burying them.
+            let trigram = std::mem::take(&mut rows);
+            for hit in extra.into_iter().chain(trigram) {
                 if !rows.iter().any(|existing| existing.path == hit.path) {
                     rows.push(hit);
                 }

crates/pdfs-core/src/db/migrations.rs

@@ -9,7 +9,7 @@ use super::Db;
 use crate::Result;
 
 /// Current schema version. Bump on every forward migration added below.
-pub(super) const SCHEMA_VERSION: i64 = 19;
+pub(super) const SCHEMA_VERSION: i64 = 28;
 
 impl Db {
     pub(super) fn migrate(&self) -> Result<()> {
@@ -98,6 +98,126 @@ impl Db {
         if current < 19 {
             tx.execute_batch(MIGRATION_V19)?;
         }
+        if current < 20 {
+            tx.execute_batch(MIGRATION_V20)?;
+        }
+        if current < 21 {
+            // A V17-and-older fixture may carry only the tables its own test
+            // cares about; there is nothing to reindex without `nodes`.
+            let has_nodes: bool = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'nodes'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            if has_nodes {
+                tx.execute_batch(MIGRATION_V21)?;
+            }
+        }
+        if current < 22 {
+            // Older fixtures (and a database that never grew a table because
+            // its feature was never used) may be missing any of these, and an
+            // index on an absent table is a hard error rather than a no-op.
+            for (table, sql) in MIGRATION_V22 {
+                let present: bool = tx.query_row(
+                    "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = ?1",
+                    [table],
+                    |row| row.get::<_, i64>(0),
+                )? > 0;
+                if present {
+                    tx.execute_batch(sql)?;
+                }
+            }
+            // `activity_time` indexes `time DESC` while both activity queries
+            // order by `id`: it has only ever cost writes.
+            tx.execute_batch("DROP INDEX IF EXISTS activity_time;")?;
+        }
+        if current < 23 {
+            // One last full rebuild of the local index, because from here on the
+            // scan maintains it incrementally (`local_upsert_batch`) and so can
+            // no longer repair a `local_fts` that drifted from `local_files`.
+            // Whatever it costs, it costs once, at startup, before the mount
+            // serves anything.
+            let present: bool = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'local_fts'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            if present {
+                tx.execute_batch("INSERT INTO local_fts(local_fts) VALUES('rebuild');")?;
+            }
+        }
+        if current < 24 {
+            tx.execute_batch(MIGRATION_V24)?;
+        }
+        if current < 25 {
+            // Same guard as V21: an old fixture may not have `nodes` at all,
+            // and there is no path to materialise without it.
+            let has_nodes: bool = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'nodes'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            if has_nodes {
+                tx.execute_batch(MIGRATION_V25)?;
+            }
+        }
+        if current < 26 {
+            // Same guard as V22: a fixture that never exercised the queue may
+            // not have `pending_op`, and altering an absent table is an error
+            // rather than a no-op.
+            // A fixture built from the current schema and then rewound to an
+            // older `schema_version` already has the column, and `ADD COLUMN`
+            // has no `IF NOT EXISTS`.
+            let has_column: bool = tx.query_row(
+                "SELECT COUNT(*) FROM pragma_table_info('pending_op') WHERE name = 'claimed_at'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            let has_ops: bool = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'pending_op'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            if has_ops && !has_column {
+                tx.execute_batch(MIGRATION_V26)?;
+            }
+        }
+        if current < 27 {
+            // Same guards as V26, for the same two reasons: the table may not
+            // exist in an old fixture, and a fixture rewound from the current
+            // schema already has the column.
+            let has_column: bool = tx.query_row(
+                "SELECT COUNT(*) FROM pragma_table_info('pending_op') \
+                 WHERE name = 'access_deferred_since'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            let has_ops: bool = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'pending_op'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            if has_ops && !has_column {
+                tx.execute_batch(MIGRATION_V27)?;
+            }
+        }
+        if current < 28 {
+            // Same guards as V26/V27, for the same two reasons.
+            let has_column: bool = tx.query_row(
+                "SELECT COUNT(*) FROM pragma_table_info('sync_entry') \
+                 WHERE name = 'local_mtime_ns'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            let has_entries: bool = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'sync_entry'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            if has_entries && !has_column {
+                tx.execute_batch(MIGRATION_V28)?;
+            }
+        }
         tx.execute(
             "INSERT INTO sync_state (key, value) VALUES ('schema_version', ?1)
              ON CONFLICT(key) DO UPDATE SET value = excluded.value",
@@ -511,3 +631,218 @@ CREATE TABLE album_photos (
 CREATE INDEX idx_album_photos_seq ON album_photos(album_uid, seq);
 CREATE INDEX idx_album_photos_uid ON album_photos(uid);
 ";
+
+/// V20: whether a photo is a favourite.
+///
+/// A column rather than a tag table: `Favorite` is the only Proton photo tag a
+/// user sets by hand (the rest — Video, Screenshot, Selfie, Raw… — are the
+/// server's own classification, and the Photos page already derives its tabs
+/// from the media type). Defaulting to 0 means an existing timeline stays
+/// intact and each row learns its real value on the next refresh, the same way
+/// `media_type` did.
+const MIGRATION_V20: &str = "
+ALTER TABLE photos ADD COLUMN favorite INTEGER NOT NULL DEFAULT 0;
+CREATE INDEX IF NOT EXISTS idx_photos_favorite ON photos(favorite, seq);
+";
+
+/// V21: rebuild the node search index after fixing what counts as indexable.
+///
+/// The v16 backfill rooted its path walk at any node whose parent is null *or*
+/// not cached, but the write path's `node_is_indexable_tx` demanded a
+/// null-parent ancestor. Only the My Files root has one — a device folder's
+/// root is stored in `device`/`sync_folder`, never in `nodes` — so every node
+/// under a device folder was dropped from `nodes_fts` the first time it was
+/// upserted after the backfill, and was unfindable from the prompt (2,705 of
+/// 9,252 nodes on the account this was diagnosed against).
+///
+/// The rule now matches the backfill, so this replays it: same recursive walk
+/// as v16, over the current `nodes`.
+/// Two details the v16 backfill did not carry, both cheap here: a node under a
+/// trashed folder stays out (the write path has always excluded it, and
+/// `tombstone_subtree_tx` only marks a subtree it was told about), and the walk
+/// is depth-capped so a parent cycle in a corrupted database cannot spin the
+/// migration forever.
+const MIGRATION_V21: &str = "
+DROP TABLE IF EXISTS nodes_fts;
+CREATE VIRTUAL TABLE nodes_fts USING fts5(
+  name, path, tokenize='trigram'
+);
+INSERT INTO nodes_fts (rowid, name, path)
+WITH RECURSIVE paths(rowid, uid, path, trashed, depth) AS (
+  -- Only a true root (no parent at all) contributes nothing to the path: its
+  -- name is the mount. A row whose parent is merely uncached is an ordinary
+  -- folder and keeps its name, which is what `path_of` does at runtime.
+  SELECT n.rowid, n.uid,
+         CASE WHEN n.parent_uid IS NULL THEN '' ELSE n.name END, n.trashed, 0
+    FROM nodes n
+   WHERE n.parent_uid IS NULL
+      OR NOT EXISTS (SELECT 1 FROM nodes p WHERE p.uid = n.parent_uid)
+  UNION ALL
+  SELECT n.rowid, n.uid,
+         CASE WHEN paths.path = '' THEN n.name ELSE paths.path || '/' || n.name END,
+         MAX(paths.trashed, n.trashed), paths.depth + 1
+    FROM nodes n JOIN paths ON n.parent_uid = paths.uid
+   WHERE paths.depth < 256
+)
+SELECT n.rowid, n.name, paths.path
+  FROM nodes n JOIN paths ON paths.rowid = n.rowid
+ WHERE paths.trashed = 0;
+";
+
+/// V22: indexes for the lookups that were scanning, each paired with the table
+/// it needs to exist for.
+///
+/// Each backs a query on a hot path that had no index to use:
+///
+/// - `sync_entry(remote_uid)` — the reconcile resolves a remote uid to its
+///   local entry once per node, per pass.
+/// - `local_files(scan_gen)` — the sweep that retires the previous generation
+///   after a local index scan.
+/// - `nodes(parent_uid) WHERE trashed = 0` — every listing, with the partial
+///   index keeping it to the live rows a listing actually wants.
+///
+/// Deliberately *not* here: an index on `pending_op(next_attempt_at, id)`.
+/// `next_due_op` orders by `id`, which is the rowid, so it already stops at the
+/// first due row; offering the planner a `next_attempt_at` index makes it scan
+/// that index and then sort the matches by `id` instead —
+/// `next_due_op_does_not_scale_with_queue_length` measures the regression.
+const MIGRATION_V22: [(&str, &str); 3] = [
+    (
+        "sync_entry",
+        "CREATE INDEX IF NOT EXISTS idx_sync_entry_remote_uid ON sync_entry(remote_uid);",
+    ),
+    (
+        "local_files",
+        "CREATE INDEX IF NOT EXISTS idx_local_files_scan_gen ON local_files(scan_gen);",
+    ),
+    (
+        "nodes",
+        "CREATE INDEX IF NOT EXISTS idx_nodes_parent_live ON nodes(parent_uid) WHERE trashed = 0;",
+    ),
+];
+
+/// V24: the revisions this daemon sealed itself, so restarting does not reopen
+/// the conflict hole B70 layer B closed.
+///
+/// `Core::own_sealed_revs` held these in memory: a queued write whose baseline
+/// names an earlier revision is a conflict *unless* the remote sits at a
+/// revision we sealed, in which case it is one writer stalling and resuming and
+/// must supersede rather than fork a `(sync-conflict)` copy. Losing the map at
+/// shutdown meant the first drain after a restart could not tell the two apart.
+///
+/// `sealed_at` is what bounds the table: entries older than the window in which
+/// a stall→resume is plausible are pruned on write.
+const MIGRATION_V24: &str = "
+CREATE TABLE IF NOT EXISTS own_sealed_rev (
+  uid         TEXT PRIMARY KEY,
+  revision_id TEXT NOT NULL,
+  sealed_at   INTEGER NOT NULL
+);
+";
+
+/// V25: `nodes.path` — a node's mountpoint-relative path, stored rather than
+/// walked.
+///
+/// `path_of` was a recursive CTE per node, and search ran it once per candidate
+/// (up to a thousand per keystroke) on top of the one the write path already ran
+/// per descendant of every folder upsert. The value only changes when a node's
+/// name or parent changes, which is exactly when the write path is already
+/// walking the subtree — so it belongs in a column.
+///
+/// The backfill is the same walk V21 used for `nodes_fts`, minus the trashed
+/// filter: a trashed node stays out of the index but still has a path. Roots get
+/// `''` (their name is the mount), and a node whose parent is merely uncached
+/// keeps its own name — both matching what `path_of` returned at runtime.
+///
+/// Materialised into a temp table rather than written by a correlated subquery,
+/// so the recursive walk runs once instead of once per row.
+const MIGRATION_V25: &str = "
+ALTER TABLE nodes ADD COLUMN path TEXT;
+
+CREATE TEMP TABLE node_paths (uid TEXT PRIMARY KEY, path TEXT NOT NULL);
+
+INSERT INTO node_paths (uid, path)
+WITH RECURSIVE paths(uid, path, depth) AS (
+  SELECT n.uid, CASE WHEN n.parent_uid IS NULL THEN '' ELSE n.name END, 0
+    FROM nodes n
+   WHERE n.parent_uid IS NULL
+      OR NOT EXISTS (SELECT 1 FROM nodes p WHERE p.uid = n.parent_uid)
+  UNION ALL
+  SELECT n.uid,
+         CASE WHEN paths.path = '' THEN n.name ELSE paths.path || '/' || n.name END,
+         paths.depth + 1
+    FROM nodes n JOIN paths ON n.parent_uid = paths.uid
+   WHERE paths.depth < 256
+)
+SELECT uid, path FROM paths;
+
+UPDATE nodes
+   SET path = (SELECT p.path FROM node_paths p WHERE p.uid = nodes.uid)
+ WHERE EXISTS (SELECT 1 FROM node_paths p WHERE p.uid = nodes.uid);
+
+DROP TABLE node_paths;
+";
+
+/// V26: `pending_op.claimed_at` — the drain's claim column.
+///
+/// The drain was one thread taking one op at a time, so a 10 GiB upload held
+/// every queued rename and small write behind it for as long as it ran. Several
+/// workers can share the queue only if a claim is visible to the others: this
+/// column is what makes "already being drained by someone" a fact about the row
+/// rather than about one thread's local variable.
+///
+/// `0` is unclaimed; anything else is the ms at which a worker took it. A
+/// claim is process-local state that outlives nothing — the single-writer lock
+/// means a non-zero value found at open belongs to a crashed run, and
+/// [`Db::clear_op_claims`](super::Db::clear_op_claims) drops the lot.
+///
+/// The index is partial so it costs nothing on the ordinary row: only the
+/// handful of claimed rows are in it, which is exactly the set the claim query
+/// has to subtract to keep two workers off one node.
+const MIGRATION_V26: &str = "
+ALTER TABLE pending_op ADD COLUMN claimed_at INTEGER NOT NULL DEFAULT 0;
+
+CREATE INDEX IF NOT EXISTS idx_pending_op_claimed
+    ON pending_op(uid) WHERE claimed_at <> 0;
+";
+
+/// Schema v27: when an op was first deferred by the local access check.
+///
+/// An access deferral consumes no attempt and records no error — the op has not
+/// failed remotely, it has not been sent at all. That is right for a permission
+/// change the user is about to undo, and wrong for a condition that never
+/// clears: the row is re-deferred every
+/// [`DRAIN_ACCESS_RECHECK`](../../../pdfs_fuse/drain/constant.DRAIN_ACCESS_RECHECK.html)
+/// forever while `attempts`, `last_error`, `failing` and the logs all stay
+/// empty, so a queue that can never drain is indistinguishable from a busy one.
+/// Found in the field as 28 revision ops holding 18 GiB of accepted writes for
+/// 30 days, none of them visible anywhere.
+///
+/// `0` means "not currently access-deferred"; anything else is the ms at which
+/// the first consecutive deferral happened, which is what
+/// [`Db::defer_op_for_access`](super::Db::defer_op_for_access) measures the
+/// deferral against.
+const MIGRATION_V27: &str = "
+ALTER TABLE pending_op ADD COLUMN access_deferred_since INTEGER NOT NULL DEFAULT 0;
+";
+
+/// Schema v28: sub-second precision for a mirror folder's local baseline.
+///
+/// A reconcile pass decides whether the local side of a path changed by
+/// comparing `(local_mtime, local_size)` against the baseline. Both sides of
+/// that comparison were whole seconds, so an edit that landed in the same second
+/// as the last sync and left the file the same length — a fixed-size record
+/// rewritten, an image re-exported, a database page updated in place — read as
+/// *unchanged* and was never uploaded. The remote copy silently stayed at the
+/// older content until something else about the file moved (bugs.md B25).
+///
+/// Nullable rather than a converted `local_mtime * 1_000_000_000`: the
+/// nanosecond part of an existing baseline is genuinely unknown, and inventing
+/// zero for it would make every already-synced file compare as changed and
+/// re-upload an entire mirror on first start. `NULL` means "this row predates
+/// the column", which the comparison reads as "fall back to whole seconds" —
+/// exactly the behaviour that row was written under. Each row gains a real value
+/// the next time its path is synced.
+const MIGRATION_V28: &str = "
+ALTER TABLE sync_entry ADD COLUMN local_mtime_ns INTEGER;
+";

crates/pdfs-core/src/db/mod.rs

@@ -2,9 +2,17 @@
 //! inode bookkeeping, full-text search, content-cache LRU tracking, and pins.
 //!
 //! Only the daemon (`pdfs-fuse`) opens this for writes; the GUI and CLI reach
-//! the same data through the control socket. The connection is wrapped in a
+//! the same data through the control socket. There is one write connection
-//! `Mutex` because the FUSE callbacks are synchronous and already serialize
+//! behind a `Mutex` — SQLite allows exactly one writer, and the single-instance
-//! behind the `State` lock, so a connection pool would be overkill.
+//! `flock` makes sure it is ours — and a small pool of read-only connections
+//! behind [`Db::read`], which every `SELECT`-only method uses.
+//!
+//! The pool is what makes WAL worth having. The original justification for a
+//! single connection was that "FUSE callbacks already serialize behind the
+//! `State` lock"; that stopped being true when reads moved onto an 11-thread
+//! worker pool, and a lookup then queued behind whatever listing happened to be
+//! committing. Under WAL a reader never blocks the writer and vice versa, so the
+//! only thing left serialising them was this process's own mutex.
 //!
 //! This module is the P0 foundation: it opens the database, enables WAL, and
 //! applies the forward-only schema migrations. Write-through of nodes, the
@@ -18,8 +26,10 @@
 use parking_lot::Mutex;
 use rusqlite::Connection;
 
-use crate::Result;
+use crate::{Error, Result};
-use std::path::Path;
+use std::fs::File;
+use std::os::fd::AsRawFd;
+use std::path::{Path, PathBuf};
 
 mod activity;
 mod albums;
@@ -49,7 +59,8 @@ pub use ops::{
     AttachedBlob, LOCAL_VOLUME, OP_CREATE, OP_MKDIR, OP_RENAME, OP_REVISION, OP_TRASH, PARK_UNTIL,
     PendingCounts, PendingOp, RenameMeta, op_supersedes,
 };
-pub use photos::{StoredPhoto, THUMB_HAVE, THUMB_NONE, THUMB_UNKNOWN};
+pub use photos::{StoredPhoto, THUMB_HAVE, THUMB_NONE, THUMB_UNKNOWN, TimelineRow};
+pub use pins::PinRow;
 pub use sync::{StoredSyncEntry, StoredSyncFolder};
 pub use trash::StoredTrash;
 
@@ -65,18 +76,208 @@ const WAL_SIZE_LIMIT: i64 = 64 * 1024 * 1024;
 /// genuinely stuck holder surfaces as an error rather than an apparent hang.
 const BUSY_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(5);
 
+/// Page cache, in KiB (applied negated, which is how SQLite reads a size in KiB
+/// rather than in pages). 32 MiB against a database that is typically tens of
+/// MiB: large enough to hold the working set of a listing-heavy session, small
+/// enough to be unremarkable in a desktop daemon's RSS.
+const CACHE_SIZE_KIB: i64 = 32 * 1024;
+
+/// Ceiling on the memory-mapped window over the database file. 256 MiB covers
+/// any realistic index while keeping the mapping bounded.
+const MMAP_SIZE: i64 = 256 * 1024 * 1024;
+
+/// WAL pages between automatic checkpoints (default 1000, i.e. ~4 MiB). Halved
+/// so the synchronous checkpoint a committing thread inherits stays short.
+const WAL_AUTOCHECKPOINT_PAGES: i64 = 500;
+
 /// Handle to the unified metadata database.
 ///
 /// Cheap to wrap in an `Arc`; clone the `Arc`, not this. All access goes through
 /// the inner `Mutex<Connection>`.
 pub struct Db {
     conn: Mutex<Connection>,
+    /// Read-only connections for `SELECT`-only methods. `None` for an in-memory
+    /// database, where a second connection would open a different, empty one —
+    /// those fall back to the write connection.
+    readers: Option<ReadPool>,
+    /// The single-writer lock, held open for as long as this handle lives.
+    ///
+    /// Never read; dropping the `File` is what releases the `flock`, so it has
+    /// to be owned here rather than by `open`'s stack frame. `None` for
+    /// in-memory databases, which nothing else can reach.
+    _single_writer: Option<File>,
+}
+
+/// Idle read-only connections, opened on demand and kept for reuse.
+///
+/// Not a bounded pool: the number in flight is bounded by the number of threads
+/// that can be inside a read at once (the FUSE worker lanes plus the control
+/// handlers), and blocking one of those on a permit would reintroduce exactly
+/// the queueing this exists to remove. Only the *idle* set is capped, so a burst
+/// does not leave a connection per thread parked forever.
+struct ReadPool {
+    path: PathBuf,
+    idle: Mutex<Vec<Connection>>,
+}
+
+/// How many idle read connections to keep. Enough that the steady state never
+/// reopens, small enough to be unremarkable.
+const MAX_IDLE_READERS: usize = 4;
+
+impl ReadPool {
+    fn take(&self) -> Option<Connection> {
+        if let Some(conn) = self.idle.lock().pop() {
+            return Some(conn);
+        }
+        match open_read_only(&self.path) {
+            Ok(conn) => Some(conn),
+            Err(error) => {
+                // Falling back to the write connection is correct, just slower,
+                // so this is a warning and not a failed read.
+                tracing::warn!(%error, "could not open a read-only connection");
+                None
+            }
+        }
+    }
+
+    fn put(&self, conn: Connection) {
+        let mut idle = self.idle.lock();
+        if idle.len() < MAX_IDLE_READERS {
+            idle.push(conn);
+        }
+    }
+}
+
+/// A connection to read through: one borrowed from [`ReadPool`], or the write
+/// connection when there is no pool (in-memory) or opening one failed.
+///
+/// Derefs to `Connection`, so a method converts by swapping `self.conn.lock()`
+/// for `self.read()` and nothing else.
+pub(super) struct Reader<'a> {
+    pooled: Option<Connection>,
+    writer: Option<parking_lot::MutexGuard<'a, Connection>>,
+    pool: Option<&'a ReadPool>,
+}
+
+impl std::ops::Deref for Reader<'_> {
+    type Target = Connection;
+
+    fn deref(&self) -> &Connection {
+        self.pooled
+            .as_ref()
+            .or(self.writer.as_deref())
+            .expect("a Reader always holds one of the two")
+    }
+}
+
+impl Drop for Reader<'_> {
+    fn drop(&mut self) {
+        if let (Some(conn), Some(pool)) = (self.pooled.take(), self.pool) {
+            pool.put(conn);
+        }
+    }
+}
+
+/// Open a second connection to the same file for reads only.
+///
+/// `SQLITE_OPEN_READ_ONLY` plus `query_only` is belt and braces: the flag stops
+/// a routing mistake at the file, the pragma stops it at the statement. The rest
+/// mirror [`Db::open_configured`] — a read connection has its own page cache,
+/// its own temp store and its own busy timeout, and gets nothing from the
+/// writer's.
+///
+/// `journal_mode` is deliberately absent: it is a property of the database file,
+/// which the writer already set to WAL, and a read-only connection cannot change
+/// it anyway.
+fn open_read_only(path: &Path) -> Result<Connection> {
+    use rusqlite::OpenFlags;
+    let conn = Connection::open_with_flags(
+        path,
+        OpenFlags::SQLITE_OPEN_READ_ONLY | OpenFlags::SQLITE_OPEN_NO_MUTEX,
+    )?;
+    conn.busy_timeout(BUSY_TIMEOUT)?;
+    conn.pragma_update(None, "cache_size", -CACHE_SIZE_KIB)?;
+    conn.pragma_update(None, "temp_store", "MEMORY")?;
+    conn.pragma_update(None, "mmap_size", MMAP_SIZE)?;
+    conn.pragma_update(None, "query_only", true)?;
+    Ok(conn)
 }
 
 impl Db {
     /// Open (creating if absent) the database at `path`, enable WAL, and bring
     /// the schema up to [`SCHEMA_VERSION`].
+    ///
+    /// Takes the single-instance lock first (see
+    /// [`acquire_single_writer_lock`]), and rebuilds from empty if what is on
+    /// disk turns out not to be a readable database (see [`is_corrupt`]).
     pub fn open(path: &Path) -> Result<Self> {
+        let single_writer = acquire_single_writer_lock(path)?;
+        let conn = match Self::open_configured(path) {
+            Ok(conn) => conn,
+            Err(e) if is_corrupt(&e) => {
+                // Every byte in here is derived from the account or from the
+                // content cache directory, so the recovery is to start over —
+                // loudly, and keeping the damaged file for a post-mortem rather
+                // than deleting evidence.
+                tracing::error!(
+                    db = %path.display(),
+                    error = %e,
+                    "cache database is corrupt — moving it aside and rebuilding \
+                     (metadata will be re-fetched; no user data is stored here)"
+                );
+                quarantine_corrupt_db(path)?;
+                Self::open_configured(path)?
+            }
+            Err(e) => return Err(e),
+        };
+        let db = Self {
+            conn: Mutex::new(conn),
+            // No pool for `:memory:`. A second connection to that name is a
+            // second, empty database rather than another view of this one, so
+            // every routed read would find a schema that does not exist.
+            readers: (!is_in_memory(path)).then(|| ReadPool {
+                path: path.to_path_buf(),
+                idle: Mutex::new(Vec::new()),
+            }),
+            _single_writer: single_writer,
+        };
+        // A drain claim names a worker thread in the process that took it, and
+        // the single-writer lock above says that process is not running. Any
+        // claim still on disk is therefore a crashed run's, and leaving it would
+        // hide those ops from every worker for good.
+        match db.clear_op_claims() {
+            Ok(0) => {}
+            Ok(n) => tracing::info!(ops = n, "released drain claims left by a previous run"),
+            Err(e) => tracing::warn!(error = %e, "clearing stale drain claims failed"),
+        }
+        Ok(db)
+    }
+
+    /// A connection for a `SELECT`-only method.
+    ///
+    /// Reads see the last committed state, which is the same thing they saw
+    /// through the write connection: every method here commits before it
+    /// returns, and nothing holds a transaction open across calls.
+    pub(super) fn read(&self) -> Reader<'_> {
+        if let Some(pool) = &self.readers
+            && let Some(conn) = pool.take()
+        {
+            return Reader {
+                pooled: Some(conn),
+                writer: None,
+                pool: Some(pool),
+            };
+        }
+        Reader {
+            pooled: None,
+            writer: Some(self.conn.lock()),
+            pool: None,
+        }
+    }
+
+    /// Open the file, apply every PRAGMA, and migrate. Split out of
+    /// [`open`](Self::open) so the corruption path can retry it verbatim.
+    fn open_configured(path: &Path) -> Result<Connection> {
         let conn = Connection::open(path)?;
         // WAL: readers never block the single writer. NORMAL sync is the
         // standard durability/throughput tradeoff for WAL.
@@ -101,12 +302,39 @@ impl Db {
         // (Bare SQLite does default to 0, which is where the belief that this
         // was unset came from. That default is not what we get.)
         conn.busy_timeout(BUSY_TIMEOUT)?;
+        // Page cache. The default is 2 MiB, against a schema whose hot table
+        // stores a JSON blob per node — a listing of a few thousand files
+        // evicts itself while it is being read.
+        conn.pragma_update(None, "cache_size", -CACHE_SIZE_KIB)?;
+        // Sorts and recursive CTEs materialise their intermediate results.
+        // Every `ORDER BY … COLLATE NOCASE` listing and every ancestor walk
+        // spills those to a file in `/tmp` by default; they are small and
+        // short-lived, so memory is both faster and less surprising.
+        conn.pragma_update(None, "temp_store", "MEMORY")?;
+        // Read the database through the page cache of the OS rather than
+        // `pread` per page. Bounded rather than unlimited so the daemon's RSS
+        // does not track the database size.
+        conn.pragma_update(None, "mmap_size", MMAP_SIZE)?;
+        // Checkpointing is synchronous in whichever thread happens to commit
+        // the transaction that crosses the threshold — often a FUSE callback.
+        // A smaller autocheckpoint makes that debt smaller and more frequent
+        // rather than rare and multi-second.
+        conn.pragma_update(None, "wal_autocheckpoint", WAL_AUTOCHECKPOINT_PAGES)?;
 
         let db = Self {
             conn: Mutex::new(conn),
+            readers: None,
+            _single_writer: None,
         };
         db.migrate()?;
-        Ok(db)
+        Ok(db.into_conn())
+    }
+
+    /// Unwrap the connection back out of a temporary handle. Only
+    /// [`open_configured`](Self::open_configured) uses it, to run `migrate`
+    /// (which is written against `&self`) before the real handle exists.
+    fn into_conn(self) -> Connection {
+        self.conn.into_inner()
     }
 
     /// Open an in-memory database. For tests.
@@ -119,6 +347,8 @@ impl Db {
         conn.pragma_update(None, "foreign_keys", "ON")?;
         let db = Self {
             conn: Mutex::new(conn),
+            readers: None,
+            _single_writer: None,
         };
         db.migrate()?;
         Ok(db)
@@ -132,5 +362,102 @@ impl Db {
     }
 }
 
+/// Whether `path` names the in-memory database rather than a file. Both
+/// spellings SQLite accepts are checked, because neither has a lock file or a
+/// corruption story.
+fn is_in_memory(path: &Path) -> bool {
+    let p = path.as_os_str();
+    p == ":memory:" || p.is_empty()
+}
+
+/// Take the single-instance write lock for the database at `path`.
+///
+/// The daemon is the only writer by design — the front-ends go through the
+/// control socket — but nothing stopped a hand-run `pdfs mount` from starting
+/// alongside the systemd unit, at which point two processes own the same inode
+/// space, the same content cache, and the same drain queue. SQLite's own
+/// locking makes each *statement* safe and does nothing about that.
+///
+/// `flock` on a sibling `.lock` file rather than on the database itself:
+/// SQLite uses POSIX record locks, so the two never interact, and a lock file
+/// left behind carries no state — the lock lives in the kernel and dies with
+/// the process, however it exits.
+fn acquire_single_writer_lock(path: &Path) -> Result<Option<File>> {
+    if is_in_memory(path) {
+        return Ok(None);
+    }
+    let lock_path = lock_path_for(path);
+    let file = std::fs::OpenOptions::new()
+        .create(true)
+        .read(true)
+        .truncate(false)
+        .write(true)
+        .open(&lock_path)?;
+    // SAFETY: `file` owns the descriptor and outlives the call.
+    let rc = unsafe { libc::flock(file.as_raw_fd(), libc::LOCK_EX | libc::LOCK_NB) };
+    if rc != 0 {
+        let e = std::io::Error::last_os_error();
+        if e.raw_os_error() == Some(libc::EWOULDBLOCK) {
+            return Err(Error::Other(format!(
+                "another Proton Drive daemon is already using {} — \
+                 stop it first (`systemctl --user stop proton-drive.service`)",
+                path.display()
+            )));
+        }
+        return Err(Error::Io(e));
+    }
+    Ok(Some(file))
+}
+
+fn lock_path_for(path: &Path) -> PathBuf {
+    let mut name = path.as_os_str().to_owned();
+    name.push(".lock");
+    PathBuf::from(name)
+}
+
+/// Whether `e` says the file is not a usable database, as opposed to any other
+/// failure. These are the only two conditions rebuilding fixes; a disk error, a
+/// permission problem or a newer-than-supported schema must all still fail.
+fn is_corrupt(e: &Error) -> bool {
+    matches!(
+        e,
+        Error::Db(rusqlite::Error::SqliteFailure(inner, _))
+            if inner.code == rusqlite::ErrorCode::DatabaseCorrupt
+                || inner.code == rusqlite::ErrorCode::NotADatabase
+    )
+}
+
+/// Move a damaged database (and its WAL sidecars) out of the way so the next
+/// open starts from empty.
+///
+/// Renamed rather than deleted: this is a cache, but it is also the only
+/// evidence of what went wrong, and it costs one file the user can remove.
+fn quarantine_corrupt_db(path: &Path) -> Result<()> {
+    let stamp = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0);
+    for suffix in ["", "-wal", "-shm"] {
+        let mut from = path.as_os_str().to_owned();
+        from.push(suffix);
+        let from = PathBuf::from(from);
+        if !from.exists() {
+            continue;
+        }
+        let mut to = path.as_os_str().to_owned();
+        to.push(format!(".corrupt-{stamp}{suffix}"));
+        let to = PathBuf::from(to);
+        // A failure to rename the sidecars is survivable — SQLite discards a
+        // WAL whose database header no longer matches — but failing to move the
+        // database itself is not, because the retry would hit the same file.
+        match std::fs::rename(&from, &to) {
+            Ok(()) => tracing::warn!(from = %from.display(), to = %to.display(), "quarantined"),
+            Err(e) if suffix.is_empty() => return Err(Error::Io(e)),
+            Err(e) => tracing::warn!(file = %from.display(), error = %e, "could not quarantine"),
+        }
+    }
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests;

crates/pdfs-core/src/db/mounts.rs

@@ -74,7 +74,7 @@ impl Db {
 
     /// Every local location, with device fields joined from `sync_folder`.
     pub fn mount_list(&self) -> Result<Vec<MountSpec>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let mut stmt = conn.prepare(
             "SELECT
                  m.id,

crates/pdfs-core/src/db/nodes.rs

@@ -10,7 +10,9 @@ use crate::{Access, Result};
 use proton_drive_rs::proton_sdk::ids::{LinkId, NodeUid, VolumeId};
 use proton_drive_rs::{Node, NodeKind};
 
-use super::utils::{TRIGRAM_MIN, collect_pairs, like_escape, pair, path_of};
+use super::utils::{
+    HitRow, TRIGRAM_MIN, collect_hits, hit_row, join_path, like_escape, path_of, walk_path_of,
+};
 
 pub struct StoredNode {
     pub node: Node,
@@ -59,7 +61,7 @@ impl Db {
     /// flag. Synthetic shared listings use this to serve the last completed
     /// snapshot while offline, including after a live event expired its TTL.
     pub fn visible_children(&self, parent: &NodeUid) -> Result<Vec<Node>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let mut stmt = conn.prepare(
             "SELECT node_json FROM nodes
               WHERE parent_uid = ?1 AND trashed = 0 AND node_json IS NOT NULL
@@ -285,7 +287,7 @@ impl Db {
     /// Check if a folder node has any non-trashed children in the database.
     pub fn has_children(&self, parent_uid: &NodeUid) -> Result<bool> {
         let uid_str = parent_uid.to_string();
-        let conn = self.conn.lock();
+        let conn = self.read();
         let count: i64 = conn.query_row(
             "SELECT COUNT(*) FROM nodes WHERE parent_uid = ?1 AND trashed = 0",
             params![uid_str],
@@ -294,6 +296,25 @@ impl Db {
         Ok(count > 0)
     }
 
+    /// A node's mountpoint-relative path, or `None` when it is not cached.
+    ///
+    /// One indexed read of the stored `path`. Callers that need to relate many
+    /// nodes to a handful of roots — search decorating each hit with its
+    /// mountpoint — resolve the roots once through this and do the rest as
+    /// string arithmetic, instead of a `path_relative_to` walk per pair.
+    pub fn node_path(&self, uid: &str) -> Result<Option<String>> {
+        let conn = self.read();
+        let exists: Option<i64> = conn
+            .query_row("SELECT 1 FROM nodes WHERE uid = ?1", params![uid], |r| {
+                r.get(0)
+            })
+            .optional()?;
+        if exists.is_none() {
+            return Ok(None);
+        }
+        Ok(Some(path_of(&conn, uid)?))
+    }
+
     /// Resolve `uid` relative to an ancestor node.
     ///
     /// This is used when a remote subtree has its own local sync mount: the
@@ -302,7 +323,7 @@ impl Db {
     /// chain keeps callers from accidentally joining a Drive-wide path onto the
     /// wrong mountpoint. The ancestor itself resolves to the empty path.
     pub fn path_relative_to(&self, ancestor_uid: &str, uid: &str) -> Result<Option<String>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let mut stmt = conn.prepare(
             "WITH RECURSIVE anc(uid, parent_uid, name, depth) AS (
                SELECT uid, parent_uid, name, 0 FROM nodes WHERE uid = ?1
@@ -338,15 +359,15 @@ impl Db {
         if query.is_empty() {
             return Ok(Vec::new());
         }
-        let conn = self.conn.lock();
+        let conn = self.read();
-        let rows: Vec<(String, String)> = if query.chars().count() < TRIGRAM_MIN {
+        let rows: Vec<HitRow> = if query.chars().count() < TRIGRAM_MIN {
             let pat = format!("%{}%", like_escape(query));
             let mut stmt = conn.prepare(
-                "SELECT node_json, uid FROM nodes
+                "SELECT node_json, uid, path FROM nodes
                  WHERE name LIKE ?1 ESCAPE '\\' AND trashed = 0 AND node_json IS NOT NULL
                  ORDER BY name LIMIT ?2",
             )?;
-            collect_pairs(stmt.query_map(params![pat, limit as i64], pair)?)?
+            collect_hits(stmt.query_map(params![pat, limit as i64], hit_row)?)?
         } else {
             // Escape double quotes and quote each term, then combine with AND so
             // all terms must match but can appear in any order or position.
@@ -356,18 +377,21 @@ impl Db {
                 .collect::<Vec<_>>()
                 .join(" AND ");
             let mut stmt = conn.prepare(
-                "SELECT n.node_json, n.uid
+                "SELECT n.node_json, n.uid, n.path
                  FROM nodes_fts f JOIN nodes n ON n.rowid = f.rowid
                  WHERE f.name MATCH ?1 AND n.trashed = 0 AND n.node_json IS NOT NULL
                  ORDER BY f.rank LIMIT ?2",
             )?;
-            collect_pairs(stmt.query_map(params![phrase, limit as i64], pair)?)?
+            collect_hits(stmt.query_map(params![phrase, limit as i64], hit_row)?)?
         };
 
         let mut hits = Vec::with_capacity(rows.len());
-        for (json, uid) in rows {
+        for (json, uid, path) in rows {
             let node: Node = serde_json::from_str(&json)?;
-            let path = path_of(&conn, &uid)?;
+            let path = match path {
+                Some(path) => path,
+                None => walk_path_of(&conn, &uid)?,
+            };
             hits.push(SearchHit { node, path });
         }
         Ok(hits)
@@ -382,54 +406,65 @@ impl Db {
         if query.is_empty() || limit == 0 {
             return Ok(Vec::new());
         }
-        let conn = self.conn.lock();
+        let conn = self.read();
         let terms = candidate_trigrams(query);
         let lane_limit = limit.div_ceil(2);
-        let mut rows: Vec<(String, String)> = if terms.is_empty() {
+        let mut rows: Vec<HitRow> = if terms.is_empty() {
             let pat = format!("%{}%", like_escape(query));
             let mut stmt = conn.prepare(
-                "SELECT node_json, uid FROM nodes
+                "SELECT node_json, uid, path FROM nodes
                  WHERE name LIKE ?1 ESCAPE '\\' AND trashed = 0 AND node_json IS NOT NULL
                  ORDER BY name LIMIT ?2",
             )?;
-            collect_pairs(stmt.query_map(params![pat, limit as i64], pair)?)?
+            collect_hits(stmt.query_map(params![pat, limit as i64], hit_row)?)?
         } else {
             let expression = terms.join(" OR ");
             let mut stmt = conn.prepare(
-                "SELECT n.node_json, n.uid
+                "SELECT n.node_json, n.uid, n.path
                    FROM nodes_fts f JOIN nodes n ON n.rowid = f.rowid
                   WHERE nodes_fts MATCH ?1 AND n.trashed = 0 AND n.node_json IS NOT NULL
                   ORDER BY f.rank LIMIT ?2",
             )?;
-            collect_pairs(stmt.query_map(params![expression, lane_limit as i64], pair)?)?
+            collect_hits(stmt.query_map(params![expression, lane_limit as i64], hit_row)?)?
         };
-        // A short substitution can destroy every trigram (`vedio` vs `video`).
+        // Trigram rank does not know that a name *starts* with the query, and a
-        // Feed the scorer an additional indexed same-initial lane so it can
+        // short substitution can destroy every trigram outright (`vedio` vs
-        // recover those candidates without scanning the full node table.
+        // `video`). Two indexed lanes cover both without scanning the node
+        // table: whole-query prefix first, then same-initial.
         if !terms.is_empty()
             && let Some(first) = query.chars().next()
         {
-            let prefix = format!("{}%", like_escape(&first.to_string()));
             let mut stmt = conn.prepare(
-                "SELECT node_json, uid FROM nodes
+                "SELECT node_json, uid, path FROM nodes
                  WHERE name COLLATE NOCASE LIKE ?1 ESCAPE '\\'
                    AND trashed = 0 AND node_json IS NOT NULL
                  ORDER BY name COLLATE NOCASE LIMIT ?2",
             )?;
-            let fallback =
+            let mut extra = Vec::new();
-                collect_pairs(stmt.query_map(params![prefix, lane_limit as i64], pair)?)?;
+            for pattern in [
-            for row in fallback {
+                format!("{}%", like_escape(query)),
-                if !rows.iter().any(|(_, uid)| uid == &row.1) {
+                format!("{}%", like_escape(&first.to_string())),
+            ] {
+                extra.extend(collect_hits(
+                    stmt.query_map(params![pattern, lane_limit as i64], hit_row)?,
+                )?);
+            }
+            let trigram = std::mem::take(&mut rows);
+            for row in extra.into_iter().chain(trigram) {
+                if !rows.iter().any(|(_, uid, _)| uid == &row.1) {
                     rows.push(row);
                 }
             }
             rows.truncate(limit);
         }
         rows.into_iter()
-            .map(|(json, uid)| {
+            .map(|(json, uid, path)| {
                 Ok(SearchHit {
                     node: serde_json::from_str(&json)?,
-                    path: path_of(&conn, &uid)?,
+                    path: match path {
+                        Some(path) => path,
+                        None => walk_path_of(&conn, &uid)?,
+                    },
                 })
             })
             .collect()
@@ -449,7 +484,7 @@ impl Db {
 
     /// Load every persisted node for cold-start hydration of the `State` maps.
     pub fn load_all(&self) -> Result<Vec<StoredNode>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let mut stmt =
             conn.prepare("SELECT node_json, listed FROM nodes WHERE node_json IS NOT NULL")?;
         let rows = stmt.query_map([], |row| {
@@ -470,7 +505,7 @@ impl Db {
     /// when the API is unreachable, so the mount can still serve the cached tree
     /// (offline.md Phase 1).
     pub fn node_by_uid(&self, uid: &str) -> Result<Option<Node>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let json: Option<String> = conn
             .query_row(
                 "SELECT node_json FROM nodes WHERE uid = ?1 AND node_json IS NOT NULL",
@@ -488,7 +523,7 @@ impl Db {
     /// The daemon resumes from this on restart instead of reseeding to the
     /// server head, so changes made while unmounted are still applied (P2).
     pub fn children_if_listed(&self, parent: &NodeUid) -> Result<Option<Vec<Node>>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let listed: Option<i64> = conn
             .query_row(
                 "SELECT listed FROM nodes WHERE uid = ?1",
@@ -521,13 +556,57 @@ impl Db {
     // in sync on every store/read/evict, so it is authoritative for eviction.
 }
 
+/// What a node's row looked like before this upsert, for the fields that decide
+/// whether the subtree below it has to be touched at all.
+struct PriorRow {
+    parent_uid: Option<String>,
+    name: String,
+    path: Option<String>,
+    trashed: bool,
+}
+
 fn upsert_node_tx(tx: &Transaction<'_>, node: &Node) -> Result<()> {
     let json = serde_json::to_string(node)?;
     let uid = node.uid.to_string();
+    let parent_uid = node.parent_uid.as_ref().map(|u| u.to_string());
+
+    let prior: Option<PriorRow> = tx
+        .query_row(
+            "SELECT parent_uid, name, path, trashed FROM nodes WHERE uid = ?1",
+            params![uid],
+            |row| {
+                Ok(PriorRow {
+                    parent_uid: row.get(0)?,
+                    name: row.get(1)?,
+                    path: row.get(2)?,
+                    trashed: row.get::<_, i64>(3)? != 0,
+                })
+            },
+        )
+        .optional()?;
+
+    // A node's path is its parent's path plus its own name — one indexed lookup,
+    // where resolving it from scratch is a recursive walk to the root. A node
+    // whose parent is not cached (a device folder's root lives in `device`, never
+    // in `nodes`) starts a path of its own, which is what the walk did too.
+    let path = match &parent_uid {
+        None => String::new(),
+        Some(parent) => {
+            let parent_path: Option<Option<String>> = tx
+                .query_row(
+                    "SELECT path FROM nodes WHERE uid = ?1",
+                    params![parent],
+                    |row| row.get(0),
+                )
+                .optional()?;
+            join_path(parent_path.flatten().as_deref().unwrap_or(""), &node.name)
+        }
+    };
+
     tx.execute(
         "INSERT INTO nodes
-           (uid, parent_uid, name, is_dir, size, mtime, trashed, node_json)
+           (uid, parent_uid, name, is_dir, size, mtime, trashed, node_json, path)
-         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)
+         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)
          ON CONFLICT(uid) DO UPDATE SET
            parent_uid = excluded.parent_uid,
            name       = excluded.name,
@@ -535,59 +614,116 @@ fn upsert_node_tx(tx: &Transaction<'_>, node: &Node) -> Result<()> {
            size       = excluded.size,
            mtime      = excluded.mtime,
            trashed    = excluded.trashed,
-           node_json  = excluded.node_json",
+           node_json  = excluded.node_json,
+           path       = excluded.path",
         params![
             uid,
-            node.parent_uid.as_ref().map(|u| u.to_string()),
+            parent_uid,
             node.name,
             node.is_folder() as i64,
             node_size(node),
             node.modification_time,
             node.trashed as i64,
             json,
+            path,
         ],
     )?;
-    // FTS5 has no UPSERT. Folder moves also change every descendant path, so
-    // refresh the whole affected subtree while keeping rowid deletes indexed.
     let rowid: i64 = tx.query_row(
         "SELECT rowid FROM nodes WHERE uid = ?1",
         params![uid],
         |row| row.get(0),
     )?;
-    let mut affected = vec![rowid];
+
-    if node.is_folder() {
+    // FTS5 has no UPSERT, so the node's own row is always replaced.
-        let mut stmt = tx.prepare(
+    let indexable = node_is_indexable_tx(tx, &uid)?;
-            "WITH RECURSIVE descendants(rowid, uid) AS (
+    tx.execute("DELETE FROM nodes_fts WHERE rowid = ?1", params![rowid])?;
-               SELECT rowid, uid FROM nodes WHERE parent_uid = ?1
+    if indexable {
-               UNION ALL
-               SELECT n.rowid, n.uid FROM nodes n
-                 JOIN descendants d ON n.parent_uid = d.uid
-             ) SELECT rowid FROM descendants",
-        )?;
-        for descendant in stmt.query_map(params![uid], |row| row.get(0))? {
-            affected.push(descendant?);
-        }
-    }
-    for affected_rowid in affected {
         tx.execute(
-            "DELETE FROM nodes_fts WHERE rowid = ?1",
+            "INSERT INTO nodes_fts (rowid, name, path) VALUES (?1, ?2, ?3)",
-            params![affected_rowid],
+            params![rowid, node.name, path],
         )?;
-        let indexed: Option<(String, String)> = tx
+    }
-            .query_row(
+
-                "SELECT name, uid FROM nodes WHERE rowid = ?1",
+    // Everything below only matters when the subtree's paths or reachability
-                params![affected_rowid],
+    // actually moved. Re-listing a folder upserts it unchanged, and paying for a
-                |row| Ok((row.get(0)?, row.get(1)?)),
+    // full descendant walk on each of those was most of what a large tree spent
-            )
+    // its time on.
-            .optional()?;
+    let subtree_moved = prior.is_none_or(|prior| {
-        if let Some((name, indexed_uid)) = indexed
+        prior.parent_uid != parent_uid
-            && node_is_indexable_tx(tx, &indexed_uid)?
+            || prior.name != node.name
-        {
+            || prior.path.as_deref() != Some(path.as_str())
-            let path = path_of(tx, &indexed_uid)?;
+            || prior.trashed != node.trashed
-            tx.execute(
+    });
-                "INSERT INTO nodes_fts (rowid, name, path) VALUES (?1, ?2, ?3)",
+    if node.is_folder() && subtree_moved {
-                params![affected_rowid, name, path],
+        reindex_subtree_tx(tx, &uid, &path, indexable)?;
-            )?;
+    }
+    Ok(())
+}
+
+/// Rewrite every descendant's stored path and search-index row after `folder`
+/// moved, was renamed, or changed reachability.
+///
+/// One recursive walk carries both the new path and whether anything on the way
+/// down is trashed, so each descendant costs two trivial statements instead of a
+/// `path_of` walk plus an ancestor walk of its own. `folder_indexable` is the
+/// answer `node_is_indexable_tx` gave for the folder itself: what is above the
+/// subtree is the same for every node in it.
+///
+/// The depth cap is a liveness guard, not a policy: `UNION ALL` over a parent
+/// cycle (a's parent is b, b's parent is a — corrupt data, but the API can hand
+/// it to us) never terminates, and this runs inside the write transaction that
+/// holds the daemon's only SQLite connection. Real Drive trees are nowhere near
+/// this deep.
+fn reindex_subtree_tx(
+    tx: &Transaction<'_>,
+    folder: &str,
+    folder_path: &str,
+    folder_indexable: bool,
+) -> Result<()> {
+    let descendants: Vec<(i64, String, bool)> = {
+        let mut stmt = tx.prepare(
+            "WITH RECURSIVE sub(rowid, uid, name, path, blocked, depth) AS (
+               SELECT n.rowid, n.uid, n.name,
+                      CASE WHEN ?2 = '' THEN n.name ELSE ?2 || '/' || n.name END,
+                      n.trashed, 0
+                 FROM nodes n WHERE n.parent_uid = ?1
+               UNION ALL
+               SELECT n.rowid, n.uid, n.name,
+                      sub.path || '/' || n.name,
+                      MAX(sub.blocked, n.trashed), sub.depth + 1
+                 FROM nodes n JOIN sub ON n.parent_uid = sub.uid
+                WHERE sub.depth < 256
+             )
+             SELECT rowid, path, blocked FROM sub",
+        )?;
+        let rows = stmt.query_map(params![folder, folder_path], |row| {
+            Ok((
+                row.get::<_, i64>(0)?,
+                row.get::<_, String>(1)?,
+                row.get::<_, i64>(2)? != 0,
+            ))
+        })?;
+        let mut out = Vec::new();
+        for row in rows {
+            out.push(row?);
+        }
+        out
+    };
+    if descendants.is_empty() {
+        return Ok(());
+    }
+
+    let mut set_path = tx.prepare("UPDATE nodes SET path = ?2 WHERE rowid = ?1")?;
+    let mut unindex = tx.prepare("DELETE FROM nodes_fts WHERE rowid = ?1")?;
+    let mut index = tx.prepare(
+        "INSERT INTO nodes_fts (rowid, name, path)
+         SELECT rowid, name, ?2 FROM nodes WHERE rowid = ?1",
+    )?;
+    for (rowid, path, blocked) in descendants {
+        set_path.execute(params![rowid, path])?;
+        unindex.execute(params![rowid])?;
+        if folder_indexable && !blocked {
+            index.execute(params![rowid, path])?;
         }
     }
     Ok(())
@@ -603,13 +739,27 @@ fn direct_child_uids_tx(tx: &Transaction<'_>, parent: &str) -> Result<Vec<String
     Ok(uids)
 }
 
+/// Whether a node belongs in the search index: it exists, and nothing on the
+/// way up to the top of its cached chain is trashed.
+///
+/// The chain does *not* have to reach a `parent_uid IS NULL` row. Only the My
+/// Files root is stored that way; a device folder's root lives in `device` /
+/// `sync_folder` and never gets a `nodes` row, so requiring a null-parent
+/// ancestor silently excluded every device-folder subtree from search — 29% of
+/// the nodes on the account this was found on. A subtree whose topmost cached
+/// row has an uncached parent is ordinary, reachable data.
+///
+/// What is still excluded is a *cycle*: the walk's own guard stops it, but
+/// [`path_of`] has no such guard, so an indexed cycle would hang a search. A
+/// clean chain ends at a row whose parent is null or simply not cached; a cycle
+/// ends at one whose parent is a row we have already visited.
 fn node_is_indexable_tx(tx: &Transaction<'_>, uid: &str) -> Result<bool> {
     let indexable: i64 = tx.query_row(
-        "WITH RECURSIVE ancestors(uid, parent_uid, trashed, path) AS (
+        "WITH RECURSIVE ancestors(uid, parent_uid, trashed, depth, path) AS (
-           SELECT uid, parent_uid, trashed, char(31) || uid || char(31)
+           SELECT uid, parent_uid, trashed, 0, char(31) || uid || char(31)
              FROM nodes WHERE uid = ?1
            UNION ALL
-           SELECT n.uid, n.parent_uid, n.trashed,
+           SELECT n.uid, n.parent_uid, n.trashed, a.depth + 1,
                   a.path || n.uid || char(31)
              FROM ancestors a JOIN nodes n ON n.uid = a.parent_uid
             WHERE instr(a.path, char(31) || n.uid || char(31)) = 0
@@ -617,7 +767,12 @@ fn node_is_indexable_tx(tx: &Transaction<'_>, uid: &str) -> Result<bool> {
          SELECT CASE
            WHEN COUNT(*) = 0 THEN 0
            WHEN MAX(trashed) != 0 THEN 0
-           WHEN MAX(CASE WHEN parent_uid IS NULL THEN 1 ELSE 0 END) = 0 THEN 0
+           WHEN EXISTS (
+             SELECT 1 FROM ancestors a
+              WHERE a.depth = (SELECT MAX(depth) FROM ancestors)
+                AND a.parent_uid IS NOT NULL
+                AND EXISTS (SELECT 1 FROM nodes p WHERE p.uid = a.parent_uid)
+           ) THEN 0
            ELSE 1
          END
          FROM ancestors",

crates/pdfs-core/src/db/ops.rs

@@ -119,15 +119,32 @@ pub struct PendingOp {
 }
 
 /// How much work the queue owes the server, by whether it carries bytes.
-#[derive(Debug, Clone, Copy, Default)]
+#[derive(Debug, Clone, Default)]
 pub struct PendingCounts {
     /// Queued `create`/`revision` ops: files whose content is not on the remote.
     pub uploads: i64,
     /// Queued `mkdir`/`rename`/`trash` ops: metadata the remote has not been
     /// told about.
     pub changes: i64,
+    /// Ops parked at [`PARK_UNTIL`]: a transient file's bytes, held back until
+    /// the rename that gives it its finished name. They are queued but will
+    /// never drain on their own, so counting them as "waiting to upload" would
+    /// have the front-end promise progress that is not coming.
+    pub parked: i64,
+    /// Ops that have failed at least [`FAILING_ATTEMPTS`] times. A permanently
+    /// failing op never wedges the queue — the backoff sees to that — which is
+    /// exactly why it needs surfacing: it retries forever, invisibly.
+    pub failing: i64,
+    /// The most recent error text from a failing op, for the front-end to show
+    /// instead of the bare count.
+    pub last_error: Option<String>,
 }
 
+/// Failed attempts after which an op is reported as failing rather than merely
+/// retrying. Six is where the backoff has reached its ceiling, so an op past it
+/// is retrying at the slowest rate it ever will and has been for minutes.
+pub const FAILING_ATTEMPTS: i64 = 6;
+
 /// The outcome of folding freshly written bytes into a queued create.
 #[derive(Debug, Clone)]
 pub struct AttachedBlob {
@@ -140,7 +157,7 @@ pub struct AttachedBlob {
 impl Db {
     /// Whether a specific desired-state operation is still queued for a node.
     pub fn has_pending_op(&self, uid: &str, kind: &str) -> Result<bool> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         conn.query_row(
             "SELECT EXISTS(
                 SELECT 1 FROM pending_op WHERE uid = ?1 AND kind = ?2
@@ -153,7 +170,7 @@ impl Db {
 
     /// Read an existing operation's metadata before a superseding enqueue.
     pub fn pending_op_meta(&self, uid: &str, kind: &str) -> Result<Option<String>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         conn.query_row(
             "SELECT meta_json FROM pending_op WHERE uid = ?1 AND kind = ?2",
             params![uid, kind],
@@ -352,7 +369,7 @@ impl Db {
 
     /// Check if a queued create or mkdir op exists for `uid`.
     pub fn has_create_op(&self, uid: &str) -> Result<bool> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let count: i64 = conn.query_row(
             "SELECT COUNT(*) FROM pending_op WHERE uid = ?1 AND kind IN (?2, ?3)",
             params![uid, OP_CREATE, OP_MKDIR],
@@ -368,7 +385,7 @@ impl Db {
     /// bytes are still owed an upload, and dropping it would discard the staged
     /// blob that holds them (`docs/BUGS.md` B71).
     pub fn has_any_op(&self, uid: &str) -> Result<bool> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let count: i64 = conn.query_row(
             "SELECT COUNT(*) FROM pending_op WHERE uid = ?1",
             params![uid],
@@ -464,7 +481,7 @@ impl Db {
     /// sort, and no separate index to maintain. The common case (something is
     /// due) exits on the first row.
     pub fn next_due_op(&self, now: i64) -> Result<Option<PendingOp>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let mut stmt = conn.prepare_cached(&format!(
             "SELECT id, kind, uid, parent_uid, name, blob_path, meta_json, created_at,
                     attempts, last_error, next_attempt_at
@@ -495,17 +512,115 @@ impl Db {
         Ok(op)
     }
 
+    /// Take the oldest due op for this worker, marking it claimed so no other
+    /// drain worker takes it, or `None` when there is nothing to do.
+    ///
+    /// The drain is several workers over one queue, which is only safe because
+    /// the claim is a column: a row is offered to exactly one worker, and the
+    /// worker that took it is the only one that may retire, defer or fail it.
+    ///
+    /// Two exclusions on top of [`next_due_op`](Self::next_due_op)'s:
+    ///
+    /// * `claimed_at = 0` — not already in flight somewhere else.
+    /// * no *other* claimed op shares this `uid`. Ordering only has to hold per
+    ///   node, but there it has to hold absolutely: a queued rename and a queued
+    ///   revision of one file must land in the order they were made, and two
+    ///   workers on one node would also race over its staged blob and its
+    ///   pending entry. `ORDER BY id` plus this exclusion gives per-uid serial
+    ///   order for free — the older op is claimed first and the newer one is
+    ///   invisible until it retires.
+    ///
+    /// Select and mark are one transaction, so two workers cannot both see the
+    /// row as unclaimed.
+    pub fn claim_next_due_op(&self, now: i64) -> Result<Option<PendingOp>> {
+        let mut conn = self.conn.lock();
+        let tx = conn.transaction()?;
+        let op = {
+            let mut stmt = tx.prepare_cached(&format!(
+                "SELECT id, kind, uid, parent_uid, name, blob_path, meta_json, created_at,
+                        attempts, last_error, next_attempt_at
+                 FROM pending_op
+                 WHERE next_attempt_at <= ?1
+                   AND claimed_at = 0
+                   AND (parent_uid IS NULL OR substr(parent_uid, 1, {n}) <> '{v}~')
+                   AND uid NOT IN (SELECT uid FROM pending_op WHERE claimed_at <> 0)
+                 ORDER BY id LIMIT 1",
+                v = LOCAL_VOLUME,
+                n = LOCAL_VOLUME.len() + 1,
+            ))?;
+            stmt.query_row(params![now], |r| {
+                Ok(PendingOp {
+                    id: r.get(0)?,
+                    kind: r.get(1)?,
+                    uid: r.get(2)?,
+                    parent_uid: r.get(3)?,
+                    name: r.get(4)?,
+                    blob_path: r.get(5)?,
+                    meta_json: r.get(6)?,
+                    created_at: r.get(7)?,
+                    attempts: r.get(8)?,
+                    last_error: r.get(9)?,
+                    next_attempt_at: r.get(10)?,
+                })
+            })
+            .optional()?
+        };
+        if let Some(op) = op.as_ref() {
+            tx.execute(
+                "UPDATE pending_op SET claimed_at = ?2 WHERE id = ?1",
+                params![op.id, now.max(1)],
+            )?;
+        }
+        tx.commit()?;
+        Ok(op)
+    }
+
+    /// Give a claimed op back to the queue, whatever became of the attempt.
+    ///
+    /// Called on every path out of a drain attempt rather than only the failing
+    /// ones: a handler that retires its own row leaves nothing to release (the
+    /// `UPDATE` matches nothing), and a handler that returns without retiring
+    /// *and* without failing would otherwise leave the row claimed by a worker
+    /// that has moved on — invisible to every worker, forever.
+    pub fn release_op_claim(&self, id: i64) -> Result<()> {
+        let conn = self.conn.lock();
+        conn.execute(
+            "UPDATE pending_op SET claimed_at = 0 WHERE id = ?1",
+            params![id],
+        )?;
+        Ok(())
+    }
+
+    /// Drop every claim in the table.
+    ///
+    /// A claim describes a worker in *this* process, so one surviving on disk
+    /// means the previous run died holding it. The single-writer lock
+    /// ([`Db::open`]) is what makes that inference safe: nobody else can be
+    /// draining this queue while we are opening it.
+    pub fn clear_op_claims(&self) -> Result<usize> {
+        let conn = self.conn.lock();
+        Ok(conn.execute(
+            "UPDATE pending_op SET claimed_at = 0 WHERE claimed_at <> 0",
+            [],
+        )?)
+    }
+
     /// The earliest `next_attempt_at` among all queued ops, or `None` if the
     /// queue is empty. Used by the drain loop to sleep exactly until the next
     /// debounced or backed-off op becomes eligible rather than waiting the full
     /// idle-poll interval.
+    ///
+    /// Claimed ops are excluded: another worker is already on them, so they are
+    /// not work this one is waiting for, and counting them would have an idle
+    /// worker spin on a row it cannot have.
     pub fn earliest_due_at(&self) -> Result<Option<i64>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let ts: Option<i64> = conn
             .query_row(
                 &format!(
                     "SELECT MIN(next_attempt_at) FROM pending_op \
-                     WHERE parent_uid IS NULL OR substr(parent_uid, 1, {n}) <> '{v}~'",
+                     WHERE claimed_at = 0 \
+                       AND (parent_uid IS NULL OR substr(parent_uid, 1, {n}) <> '{v}~')",
                     v = LOCAL_VOLUME,
                     n = LOCAL_VOLUME.len() + 1,
                 ),
@@ -520,7 +635,7 @@ impl Db {
     /// Every queued op, oldest first. For status read-outs and the CLI — the
     /// drain wants [`next_due_op`](Self::next_due_op) instead.
     pub fn pending_ops(&self) -> Result<Vec<PendingOp>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let mut stmt = conn.prepare(
             "SELECT id, kind, uid, parent_uid, name, blob_path, meta_json, created_at,
                     attempts, last_error, next_attempt_at
@@ -553,7 +668,7 @@ impl Db {
     /// mount owes the server, but it carries no bytes and reporting it as an
     /// upload is simply untrue.
     pub fn pending_op_counts(&self) -> Result<PendingCounts> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let uploads = conn.query_row(
             "SELECT COUNT(*) FROM pending_op WHERE kind IN (?1, ?2)",
             params![OP_REVISION, OP_CREATE],
@@ -564,7 +679,33 @@ impl Db {
             params![OP_REVISION, OP_CREATE],
             |r| r.get(0),
         )?;
-        Ok(PendingCounts { uploads, changes })
+        let parked = conn.query_row(
+            "SELECT COUNT(*) FROM pending_op WHERE next_attempt_at >= ?1",
+            params![PARK_UNTIL],
+            |r| r.get(0),
+        )?;
+        let failing = conn.query_row(
+            "SELECT COUNT(*) FROM pending_op WHERE attempts >= ?1",
+            params![FAILING_ATTEMPTS],
+            |r| r.get(0),
+        )?;
+        let last_error = conn
+            .query_row(
+                "SELECT last_error FROM pending_op
+                  WHERE attempts >= ?1 AND last_error IS NOT NULL
+                  ORDER BY attempts DESC LIMIT 1",
+                params![FAILING_ATTEMPTS],
+                |r| r.get::<_, Option<String>>(0),
+            )
+            .optional()?
+            .flatten();
+        Ok(PendingCounts {
+            uploads,
+            changes,
+            parked,
+            failing,
+            last_error,
+        })
     }
 
     /// Nothing bearing this volume may be handed to the API — it would 404. The
@@ -580,11 +721,16 @@ impl Db {
 
     /// Record a failed attempt and when to next try. Leaves the row in place —
     /// the staged bytes are still the only copy of the user's write.
+    ///
+    /// Clears any access-deferral window: whatever the op was waiting for has
+    /// now been reported, so the next uncleared deferral starts its own window
+    /// rather than escalating again on the following recheck.
     pub fn record_op_failure(&self, id: i64, error: &str, next_attempt_at: i64) -> Result<()> {
         let conn = self.conn.lock();
         conn.execute(
             "UPDATE pending_op
-             SET attempts = attempts + 1, last_error = ?2, next_attempt_at = ?3
+             SET attempts = attempts + 1, last_error = ?2, next_attempt_at = ?3,
+                 access_deferred_since = 0
              WHERE id = ?1",
             params![id, error, next_attempt_at],
         )?;
@@ -609,4 +755,132 @@ impl Db {
         )?;
         Ok(())
     }
+
+    /// Defer an op the local access check refused, and report how long it has
+    /// been refused for.
+    ///
+    /// Identical to [`defer_op_without_attempt`](Self::defer_op_without_attempt)
+    /// on the retry clock, plus the one thing that was missing: the first
+    /// deferral of a run stamps `access_deferred_since`, and every deferral
+    /// returns that stamp. A caller can therefore tell a deferral that is one
+    /// recheck old from one that has been repeating unchanged for days, which is
+    /// the difference between a permission the user is mid-way through changing
+    /// and a queue that will never drain.
+    ///
+    /// Returns the ms at which the current run of deferrals began — `now` on the
+    /// first one.
+    pub fn defer_op_for_access(&self, id: i64, now: i64, next_attempt_at: i64) -> Result<i64> {
+        let conn = self.conn.lock();
+        conn.execute(
+            "UPDATE pending_op
+             SET next_attempt_at = CASE
+                 WHEN next_attempt_at >= ?4 THEN next_attempt_at
+                 ELSE ?3
+             END,
+             access_deferred_since = CASE
+                 WHEN access_deferred_since = 0 THEN ?2
+                 ELSE access_deferred_since
+             END
+             WHERE id = ?1",
+            params![id, now, next_attempt_at, PARK_UNTIL],
+        )?;
+        let since = conn
+            .query_row(
+                "SELECT access_deferred_since FROM pending_op WHERE id = ?1",
+                params![id],
+                |r| r.get::<_, i64>(0),
+            )
+            .optional()?;
+        // A row that drained out from under this call leaves nothing to measure;
+        // reporting `now` says "this run just started", which is the reading that
+        // never escalates something that no longer exists.
+        Ok(since.filter(|since| *since != 0).unwrap_or(now))
+    }
+
+    /// Forget an op's access-deferral window, after an attempt the access check
+    /// let through. The op is no longer blocked, so a later deferral is the
+    /// start of a new run rather than the continuation of an old one.
+    pub fn clear_op_access_deferral(&self, id: i64) -> Result<()> {
+        let conn = self.conn.lock();
+        conn.execute(
+            "UPDATE pending_op SET access_deferred_since = 0
+             WHERE id = ?1 AND access_deferred_since <> 0",
+            params![id],
+        )?;
+        Ok(())
+    }
+
+    /// Every staged blob the queue still refers to.
+    ///
+    /// The startup staging reconcile subtracts this from what is actually in
+    /// `staging/`: the difference is bytes the kernel was told were written and
+    /// that nothing is going to upload.
+    pub fn op_blob_paths(&self) -> Result<std::collections::HashSet<String>> {
+        let conn = self.read();
+        let mut stmt =
+            conn.prepare("SELECT blob_path FROM pending_op WHERE blob_path IS NOT NULL")?;
+        let rows = stmt.query_map([], |r| r.get::<_, String>(0))?;
+        let mut out = std::collections::HashSet::new();
+        for row in rows {
+            out.insert(row?);
+        }
+        Ok(out)
+    }
+
+    /// Record that this daemon sealed `revision_id` on `uid`, and prune entries
+    /// past [`OWN_SEALED_TTL_MS`].
+    ///
+    /// One row per node, overwritten as the node advances. See
+    /// [`own_sealed_rev`](Self::own_sealed_rev) for what reads it.
+    pub fn set_own_sealed_rev(&self, uid: &str, revision_id: &str, now_ms: i64) -> Result<()> {
+        let conn = self.conn.lock();
+        conn.execute(
+            "INSERT INTO own_sealed_rev (uid, revision_id, sealed_at)
+             VALUES (?1, ?2, ?3)
+             ON CONFLICT(uid) DO UPDATE SET
+               revision_id = excluded.revision_id,
+               sealed_at   = excluded.sealed_at",
+            params![uid, revision_id, now_ms],
+        )?;
+        conn.execute(
+            "DELETE FROM own_sealed_rev WHERE sealed_at < ?1",
+            params![now_ms - OWN_SEALED_TTL_MS],
+        )?;
+        Ok(())
+    }
+
+    /// The last revision of `uid` this daemon sealed itself, if it is still
+    /// within [`OWN_SEALED_TTL_MS`].
+    ///
+    /// The drain asks before treating a moved-on remote as a conflict: a
+    /// revision we sealed means one writer stalled and resumed, which
+    /// supersedes rather than forking a `(sync-conflict)` copy (docs/BUGS.md
+    /// B70 layer B).
+    pub fn own_sealed_rev(&self, uid: &str, now_ms: i64) -> Result<Option<String>> {
+        let conn = self.read();
+        Ok(conn
+            .query_row(
+                "SELECT revision_id FROM own_sealed_rev
+                  WHERE uid = ?1 AND sealed_at >= ?2",
+                params![uid, now_ms - OWN_SEALED_TTL_MS],
+                |r| r.get(0),
+            )
+            .optional()?)
+    }
+
+    /// Forget what we sealed on `uid` — it has been trashed, so there is no
+    /// revision left to chain onto.
+    pub fn clear_own_sealed_rev(&self, uid: &str) -> Result<()> {
+        let conn = self.conn.lock();
+        conn.execute("DELETE FROM own_sealed_rev WHERE uid = ?1", params![uid])?;
+        Ok(())
+    }
 }
+
+/// How long a revision this daemon sealed stays recognisable as its own.
+///
+/// Bounds a table that would otherwise grow with every write for the life of
+/// the install. A week is far longer than any stall→resume — a browser download
+/// that pauses and continues, an editor that reopens its handle — and short
+/// enough that the table tracks recent work rather than accumulating history.
+pub const OWN_SEALED_TTL_MS: i64 = 7 * 24 * 60 * 60 * 1000;

crates/pdfs-core/src/db/photos.rs

@@ -32,13 +32,21 @@ pub struct StoredPhoto {
     /// Which Photos-page tab this entry belongs to, derived from its name and
     /// media type when the timeline was last replaced.
     pub kind: crate::control::PhotoKind,
+    /// Whether the photo carries Proton's `Favorite` tag.
+    pub favorite: bool,
 }
 
+/// One row of a timeline replacement: `(uid, capture_time, name, media_type,
+/// favorite)`. The two trailing options are "what this refresh learned" — a
+/// `None` keeps whatever is already stored rather than clearing it.
+pub type TimelineRow = (String, i64, Option<String>, Option<String>, Option<bool>);
+
 impl Db {
-    pub fn photos_replace(
+    /// Replace the timeline wholesale. Each item is
-        &self,
+    /// `(uid, capture_time, name, media_type, favorite)`; `favorite` is `None`
-        items: &[(String, i64, Option<String>, Option<String>)],
+    /// when the refresh could not resolve that photo's node, in which case the
-    ) -> Result<()> {
+    /// flag already stored is kept rather than silently cleared.
+    pub fn photos_replace(&self, items: &[TimelineRow]) -> Result<()> {
         let mut conn = self.conn.lock();
         let tx = conn.transaction()?;
         // `media_type` is learned-and-kept like the ratio and thumb verdict: the
@@ -46,10 +54,14 @@ impl Db {
         // not know a photo's media type yet when it replaces the timeline. Keep
         // any previously learned value so the Photos/Videos/Raw split survives a
         // refresh instead of collapsing back to name-extension guesses.
-        let learned: HashMap<String, (Option<f64>, i64, Option<String>)> = {
+        let learned: HashMap<String, (Option<f64>, i64, Option<String>, bool)> = {
-            let mut stmt = tx.prepare("SELECT uid, ratio, thumb_state, media_type FROM photos")?;
+            let mut stmt =
+                tx.prepare("SELECT uid, ratio, thumb_state, media_type, favorite FROM photos")?;
             let rows = stmt.query_map([], |r| {
-                Ok((r.get::<_, String>(0)?, (r.get(1)?, r.get(2)?, r.get(3)?)))
+                Ok((
+                    r.get::<_, String>(0)?,
+                    (r.get(1)?, r.get(2)?, r.get(3)?, r.get::<_, i64>(4)? != 0),
+                ))
             })?;
             rows.collect::<rusqlite::Result<_>>()?
         };
@@ -58,16 +70,16 @@ impl Db {
         {
             let mut stmt = tx.prepare(
                 "INSERT INTO photos
-                   (uid, capture_time, name, ratio, thumb_state, seq, media_type, kind)
+                   (uid, capture_time, name, ratio, thumb_state, seq, media_type, kind, favorite)
-                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)",
+                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)",
             )?;
-            for (seq, (uid, capture_time, name, media_type)) in items.iter().enumerate() {
+            for (seq, (uid, capture_time, name, media_type, favorite)) in items.iter().enumerate() {
-                let (ratio, thumb_state, learned_media) =
+                let (ratio, thumb_state, learned_media, learned_favorite) = learned
-                    learned
+                    .get(uid)
-                        .get(uid)
+                    .cloned()
-                        .cloned()
+                    .unwrap_or((None, THUMB_UNKNOWN, None, false));
-                        .unwrap_or((None, THUMB_UNKNOWN, None));
                 let media_type = media_type.clone().or(learned_media);
+                let favorite = favorite.unwrap_or(learned_favorite);
                 // The tab this photo lands in is derived here, once, so a page or
                 // count query is a plain indexed `WHERE kind = ?` rather than a
                 // reclassification of every row.
@@ -82,6 +94,7 @@ impl Db {
                     seq as i64,
                     media_type,
                     kind.as_i64(),
+                    favorite as i64,
                 ])?;
             }
         }
@@ -93,18 +106,21 @@ impl Db {
     /// restricts the page to one tab (Photos / Videos / Raw); `range`, when set,
     /// restricts it to a `[from, to)` capture-time window (epoch seconds) — the
     /// date scrubber's jump. `offset` is relative to whatever the filters leave.
+    /// `favorites` restricts the page to favourited photos.
     pub fn photos_page(
         &self,
         offset: usize,
         limit: usize,
         kind: Option<crate::control::PhotoKind>,
         range: Option<(i64, i64)>,
+        favorites: bool,
     ) -> Result<Vec<StoredPhoto>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         // Built up so any combination of the optional filters is one indexed
         // query rather than a statement per case.
-        let mut sql =
+        let mut sql = String::from(
-            String::from("SELECT uid, capture_time, name, ratio, thumb_state, kind FROM photos");
+            "SELECT uid, capture_time, name, ratio, thumb_state, kind, favorite FROM photos",
+        );
         let mut binds: Vec<i64> = Vec::new();
         let mut conds: Vec<String> = Vec::new();
         if let Some(k) = kind {
@@ -117,6 +133,9 @@ impl Db {
             binds.push(to);
             conds.push(format!("capture_time < ?{}", binds.len()));
         }
+        if favorites {
+            conds.push("favorite = 1".to_string());
+        }
         if !conds.is_empty() {
             sql.push_str(" WHERE ");
             sql.push_str(&conds.join(" AND "));
@@ -139,6 +158,7 @@ impl Db {
                     ratio: r.get(3)?,
                     thumb_state: r.get(4)?,
                     kind: crate::control::PhotoKind::from_i64(r.get(5)?),
+                    favorite: r.get::<_, i64>(6)? != 0,
                 })
             })?
             .collect::<rusqlite::Result<_>>()?;
@@ -154,7 +174,7 @@ impl Db {
         &self,
         kind: Option<crate::control::PhotoKind>,
     ) -> Result<Vec<(i32, i32, usize)>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let (filter, binds): (&str, Vec<i64>) = match kind {
             Some(k) => (" WHERE kind = ?1", vec![k.as_i64()]),
             None => ("", Vec::new()),
@@ -181,7 +201,7 @@ impl Db {
     /// Per-tab counts for the Photos page subtitle: `(photos, videos, raw)`.
     pub fn photos_counts(&self) -> Result<(usize, usize, usize)> {
         use crate::control::PhotoKind;
-        let conn = self.conn.lock();
+        let conn = self.read();
         let mut stmt = conn.prepare("SELECT kind, COUNT(*) FROM photos GROUP BY kind")?;
         let rows = stmt.query_map([], |r| Ok((r.get::<_, i64>(0)?, r.get::<_, i64>(1)?)))?;
         let (mut photos, mut videos, mut raw) = (0usize, 0usize, 0usize);
@@ -203,10 +223,10 @@ impl Db {
         if uids.is_empty() {
             return Ok(Vec::new());
         }
-        let conn = self.conn.lock();
+        let conn = self.read();
         let placeholders = vec!["?"; uids.len()].join(",");
         let mut stmt = conn.prepare(&format!(
-            "SELECT uid, capture_time, name, ratio, thumb_state, kind FROM photos
+            "SELECT uid, capture_time, name, ratio, thumb_state, kind, favorite FROM photos
              WHERE uid IN ({placeholders})"
         ))?;
         let rows = stmt.query_map(rusqlite::params_from_iter(uids), |r| {
@@ -217,6 +237,7 @@ impl Db {
                 ratio: r.get(3)?,
                 thumb_state: r.get(4)?,
                 kind: crate::control::PhotoKind::from_i64(r.get(5)?),
+                favorite: r.get::<_, i64>(6)? != 0,
             })
         })?;
         let mut photos = Vec::new();
@@ -226,6 +247,18 @@ impl Db {
         Ok(photos)
     }
 
+    /// Record a photo's favourite flag locally, after the server accepted the
+    /// change. A uid the timeline does not hold is a no-op — an album photo on
+    /// someone else's volume is never in our own `photos` table.
+    pub fn photos_set_favorite(&self, uid: &str, favorite: bool) -> Result<()> {
+        let conn = self.conn.lock();
+        conn.execute(
+            "UPDATE photos SET favorite = ?2 WHERE uid = ?1",
+            params![uid, favorite as i64],
+        )?;
+        Ok(())
+    }
+
     /// Record what a thumbnail attempt learned: whether the photo now has one
     /// ([`THUMB_HAVE`] / [`THUMB_NONE`]), and its aspect ratio if the pixels were
     /// seen. A `None` ratio leaves any previously learned one alone.
@@ -240,7 +273,7 @@ impl Db {
 
     /// Number of photos in the persisted timeline.
     pub fn photos_count(&self) -> Result<usize> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let n: i64 = conn.query_row("SELECT COUNT(*) FROM photos", [], |r| r.get(0))?;
         Ok(n.max(0) as usize)
     }

crates/pdfs-core/src/db/pins.rs

@@ -4,8 +4,21 @@
 use rusqlite::{OptionalExtension, params};
 
 use super::Db;
+use super::utils::MAX_PATH_DEPTH;
 use crate::Result;
 
+/// One row of [`Db::pin_list`]. `recursive` is pin *policy* — whether the whole
+/// subtree is kept — while `is_dir` is the node's kind as the node cache knows
+/// it, or `None` for a pin whose node is not cached. Reading the former as the
+/// latter is what made a non-recursively pinned folder render as a file.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PinRow {
+    pub uid: String,
+    pub path: String,
+    pub recursive: bool,
+    pub is_dir: Option<bool>,
+}
+
 impl Db {
     pub fn pin_add(&self, uid: &str, path: &str, recursive: bool) -> Result<()> {
         let conn = self.conn.lock();
@@ -25,16 +38,23 @@ impl Db {
         Ok(n > 0)
     }
 
-    /// Every directly-pinned entry `(uid, path, recursive)`, ordered by uid.
+    /// Every directly-pinned entry, ordered by uid.
-    pub fn pin_list(&self) -> Result<Vec<(String, String, bool)>> {
+    pub fn pin_list(&self) -> Result<Vec<PinRow>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
-        let mut stmt = conn.prepare("SELECT uid, path, recursive FROM pins ORDER BY uid")?;
+        // `recursive` is pin policy; the node's kind comes from `nodes`, and is
+        // NULL for a pin whose node was never cached.
+        let mut stmt = conn.prepare(
+            "SELECT p.uid, p.path, p.recursive, n.is_dir
+               FROM pins p LEFT JOIN nodes n ON n.uid = p.uid
+              ORDER BY p.uid",
+        )?;
         let rows = stmt.query_map([], |r| {
-            Ok((
+            Ok(PinRow {
-                r.get::<_, String>(0)?,
+                uid: r.get(0)?,
-                r.get::<_, String>(1)?,
+                path: r.get(1)?,
-                r.get::<_, i64>(2)? != 0,
+                recursive: r.get::<_, i64>(2)? != 0,
-            ))
+                is_dir: r.get::<_, Option<i64>>(3)?.map(|is_dir| is_dir != 0),
+            })
         })?;
         let mut out = Vec::new();
         for r in rows {
@@ -47,8 +67,13 @@ impl Db {
     /// is pinned recursively. The ancestor check walks `parent_uid` to the root
     /// via a CTE; a direct pin is honoured even when the node has no `nodes` row
     /// yet (e.g. a CLI that never hydrates the node cache).
+    ///
+    /// The walk is depth-capped like [`super::utils::path_of`]: a `parent_uid`
+    /// cycle is corrupt data the API can hand us, and `UNION ALL` over one never
+    /// terminates — while holding the daemon's only SQLite connection, on a path
+    /// that runs per cached read.
     pub fn is_pinned(&self, uid: &str) -> Result<bool> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let direct: Option<i64> = conn
             .query_row("SELECT 1 FROM pins WHERE uid = ?1", params![uid], |r| {
                 r.get(0)
@@ -59,14 +84,18 @@ impl Db {
         }
         let anc: Option<i64> = conn
             .query_row(
-                "WITH RECURSIVE anc(uid, parent_uid) AS (
+                &format!(
-                   SELECT uid, parent_uid FROM nodes WHERE uid = ?1
+                    "WITH RECURSIVE anc(uid, parent_uid, depth) AS (
-                   UNION ALL
+                       SELECT uid, parent_uid, 0 FROM nodes WHERE uid = ?1
-                   SELECT n.uid, n.parent_uid FROM nodes n JOIN anc ON n.uid = anc.parent_uid
+                       UNION ALL
-                 )
+                       SELECT n.uid, n.parent_uid, anc.depth + 1
-                 SELECT 1 FROM anc a JOIN pins p ON p.uid = a.uid
+                       FROM nodes n JOIN anc ON n.uid = anc.parent_uid
-                 WHERE a.uid != ?1 AND p.recursive = 1
+                       WHERE anc.depth < {MAX_PATH_DEPTH}
-                 LIMIT 1",
+                     )
+                     SELECT 1 FROM anc a JOIN pins p ON p.uid = a.uid
+                     WHERE a.uid != ?1 AND p.recursive = 1
+                     LIMIT 1"
+                ),
                 params![uid],
                 |r| r.get(0),
             )
@@ -78,7 +107,7 @@ impl Db {
     /// every descendant of a recursively-pinned folder. Used to build the
     /// eviction-exempt set (the budget enforcer hashes these into cache keys).
     pub fn pinned_uids(&self) -> Result<Vec<String>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let mut stmt = conn.prepare(
             "WITH RECURSIVE sub(uid) AS (
                SELECT uid FROM pins WHERE recursive = 1
@@ -100,7 +129,7 @@ impl Db {
     /// Every descendant uid of `folder` (all depths), via a `parent_uid` CTE.
     /// Used to evict a recursively-pinned subtree's cached blobs on unpin.
     pub fn descendants(&self, folder: &str) -> Result<Vec<String>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let mut stmt = conn.prepare(
             "WITH RECURSIVE sub(uid) AS (
                SELECT uid FROM nodes WHERE parent_uid = ?1

crates/pdfs-core/src/db/share_access.rs

@@ -16,7 +16,7 @@ impl Db {
     /// remains the restart/offline authority and every explicit role change is
     /// written through before this cache is updated.
     pub fn all_share_access(&self) -> Result<HashMap<NodeUid, Access>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let mut stmt = conn.prepare("SELECT root_uid, access FROM share_access")?;
         let rows = stmt.query_map([], |row| {
             Ok((row.get::<_, String>(0)?, row.get::<_, String>(1)?))
@@ -42,7 +42,7 @@ impl Db {
 
     /// Read the effective access recorded for a shared-tree root.
     pub fn share_access(&self, uid: &NodeUid) -> Result<Option<Access>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let value = conn
             .query_row(
                 "SELECT access FROM share_access WHERE root_uid = ?1",
@@ -96,7 +96,7 @@ impl Db {
     /// share root. `None` means the node itself is not persisted, which callers
     /// must not treat as owned: stale handles need to fail closed.
     pub fn effective_node_access(&self, uid: &NodeUid) -> Result<Option<Access>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let exists: bool = conn.query_row(
             "SELECT EXISTS(SELECT 1 FROM nodes WHERE uid = ?1)",
             [uid.to_string()],

crates/pdfs-core/src/db/state.rs

@@ -8,7 +8,7 @@ use crate::Result;
 
 impl Db {
     pub fn get_event_cursor(&self) -> Result<Option<String>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let v = conn
             .query_row(
                 "SELECT value FROM sync_state WHERE key = 'event_cursor'",
@@ -32,7 +32,7 @@ impl Db {
 
     /// Read a `sync_state` value as a string.
     pub fn state_str(&self, key: &str) -> Result<Option<String>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let v = conn
             .query_row(
                 "SELECT value FROM sync_state WHERE key = ?1",
@@ -66,7 +66,7 @@ impl Db {
     /// dropping it would leave a file that exists nowhere but this machine with
     /// nothing left to create it. (Writes to a node that is itself still queued
     pub fn state_i64(&self, key: &str) -> Result<Option<i64>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let v: Option<String> = conn
             .query_row(
                 "SELECT value FROM sync_state WHERE key = ?1",

crates/pdfs-core/src/db/sync.rs

@@ -35,6 +35,14 @@ pub struct StoredSyncEntry {
     pub remote_uid: Option<String>,
     pub local_mtime: i64,
     pub local_size: i64,
+    /// The same modification time to nanosecond precision, when it is known.
+    ///
+    /// `local_mtime` alone cannot tell an edit that landed inside the same
+    /// second as the last sync — and left the file the same length — from no
+    /// edit at all, so those never uploaded (bugs.md B25). `None` on a row
+    /// written before schema 28, which the comparison reads as "compare whole
+    /// seconds", so upgrading does not make an entire mirror look changed.
+    pub local_mtime_ns: Option<i64>,
     pub remote_rev: Option<String>,
     pub remote_hash: Option<String>,
 }
@@ -57,7 +65,7 @@ impl Db {
 
     /// Every synced folder, oldest first.
     pub fn sync_folder_list(&self) -> Result<Vec<StoredSyncFolder>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let mut stmt = conn.prepare(
             "SELECT id, local_path, remote_uid, remote_share_id, mode, pending_mode, state, last_sync
              FROM sync_folder ORDER BY id",
@@ -83,7 +91,7 @@ impl Db {
 
     /// Look up one synced folder by id.
     pub fn sync_folder_get(&self, id: i64) -> Result<Option<StoredSyncFolder>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         conn.query_row(
             "SELECT id, local_path, remote_uid, remote_share_id, mode, pending_mode, state, last_sync
              FROM sync_folder WHERE id = ?1",
@@ -166,9 +174,10 @@ impl Db {
 
     /// The whole per-file sync baseline for a folder, keyed by relative path.
     pub fn sync_entries(&self, folder_id: i64) -> Result<HashMap<String, StoredSyncEntry>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let mut stmt = conn.prepare(
-            "SELECT rel_path, remote_uid, local_mtime, local_size, remote_rev, remote_hash
+            "SELECT rel_path, remote_uid, local_mtime, local_size, remote_rev, remote_hash,
+                    local_mtime_ns
              FROM sync_entry WHERE folder_id = ?1",
         )?;
         let rows = stmt.query_map(params![folder_id], |r| {
@@ -179,6 +188,7 @@ impl Db {
                 local_size: r.get(3)?,
                 remote_rev: r.get(4)?,
                 remote_hash: r.get(5)?,
+                local_mtime_ns: r.get(6)?,
             })
         })?;
         let mut map = HashMap::new();
@@ -196,7 +206,7 @@ impl Db {
     /// `sync_folder` and descendants come from the last successful
     /// `sync_entry` baseline.
     pub fn mirror_contains_uid(&self, uid: &str) -> Result<bool> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         conn.query_row(
             "SELECT EXISTS(
                  SELECT 1
@@ -216,14 +226,16 @@ impl Db {
         let conn = self.conn.lock();
         conn.execute(
             "INSERT INTO sync_entry
-               (folder_id, rel_path, remote_uid, local_mtime, local_size, remote_rev, remote_hash)
+               (folder_id, rel_path, remote_uid, local_mtime, local_size, remote_rev,
-             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)
+                remote_hash, local_mtime_ns)
+             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)
              ON CONFLICT(folder_id, rel_path) DO UPDATE SET
-               remote_uid  = excluded.remote_uid,
+               remote_uid     = excluded.remote_uid,
-               local_mtime = excluded.local_mtime,
+               local_mtime    = excluded.local_mtime,
-               local_size  = excluded.local_size,
+               local_size     = excluded.local_size,
-               remote_rev  = excluded.remote_rev,
+               remote_rev     = excluded.remote_rev,
-               remote_hash = excluded.remote_hash",
+               remote_hash    = excluded.remote_hash,
+               local_mtime_ns = excluded.local_mtime_ns",
             params![
                 folder_id,
                 e.rel_path,
@@ -232,6 +244,7 @@ impl Db {
                 e.local_size,
                 e.remote_rev,
                 e.remote_hash,
+                e.local_mtime_ns,
             ],
         )?;
         Ok(())

crates/pdfs-core/src/db/tests.rs

@@ -113,9 +113,9 @@ fn node_from(parent: serde_json::Value, link: &str, name: &str, kind: serde_json
 fn photos_replace_keeps_what_was_learned_and_drops_what_left() {
     let db = Db::open_in_memory().unwrap();
     db.photos_replace(&[
-        ("p1".into(), 300, None, Some("video/mp4".into())),
+        ("p1".into(), 300, None, Some("video/mp4".into()), Some(true)),
-        ("p2".into(), 200, None, None),
+        ("p2".into(), 200, None, None, None),
-        ("p3".into(), 100, None, None),
+        ("p3".into(), 100, None, None, None),
     ])
     .unwrap();
 
@@ -126,13 +126,13 @@ fn photos_replace_keeps_what_was_learned_and_drops_what_left() {
     // The next refresh brings a new photo, keeps p1 and p2, and loses p3.
     // p1's media type arrives as `None` this time and must not be forgotten.
     db.photos_replace(&[
-        ("p0".into(), 400, Some("new.jpg".into()), None),
+        ("p0".into(), 400, Some("new.jpg".into()), None, Some(false)),
-        ("p1".into(), 300, None, None),
+        ("p1".into(), 300, None, None, None),
-        ("p2".into(), 200, None, None),
+        ("p2".into(), 200, None, None, None),
     ])
     .unwrap();
 
-    let page = db.photos_page(0, 10, None, None).unwrap();
+    let page = db.photos_page(0, 10, None, None, false).unwrap();
     assert_eq!(
         page.iter().map(|p| p.uid.as_str()).collect::<Vec<_>>(),
         ["p0", "p1", "p2"],
@@ -155,7 +155,7 @@ fn photos_replace_keeps_what_was_learned_and_drops_what_left() {
     // The counts break down by tab, and a filtered page returns only its tab.
     assert_eq!(db.photos_counts().unwrap(), (2, 1, 0));
     let videos = db
-        .photos_page(0, 10, Some(crate::control::PhotoKind::Video), None)
+        .photos_page(0, 10, Some(crate::control::PhotoKind::Video), None, false)
         .unwrap();
     assert_eq!(
         videos.iter().map(|p| p.uid.as_str()).collect::<Vec<_>>(),
@@ -167,7 +167,9 @@ fn photos_replace_keeps_what_was_learned_and_drops_what_left() {
 
     // A date-range page keeps only the window's photos: [150, 350) is p1+p2,
     // not p0 at 400. Combined with a kind filter both conditions apply.
-    let ranged = db.photos_page(0, 10, None, Some((150, 350))).unwrap();
+    let ranged = db
+        .photos_page(0, 10, None, Some((150, 350)), false)
+        .unwrap();
     assert_eq!(
         ranged.iter().map(|p| p.uid.as_str()).collect::<Vec<_>>(),
         ["p1", "p2"]
@@ -178,6 +180,7 @@ fn photos_replace_keeps_what_was_learned_and_drops_what_left() {
             10,
             Some(crate::control::PhotoKind::Video),
             Some((150, 350)),
+            false,
         )
         .unwrap();
     assert_eq!(
@@ -193,20 +196,52 @@ fn photos_replace_keeps_what_was_learned_and_drops_what_left() {
     assert_eq!(months[0].2, 3);
 }
 
+#[test]
+fn favorites_are_remembered_across_refreshes_and_filter_a_page() {
+    let db = Db::open_in_memory().unwrap();
+    db.photos_replace(&[
+        ("p1".into(), 300, None, None, Some(true)),
+        ("p2".into(), 200, None, None, Some(false)),
+    ])
+    .unwrap();
+    let favorites = db.photos_page(0, 10, None, None, true).unwrap();
+    assert_eq!(
+        favorites.iter().map(|p| p.uid.as_str()).collect::<Vec<_>>(),
+        ["p1"],
+        "only the favourited photo is in a favourites page"
+    );
+
+    // A local toggle survives a refresh that could not resolve the photo's node
+    // (`None`), and loses to one that could.
+    db.photos_set_favorite("p2", true).unwrap();
+    db.photos_replace(&[
+        ("p1".into(), 300, None, None, Some(false)),
+        ("p2".into(), 200, None, None, None),
+    ])
+    .unwrap();
+    let favorites = db.photos_page(0, 10, None, None, true).unwrap();
+    assert_eq!(
+        favorites.iter().map(|p| p.uid.as_str()).collect::<Vec<_>>(),
+        ["p2"],
+        "the server's answer wins where it has one; the local flag holds where it doesn't"
+    );
+    assert!(db.photos_by_uid(&["p2".into()]).unwrap()[0].favorite);
+}
+
 #[test]
 fn photos_page_slices_the_timeline_in_order() {
     let db = Db::open_in_memory().unwrap();
     let items: Vec<_> = (0..5)
-        .map(|i| (format!("p{i}"), 500 - i as i64, None, None::<String>))
+        .map(|i| (format!("p{i}"), 500 - i as i64, None, None::<String>, None))
         .collect();
     db.photos_replace(&items).unwrap();
 
-    let page = db.photos_page(2, 2, None, None).unwrap();
+    let page = db.photos_page(2, 2, None, None, false).unwrap();
     assert_eq!(
         page.iter().map(|p| p.uid.as_str()).collect::<Vec<_>>(),
         ["p2", "p3"]
     );
-    assert!(db.photos_page(9, 2, None, None).unwrap().is_empty());
+    assert!(db.photos_page(9, 2, None, None, false).unwrap().is_empty());
 }
 
 #[test]
@@ -832,6 +867,67 @@ fn shared_root_pinned_name_survives_database_reopen() {
     let _ = std::fs::remove_file(path);
 }
 
+/// Two writers on one database is the failure mode the single-instance lock
+/// exists to prevent — a hand-run `pdfs mount` next to the systemd unit gives
+/// two daemons the same inode space, content cache, and drain queue. The second
+/// open has to fail, and it has to stop failing once the first handle is gone.
+#[test]
+fn a_second_writer_is_refused_while_the_first_holds_the_database() {
+    let path = std::env::temp_dir().join(format!(
+        "pdfs-single-writer-{}-{}.db",
+        std::process::id(),
+        now_test_id()
+    ));
+    let first = Db::open(&path).unwrap();
+    let second = Db::open(&path);
+    assert!(second.is_err(), "a second writer was allowed in");
+
+    drop(first);
+    // The lock lives in the kernel and dies with the descriptor, so nothing has
+    // to be cleaned up for the next daemon to start.
+    Db::open(&path).expect("reopen after the first handle is dropped");
+
+    let _ = std::fs::remove_file(&path);
+    let _ = std::fs::remove_file(path.with_extension("db.lock"));
+}
+
+/// `cache.db` is derived state — every row can be re-fetched or re-scanned — so
+/// a file that is not a database at all must not stop the daemon starting. It
+/// is moved aside (not deleted: it is the only evidence) and rebuilt.
+#[test]
+fn a_corrupt_database_is_moved_aside_and_rebuilt() {
+    let path = std::env::temp_dir().join(format!(
+        "pdfs-corrupt-{}-{}.db",
+        std::process::id(),
+        now_test_id()
+    ));
+    std::fs::write(&path, b"this is not an SQLite database").unwrap();
+
+    let db = Db::open(&path).unwrap();
+    db.set_state_str("shared_with_me_name", "rebuilt").unwrap();
+    assert_eq!(
+        db.state_str("shared_with_me_name").unwrap().as_deref(),
+        Some("rebuilt")
+    );
+    drop(db);
+
+    let dir = path.parent().unwrap();
+    let stem = path.file_name().unwrap().to_string_lossy().to_string();
+    let quarantined: Vec<_> = std::fs::read_dir(dir)
+        .unwrap()
+        .filter_map(|e| e.ok())
+        .map(|e| e.file_name().to_string_lossy().to_string())
+        .filter(|name| name.starts_with(&format!("{stem}.corrupt-")))
+        .collect();
+    assert_eq!(quarantined.len(), 1, "the damaged file was not kept");
+
+    for name in quarantined {
+        let _ = std::fs::remove_file(dir.join(name));
+    }
+    let _ = std::fs::remove_file(&path);
+    let _ = std::fs::remove_file(path.with_extension("db.lock"));
+}
+
 fn local(path: &str, name: &str, is_dir: bool) -> LocalEntry {
     LocalEntry {
         path: path.into(),
@@ -876,6 +972,25 @@ fn local_scan_indexes_then_prunes_stale_paths() {
     assert_eq!(db.search_local("notes", 10).unwrap().len(), 1);
 }
 
+/// The index is maintained incrementally rather than rebuilt at the end of a
+/// scan, so the case that used to be covered for free — a file the scan sees
+/// again — needs its own test: a re-scan must neither lose the entry nor
+/// duplicate it.
+#[test]
+fn rescanning_an_unchanged_file_keeps_exactly_one_index_entry() {
+    let db = Db::open_in_memory().unwrap();
+    for (generation, mtime) in [(1_000, 5), (2_000, 9)] {
+        let g = db.local_begin_scan().unwrap();
+        let mut e = local("/home/u/docs/report.pdf", "report.pdf", false);
+        e.mtime = mtime;
+        db.local_upsert_batch(g, &[e]).unwrap();
+        assert_eq!(db.local_finish_scan(g, generation).unwrap(), 1);
+        let hits = db.search_local("report", 10).unwrap();
+        assert_eq!(hits.len(), 1, "generation {generation}");
+        assert_eq!(hits[0].mtime, mtime);
+    }
+}
+
 /// Queries below the trigram minimum still match, via the `LIKE` fallback.
 #[test]
 fn local_search_short_query_like_fallback() {
@@ -954,6 +1069,62 @@ fn search_excludes_trashed_and_respects_limit() {
     assert_eq!(db.search("alph", 1).unwrap().len(), 1);
 }
 
+/// A device folder's root is stored in `device`/`sync_folder`, never in
+/// `nodes`, so its children's `parent_uid` points at a row that does not exist.
+/// Requiring the ancestor walk to reach a `parent_uid IS NULL` row therefore
+/// excluded every device-folder subtree from search: 2,705 of 9,252 nodes on
+/// the account this was found on, including everything under `~/Downloads`.
+#[test]
+fn search_finds_nodes_below_an_uncached_parent() {
+    let db = Db::open_in_memory().unwrap();
+    // "device-root" is deliberately never upserted.
+    db.upsert_node(&folder("downloads", Some("device-root"), "Downloads"))
+        .unwrap();
+    db.upsert_node(&file("t", "downloads", "tickets.pdf", 1))
+        .unwrap();
+
+    let hits = db.search("tickets", 10).unwrap();
+    assert_eq!(hits.len(), 1, "a device folder's files must be searchable");
+    assert_eq!(hits[0].path, "Downloads/tickets.pdf");
+}
+
+/// The relaxed rule must not also start indexing trash: a node whose *parent*
+/// is trashed stays out even though the walk now terminates happily.
+#[test]
+fn search_excludes_a_node_under_a_trashed_ancestor() {
+    let db = Db::open_in_memory().unwrap();
+    db.upsert_node(&folder("root", None, "My Files")).unwrap();
+    let mut folder_gone = folder("boxed", Some("root"), "Boxed");
+    folder_gone.trashed = true;
+    db.upsert_node(&folder_gone).unwrap();
+    db.upsert_node(&file("f1", "boxed", "buried.txt", 1))
+        .unwrap();
+
+    assert!(db.search("buried", 10).unwrap().is_empty());
+}
+
+/// A parent cycle is corrupt data the API can still hand us. It must stay out
+/// of the index, and — because the short-query `LIKE` lane reads `nodes`
+/// directly and never consults the index — resolving one's path must terminate
+/// rather than spin inside the daemon's only SQLite connection.
+#[test]
+fn a_parent_cycle_is_unindexed_and_never_hangs_a_search() {
+    let db = Db::open_in_memory().unwrap();
+    db.upsert_node(&folder("a", Some("b"), "Alphaville"))
+        .unwrap();
+    db.upsert_node(&folder("b", Some("a"), "Betamax")).unwrap();
+
+    // Index lane: the cycle is not indexed, so it cannot be found.
+    assert!(db.search("alphaville", 10).unwrap().is_empty());
+    assert!(db.search("betamax", 10).unwrap().is_empty());
+
+    // LIKE lane (below the trigram minimum): the rows are reachable, and what
+    // matters is that resolving their paths returns at all.
+    let hits = db.search("al", 10).unwrap();
+    assert_eq!(hits.len(), 1);
+    assert!(hits[0].path.ends_with("Alphaville"));
+}
+
 #[test]
 fn search_short_query_like_fallback() {
     let db = Db::open_in_memory().unwrap();
@@ -1336,6 +1507,9 @@ fn migration_v17_adds_share_access_to_a_v16_fixture() {
              DROP TABLE share_access;
              DROP TABLE album_photos;
              DROP TABLE albums;
+             DROP INDEX idx_photos_favorite;
+             ALTER TABLE photos DROP COLUMN favorite;
+             ALTER TABLE nodes DROP COLUMN path;
              UPDATE sync_state SET value = '16' WHERE key = 'schema_version';",
         )
         .unwrap();
@@ -1402,6 +1576,18 @@ fn migration_v18_projects_v17_sync_folders_and_cascades_deletes() {
              VALUES
                (41, '/home/me/Existing', 'vol~existing', 'share-existing',
                 'ondemand', 'syncing', 123);
+             -- The timeline as V17 held it: later migrations add columns to it,
+             -- so a fixture without it isn't a database any release produced.
+             CREATE TABLE photos (
+               uid          TEXT PRIMARY KEY,
+               capture_time INTEGER NOT NULL,
+               name         TEXT,
+               ratio        REAL,
+               thumb_state  INTEGER NOT NULL DEFAULT 0,
+               seq          INTEGER NOT NULL,
+               media_type   TEXT,
+               kind         INTEGER NOT NULL DEFAULT 0
+             );
              CREATE TABLE share_access (
                root_uid TEXT PRIMARY KEY,
                access   TEXT NOT NULL
@@ -2222,6 +2408,7 @@ fn mirror_uid_lookup_covers_the_root_and_synced_descendants_only() {
             local_size: 2,
             remote_rev: Some("3".into()),
             remote_hash: Some("2".into()),
+            local_mtime_ns: None,
         },
     )
     .unwrap();
@@ -2238,6 +2425,7 @@ fn mirror_uid_lookup_covers_the_root_and_synced_descendants_only() {
             local_size: 2,
             remote_rev: Some("3".into()),
             remote_hash: Some("2".into()),
+            local_mtime_ns: None,
         },
     )
     .unwrap();
@@ -2423,14 +2611,41 @@ fn pin_add_list_remove_roundtrip() {
     db.pin_add("vol~d", "docs", true).unwrap();
     let list = db.pin_list().unwrap();
     assert_eq!(list.len(), 2);
-    assert_eq!(list[0], ("vol~a".into(), "docs/a.txt".into(), false));
+    // No `nodes` row for either pin, so the kind is unknown rather than guessed
-    assert_eq!(list[1], ("vol~d".into(), "docs".into(), true));
+    // from the recursive flag.
+    assert_eq!(
+        list[0],
+        PinRow {
+            uid: "vol~a".into(),
+            path: "docs/a.txt".into(),
+            recursive: false,
+            is_dir: None,
+        }
+    );
+    assert_eq!(
+        list[1],
+        PinRow {
+            uid: "vol~d".into(),
+            path: "docs".into(),
+            recursive: true,
+            is_dir: None,
+        }
+    );
+
+    // Once the node is cached, the pin reports the real kind — a folder pinned
+    // non-recursively must not look like a file.
+    db.upsert_node(&folder("root", None, "My Files")).unwrap();
+    db.upsert_node(&folder("d", Some("root"), "docs")).unwrap();
+    db.pin_add("vol~d", "docs", false).unwrap();
+    let list = db.pin_list().unwrap();
+    assert!(!list[1].recursive, "pin policy stays non-recursive");
+    assert_eq!(list[1].is_dir, Some(true), "but the node is still a folder");
 
     // Re-pin refreshes path/flag, not a duplicate row.
     db.pin_add("vol~a", "moved/a.txt", false).unwrap();
     let list = db.pin_list().unwrap();
     assert_eq!(list.len(), 2);
-    assert_eq!(list[0].1, "moved/a.txt");
+    assert_eq!(list[0].path, "moved/a.txt");
 
     assert!(db.pin_remove("vol~a").unwrap());
     assert!(!db.pin_remove("vol~a").unwrap());
@@ -2496,6 +2711,26 @@ fn non_recursive_folder_pin_does_not_cover_children() {
     assert!(!db.is_pinned(&du("rep")).unwrap());
 }
 
+/// A `parent_uid` cycle is corrupt data the API can hand us, and `is_pinned`'s
+/// ancestor walk is `UNION ALL` — uncapped it never terminates, while holding
+/// the daemon's only SQLite connection, on a path that runs per cached read.
+/// The answer here matters less than the fact that there is one.
+#[test]
+fn is_pinned_terminates_on_a_parent_cycle() {
+    let db = Db::open_in_memory().unwrap();
+    let du = |l: &str| uid(l).to_string();
+    // a -> b -> a, with nothing pinned above either.
+    db.upsert_node(&folder("a", Some("b"), "A")).unwrap();
+    db.upsert_node(&folder("b", Some("a"), "B")).unwrap();
+    db.upsert_node(&file("leaf", "a", "leaf.txt", 1)).unwrap();
+
+    assert!(!db.is_pinned(&du("leaf")).unwrap());
+
+    // And a pin *inside* the cycle is still found rather than walked past.
+    db.pin_add(&du("a"), "A", true).unwrap();
+    assert!(db.is_pinned(&du("leaf")).unwrap());
+}
+
 #[test]
 fn schema_objects_exist() {
     let db = Db::open_in_memory().unwrap();
@@ -3050,3 +3285,502 @@ fn clear_state_prefix_takes_only_the_prefixed_keys() {
         "the listing's own stamp is not a per-album one"
     );
 }
+
+// --- `nodes.path`, and the subtree work it replaces (DB3) -------------------
+
+/// Read the stored path column directly: the point of these tests is that the
+/// column itself is right, not that `path_of` can still fall back to a walk.
+fn stored_path(db: &Db, link: &str) -> Option<String> {
+    use rusqlite::OptionalExtension;
+    db.with_conn(|conn| {
+        Ok(conn
+            .query_row(
+                "SELECT path FROM nodes WHERE uid = ?1",
+                [uid(link).to_string()],
+                |row| row.get::<_, Option<String>>(0),
+            )
+            .optional()?
+            .flatten())
+    })
+    .unwrap()
+}
+
+#[test]
+fn a_node_stores_its_path_when_it_is_written() {
+    let db = Db::open_in_memory().unwrap();
+    db.upsert_node(&folder("root", None, "My Files")).unwrap();
+    db.upsert_node(&folder("docs", Some("root"), "Documents"))
+        .unwrap();
+    db.upsert_node(&file("f1", "docs", "report.pdf", 1))
+        .unwrap();
+
+    // The root's name is the mount, so it contributes nothing.
+    assert_eq!(stored_path(&db, "root").as_deref(), Some(""));
+    assert_eq!(stored_path(&db, "docs").as_deref(), Some("Documents"));
+    assert_eq!(
+        stored_path(&db, "f1").as_deref(),
+        Some("Documents/report.pdf")
+    );
+}
+
+#[test]
+fn a_node_below_an_uncached_parent_starts_its_own_path() {
+    // A device folder's root lives in `device`/`sync_folder` and never gets a
+    // `nodes` row, so its children are the top of the cached chain.
+    let db = Db::open_in_memory().unwrap();
+    db.upsert_node(&folder("orphan", Some("never-cached"), "Work"))
+        .unwrap();
+    db.upsert_node(&file("f1", "orphan", "notes.txt", 1))
+        .unwrap();
+
+    assert_eq!(stored_path(&db, "orphan").as_deref(), Some("Work"));
+    assert_eq!(stored_path(&db, "f1").as_deref(), Some("Work/notes.txt"));
+}
+
+#[test]
+fn renaming_a_folder_rewrites_every_descendant_path() {
+    let db = Db::open_in_memory().unwrap();
+    db.upsert_node(&folder("root", None, "My Files")).unwrap();
+    db.upsert_node(&folder("a", Some("root"), "Before"))
+        .unwrap();
+    db.upsert_node(&folder("b", Some("a"), "Inner")).unwrap();
+    db.upsert_node(&file("f1", "b", "deep.txt", 1)).unwrap();
+    assert_eq!(
+        stored_path(&db, "f1").as_deref(),
+        Some("Before/Inner/deep.txt")
+    );
+
+    db.upsert_node(&folder("a", Some("root"), "After")).unwrap();
+
+    assert_eq!(stored_path(&db, "a").as_deref(), Some("After"));
+    assert_eq!(stored_path(&db, "b").as_deref(), Some("After/Inner"));
+    assert_eq!(
+        stored_path(&db, "f1").as_deref(),
+        Some("After/Inner/deep.txt")
+    );
+    let hit = &db.search("deep.txt", 10).unwrap()[0];
+    assert_eq!(
+        hit.path, "After/Inner/deep.txt",
+        "the search index must carry the rewritten path too"
+    );
+}
+
+#[test]
+fn moving_a_folder_rewrites_every_descendant_path() {
+    let db = Db::open_in_memory().unwrap();
+    db.upsert_node(&folder("root", None, "My Files")).unwrap();
+    db.upsert_node(&folder("old", Some("root"), "Old")).unwrap();
+    db.upsert_node(&folder("new", Some("root"), "New")).unwrap();
+    db.upsert_node(&folder("moved", Some("old"), "Moved"))
+        .unwrap();
+    db.upsert_node(&file("f1", "moved", "deep.txt", 1)).unwrap();
+
+    db.upsert_node(&folder("moved", Some("new"), "Moved"))
+        .unwrap();
+
+    assert_eq!(stored_path(&db, "moved").as_deref(), Some("New/Moved"));
+    assert_eq!(
+        stored_path(&db, "f1").as_deref(),
+        Some("New/Moved/deep.txt")
+    );
+}
+
+#[test]
+fn trashing_a_folder_drops_its_subtree_from_the_index() {
+    let db = Db::open_in_memory().unwrap();
+    db.upsert_node(&folder("root", None, "My Files")).unwrap();
+    db.upsert_node(&folder("a", Some("root"), "Holder"))
+        .unwrap();
+    db.upsert_node(&file("f1", "a", "hidden.txt", 1)).unwrap();
+    assert_eq!(db.search("hidden", 10).unwrap().len(), 1);
+
+    let mut trashed = folder("a", Some("root"), "Holder");
+    trashed.trashed = true;
+    db.upsert_node(&trashed).unwrap();
+
+    assert_eq!(
+        db.search("hidden", 10).unwrap().len(),
+        0,
+        "a file under a trashed folder is not reachable and must not be findable"
+    );
+
+    // …and comes back when the folder does.
+    db.upsert_node(&folder("a", Some("root"), "Holder"))
+        .unwrap();
+    assert_eq!(db.search("hidden", 10).unwrap().len(), 1);
+}
+
+/// The re-listing case, which is most of what the write path actually does: a
+/// folder upserted with the same name and parent must not touch its subtree.
+///
+/// Written as a ratio between two subtree sizes, so it fails on the scaling
+/// regression rather than on a slow machine. Before this, every re-listing paid
+/// a `path_of` walk plus an ancestor walk per descendant.
+#[test]
+fn re_listing_a_folder_does_not_scale_with_its_subtree() {
+    fn elapsed_for(children: usize) -> std::time::Duration {
+        let db = Db::open_in_memory().unwrap();
+        db.upsert_node(&folder("root", None, "My Files")).unwrap();
+        db.upsert_node(&folder("big", Some("root"), "Big")).unwrap();
+        let kids: Vec<Node> = (0..children)
+            .map(|i| file(&format!("k{i}"), "big", &format!("child-{i}.txt"), 1))
+            .collect();
+        db.upsert_nodes(&kids).unwrap();
+
+        let unchanged = folder("big", Some("root"), "Big");
+        let start = std::time::Instant::now();
+        for _ in 0..20 {
+            db.upsert_node(&unchanged).unwrap();
+        }
+        start.elapsed()
+    }
+
+    let small = elapsed_for(100);
+    let large = elapsed_for(2_000);
+    assert!(
+        large < small * 8,
+        "re-listing a folder scaled with its subtree: {small:?} for 100 children, \
+         {large:?} for 2000 (20x the descendants)"
+    );
+}
+
+#[test]
+fn migration_v25_backfills_paths_for_an_existing_tree() {
+    let path = std::env::temp_dir().join(format!(
+        "pdfs-db-v24-fixture-{}-{}.db",
+        std::process::id(),
+        std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap()
+            .as_nanos()
+    ));
+    {
+        let db = Db::open(&path).unwrap();
+        db.upsert_node(&folder("root", None, "My Files")).unwrap();
+        db.upsert_node(&folder("docs", Some("root"), "Documents"))
+            .unwrap();
+        db.upsert_node(&file("f1", "docs", "report.pdf", 1))
+            .unwrap();
+        db.upsert_node(&folder("orphan", Some("never-cached"), "Work"))
+            .unwrap();
+        db.upsert_node(&file("f2", "orphan", "notes.txt", 1))
+            .unwrap();
+    }
+    {
+        // Put the file back in the state a released V24 database was in.
+        let conn = rusqlite::Connection::open(&path).unwrap();
+        conn.execute_batch(
+            "ALTER TABLE nodes DROP COLUMN path;
+             UPDATE sync_state SET value = '24' WHERE key = 'schema_version';",
+        )
+        .unwrap();
+    }
+
+    let db = Db::open(&path).unwrap();
+    assert_eq!(stored_path(&db, "root").as_deref(), Some(""));
+    assert_eq!(stored_path(&db, "docs").as_deref(), Some("Documents"));
+    assert_eq!(
+        stored_path(&db, "f1").as_deref(),
+        Some("Documents/report.pdf"),
+        "an existing tree must come out of the migration with the same paths \
+         the walk used to produce"
+    );
+    // A subtree whose top has an uncached parent is ordinary data, not an error.
+    assert_eq!(stored_path(&db, "orphan").as_deref(), Some("Work"));
+    assert_eq!(stored_path(&db, "f2").as_deref(), Some("Work/notes.txt"));
+
+    let _ = std::fs::remove_file(&path);
+    let _ = std::fs::remove_file(format!("{}.lock", path.display()));
+}
+
+/// A queue carried over from V26 keeps its rows, and every one of them starts
+/// out not access-deferred — a migration must not invent a deferral window that
+/// would report an ordinary queued upload as blocked.
+#[test]
+fn migration_v27_adds_the_access_deferral_column_to_a_v26_queue() {
+    let path = std::env::temp_dir().join(format!(
+        "pdfs-db-v26-fixture-{}-{}.db",
+        std::process::id(),
+        std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap()
+            .as_nanos()
+    ));
+    {
+        let db = Db::open(&path).unwrap();
+        db.enqueue_op(&crate::db::PendingOp {
+            id: 0,
+            kind: crate::db::OP_REVISION.to_string(),
+            uid: "v~l".to_string(),
+            parent_uid: None,
+            name: None,
+            blob_path: Some("/tmp/blob".to_string()),
+            meta_json: Some("{}".to_string()),
+            created_at: 1,
+            attempts: 0,
+            last_error: None,
+            next_attempt_at: 0,
+        })
+        .unwrap();
+    }
+    {
+        // Put the file back in the state a released V26 database was in.
+        let conn = rusqlite::Connection::open(&path).unwrap();
+        conn.execute_batch(
+            "ALTER TABLE pending_op DROP COLUMN access_deferred_since;
+             UPDATE sync_state SET value = '26' WHERE key = 'schema_version';",
+        )
+        .unwrap();
+    }
+
+    let db = Db::open(&path).unwrap();
+    let ops = db.pending_ops().unwrap();
+    assert_eq!(ops.len(), 1, "the migration keeps the queued write");
+    let now = 5_000i64;
+    assert_eq!(
+        db.defer_op_for_access(ops[0].id, now, now + 5_000).unwrap(),
+        now,
+        "a carried-over op is not already deferred"
+    );
+
+    let _ = std::fs::remove_file(&path);
+    let _ = std::fs::remove_file(format!("{}.lock", path.display()));
+}
+
+/// A mirror baseline carried over from V27 keeps its rows, and each one reads
+/// back with no nanosecond time. That `None` is the whole point: it makes the
+/// comparison fall back to whole seconds for rows written before the column
+/// existed, instead of asserting a sub-second time of zero and re-uploading
+/// every already-synced file in the folder (bugs.md B25).
+#[test]
+fn migration_v28_adds_sub_second_local_times_without_disturbing_a_v27_baseline() {
+    let path = std::env::temp_dir().join(format!(
+        "pdfs-db-v27-fixture-{}-{}.db",
+        std::process::id(),
+        std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap()
+            .as_nanos()
+    ));
+    {
+        let db = Db::open(&path).unwrap();
+        let folder = db
+            .sync_folder_add("/home/me/Mirror", "vol~root", "share")
+            .unwrap();
+        db.sync_entry_upsert(
+            folder,
+            &StoredSyncEntry {
+                rel_path: "notes.txt".into(),
+                remote_uid: Some("vol~notes".into()),
+                local_mtime: 1_700_000_000,
+                local_mtime_ns: Some(1_700_000_000_123_456_789),
+                local_size: 42,
+                remote_rev: Some("1700000000".into()),
+                remote_hash: Some("42".into()),
+            },
+        )
+        .unwrap();
+    }
+    {
+        // Put the file back in the state a released V27 database was in.
+        let conn = rusqlite::Connection::open(&path).unwrap();
+        conn.execute_batch(
+            "ALTER TABLE sync_entry DROP COLUMN local_mtime_ns;
+             UPDATE sync_state SET value = '27' WHERE key = 'schema_version';",
+        )
+        .unwrap();
+    }
+
+    let db = Db::open(&path).unwrap();
+    let entries = db.sync_entries(1).unwrap();
+    let entry = entries.get("notes.txt").expect("the baseline row survives");
+    assert_eq!(entry.local_mtime, 1_700_000_000);
+    assert_eq!(entry.local_size, 42);
+    assert_eq!(
+        entry.local_mtime_ns, None,
+        "a carried-over row must not claim a sub-second time it never recorded"
+    );
+
+    // And the column is live: a refreshed row keeps the precision it is given.
+    db.sync_entry_upsert(
+        1,
+        &StoredSyncEntry {
+            local_mtime_ns: Some(1_700_000_001_000_000_500),
+            ..entry.clone()
+        },
+    )
+    .unwrap();
+    assert_eq!(
+        db.sync_entries(1).unwrap()["notes.txt"].local_mtime_ns,
+        Some(1_700_000_001_000_000_500)
+    );
+
+    let _ = std::fs::remove_file(&path);
+    let _ = std::fs::remove_file(format!("{}.lock", path.display()));
+}
+
+// --- read-only connection pool (DB2) ---------------------------------------
+
+/// A read must not queue behind whatever happens to be writing.
+///
+/// The write connection is held for the whole measurement — which is what a
+/// large listing's commit does to it — while a reader asks for a search. Before
+/// the pool this was the same mutex, so the read waited for the writer;
+/// `busy_timeout` never entered into it, because the contention was this
+/// process's own lock rather than SQLite's.
+#[test]
+fn a_read_does_not_wait_for_the_write_connection() {
+    let path = std::env::temp_dir().join(format!(
+        "pdfs-db-readpool-{}-{}.db",
+        std::process::id(),
+        std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap()
+            .as_nanos()
+    ));
+    let db = std::sync::Arc::new(Db::open(&path).unwrap());
+    db.upsert_node(&folder("root", None, "My Files")).unwrap();
+    db.upsert_node(&file("f1", "root", "findme.txt", 1))
+        .unwrap();
+
+    let held = std::time::Duration::from_millis(500);
+    let (tx, rx) = std::sync::mpsc::channel();
+    let writer = {
+        let db = db.clone();
+        std::thread::spawn(move || {
+            db.with_conn(|_conn| {
+                tx.send(()).unwrap();
+                std::thread::sleep(held);
+                Ok(())
+            })
+            .unwrap();
+        })
+    };
+    rx.recv().unwrap();
+
+    let start = std::time::Instant::now();
+    let hits = db.search("findme", 10).unwrap();
+    let waited = start.elapsed();
+    writer.join().unwrap();
+
+    assert_eq!(hits.len(), 1, "the read must still see committed data");
+    assert!(
+        waited < held / 2,
+        "the read waited {waited:?} for a write connection held {held:?}"
+    );
+
+    drop(db);
+    let _ = std::fs::remove_file(&path);
+    let _ = std::fs::remove_file(format!("{}.lock", path.display()));
+}
+
+/// §5: the drain is several workers over one queue, and the claim column is the
+/// only thing keeping them off each other's work. Two properties matter — no
+/// row is ever handed to two workers, and no *node* is ever worked by two
+/// workers even though its ops are separate rows.
+#[test]
+fn a_claimed_op_is_invisible_to_every_other_worker() {
+    let db = Db::open_in_memory().unwrap();
+    let root = uid("root").to_string();
+    for i in 0..3 {
+        db.enqueue_op(&bulk_op(i, &root)).unwrap();
+    }
+
+    let first = db.claim_next_due_op(10).unwrap().expect("an op is due");
+    let second = db
+        .claim_next_due_op(10)
+        .unwrap()
+        .expect("another op is due");
+    let third = db
+        .claim_next_due_op(10)
+        .unwrap()
+        .expect("a third op is due");
+    assert!(
+        db.claim_next_due_op(10).unwrap().is_none(),
+        "a fourth claim must find nothing left: every queued op is taken"
+    );
+
+    let mut ids = [first.id, second.id, third.id];
+    ids.sort_unstable();
+    assert_eq!(
+        ids,
+        [1, 2, 3],
+        "each worker must get a distinct row, oldest first"
+    );
+
+    // Releasing puts one back, and it is the one that comes out next.
+    db.release_op_claim(second.id).unwrap();
+    let again = db.claim_next_due_op(10).unwrap().expect("the released op");
+    assert_eq!(again.id, second.id);
+}
+
+#[test]
+fn two_workers_never_share_a_node() {
+    let db = Db::open_in_memory().unwrap();
+    let root = uid("root").to_string();
+    // Two ops of different kinds against one node — a queued rename and a
+    // queued revision, which is an ordinary `mv` plus a save.
+    let mut revision = bulk_op(0, &root);
+    revision.parent_uid = None;
+    db.enqueue_op(&revision).unwrap();
+    let rename = PendingOp {
+        kind: OP_RENAME.to_string(),
+        parent_uid: Some(root.clone()),
+        blob_path: None,
+        meta_json: None,
+        ..bulk_op(0, &root)
+    };
+    db.enqueue_op(&rename).unwrap();
+
+    let claimed = db.claim_next_due_op(10).unwrap().expect("an op is due");
+    assert_eq!(claimed.kind, OP_REVISION, "the older op goes first");
+    assert!(
+        db.claim_next_due_op(10).unwrap().is_none(),
+        "the second op targets the same node, so it must wait for the first: \
+         two workers on one uid would race over its staged blob and land its \
+         changes out of order"
+    );
+
+    db.release_op_claim(claimed.id).unwrap();
+    db.delete_op(claimed.id).unwrap();
+    assert_eq!(
+        db.claim_next_due_op(10).unwrap().map(|o| o.kind),
+        Some(OP_RENAME.to_string()),
+        "once the revision retires, the rename is claimable"
+    );
+}
+
+#[test]
+fn claims_do_not_survive_the_process_that_took_them() {
+    let db = Db::open_in_memory().unwrap();
+    let root = uid("root").to_string();
+    for i in 0..2 {
+        db.enqueue_op(&bulk_op(i, &root)).unwrap();
+    }
+    db.claim_next_due_op(10).unwrap().unwrap();
+    db.claim_next_due_op(10).unwrap().unwrap();
+    assert!(db.claim_next_due_op(10).unwrap().is_none());
+
+    // What `Db::open` does after the single-writer lock says the previous run
+    // is gone. Without it those ops are invisible to every worker forever.
+    assert_eq!(db.clear_op_claims().unwrap(), 2);
+    assert!(
+        db.claim_next_due_op(10).unwrap().is_some(),
+        "a crashed run's claims must not park its queue"
+    );
+}
+
+#[test]
+fn an_idle_worker_does_not_wait_on_an_op_another_worker_has() {
+    let db = Db::open_in_memory().unwrap();
+    let root = uid("root").to_string();
+    db.enqueue_op(&bulk_op(0, &root)).unwrap();
+
+    assert_eq!(db.earliest_due_at().unwrap(), Some(0));
+    db.claim_next_due_op(10).unwrap().unwrap();
+    assert_eq!(
+        db.earliest_due_at().unwrap(),
+        None,
+        "an op somebody else is draining is not work this worker is waiting for"
+    );
+}

crates/pdfs-core/src/db/trash.rs

@@ -39,7 +39,7 @@ impl Db {
     /// The persisted trash listing, folders first then by name — the order the
     /// Trash page shows it in.
     pub fn trash_list(&self) -> Result<Vec<StoredTrash>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let mut stmt = conn.prepare(
             "SELECT uid, name, is_dir, size, mtime FROM trash
              ORDER BY is_dir DESC, name COLLATE NOCASE",

crates/pdfs-core/src/db/utils.rs

@@ -1,6 +1,6 @@
 //! Small query helpers shared across the table modules.
 
-use rusqlite::{Connection, params};
+use rusqlite::{Connection, OptionalExtension, params};
 
 use crate::Result;
 
@@ -8,14 +8,19 @@ use crate::Result;
 /// grams), so short queries fall back to a `LIKE` scan over `nodes.name`.
 pub(super) const TRIGRAM_MIN: usize = 3;
 
-pub(super) fn pair(row: &rusqlite::Row) -> rusqlite::Result<(String, String)> {
+/// One raw search row: the node's JSON, its uid, and its stored path — `None`
-    Ok((row.get(0)?, row.get(1)?))
+/// only for a row written before the `path` column existed, which
+/// [`path_of`] repairs by walking.
+pub(super) type HitRow = (String, String, Option<String>);
+
+pub(super) fn hit_row(row: &rusqlite::Row) -> rusqlite::Result<HitRow> {
+    Ok((row.get(0)?, row.get(1)?, row.get(2)?))
 }
 
-/// Drain a `query_map` of [`pair`] rows into a `Vec`, propagating row errors.
+/// Drain a `query_map` of [`hit_row`] rows into a `Vec`, propagating row errors.
-pub(super) fn collect_pairs(
+pub(super) fn collect_hits(
-    rows: impl Iterator<Item = rusqlite::Result<(String, String)>>,
+    rows: impl Iterator<Item = rusqlite::Result<HitRow>>,
-) -> Result<Vec<(String, String)>> {
+) -> Result<Vec<HitRow>> {
     let mut out = Vec::new();
     for r in rows {
         out.push(r?);
@@ -31,19 +36,58 @@ pub(super) fn like_escape(s: &str) -> String {
         .replace('_', "\\_")
 }
 
-/// Resolve a node's mountpoint-relative path by walking `parent_uid` to the
+/// How deep the parent walk may go before it gives up. Real Drive trees are
-/// root via a recursive CTE. The root (the node with no parent) is excluded, so
+/// nowhere near this; a parent *cycle* is unbounded, and this query is on the
-/// a top-level file `report.pdf` yields `"report.pdf"`, not `"My Files/report.pdf"`.
+/// path of every search result, including the `LIKE` lane that reads `nodes`
+/// directly and so never passed through the index's cycle check.
+pub(super) const MAX_PATH_DEPTH: usize = 256;
+
+/// Append `name` to a parent's stored path. An empty parent path is the root,
+/// whose name is the mount and so contributes nothing.
+pub(super) fn join_path(parent_path: &str, name: &str) -> String {
+    if parent_path.is_empty() {
+        name.to_string()
+    } else {
+        format!("{parent_path}/{name}")
+    }
+}
+
+/// Resolve a node's mountpoint-relative path. The root (the node with no
+/// parent) is excluded, so a top-level file `report.pdf` yields
+/// `"report.pdf"`, not `"My Files/report.pdf"`.
+///
+/// Reads the stored `nodes.path`, which the write path maintains (see
+/// `upsert_node_tx`). Falls back to [`walk_path_of`] for a row that predates the
+/// column or was never written through — a search serving a keystroke used to
+/// run that walk once per candidate, which is the reason the column exists.
 pub(super) fn path_of(conn: &Connection, uid: &str) -> Result<String> {
-    let mut stmt = conn.prepare(
+    let stored: Option<Option<String>> = conn
+        .query_row("SELECT path FROM nodes WHERE uid = ?1", params![uid], |r| {
+            r.get(0)
+        })
+        .optional()?;
+    match stored.flatten() {
+        Some(path) => Ok(path),
+        None => walk_path_of(conn, uid),
+    }
+}
+
+/// Resolve a path by walking `parent_uid` to the root via a recursive CTE.
+///
+/// A cycle in `parent_uid` is corrupt data the API can still hand us, and
+/// `UNION ALL` over one never terminates — the walk is therefore depth-capped
+/// and returns the truncated path rather than hanging the caller.
+pub(super) fn walk_path_of(conn: &Connection, uid: &str) -> Result<String> {
+    let mut stmt = conn.prepare(&format!(
         "WITH RECURSIVE anc(uid, parent_uid, name, depth) AS (
            SELECT uid, parent_uid, name, 0 FROM nodes WHERE uid = ?1
            UNION ALL
            SELECT n.uid, n.parent_uid, n.name, anc.depth + 1
            FROM nodes n JOIN anc ON n.uid = anc.parent_uid
+           WHERE anc.depth < {MAX_PATH_DEPTH}
          )
-         SELECT name, parent_uid FROM anc ORDER BY depth DESC",
+         SELECT name, parent_uid FROM anc ORDER BY depth DESC"
-    )?;
+    ))?;
     let rows = stmt.query_map(params![uid], |r| {
         Ok((r.get::<_, String>(0)?, r.get::<_, Option<String>>(1)?))
     })?;

crates/pdfs-core/src/error.rs

@@ -45,6 +45,27 @@ pub enum Error {
     Other(String),
 }
 
+impl Error {
+    /// Whether this is the local disk being full (`ENOSPC`), as opposed to any
+    /// other I/O failure.
+    ///
+    /// Worth distinguishing because it is the one storage failure the user can
+    /// act on, and because the caller's response differs: a full disk is met by
+    /// evicting cached blobs and answering `ENOSPC`, where `EIO` would read as a
+    /// broken file. `std::io::ErrorKind::StorageFull` is still unstable, so this
+    /// compares the raw code.
+    pub fn is_disk_full(&self) -> bool {
+        match self {
+            Error::Io(e) => e.raw_os_error() == Some(libc::ENOSPC),
+            // SQLite reports it as its own code rather than surfacing the errno.
+            Error::Db(rusqlite::Error::SqliteFailure(e, _)) => {
+                e.code == rusqlite::ErrorCode::DiskFull
+            }
+            _ => false,
+        }
+    }
+}
+
 pub type Result<T> = std::result::Result<T, Error>;
 
 /// A failure on its way to a front-end: prose for the user, plus the

crates/pdfs-core/src/lib.rs

@@ -4,14 +4,18 @@
 
 pub mod access;
 pub mod auth;
+pub mod batch;
 pub mod cache;
 pub mod config;
 pub mod control;
 pub mod db;
 pub mod error;
 pub mod localindex;
+pub mod menu;
 pub mod mounts;
+pub mod opener;
 pub mod profile;
+pub mod sdkcache;
 pub mod search;
 pub mod service;
 pub mod shell;

crates/pdfs-core/src/localindex.rs

@@ -26,10 +26,20 @@ const SKIP_DIRS: &[&str] = &[
     "venv",
     ".venv",
     "vendor",
+    "dist",
     "dist-newstyle",
+    "build",
     "Trash",
 ];
 
+/// Directory *paths* skipped when they end with one of these, for caches whose
+/// own name is too generic to blacklist (`mod`). The Go module cache was 63,399
+/// of the 110,187 entries indexed on the machine this was measured on — 58% of
+/// the index, crowding real files out of the bounded candidate pool the fuzzy
+/// scorer draws from. The other big dependency caches (`.cargo`, `.rustup`,
+/// `.gradle`, `.m2`) are already skipped by the hidden-file filter.
+const SKIP_PATH_SUFFIXES: &[&str] = &["go/pkg/mod"];
+
 /// Hard cap on indexed entries, so a pathological home directory cannot grow the
 /// database without bound. Reaching it stops the walk early.
 const MAX_ENTRIES: usize = 400_000;
@@ -90,7 +100,10 @@ pub fn scan(
             if excludes.iter().any(|e| path.starts_with(e)) {
                 return false;
             }
-            !matches!(entry.file_name().to_str(), Some(name) if SKIP_DIRS.contains(&name))
+            if matches!(entry.file_name().to_str(), Some(name) if SKIP_DIRS.contains(&name)) {
+                return false;
+            }
+            !is_skipped_path(path)
         });
 
     let state = parking_lot::Mutex::new(SinkState {
@@ -150,6 +163,17 @@ impl<F: FnMut(Vec<LocalEntry>)> SinkState<F> {
     }
 }
 
+/// Whether `path` is (or is inside) one of the [`SKIP_PATH_SUFFIXES`] caches.
+/// Matched on the path's own components so a directory merely *named* `mod`
+/// keeps being indexed.
+fn is_skipped_path(path: &Path) -> bool {
+    let path = path.to_string_lossy();
+    SKIP_PATH_SUFFIXES.iter().any(|suffix| {
+        path.strip_suffix(suffix)
+            .is_some_and(|head| head.is_empty() || head.ends_with('/'))
+    })
+}
+
 /// Convert a walker entry into a [`LocalEntry`], reusing the metadata the walker
 /// already fetched. Entries with non-UTF-8 paths are dropped: the index (and the
 /// JSON wire format) is UTF-8 only.
@@ -221,4 +245,27 @@ mod tests {
 
         std::fs::remove_dir_all(&tmp).unwrap();
     }
+
+    /// The Go module cache is the single largest source of index noise on a
+    /// developer's machine (58% of the entries on the one this was measured
+    /// on), and it cannot be pruned by directory name: `mod` is far too
+    /// common a name to blacklist outright.
+    #[test]
+    fn the_go_module_cache_is_pruned_but_a_plain_mod_dir_is_not() {
+        let tmp = std::env::temp_dir().join(format!("pdfs-scan-gomod-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&tmp);
+        std::fs::create_dir_all(tmp.join("go/pkg/mod/example.com/lib")).unwrap();
+        std::fs::create_dir_all(tmp.join("kernel/mod")).unwrap();
+        std::fs::write(tmp.join("go/pkg/mod/example.com/lib/vendored.go"), b"x").unwrap();
+        std::fs::write(tmp.join("kernel/mod/mine.conf"), b"x").unwrap();
+
+        let mut got = Vec::new();
+        scan(std::slice::from_ref(&tmp), &[], |batch| got.extend(batch));
+
+        let names: Vec<&str> = got.iter().map(|e| e.name.as_str()).collect();
+        assert!(!names.contains(&"vendored.go"), "{names:?}");
+        assert!(names.contains(&"mine.conf"), "{names:?}");
+
+        std::fs::remove_dir_all(&tmp).unwrap();
+    }
 }

crates/pdfs-core/src/menu.rs

@@ -0,0 +1,422 @@
+//! Driving an external dmenu-style launcher (fuzzel, rofi, wofi, …).
+//!
+//! `pdfs-prompt` ships its own GTK HUD, but on a tiling-WM desktop the user
+//! already has a launcher bound to a key, themed to match everything else. This
+//! module lets the prompt borrow it: entries go out on the child's stdin, the
+//! chosen line comes back on stdout.
+//!
+//! Two things vary between launchers and are the only reasons this is not four
+//! lines of `Command`:
+//!
+//! * the flag that turns on filter mode and the one that sets the prompt text;
+//! * icon support, which fuzzel and rofi both spell `text\0icon\x1fNAME` and
+//!   everything else would render as literal garbage.
+//!
+//! Selection is matched back by label rather than by index, because the one
+//! feature no launcher agrees on is index output. A line that matches nothing is
+//! the user's own typing — [`MenuChoice::Custom`] — which is what makes
+//! type-then-search work at all.
+
+use std::io::{BufRead, BufReader, Write};
+use std::path::Path;
+use std::process::{Command, Stdio};
+
+use serde::{Deserialize, Serialize};
+
+use crate::error::{Error, Result};
+
+/// Separates the label from its icon name in the fuzzel/rofi protocol.
+const ICON_SEPARATOR: &str = "\0icon\x1f";
+
+/// Launchers we know how to invoke, most-preferred first:
+/// `(program, filter-mode args, prompt flag, icon protocol)`.
+///
+/// The prompt flag is written as it is passed: fuzzel wants `--prompt=TEXT` as
+/// one argument, the rest take the text as a separate one.
+const KNOWN_MENUS: [MenuFlavor; 6] = [
+    MenuFlavor {
+        program: "fuzzel",
+        mode: &["--dmenu"],
+        prompt: PromptFlag::Joined("--prompt="),
+        icons: true,
+    },
+    MenuFlavor {
+        program: "rofi",
+        mode: &["-dmenu"],
+        prompt: PromptFlag::Separate("-p"),
+        icons: true,
+    },
+    MenuFlavor {
+        program: "wofi",
+        mode: &["--dmenu"],
+        prompt: PromptFlag::Separate("--prompt"),
+        icons: false,
+    },
+    MenuFlavor {
+        program: "tofi",
+        mode: &[],
+        prompt: PromptFlag::Joined("--prompt-text="),
+        icons: false,
+    },
+    MenuFlavor {
+        program: "bemenu",
+        mode: &[],
+        prompt: PromptFlag::Separate("-p"),
+        icons: false,
+    },
+    MenuFlavor {
+        program: "dmenu",
+        mode: &[],
+        prompt: PromptFlag::Separate("-p"),
+        icons: false,
+    },
+];
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum PromptFlag {
+    /// `--prompt=TEXT`
+    Joined(&'static str),
+    /// `-p TEXT`
+    Separate(&'static str),
+}
+
+#[derive(Debug, Clone, Copy)]
+struct MenuFlavor {
+    program: &'static str,
+    mode: &'static [&'static str],
+    prompt: PromptFlag,
+    icons: bool,
+}
+
+/// Prompt behaviour from `config.json`, under `prompt`.
+///
+/// ```json
+/// "prompt": { "menu": ["fuzzel", "--dmenu", "--width=60"], "menu_limit": 40 }
+/// ```
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct PromptConfig {
+    /// Which front end `pdfs-prompt` uses when invoked with no mode flag, so a
+    /// desktop shortcut does not have to be re-bound to switch. `None` is
+    /// [`PromptMode::Gtk`], the built-in HUD.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub mode: Option<PromptMode>,
+    /// Launcher argv for `pdfs-prompt --dmenu`. Unset means "find one" — see
+    /// [`resolve_menu`]. A `{prompt}` token anywhere in the argv is replaced by
+    /// the prompt text; without one the launcher's own prompt flag is appended.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub menu: Option<Vec<String>>,
+    /// How many results to feed the launcher. Unset means
+    /// [`DEFAULT_MENU_LIMIT`].
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub menu_limit: Option<usize>,
+    /// Show icons when the launcher understands them. Defaults to true; set
+    /// false for a launcher that advertises support but is themed without them.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub menu_icons: Option<bool>,
+}
+
+/// Which front end the prompt presents.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum PromptMode {
+    /// The built-in GTK HUD.
+    #[default]
+    Gtk,
+    /// The user's own launcher, driven over stdin/stdout.
+    Dmenu,
+}
+
+/// Rows an external launcher can show without becoming a scroll exercise. Larger
+/// than the GTK prompt's cap because filtering happens launcher-side.
+pub const DEFAULT_MENU_LIMIT: usize = 50;
+
+impl PromptConfig {
+    pub fn resolved_mode(&self) -> PromptMode {
+        self.mode.unwrap_or_default()
+    }
+
+    pub fn resolved_menu_limit(&self) -> usize {
+        self.menu_limit.unwrap_or(DEFAULT_MENU_LIMIT)
+    }
+
+    pub fn resolved_menu_icons(&self) -> bool {
+        self.menu_icons.unwrap_or(true)
+    }
+}
+
+/// One line offered to the launcher.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct MenuItem {
+    /// What the user sees, and what identifies the choice on the way back.
+    pub label: String,
+    /// Icon theme name, used only by launchers that support the protocol.
+    pub icon: Option<String>,
+}
+
+impl MenuItem {
+    pub fn new(label: impl Into<String>, icon: Option<String>) -> Self {
+        Self {
+            label: label.into(),
+            icon,
+        }
+    }
+}
+
+/// What came back from the launcher.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum MenuChoice {
+    /// Index into the items that were passed in.
+    Item(usize),
+    /// Text the user typed that matched no item — treat it as a query.
+    Custom(String),
+    /// Escape, or an empty selection.
+    Cancelled,
+}
+
+/// The launcher to run: the configured one, or the first [`KNOWN_MENUS`] entry
+/// on `PATH`. Returns the argv as it should be spawned, filter-mode flags
+/// included.
+pub fn resolve_menu(configured: Option<&Vec<String>>) -> Option<Vec<String>> {
+    if let Some(argv) = configured.filter(|argv| !argv.is_empty()) {
+        return Some(argv.clone());
+    }
+    let flavor = KNOWN_MENUS.iter().find(|f| on_path(f.program))?;
+    let mut argv = vec![flavor.program.to_string()];
+    argv.extend(flavor.mode.iter().map(|f| (*f).to_string()));
+    Some(argv)
+}
+
+/// Show `items` in the launcher named by `argv` and wait for a choice.
+///
+/// Blocking by design: the caller is a one-shot CLI invocation whose entire job
+/// is this round-trip.
+pub fn run(argv: &[String], prompt: &str, items: &[MenuItem]) -> Result<MenuChoice> {
+    let argv = with_prompt(argv, prompt);
+    let Some((program, args)) = argv.split_first() else {
+        return Err(Error::Other("no launcher command configured".into()));
+    };
+    let icons = supports_icons(program);
+
+    let mut child = Command::new(program)
+        .args(args)
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .spawn()
+        .map_err(|e| Error::Other(format!("cannot run launcher {program}: {e}")))?;
+
+    // Write on a worker: a launcher that starts reading only after it maps its
+    // window would otherwise deadlock against a full pipe buffer.
+    let payload = render(items, icons);
+    let mut stdin = child
+        .stdin
+        .take()
+        .ok_or_else(|| Error::Other("launcher stdin unavailable".into()))?;
+    let writer = std::thread::spawn(move || {
+        let _ = stdin.write_all(payload.as_bytes());
+        let _ = stdin.flush();
+    });
+
+    let mut selected = String::new();
+    if let Some(stdout) = child.stdout.take() {
+        // Only the first line matters; multi-select is not a thing here, and a
+        // launcher that emits more must not leave us blocked on a full pipe.
+        let mut reader = BufReader::new(stdout);
+        let mut line = String::new();
+        while reader.read_line(&mut line).unwrap_or(0) > 0 {
+            if selected.is_empty() {
+                selected = line.trim_end_matches('\n').to_string();
+            }
+            line.clear();
+        }
+    }
+    let _ = child.wait();
+    let _ = writer.join();
+
+    Ok(interpret(&selected, items))
+}
+
+/// Map the launcher's output back to a choice. Exposed for tests; the ambiguity
+/// it resolves (label vs. free text) is the whole contract with the launcher.
+fn interpret(selected: &str, items: &[MenuItem]) -> MenuChoice {
+    // Some launchers echo the icon protocol back verbatim.
+    let selected = selected
+        .split(ICON_SEPARATOR)
+        .next()
+        .unwrap_or(selected)
+        .trim_end();
+    if selected.is_empty() {
+        return MenuChoice::Cancelled;
+    }
+    match items.iter().position(|item| item.label == selected) {
+        Some(index) => MenuChoice::Item(index),
+        None => MenuChoice::Custom(selected.to_string()),
+    }
+}
+
+/// The stdin payload. Labels are stripped of newlines rather than escaped —
+/// there is no escape in this protocol, and a file name with a newline in it
+/// would otherwise become two entries.
+fn render(items: &[MenuItem], icons: bool) -> String {
+    let mut out = String::new();
+    for item in items {
+        let label = item.label.replace(['\n', '\r'], " ");
+        out.push_str(&label);
+        if icons && let Some(icon) = &item.icon {
+            out.push_str(ICON_SEPARATOR);
+            out.push_str(icon);
+        }
+        out.push('\n');
+    }
+    out
+}
+
+/// Add the prompt text: substituted for `{prompt}` if the user placed one,
+/// otherwise appended using the launcher's own flag. An unrecognised launcher
+/// gets no prompt rather than a guessed flag that might not parse.
+fn with_prompt(argv: &[String], prompt: &str) -> Vec<String> {
+    if argv.iter().any(|arg| arg.contains("{prompt}")) {
+        return argv
+            .iter()
+            .map(|arg| arg.replace("{prompt}", prompt))
+            .collect();
+    }
+    let mut argv = argv.to_vec();
+    if prompt.is_empty() {
+        return argv;
+    }
+    if let Some(flavor) = argv.first().and_then(|program| flavor_of(program)) {
+        match flavor.prompt {
+            PromptFlag::Joined(flag) => argv.push(format!("{flag}{prompt}")),
+            PromptFlag::Separate(flag) => {
+                argv.push(flag.to_string());
+                argv.push(prompt.to_string());
+            }
+        }
+    }
+    argv
+}
+
+fn supports_icons(program: &str) -> bool {
+    flavor_of(program).is_some_and(|flavor| flavor.icons)
+}
+
+fn flavor_of(program: &str) -> Option<&'static MenuFlavor> {
+    let base = Path::new(program).file_name()?.to_str()?;
+    KNOWN_MENUS.iter().find(|flavor| flavor.program == base)
+}
+
+fn on_path(program: &str) -> bool {
+    let Some(path) = std::env::var_os("PATH") else {
+        return false;
+    };
+    std::env::split_paths(&path).any(|dir| dir.join(program).is_file())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn items() -> Vec<MenuItem> {
+        vec![
+            MenuItem::new(
+                "notes.md   ·   My files / Docs",
+                Some("text-x-generic".into()),
+            ),
+            MenuItem::new("photo.png   ·   Home / Pictures", None),
+        ]
+    }
+
+    #[test]
+    fn a_matching_line_is_an_item_and_anything_else_is_a_query() {
+        let items = items();
+        assert_eq!(
+            interpret("notes.md   ·   My files / Docs", &items),
+            MenuChoice::Item(0)
+        );
+        assert_eq!(
+            interpret("invoice", &items),
+            MenuChoice::Custom("invoice".into())
+        );
+        assert_eq!(interpret("", &items), MenuChoice::Cancelled);
+    }
+
+    #[test]
+    fn an_echoed_icon_field_does_not_break_the_match() {
+        let items = items();
+        assert_eq!(
+            interpret(
+                "notes.md   ·   My files / Docs\0icon\x1ftext-x-generic",
+                &items
+            ),
+            MenuChoice::Item(0)
+        );
+    }
+
+    #[test]
+    fn icons_are_only_rendered_for_launchers_that_understand_them() {
+        let items = items();
+        assert_eq!(
+            render(&items, true),
+            "notes.md   ·   My files / Docs\0icon\x1ftext-x-generic\nphoto.png   ·   Home / Pictures\n"
+        );
+        assert_eq!(
+            render(&items, false),
+            "notes.md   ·   My files / Docs\nphoto.png   ·   Home / Pictures\n"
+        );
+        assert!(supports_icons("fuzzel"));
+        assert!(supports_icons("/usr/bin/rofi"));
+        assert!(!supports_icons("wofi"));
+        assert!(!supports_icons("mystery-menu"));
+    }
+
+    #[test]
+    fn a_label_with_a_newline_stays_one_entry() {
+        let sneaky = vec![MenuItem::new("two\nlines.txt", None)];
+        assert_eq!(render(&sneaky, false), "two lines.txt\n");
+    }
+
+    #[test]
+    fn the_prompt_uses_each_launchers_own_flag() {
+        assert_eq!(
+            with_prompt(&["fuzzel".into(), "--dmenu".into()], "Drive"),
+            vec!["fuzzel", "--dmenu", "--prompt=Drive"]
+        );
+        assert_eq!(
+            with_prompt(&["rofi".into(), "-dmenu".into()], "Drive"),
+            vec!["rofi", "-dmenu", "-p", "Drive"]
+        );
+        // Unknown launcher: no guessed flag.
+        assert_eq!(
+            with_prompt(&["mystery-menu".into()], "Drive"),
+            vec!["mystery-menu"]
+        );
+    }
+
+    #[test]
+    fn an_explicit_placeholder_wins_over_the_flag() {
+        assert_eq!(
+            with_prompt(
+                &[
+                    "rofi".into(),
+                    "-dmenu".into(),
+                    "-p".into(),
+                    "{prompt} >".into()
+                ],
+                "Drive"
+            ),
+            vec!["rofi", "-dmenu", "-p", "Drive >"]
+        );
+    }
+
+    #[test]
+    fn a_configured_launcher_is_used_verbatim() {
+        let configured = vec!["my-menu".to_string(), "--pick".to_string()];
+        assert_eq!(resolve_menu(Some(&configured)), Some(configured.clone()));
+        // An empty list is "not configured", not "run nothing".
+        assert_eq!(
+            resolve_menu(Some(&Vec::new())),
+            resolve_menu(None),
+            "an empty menu list must fall back to detection"
+        );
+    }
+}

crates/pdfs-core/src/opener.rs

@@ -0,0 +1,599 @@
+//! How a file chosen in the prompt (or the browser) is actually opened.
+//!
+//! The default is `xdg-open`, which routes through the desktop's MIME
+//! associations. That is the right answer for a GNOME session and the wrong one
+//! for a tiling-WM setup where "open a text file" means "run `nvim` inside my
+//! terminal" — there is no desktop file for that, and pointing `xdg-open` at a
+//! terminal editor globally breaks every graphical caller.
+//!
+//! So the rules live in `config.json` under `open_with`: an ordered list of
+//! name/class patterns mapped to argv, each optionally wrapped in a terminal.
+//! First match wins; anything unmatched falls through to `default` (itself
+//! `xdg-open` unless overridden). Nothing here is required — an absent
+//! `open_with` reproduces the previous behaviour exactly.
+//!
+//! ```json
+//! "open_with": {
+//!   "terminal": ["alacritty", "-e"],
+//!   "rules": [
+//!     { "match": ["@text", "*.rs", "*.toml"], "command": ["nvim"], "terminal": true },
+//!     { "match": ["*.png"], "command": ["imv"] }
+//!   ]
+//! }
+//! ```
+
+use std::ffi::OsStr;
+use std::path::Path;
+use std::process::Command;
+
+use serde::{Deserialize, Serialize};
+
+/// Environment override for the terminal used by `"terminal": true` rules.
+/// Checked before `$TERMINAL` so a support case can redirect it without editing
+/// config.
+pub const TERMINAL_ENV: &str = "PDFS_TERMINAL";
+
+/// Terminals we know how to hand a command line to, most-preferred first, with
+/// the argument that means "run this, don't parse it as options". `kitty` and
+/// `wezterm start --` take the command positionally.
+const KNOWN_TERMINALS: [(&str, &[&str]); 11] = [
+    ("alacritty", &["-e"]),
+    ("foot", &["-e"]),
+    ("kitty", &[]),
+    ("ghostty", &["-e"]),
+    ("wezterm", &["start", "--"]),
+    ("gnome-terminal", &["--"]),
+    ("konsole", &["-e"]),
+    ("xfce4-terminal", &["-x"]),
+    ("urxvt", &["-e"]),
+    ("st", &["-e"]),
+    ("xterm", &["-e"]),
+];
+
+/// The opener policy as it appears in `config.json`.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct OpenWith {
+    /// Terminal argv used by rules with `"terminal": true`, e.g.
+    /// `["alacritty", "-e"]`. Unset means "resolve one" — see
+    /// [`resolve_terminal`].
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub terminal: Option<Vec<String>>,
+    /// What to run when no rule matches. Unset means `xdg-open`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub default: Option<Vec<String>>,
+    /// Ordered; first match wins.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub rules: Vec<OpenRule>,
+}
+
+/// One `pattern set -> command` mapping.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct OpenRule {
+    /// Patterns this rule answers to. Either a shell-style glob against the file
+    /// name (`*.md`, `notes-*.txt`) or one of the classes `@dir`, `@text`,
+    /// `@document`, `@image`, `@media`, `@any`. Matching is case-insensitive.
+    #[serde(rename = "match", default)]
+    pub patterns: Vec<String>,
+    /// argv to run. A `{}` token is replaced by the path; without one the path
+    /// is appended. `$VAR`/`${VAR}` tokens expand from the environment, so
+    /// `["$EDITOR"]` follows the user's editor.
+    #[serde(default)]
+    pub command: Vec<String>,
+    /// Wrap [`command`](Self::command) in the terminal emulator.
+    #[serde(default)]
+    pub terminal: bool,
+}
+
+impl OpenWith {
+    /// The argv that opens `path`, terminal wrapping included. Never fails: an
+    /// unmatched path — or a rule whose terminal cannot be resolved — degrades
+    /// to the default opener rather than doing nothing.
+    pub fn command_for(&self, path: &Path, is_dir: bool) -> Vec<String> {
+        let name = path
+            .file_name()
+            .and_then(OsStr::to_str)
+            .unwrap_or_default()
+            .to_string();
+        self.command_for_named(path, &name, is_dir)
+    }
+
+    /// [`command_for`](Self::command_for) with the rules matched against `name`
+    /// instead of the last component of `path`.
+    ///
+    /// A materialised Drive file lives in the content cache under its content
+    /// hash — no extension, no original name — so matching the on-disk path
+    /// classifies every download as "unknown" and hands it to `xdg-open`, which
+    /// sniffs the bytes and picks whatever claims `text/plain` (LibreOffice, for
+    /// a Markdown file). The rules are about *what the user opened*, so the
+    /// caller passes that name and the argv still gets the real path.
+    pub fn command_for_named(&self, path: &Path, name: &str, is_dir: bool) -> Vec<String> {
+        for rule in &self.rules {
+            if rule.command.is_empty() {
+                continue;
+            }
+            if !rule.patterns.iter().any(|p| matches(p, name, is_dir)) {
+                continue;
+            }
+            let argv = expand(&rule.command, path);
+            if !rule.terminal {
+                return argv;
+            }
+            match self.terminal_argv() {
+                Some(mut terminal) => {
+                    terminal.extend(argv);
+                    return terminal;
+                }
+                // A terminal rule with no terminal to run it in would silently
+                // launch a TUI with no tty. Fall through to the desktop instead.
+                None => {
+                    tracing::warn!(
+                        "no terminal found for a terminal open rule; using the default opener"
+                    );
+                    break;
+                }
+            }
+        }
+
+        let fallback = self
+            .default
+            .clone()
+            .unwrap_or_else(|| vec!["xdg-open".to_string()]);
+        expand(&fallback, path)
+    }
+
+    /// The configured terminal, or a resolved one.
+    fn terminal_argv(&self) -> Option<Vec<String>> {
+        match &self.terminal {
+            Some(argv) if !argv.is_empty() => Some(argv.clone()),
+            _ => resolve_terminal(),
+        }
+    }
+}
+
+/// Launch `path` under `policy`. Fire-and-forget: the child outlives us, and a
+/// spawn failure is logged rather than propagated — every caller is a UI action
+/// with nowhere useful to report to.
+pub fn open(policy: &OpenWith, path: &Path, is_dir: bool) {
+    let argv = policy.command_for(path, is_dir);
+    spawn(&argv, path);
+}
+
+/// [`open`] for a path whose own file name says nothing about its type — see
+/// [`OpenWith::command_for_named`].
+pub fn open_named(policy: &OpenWith, path: &Path, name: &str, is_dir: bool) {
+    let argv = policy.command_for_named(path, name, is_dir);
+    spawn(&argv, path);
+}
+
+fn spawn(argv: &[String], path: &Path) {
+    let Some((program, args)) = argv.split_first() else {
+        return;
+    };
+    tracing::info!(path = %path.display(), command = ?argv, "opening");
+    if let Err(e) = Command::new(program).args(args).spawn() {
+        tracing::error!(command = ?argv, "open failed: {e}");
+    }
+}
+
+/// [`open`] with the policy from the user's `config.json`, read once per
+/// process. For callers that open the occasional path and have no reason to
+/// carry a policy around; long-lived windows should hold their own copy.
+pub fn open_default(path: &Path, is_dir: bool) {
+    open(default_policy(), path, is_dir);
+}
+
+/// [`open_default`] matching the rules against `name` — see
+/// [`OpenWith::command_for_named`].
+pub fn open_default_named(path: &Path, name: &str, is_dir: bool) {
+    open_named(default_policy(), path, name, is_dir);
+}
+
+fn default_policy() -> &'static OpenWith {
+    static POLICY: std::sync::OnceLock<OpenWith> = std::sync::OnceLock::new();
+    POLICY.get_or_init(|| {
+        crate::config::AppDirs::new()
+            .map(|dirs| dirs.load_config().resolved_open_with())
+            .unwrap_or_default()
+    })
+}
+
+/// `$PDFS_TERMINAL`, then `$TERMINAL`, then the first [`KNOWN_TERMINALS`] entry
+/// on `PATH`. An env value may be a full command line (`"foot -e"`), in which
+/// case it is used verbatim; a bare program name gains that terminal's "run
+/// this" argument so `TERMINAL=alacritty` does the obvious thing.
+pub fn resolve_terminal() -> Option<Vec<String>> {
+    for key in [TERMINAL_ENV, "TERMINAL"] {
+        let Ok(value) = std::env::var(key) else {
+            continue;
+        };
+        let argv: Vec<String> = value.split_whitespace().map(str::to_string).collect();
+        match argv.len() {
+            0 => continue,
+            1 => return Some(with_exec_flag(&argv[0])),
+            _ => return Some(argv),
+        }
+    }
+
+    KNOWN_TERMINALS
+        .iter()
+        .find(|(program, _)| on_path(program))
+        .map(|(program, _)| with_exec_flag(program))
+}
+
+/// A bare terminal name plus whatever it needs before a command.
+fn with_exec_flag(program: &str) -> Vec<String> {
+    let base = Path::new(program)
+        .file_name()
+        .and_then(OsStr::to_str)
+        .unwrap_or(program);
+    let mut argv = vec![program.to_string()];
+    let flags = KNOWN_TERMINALS
+        .iter()
+        .find(|(known, _)| *known == base)
+        .map_or(&["-e"][..], |(_, flags)| *flags);
+    argv.extend(flags.iter().map(|f| (*f).to_string()));
+    argv
+}
+
+fn on_path(program: &str) -> bool {
+    let Some(path) = std::env::var_os("PATH") else {
+        return false;
+    };
+    std::env::split_paths(&path).any(|dir| dir.join(program).is_file())
+}
+
+/// Substitute `{}` (or append) the path, and expand `$VAR` tokens. Tokens that
+/// expand to nothing are dropped, so `["$EDITOR"]` with no `EDITOR` set leaves
+/// an empty argv and falls back at the call site.
+fn expand(argv: &[String], path: &Path) -> Vec<String> {
+    let target = path.display().to_string();
+    let mut out = Vec::with_capacity(argv.len() + 1);
+    let mut substituted = false;
+    for token in argv {
+        if token.contains("{}") {
+            out.push(token.replace("{}", &target));
+            substituted = true;
+            continue;
+        }
+        match expand_env(token) {
+            Some(value) => out.push(value),
+            None => continue,
+        }
+    }
+    if out.is_empty() {
+        return vec!["xdg-open".to_string(), target];
+    }
+    if !substituted {
+        out.push(target);
+    }
+    out
+}
+
+/// `$VAR` / `${VAR}` for a whole token, `None` when the variable is unset or
+/// empty so the token drops out. A token that is not a variable reference is
+/// returned unchanged; this is deliberately not a shell — no word splitting, no
+/// quoting rules.
+fn expand_env(token: &str) -> Option<String> {
+    let Some(name) = token
+        .strip_prefix("${")
+        .and_then(|rest| rest.strip_suffix('}'))
+        .or_else(|| token.strip_prefix('$'))
+    else {
+        return Some(token.to_string());
+    };
+    if name.is_empty() {
+        return Some(token.to_string());
+    }
+    // Follow `$EDITOR`'s convention of preferring the graphical-capable one.
+    let value = if name == "EDITOR" {
+        std::env::var("VISUAL")
+            .ok()
+            .filter(|v| !v.is_empty())
+            .or_else(|| std::env::var("EDITOR").ok())
+    } else {
+        std::env::var(name).ok()
+    };
+    value.filter(|v| !v.is_empty())
+}
+
+/// Whether `pattern` — a glob or an `@class` — matches this name.
+fn matches(pattern: &str, name: &str, is_dir: bool) -> bool {
+    let name_lower = name.to_lowercase();
+    match pattern.to_lowercase().as_str() {
+        "@any" => true,
+        "@dir" => is_dir,
+        "@text" => !is_dir && class_text(&name_lower),
+        "@document" => !is_dir && class_document(&name_lower),
+        "@image" => !is_dir && class_image(&name_lower),
+        "@media" => !is_dir && class_media(&name_lower),
+        other if other.starts_with('@') => false,
+        other => glob_match(other, &name_lower),
+    }
+}
+
+fn extension(name: &str) -> &str {
+    Path::new(name)
+        .extension()
+        .and_then(OsStr::to_str)
+        .unwrap_or_default()
+}
+
+/// Plain-text-ish files a terminal editor is a sensible default for. Extensions
+/// only: the daemon's hits may name files that are not on this machine yet, so
+/// there is nothing to sniff.
+fn class_text(name: &str) -> bool {
+    matches!(
+        extension(name),
+        "txt"
+            | "md"
+            | "markdown"
+            | "rst"
+            | "org"
+            | "log"
+            | "conf"
+            | "cfg"
+            | "ini"
+            | "toml"
+            | "yaml"
+            | "yml"
+            | "json"
+            | "xml"
+            | "csv"
+            | "tsv"
+            | "env"
+            | "sh"
+            | "bash"
+            | "zsh"
+            | "fish"
+            | "rs"
+            | "py"
+            | "go"
+            | "c"
+            | "h"
+            | "cpp"
+            | "hpp"
+            | "js"
+            | "ts"
+            | "tsx"
+            | "jsx"
+            | "css"
+            | "html"
+            | "sql"
+            | "lua"
+            | "vim"
+            | "nix"
+            | "patch"
+            | "diff"
+    ) || name == "makefile"
+        || name == "dockerfile"
+}
+
+fn class_document(name: &str) -> bool {
+    matches!(
+        extension(name),
+        "pdf"
+            | "doc"
+            | "docx"
+            | "odt"
+            | "rtf"
+            | "xls"
+            | "xlsx"
+            | "ods"
+            | "ppt"
+            | "pptx"
+            | "odp"
+            | "epub"
+    ) || class_text(name)
+}
+
+fn class_image(name: &str) -> bool {
+    matches!(
+        extension(name),
+        "png" | "jpg" | "jpeg" | "webp" | "gif" | "bmp" | "svg" | "avif" | "heic" | "tiff"
+    )
+}
+
+fn class_media(name: &str) -> bool {
+    matches!(
+        extension(name),
+        "mp4"
+            | "mkv"
+            | "webm"
+            | "mov"
+            | "avi"
+            | "mp3"
+            | "flac"
+            | "wav"
+            | "ogg"
+            | "opus"
+            | "m4a"
+            | "aac"
+    )
+}
+
+/// `*` and `?` globbing, no character classes and no path semantics — patterns
+/// are matched against a bare file name. Iterative with backtracking so a
+/// pathological pattern cannot blow the stack.
+fn glob_match(pattern: &str, name: &str) -> bool {
+    let pattern: Vec<char> = pattern.chars().collect();
+    let name: Vec<char> = name.chars().collect();
+    let (mut p, mut n) = (0usize, 0usize);
+    // Where to resume if the current `*` turns out to have matched too little.
+    let (mut star, mut resume) = (None, 0usize);
+
+    while n < name.len() {
+        match pattern.get(p) {
+            Some('*') => {
+                star = Some(p);
+                resume = n;
+                p += 1;
+            }
+            Some('?') => {
+                p += 1;
+                n += 1;
+            }
+            Some(c) if *c == name[n] => {
+                p += 1;
+                n += 1;
+            }
+            _ => match star {
+                Some(s) => {
+                    p = s + 1;
+                    resume += 1;
+                    n = resume;
+                }
+                None => return false,
+            },
+        }
+    }
+    pattern[p..].iter().all(|c| *c == '*')
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn rule(patterns: &[&str], command: &[&str], terminal: bool) -> OpenRule {
+        OpenRule {
+            patterns: patterns.iter().map(|p| (*p).to_string()).collect(),
+            command: command.iter().map(|c| (*c).to_string()).collect(),
+            terminal,
+        }
+    }
+
+    #[test]
+    fn a_cache_blob_is_classified_by_the_name_it_was_opened_as() {
+        let policy = OpenWith {
+            terminal: Some(vec!["alacritty".into(), "-e".into()]),
+            default: None,
+            rules: vec![rule(&["@text"], &["nvim"], true)],
+        };
+        // What the daemon hands back: content-hash name, no extension. Matched
+        // on its own it is "unknown" and would land in xdg-open's lap.
+        let blob = Path::new("/home/me/.cache/proton-drive-linux/content/364d1d8cc8e6");
+        assert_eq!(
+            policy.command_for(blob, false),
+            vec![
+                "xdg-open",
+                "/home/me/.cache/proton-drive-linux/content/364d1d8cc8e6"
+            ]
+        );
+        assert_eq!(
+            policy.command_for_named(blob, "ONBOARDING.md", false),
+            vec![
+                "alacritty",
+                "-e",
+                "nvim",
+                "/home/me/.cache/proton-drive-linux/content/364d1d8cc8e6"
+            ]
+        );
+    }
+
+    #[test]
+    fn an_empty_policy_is_xdg_open() {
+        let policy = OpenWith::default();
+        assert_eq!(
+            policy.command_for(Path::new("/tmp/a.md"), false),
+            vec!["xdg-open".to_string(), "/tmp/a.md".to_string()]
+        );
+    }
+
+    #[test]
+    fn a_terminal_rule_wraps_the_command() {
+        let policy = OpenWith {
+            terminal: Some(vec!["alacritty".into(), "-e".into()]),
+            default: None,
+            rules: vec![rule(&["@text"], &["nvim"], true)],
+        };
+        assert_eq!(
+            policy.command_for(Path::new("/tmp/notes.md"), false),
+            vec!["alacritty", "-e", "nvim", "/tmp/notes.md"]
+        );
+    }
+
+    #[test]
+    fn the_first_matching_rule_wins_and_globs_are_case_insensitive() {
+        let policy = OpenWith {
+            terminal: None,
+            default: None,
+            rules: vec![
+                rule(&["*.PNG"], &["imv"], false),
+                rule(&["@image"], &["eog"], false),
+            ],
+        };
+        assert_eq!(
+            policy.command_for(Path::new("/tmp/shot.png"), false),
+            vec!["imv", "/tmp/shot.png"]
+        );
+    }
+
+    #[test]
+    fn a_placeholder_positions_the_path_instead_of_appending_it() {
+        let policy = OpenWith {
+            terminal: None,
+            default: None,
+            rules: vec![rule(&["@any"], &["sh", "-c", "cat {} | less"], false)],
+        };
+        assert_eq!(
+            policy.command_for(Path::new("/tmp/a.log"), false),
+            vec!["sh", "-c", "cat /tmp/a.log | less"]
+        );
+    }
+
+    #[test]
+    fn directories_only_match_the_dir_class() {
+        let policy = OpenWith {
+            terminal: None,
+            default: None,
+            rules: vec![
+                rule(&["@text"], &["nvim"], false),
+                rule(&["@dir"], &["nautilus"], false),
+            ],
+        };
+        assert_eq!(
+            policy.command_for(Path::new("/tmp/notes.md"), true),
+            vec!["nautilus", "/tmp/notes.md"]
+        );
+    }
+
+    #[test]
+    fn a_rule_that_cannot_find_a_terminal_falls_back_to_the_default() {
+        // A terminal that is spelled out in config is always honoured; this is
+        // the other path — resolution must not invent one from the test host.
+        let policy = OpenWith {
+            terminal: Some(Vec::new()),
+            default: Some(vec!["gio".into(), "open".into()]),
+            rules: vec![rule(&["@text"], &["nvim"], true)],
+        };
+        let argv = policy.command_for(Path::new("/tmp/a.md"), false);
+        // Either a terminal exists on this machine (wrapped nvim) or it does
+        // not (the default). Both are correct; what must not happen is a bare
+        // `nvim` with no tty.
+        assert!(
+            argv == vec!["gio", "open", "/tmp/a.md"]
+                || argv.ends_with(&["nvim".to_string(), "/tmp/a.md".to_string()])
+        );
+    }
+
+    #[test]
+    fn globs_backtrack() {
+        assert!(glob_match("*.md", "notes.md"));
+        assert!(glob_match("*notes*.md", "my-notes-2024.md"));
+        assert!(glob_match("a?c.txt", "abc.txt"));
+        assert!(!glob_match("*.md", "notes.mdx"));
+        assert!(!glob_match("a?c.txt", "ac.txt"));
+        assert!(glob_match("*", "anything"));
+    }
+
+    #[test]
+    fn a_bare_terminal_name_gains_its_exec_flag() {
+        assert_eq!(with_exec_flag("alacritty"), vec!["alacritty", "-e"]);
+        assert_eq!(with_exec_flag("kitty"), vec!["kitty"]);
+        assert_eq!(
+            with_exec_flag("/usr/bin/wezterm"),
+            vec!["/usr/bin/wezterm", "start", "--"]
+        );
+        // Unknown terminals get the near-universal `-e`.
+        assert_eq!(with_exec_flag("mystery-term"), vec!["mystery-term", "-e"]);
+    }
+}

crates/pdfs-core/src/sdkcache.rs

@@ -0,0 +1,283 @@
+//! A persistent [`CacheRepository`] for the SDK's Drive entity cache.
+//!
+//! The SDK caches decrypted node metadata (name, size, parent, the share whose
+//! membership signs operations on it) so navigating a tree does not re-fetch and
+//! re-decrypt what it already resolved. That cache defaults to memory, which
+//! means every daemon restart pays for the whole walk again. This backs it with
+//! SQLite so it survives one.
+//!
+//! **Its own database file, not `cache.db`.** The daemon's `Db` is a single
+//! `Mutex<Connection>` shared by every FUSE thread and the control socket; SDK
+//! cache traffic is frequent, small, and entirely reconstructible, so putting it
+//! on that mutex would add contention to the daemon's hottest lock (and to a
+//! write-ahead log whose growth is already sensitive to how long that lock is
+//! held) for no durability benefit. A separate file also means no schema
+//! migration: this store can be deleted and rebuilt at any time.
+//!
+//! **What it holds.** Decrypted metadata, never key material — the SDK keeps
+//! node keys and hash keys in a separate in-memory secret cache that nothing
+//! here can reach. The same names and sizes are already persisted in `cache.db`
+//! (`nodes`), so this file widens no exposure that the state directory did not
+//! already have; `AppDirs::ensure` is what keeps that directory private.
+//!
+//! **Staleness.** A persisted cache outlives the process, so an entry can
+//! describe a node another client has since changed. The daemon's event loop is
+//! what closes that: it resumes from a persisted cursor and calls the SDK's
+//! `invalidate_caches_for_event` for every event it replays, including the ones
+//! that happened while the daemon was down. The one case that leaves no trail is
+//! a *seeded* cursor — a first-ever mount, or a cursor the daemon lost — where
+//! nothing says what changed, so the caller [`clear`](SdkCache::clear)s this
+//! store instead of trusting it.
+
+use std::path::Path;
+use std::sync::{Arc, OnceLock};
+
+use async_trait::async_trait;
+use parking_lot::Mutex;
+use proton_sdk::cache::CacheRepository;
+use proton_sdk::error::{ProtonError, Result as SdkResult};
+use rusqlite::{Connection, params};
+
+use crate::config::AppDirs;
+use crate::error::Result;
+
+/// Process-wide handle, so the daemon's event loop can clear the same store the
+/// client is writing through without threading it down every call.
+static SHARED: OnceLock<Arc<SdkCache>> = OnceLock::new();
+
+/// SQLite-backed entity cache for the SDK.
+pub struct SdkCache {
+    conn: Mutex<Connection>,
+}
+
+impl SdkCache {
+    /// Open (creating if needed) the entity cache under the app's state
+    /// directory. The first call wins; later calls return the same handle, which
+    /// is what lets the event loop clear the store the Drive client is using.
+    pub fn shared(dirs: &AppDirs) -> Result<Arc<Self>> {
+        if let Some(existing) = SHARED.get() {
+            return Ok(existing.clone());
+        }
+        let cache = Arc::new(Self::open(&dirs.state_dir().join("sdk_cache.db"))?);
+        Ok(SHARED.get_or_init(|| cache).clone())
+    }
+
+    /// The already-open shared cache, if one was opened in this process.
+    pub fn opened() -> Option<Arc<Self>> {
+        SHARED.get().cloned()
+    }
+
+    /// Open the store at `path`, creating its schema.
+    pub fn open(path: &Path) -> Result<Self> {
+        let conn = Connection::open(path)?;
+        conn.pragma_update(None, "journal_mode", "WAL")?;
+        conn.pragma_update(None, "synchronous", "NORMAL")?;
+        conn.pragma_update(None, "foreign_keys", "ON")?;
+        // Tags cascade with their entry, so a `set` that replaces a value cannot
+        // leave the old value's tags behind pointing at the new one.
+        conn.execute_batch(
+            "CREATE TABLE IF NOT EXISTS entry (
+               key   TEXT PRIMARY KEY,
+               value TEXT NOT NULL
+             );
+             CREATE TABLE IF NOT EXISTS tag (
+               key TEXT NOT NULL REFERENCES entry(key) ON DELETE CASCADE,
+               tag TEXT NOT NULL,
+               PRIMARY KEY (key, tag)
+             );
+             CREATE INDEX IF NOT EXISTS idx_tag_tag ON tag(tag);",
+        )?;
+        Ok(Self {
+            conn: Mutex::new(conn),
+        })
+    }
+
+    /// Drop every entry. Used when the daemon cannot prove the cache is current
+    /// — a seeded event cursor — and on logout.
+    pub fn clear_now(&self) -> Result<()> {
+        let conn = self.conn.lock();
+        conn.execute_batch("DELETE FROM tag; DELETE FROM entry;")?;
+        Ok(())
+    }
+
+    fn set_now(&self, key: &str, value: &str, tags: &[String]) -> Result<()> {
+        let mut conn = self.conn.lock();
+        let tx = conn.transaction()?;
+        tx.execute(
+            "INSERT INTO entry (key, value) VALUES (?1, ?2)
+             ON CONFLICT(key) DO UPDATE SET value = excluded.value",
+            params![key, value],
+        )?;
+        tx.execute("DELETE FROM tag WHERE key = ?1", params![key])?;
+        {
+            let mut stmt = tx.prepare("INSERT INTO tag (key, tag) VALUES (?1, ?2)")?;
+            for tag in tags {
+                stmt.execute(params![key, tag])?;
+            }
+        }
+        tx.commit()?;
+        Ok(())
+    }
+
+    fn get_now(&self, key: &str) -> Result<Option<String>> {
+        let conn = self.conn.lock();
+        let mut stmt = conn.prepare("SELECT value FROM entry WHERE key = ?1")?;
+        let mut rows = stmt.query(params![key])?;
+        match rows.next()? {
+            Some(row) => Ok(Some(row.get(0)?)),
+            None => Ok(None),
+        }
+    }
+
+    fn remove_now(&self, key: &str) -> Result<()> {
+        let conn = self.conn.lock();
+        conn.execute("DELETE FROM entry WHERE key = ?1", params![key])?;
+        Ok(())
+    }
+
+    fn remove_by_tag_now(&self, tag: &str) -> Result<()> {
+        let conn = self.conn.lock();
+        conn.execute(
+            "DELETE FROM entry WHERE key IN (SELECT key FROM tag WHERE tag = ?1)",
+            params![tag],
+        )?;
+        Ok(())
+    }
+
+    /// Entries carrying **all** of `tags` — the set intersection the SDK's
+    /// `get_by_tags` contract specifies, not a union.
+    fn get_by_tags_now(&self, tags: &[String]) -> Result<Vec<(String, String)>> {
+        if tags.is_empty() {
+            return Ok(Vec::new());
+        }
+        let conn = self.conn.lock();
+        let placeholders = vec!["?"; tags.len()].join(",");
+        let sql = format!(
+            "SELECT e.key, e.value FROM entry e
+             JOIN tag t ON t.key = e.key
+             WHERE t.tag IN ({placeholders})
+             GROUP BY e.key
+             HAVING COUNT(DISTINCT t.tag) = {}",
+            tags.len()
+        );
+        let mut stmt = conn.prepare(&sql)?;
+        let rows = stmt.query_map(rusqlite::params_from_iter(tags), |r| {
+            Ok((r.get(0)?, r.get(1)?))
+        })?;
+        let mut out = Vec::new();
+        for row in rows {
+            out.push(row?);
+        }
+        Ok(out)
+    }
+}
+
+/// A cache failure is never fatal to the operation that triggered it — the SDK
+/// treats this repository as best-effort — but it still has to come back as the
+/// SDK's error type.
+fn sdk_error(e: crate::error::Error) -> ProtonError {
+    ProtonError::invalid_operation(format!("sdk entity cache: {e}"))
+}
+
+// Every method is a local SQLite statement on its own connection: microseconds,
+// no network, no shared lock with the daemon's database. Running them inline on
+// the caller's task is cheaper than the thread hop that moving them off would
+// cost.
+#[async_trait]
+impl CacheRepository for SdkCache {
+    async fn set(&self, key: &str, value: &str, tags: &[String]) -> SdkResult<()> {
+        self.set_now(key, value, tags).map_err(sdk_error)
+    }
+
+    async fn get(&self, key: &str) -> SdkResult<Option<String>> {
+        self.get_now(key).map_err(sdk_error)
+    }
+
+    async fn remove(&self, key: &str) -> SdkResult<()> {
+        self.remove_now(key).map_err(sdk_error)
+    }
+
+    async fn remove_by_tag(&self, tag: &str) -> SdkResult<()> {
+        self.remove_by_tag_now(tag).map_err(sdk_error)
+    }
+
+    async fn clear(&self) -> SdkResult<()> {
+        self.clear_now().map_err(sdk_error)
+    }
+
+    async fn get_by_tags(&self, tags: &[String]) -> SdkResult<Vec<(String, String)>> {
+        self.get_by_tags_now(tags).map_err(sdk_error)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn cache() -> SdkCache {
+        let conn = Connection::open_in_memory().unwrap();
+        conn.pragma_update(None, "foreign_keys", "ON").unwrap();
+        conn.execute_batch(
+            "CREATE TABLE entry (key TEXT PRIMARY KEY, value TEXT NOT NULL);
+             CREATE TABLE tag (
+               key TEXT NOT NULL REFERENCES entry(key) ON DELETE CASCADE,
+               tag TEXT NOT NULL,
+               PRIMARY KEY (key, tag)
+             );",
+        )
+        .unwrap();
+        SdkCache {
+            conn: Mutex::new(conn),
+        }
+    }
+
+    fn tags(values: &[&str]) -> Vec<String> {
+        values.iter().map(|t| t.to_string()).collect()
+    }
+
+    #[test]
+    fn set_replaces_the_value_and_its_tags() {
+        let cache = cache();
+        cache.set_now("k", "one", &tags(&["a", "b"])).unwrap();
+        cache.set_now("k", "two", &tags(&["b"])).unwrap();
+
+        assert_eq!(cache.get_now("k").unwrap().as_deref(), Some("two"));
+        // The tag dropped by the second write must not still select the entry —
+        // that is how a stale invalidation would miss it.
+        assert!(cache.get_by_tags_now(&tags(&["a"])).unwrap().is_empty());
+        assert_eq!(cache.get_by_tags_now(&tags(&["b"])).unwrap().len(), 1);
+    }
+
+    #[test]
+    fn get_by_tags_intersects_rather_than_unions() {
+        let cache = cache();
+        cache.set_now("both", "1", &tags(&["x", "y"])).unwrap();
+        cache.set_now("one", "2", &tags(&["x"])).unwrap();
+
+        let hits = cache.get_by_tags_now(&tags(&["x", "y"])).unwrap();
+        assert_eq!(hits, vec![("both".to_string(), "1".to_string())]);
+        // An empty tag list selects nothing, matching the SDK contract.
+        assert!(cache.get_by_tags_now(&[]).unwrap().is_empty());
+    }
+
+    #[test]
+    fn removing_by_tag_takes_the_entry_and_its_tags() {
+        let cache = cache();
+        cache.set_now("k", "v", &tags(&["gone"])).unwrap();
+        cache.remove_by_tag_now("gone").unwrap();
+
+        assert!(cache.get_now("k").unwrap().is_none());
+        assert!(cache.get_by_tags_now(&tags(&["gone"])).unwrap().is_empty());
+    }
+
+    #[test]
+    fn clear_empties_the_store() {
+        let cache = cache();
+        cache.set_now("a", "1", &tags(&["t"])).unwrap();
+        cache.set_now("b", "2", &[]).unwrap();
+        cache.clear_now().unwrap();
+
+        assert!(cache.get_now("a").unwrap().is_none());
+        assert!(cache.get_now("b").unwrap().is_none());
+    }
+}

crates/pdfs-fuse/Cargo.toml

@@ -10,6 +10,7 @@ description = "FUSE on-demand filesystem for Proton Drive"
 [dependencies]
 pdfs-core.workspace = true
 proton-drive-rs.workspace = true
+futures.workspace = true
 tokio.workspace = true
 tracing.workspace = true
 fuser.workspace = true

crates/pdfs-fuse/src/background.rs

@@ -1,6 +1,7 @@
 //! Remote-event invalidation and local-index background workers.
 
 use super::*;
+use crate::shutdown::Shutdown;
 
 /// Drop `uid` from one mount's tree and tell that mount's kernel session the
 /// entry is gone. Shared by the trash and delete paths, which differ only in
@@ -8,35 +9,20 @@ use super::*;
 ///
 /// Returns whether this mount actually held the node, so the caller can evict
 /// its content blob once if *any* mount did.
-fn forget_and_notify(st: &mut State, notifier: Option<&Notifier>, uid: &NodeUid) -> bool {
+fn forget_and_notify(st: &mut State, notify: &mut NotifyBatch, uid: &NodeUid) -> bool {
     // Capture the inode before `forget` clears the uid mapping.
     let child = st.by_uid.get(uid).copied();
     let Some((parent, name)) = st.forget(uid) else {
         return false;
     };
-    if let Some(notifier) = notifier {
+    match child {
-        match child {
+        Some(child) => notify.delete(parent, child, name),
-            Some(child) => {
+        None => notify.inval_entry(parent, name),
-                let _ = notifier.delete(INodeNo(parent), INodeNo(child), OsStr::new(&name));
-            }
-            None => {
-                let _ = notifier.inval_entry(INodeNo(parent), OsStr::new(&name));
-            }
-        }
     }
     true
 }
 
-fn invalidate_access_changes(notifier: Option<&Notifier>, changed: &[u64]) {
+fn hide_foreign_deleted_and_notify(st: &mut State, notify: &mut NotifyBatch, uid: &NodeUid) {
-    let Some(notifier) = notifier else {
-        return;
-    };
-    for &ino in changed {
-        let _ = notifier.inval_inode(INodeNo(ino), 0, 0);
-    }
-}
-
-fn hide_foreign_deleted_and_notify(st: &mut State, notifier: Option<&Notifier>, uid: &NodeUid) {
     let child = st.by_uid.get(uid).copied();
     let dentry = child.and_then(|ino| {
         st.entries
@@ -45,9 +31,9 @@ fn hide_foreign_deleted_and_notify(st: &mut State, notifier: Option<&Notifier>,
     });
     let changed = st.downgrade_shared_subtree(uid);
     st.hide_foreign_subtree(uid);
-    invalidate_access_changes(notifier, &changed);
+    notify.extend_inodes(&changed);
-    if let (Some(notifier), Some((parent, name)), Some(child)) = (notifier, dentry, child) {
+    if let (Some((parent, name)), Some(child)) = (dentry, child) {
-        let _ = notifier.delete(INodeNo(parent), INodeNo(child), OsStr::new(&name));
+        notify.delete(parent, child, name);
     }
 }
 
@@ -132,18 +118,18 @@ fn apply_event(core: &Core, event: &DriveEvent, dirty: &mut DirtyParents) -> pdf
         && foreign_delete
     {
         apply_foreign_delete(&core.db, node_uid, |uid| {
-            core.for_each_mount(|st, notifier| {
+            core.for_each_mount(|st, notify| {
-                hide_foreign_deleted_and_notify(st, notifier, uid);
+                hide_foreign_deleted_and_notify(st, notify, uid);
             });
         })
     } else {
         apply_access_downgrade(&core.db, event, |root| {
-            core.for_each_mount(|st, notifier| {
+            core.for_each_mount(|st, notify| {
                 let changed = match root {
                     Some(uid) => st.downgrade_shared_subtree(uid),
                     None => st.downgrade_known_shared_access(),
                 };
-                invalidate_access_changes(notifier, &changed);
+                notify.extend_inodes(&changed);
             });
         })
     };
@@ -173,19 +159,17 @@ fn apply_event(core: &Core, event: &DriveEvent, dirty: &mut DirtyParents) -> pdf
                 debug!(uid = %node_uid, "ignoring remote event for a node with a queued write");
             }
             let mut had_node = false;
-            core.for_each_mount(|st, notifier| {
+            core.for_each_mount(|st, notify| {
                 if *is_trashed {
                     // Trashing makes a node vanish from its parent listing.
-                    had_node |= forget_and_notify(st, notifier, node_uid);
+                    had_node |= forget_and_notify(st, notify, node_uid);
                 } else if !ours && let Some(&ino) = st.by_uid.get(node_uid) {
                     // Known node changed: drop its cached attrs/data (and
                     // listing if it is a directory) so the next access
                     // re-fetches. Its content blob may now be stale too.
                     had_node = true;
                     st.invalidate_listing(ino);
-                    if let Some(notifier) = notifier {
+                    notify.inval_inode(ino);
-                        let _ = notifier.inval_inode(INodeNo(ino), 0, 0);
-                    }
                 }
             });
             // Once, not once per mount: the content cache is per-daemon.
@@ -209,8 +193,8 @@ fn apply_event(core: &Core, event: &DriveEvent, dirty: &mut DirtyParents) -> pdf
         DriveEvent::NodeDeleted { node_uid, .. } => {
             core.cache.evict(node_uid);
             if !foreign_delete {
-                core.for_each_mount(|st, notifier| {
+                core.for_each_mount(|st, notify| {
-                    forget_and_notify(st, notifier, node_uid);
+                    forget_and_notify(st, notify, node_uid);
                 });
             }
         }
@@ -223,13 +207,11 @@ fn apply_event(core: &Core, event: &DriveEvent, dirty: &mut DirtyParents) -> pdf
         | DriveEvent::SharedWithMeUpdated { .. } => {
             warn!("event access continuity lost; downgrading shared trees and resyncing lazily");
             apply_result = apply_result.and(core.db.clear_state(SHARED_WITH_ME_SYNCED_MS));
-            core.for_each_mount(|st, notifier| {
+            core.for_each_mount(|st, notify| {
                 let dirs: Vec<u64> = st.children.keys().copied().collect();
                 for &ino in &dirs {
                     st.invalidate_listing(ino);
-                    if let Some(notifier) = notifier {
+                    notify.inval_inode(ino);
-                        let _ = notifier.inval_inode(INodeNo(ino), 0, 0);
-                    }
                 }
             });
         }
@@ -303,18 +285,16 @@ fn flush_dirty_parents(core: &Core, dirty: &DirtyParents) {
     if dirty.foreign.is_empty() && dirty.ours.is_empty() {
         return;
     }
-    core.for_each_mount(|st, notifier| {
+    fn drop_listing(st: &mut State, notify: &mut NotifyBatch, parent_uid: &NodeUid) {
-        let drop_listing = |st: &mut State, parent_uid: &NodeUid| {
+        let Some(&parent) = st.by_uid.get(parent_uid) else {
-            let Some(&parent) = st.by_uid.get(parent_uid) else {
+            return;
-                return;
-            };
-            st.invalidate_listing(parent);
-            if let Some(notifier) = notifier {
-                let _ = notifier.inval_inode(INodeNo(parent), 0, 0);
-            }
         };
+        st.invalidate_listing(parent);
+        notify.inval_inode(parent);
+    }
+    core.for_each_mount(|st, notify| {
         for parent_uid in &dirty.foreign {
-            drop_listing(st, parent_uid);
+            drop_listing(st, notify, parent_uid);
         }
         for (parent_uid, children) in &dirty.ours {
             if dirty.foreign.contains(parent_uid) {
@@ -328,7 +308,7 @@ fn flush_dirty_parents(core: &Core, dirty: &DirtyParents) {
             {
                 continue;
             }
-            drop_listing(st, parent_uid);
+            drop_listing(st, notify, parent_uid);
         }
     });
 }
@@ -358,6 +338,14 @@ pub(super) async fn run_event_sync(
         // started offline (offline.md Phase 1) — so retry rather than giving up,
         // which used to disable live sync for the life of the daemon.
         Ok(None) => {
+            // Nothing says what changed before this cursor, so a persisted SDK
+            // entity cache from an earlier run cannot be trusted: drop it rather
+            // than serve metadata no event will ever invalidate.
+            if let Some(cache) = pdfs_core::sdkcache::SdkCache::opened()
+                && let Err(e) = cache.clear_now()
+            {
+                warn!(error = %e, "clearing the persisted SDK entity cache failed");
+            }
             let mut delay = ONLINE_PROBE_MIN;
             loop {
                 match client.enumerate_events(&scope, None).await {
@@ -450,6 +438,7 @@ pub(super) fn run_local_index(
     indexing: Arc<AtomicBool>,
     transfers: Arc<TransferRegistry>,
     mountpoint: PathBuf,
+    shutdown: Arc<Shutdown>,
 ) {
     loop {
         let age = db.local_indexed_at().ok().flatten();
@@ -458,7 +447,11 @@ pub(super) fn run_local_index(
         if stale {
             scan_local_once(&db, &indexing, &transfers, &mountpoint);
         }
-        std::thread::sleep(LOCAL_INDEX_CHECK);
+        // Interruptible, so teardown joins this thread instead of leaving it to
+        // keep rewriting the index for a mount that is gone (bugs.md B44).
+        if !shutdown.sleep(LOCAL_INDEX_CHECK) {
+            return;
+        }
     }
 }
 

crates/pdfs-fuse/src/control.rs

@@ -29,7 +29,23 @@ use super::{Core, count_noun, human_bytes, human_duration, parse_uid};
 
 const MAX_CONTROL_REQUEST_BYTES: u64 = 1024 * 1024;
 const CONTROL_READ_TIMEOUT: Duration = Duration::from_secs(10);
+/// A client that connects, sends a request and then never reads its reply used
+/// to park a handler thread forever in `write_all`; 64 of those exhaust
+/// [`MAX_CONTROL_HANDLERS`] permanently. Generous enough for the largest
+/// responses (photo bytes) over a local socket, finite so a wedged peer can't
+/// hold a permit.
+const CONTROL_WRITE_TIMEOUT: Duration = Duration::from_secs(30);
 const MAX_CONTROL_HANDLERS: usize = 64;
+/// Ceiling on any client-supplied row `limit`. Every in-tree caller asks for far
+/// less (200 for activity, 60 for a photo page), but the value goes straight
+/// into `SQL LIMIT ?` under the daemon's single connection — an unclamped one
+/// materialises the whole account, and then serialises it into one JSON line.
+const MAX_ROW_LIMIT: usize = 1000;
+
+/// Clamp a client-supplied row limit to [`MAX_ROW_LIMIT`].
+fn clamp_limit(limit: usize) -> usize {
+    limit.min(MAX_ROW_LIMIT)
+}
 static ACTIVE_CONTROL_HANDLERS: AtomicUsize = AtomicUsize::new(0);
 
 struct ControlHandlerPermit;
@@ -109,6 +125,10 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
         warn!(error = %e, "control: could not set request timeout");
         return;
     }
+    if let Err(e) = stream.set_write_timeout(Some(CONTROL_WRITE_TIMEOUT)) {
+        warn!(error = %e, "control: could not set response timeout");
+        return;
+    }
     let mut reader = BufReader::new(match stream.try_clone() {
         Ok(s) => s,
         Err(e) => {
@@ -128,7 +148,13 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
         Ok(CtlRequest::Status) => {
             let pins = core.cache.list_pins();
             let queued = core.db.pending_op_counts().unwrap_or_default();
+            let staging = core.cache.staging_usage();
             CtlResponse::Status {
+                parked_uploads: queued.parked.max(0) as u64,
+                failing_ops: queued.failing.max(0) as u64,
+                failing_error: queued.last_error.clone(),
+                staged_bytes: staging.bytes,
+                staged_oldest_secs: staging.oldest_secs,
                 username: username.to_string(),
                 mountpoint: mountpoint.display().to_string(),
                 pinned: pins.len(),
@@ -203,7 +229,8 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
             limit,
             kind,
             range,
-        }) => match core.photos_timeline(offset, limit, kind, range) {
+            favorites,
+        }) => match core.photos_timeline(offset, clamp_limit(limit), kind, range, favorites) {
             Ok(Some(items)) => CtlResponse::Photos {
                 available: true,
                 items,
@@ -216,6 +243,19 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
             },
             Err(e) => CtlResponse::error(e),
         },
+        Ok(CtlRequest::SetPhotoFavorite { uid, favorite }) => match parse_uid(&uid) {
+            Some(node_uid) => match core.set_photo_favorite(&node_uid, favorite) {
+                Ok(()) => CtlResponse::Ok {
+                    message: if favorite {
+                        "added to favourites".to_string()
+                    } else {
+                        "removed from favourites".to_string()
+                    },
+                },
+                Err(e) => CtlResponse::error(e),
+            },
+            None => CtlResponse::error(CoreError::invalid(format!("invalid uid: {uid}"))),
+        },
         Ok(CtlRequest::PhotoAlbums) => match core.albums() {
             Ok(Some(items)) => CtlResponse::Albums {
                 available: true,
@@ -231,7 +271,7 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
             // An album page is a timeline page as far as the front-end is
             // concerned, so it comes back in the same reply — with `counts`
             // unset, which describe the whole timeline rather than this album.
-            Some(album) => match core.album_photos(&album, offset, limit) {
+            Some(album) => match core.album_photos(&album, offset, clamp_limit(limit)) {
                 Ok(items) => CtlResponse::Photos {
                     available: true,
                     items,
@@ -318,31 +358,38 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
                 }
             }
         }
-        Ok(CtlRequest::OpenFile { path }) => match rel_to_mount(mountpoint, &path) {
+        // A uid addresses the node wherever it lives; the path only works for
-            Ok(rel) => match core.open_file(&rel) {
+        // the primary mount's tree. Prefer the uid when the client sent one.
+        Ok(CtlRequest::OpenFile { path, uid }) => {
+            let opened = match uid.as_deref() {
+                Some(uid) => core.open_file_uid(uid),
+                None => rel_to_mount(mountpoint, &path).and_then(|rel| core.open_file(&rel)),
+            };
+            match opened {
                 Ok(p) => CtlResponse::FilePath {
                     path: p.display().to_string(),
                 },
                 Err(e) => CtlResponse::error(e),
-            },
+            }
-            Err(e) => CtlResponse::error(e),
+        }
-        },
+        Ok(CtlRequest::Search { query, limit }) => match core.search(&query, clamp_limit(limit)) {
-        Ok(CtlRequest::Search { query, limit }) => match core.search(&query, limit) {
             Ok(hits) => CtlResponse::SearchResults { hits },
             Err(e) => CtlResponse::error(e),
         },
-        Ok(CtlRequest::SearchLocal { query, limit }) => match core.search_local(&query, limit) {
+        Ok(CtlRequest::SearchLocal { query, limit }) => {
-            Ok(hits) => CtlResponse::LocalResults {
+            match core.search_local(&query, clamp_limit(limit)) {
-                hits,
+                Ok(hits) => CtlResponse::LocalResults {
-                indexing: core.indexing.load(Ordering::Relaxed),
+                    hits,
-            },
+                    indexing: core.indexing.load(Ordering::Relaxed),
-            Err(e) => CtlResponse::error(e),
+                },
-        },
+                Err(e) => CtlResponse::error(e),
+            }
+        }
         Ok(CtlRequest::SearchV2 {
             query,
             limit,
             filters,
-        }) => match core.search_v2(&query, limit, &filters) {
+        }) => match core.search_v2(&query, clamp_limit(limit), &filters) {
             Ok((drive_hits, local_hits)) => CtlResponse::SearchResultsV2 {
                 drive_hits,
                 local_hits,
@@ -521,19 +568,20 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
         }
         Ok(CtlRequest::CacheInspect { deep }) => match core.db.stats() {
             Ok(stats) => {
-                // The deep check reads every page, so it runs only on request;
+                // The deep check reads every page — tens of seconds on a real
-                // `integrity_checked` tells the caller which answer it is
+                // database, all of it holding the connection every FUSE handler
-                // holding, since "no problems found" and "never looked" are
+                // needs — so it runs on a thread and this request returns
-                // both an empty list.
+                // whatever the last completed check found. `integrity_checked`
-                let (integrity_problems, integrity_checked) = if deep {
+                // tells the caller which answer it is holding, since "no
-                    match core.db.integrity_check() {
+                // problems found" and "never looked" are both an empty list;
-                        Ok(problems) => (problems, true),
+                // `integrity_running` says a fresh answer is on its way.
-                        Err(e) => (vec![format!("integrity check failed: {e:?}")], true),
+                let (integrity_problems, integrity_checked, integrity_running) = if deep {
-                    }
+                    core.start_or_read_integrity_check()
                 } else {
-                    (Vec::new(), false)
+                    (Vec::new(), false, false)
                 };
                 CtlResponse::CacheReport {
+                    integrity_running,
                     schema_version: stats.schema_version,
                     db_bytes: stats.total_bytes(),
                     db_reclaimable_bytes: stats.reclaimable_bytes(),
@@ -546,17 +594,16 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
             }
             Err(e) => CtlResponse::error(CoreError::internal(format!("read db stats: {e:?}"))),
         },
-        Ok(CtlRequest::CacheVacuum) => match core.db.vacuum() {
+        // Ack and vacuum on a thread. `VACUUM` rewrites the whole database
-            Ok(outcome) => CtlResponse::Ok {
+        // under the connection mutex — minutes on a large one — and the
-                message: format!(
+        // request's own socket timeout is 10 s, so running it inline both froze
-                    "vacuumed: {:.1} MiB freed ({:.1} MiB → {:.1} MiB), {} WAL frame(s) checkpointed",
+        // the mount and lost its own answer. Progress shows up as a job in
-                    outcome.freed_bytes() as f64 / 1_048_576.0,
+        // `GetQueueStatus`; the outcome goes to the log.
-                    outcome.before_bytes as f64 / 1_048_576.0,
+        Ok(CtlRequest::CacheVacuum) => match core.start_vacuum() {
-                    outcome.after_bytes as f64 / 1_048_576.0,
+            Ok(()) => CtlResponse::Ok {
-                    outcome.wal_frames_checkpointed,
+                message: "compacting the cache database in the background".into(),
-                ),
             },
-            Err(e) => CtlResponse::error(CoreError::internal(format!("vacuum: {e:?}"))),
+            Err(e) => CtlResponse::error(e),
         },
         Ok(CtlRequest::GetQueueStatus) => CtlResponse::Transfers {
             items: core.transfers.snapshot(),
@@ -863,6 +910,78 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
                 Err(e) => CtlResponse::error(e),
             }
         }
+        Ok(CtlRequest::ListRevisions { path }) => match rel_to_mount(mountpoint, &path) {
+            Ok(rel) => match core.list_revisions(&rel) {
+                Ok(items) => CtlResponse::Revisions { items },
+                Err(e) => CtlResponse::error(e),
+            },
+            Err(e) => CtlResponse::error(e),
+        },
+        Ok(CtlRequest::ListRevisionsByUid { uid }) => match core.list_revisions_by_uid(&uid) {
+            Ok(items) => CtlResponse::Revisions { items },
+            Err(e) => CtlResponse::error(e),
+        },
+        Ok(CtlRequest::RestoreRevision { path, revision_id }) => {
+            match rel_to_mount(mountpoint, &path) {
+                Ok(rel) => match core.restore_revision(&rel, &revision_id) {
+                    Ok(()) => CtlResponse::Ok {
+                        message: format!("restoring version {revision_id} of {path}"),
+                    },
+                    Err(e) => CtlResponse::error(e),
+                },
+                Err(e) => CtlResponse::error(e),
+            }
+        }
+        Ok(CtlRequest::RestoreRevisionByUid { uid, revision_id }) => {
+            match core.restore_revision_by_uid(&uid, &revision_id) {
+                Ok(()) => CtlResponse::Ok {
+                    message: format!("restoring version {revision_id}"),
+                },
+                Err(e) => CtlResponse::error(e),
+            }
+        }
+        Ok(CtlRequest::DeleteRevision { path, revision_id }) => {
+            match rel_to_mount(mountpoint, &path) {
+                Ok(rel) => match core.delete_revision(&rel, &revision_id) {
+                    Ok(()) => CtlResponse::Ok {
+                        message: format!("deleted version {revision_id} of {path}"),
+                    },
+                    Err(e) => CtlResponse::error(e),
+                },
+                Err(e) => CtlResponse::error(e),
+            }
+        }
+        Ok(CtlRequest::DeleteRevisionByUid { uid, revision_id }) => {
+            match core.delete_revision_by_uid(&uid, &revision_id) {
+                Ok(()) => CtlResponse::Ok {
+                    message: format!("deleted version {revision_id}"),
+                },
+                Err(e) => CtlResponse::error(e),
+            }
+        }
+        Ok(CtlRequest::SaveRevisionAs {
+            path,
+            revision_id,
+            dest,
+        }) => match rel_to_mount(mountpoint, &path) {
+            Ok(rel) => match core.save_revision_as(&rel, &revision_id, Path::new(&dest)) {
+                Ok(written) => CtlResponse::Ok {
+                    message: format!("wrote {} to {dest}", human_bytes(written)),
+                },
+                Err(e) => CtlResponse::error(e),
+            },
+            Err(e) => CtlResponse::error(e),
+        },
+        Ok(CtlRequest::SaveRevisionAsByUid {
+            uid,
+            revision_id,
+            dest,
+        }) => match core.save_revision_as_by_uid(&uid, &revision_id, Path::new(&dest)) {
+            Ok(written) => CtlResponse::Ok {
+                message: format!("wrote {} to {dest}", human_bytes(written)),
+            },
+            Err(e) => CtlResponse::error(e),
+        },
         Ok(CtlRequest::ListSharedWithMe) => match core.list_shared_with_me() {
             Ok(entries) => CtlResponse::Entries { entries },
             Err(e) => CtlResponse::error(e),
@@ -932,7 +1051,7 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
             Err(e) => CtlResponse::error(e),
         },
         Ok(CtlRequest::ListActivity { limit }) => CtlResponse::Activity {
-            items: core.list_activity(limit),
+            items: core.list_activity(clamp_limit(limit)),
         },
         // The request did not parse: the caller sent something malformed.
         Err(e) => CtlResponse::error(CoreError::invalid(format!("bad request: {e}"))),
@@ -965,6 +1084,12 @@ pub(crate) fn run_control_socket(
 ) {
     info!("control socket listening");
     for conn in listener.incoming() {
+        // Checked on every accept, including the deliberate poke teardown sends
+        // to wake this thread out of a blocking accept (bugs.md B44).
+        if core.shutdown.is_stopping() {
+            info!("control socket closing");
+            return;
+        }
         match conn {
             Ok(stream) => {
                 let Some(permit) = ControlHandlerPermit::acquire() else {

crates/pdfs-fuse/src/devices.rs

@@ -12,6 +12,7 @@ use std::path::{Path, PathBuf};
 use std::sync::Arc;
 
 use parking_lot::Mutex;
+use pdfs_core::batch;
 use pdfs_core::control::{
     ActivityKind, DeviceInfo, JobItem, MountKind, MountSpec, SyncFolderInfo, SyncPhase,
     SyncProgress,
@@ -535,7 +536,14 @@ impl Core {
         // folder the daemon no longer tracks, and nothing would ever unmount it.
         // Tear it down first — including before trashing the remote tree it
         // serves, which would otherwise leave it answering for deleted nodes.
-        if let Some(mount) = self.mounts.lock().remove(&id)
+        // Taken in its own statement so the registry lock is released before the
+        // teardown: an edition-2024 `if let` chain holds the guard for the whole
+        // body, and `teardown` unmounts and joins the session thread — which can
+        // be inside a multi-second transfer. The shutdown path takes the same
+        // lock, so holding it here risks systemd's stop timeout landing mid-
+        // unmount and stranding the endpoint.
+        let taken = self.mounts.lock().remove(&id);
+        if let Some(mount) = taken
             && let Err(error) = commit_after_teardown(mount.teardown(), || ())
         {
             let _ = self.db.sync_folder_set_state(id, "error", now_secs());
@@ -557,7 +565,10 @@ impl Core {
         let _ = self.sync_tx.send(sync::SyncMsg::Rewatch);
         if delete_remote
             && let Some(uid) = parse_uid(&folder.remote_uid)
-            && let Err(e) = self.rt.block_on(self.client.trash_nodes(&[uid]))
+            && let Err(e) = self
+                .rt
+                .block_on(self.client.trash_nodes(&[uid]))
+                .and_then(batch::into_unit)
         {
             warn!(id, error = %e, "delete remote device folder failed");
         }
@@ -580,19 +591,8 @@ impl Core {
     pub(crate) fn fork_state(&self) -> Core {
         let mut fork = self.clone();
         fork.primary = false;
-        let share_access = self.state.lock().share_access.clone();
+        let share_access = self.state().share_access.clone();
-        fork.state = Arc::new(Mutex::new(State {
+        fork.state = Arc::new(Mutex::new(State::new(self.db.clone(), share_access, 2)));
-            entries: HashMap::new(),
-            by_uid: HashMap::new(),
-            children: HashMap::new(),
-            next_ino: 2,
-            active_writes: HashMap::new(),
-            handles: HashMap::new(),
-            next_fh: 1,
-            access_changes: std::collections::HashSet::new(),
-            share_access,
-            db: self.db.clone(),
-        }));
         // A fresh inode space needs a fresh notification channel: this fork's
         // session is the only one that knows these inodes, so it must be the one
         // notified about them. Filled in by `spawn_ondemand_mount`.
@@ -862,8 +862,11 @@ impl Core {
                 Ok(format!("{} is now on-demand", local.display()))
             }
             ApplicableMountMode::Mirror => {
-                // ondemand→mirror: tear down the secondary mount first.
+                // ondemand→mirror: tear down the secondary mount first. Taken
-                if let Some(mount) = self.mounts.lock().remove(&id)
+                // before the teardown so the registry lock is not held across
+                // the unmount and thread join (see `remove_sync_folder`).
+                let taken = self.mounts.lock().remove(&id);
+                if let Some(mount) = taken
                     && let Err(error) = commit_after_teardown(mount.teardown(), || ())
                 {
                     let _ = self.db.sync_folder_set_state(id, "error", now_secs());

crates/pdfs-fuse/src/drain.rs

@@ -20,11 +20,16 @@
 //! are kept as a conflict copy rather than discarded — see
 //! [`Core::revision_conflict`].
 
+use std::collections::HashMap;
 use std::fs::File;
 use std::path::{Path, PathBuf};
-use std::sync::atomic::Ordering;
+use std::sync::Arc;
-use std::time::Duration;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::time::{Duration, Instant};
 
+use parking_lot::Mutex;
+
+use pdfs_core::batch;
 use pdfs_core::cache::{Baseline, StagedWrite};
 use pdfs_core::control::{ActivityKind, TransferDirection};
 use pdfs_core::db::{OP_CREATE, OP_MKDIR, OP_RENAME, OP_REVISION, OP_TRASH, PendingOp, RenameMeta};
@@ -35,17 +40,132 @@ use tracing::{debug, error, info, warn};
 use super::state::Intervals;
 use super::transfers::CountingReader;
 use super::{
-    Core, DRAIN_BACKOFF_MAX, DRAIN_BACKOFF_MIN, DRAIN_IDLE_POLL, ROOT_INO, conflict_name,
+    Core, DRAIN_BACKOFF_MAX, DRAIN_BACKOFF_MIN, DRAIN_IDLE_POLL, DRAIN_REVISION_DEBOUNCE,
+    DRAIN_REVISION_DEBOUNCE_MAX, ROOT_INO, UPLOAD_TIME_MEMORY, WriteAuthority, conflict_name,
     is_already_exists, is_gone, is_local_uid_str, media_type_for, node_revision_id, node_size,
     now_millis, now_secs, parse_node_uid,
 };
 
 const DRAIN_ACCESS_RECHECK: Duration = Duration::from_secs(5);
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+/// How long an op may stay access-deferred before the deferral is reported as a
+/// failure instead of retried in silence.
+///
+/// An access deferral costs no attempt and records no error, which is right for
+/// the case it was written for: a share downgraded while the queue was moving,
+/// undone a moment later. It is wrong for anything that does not clear. Until
+/// this window existed such an op was re-deferred every
+/// [`DRAIN_ACCESS_RECHECK`] indefinitely with `attempts` at zero, `last_error`
+/// null and only a `debug!` line to show for it, so `pdfs status` counted it
+/// among ordinary queued uploads and nothing ever said otherwise.
+///
+/// The condition that produced that in practice — a node absent from the local
+/// tree, which [`Db::effective_node_access`] used to report indistinguishably
+/// from a revoked permission — is now answered directly by
+/// [`Core::resolve_unknown_authority`]. This window remains the backstop for
+/// every deferral that does not resolve, including a refetch that keeps not
+/// helping.
+///
+/// Five minutes is far longer than a permission change takes to settle and far
+/// shorter than a user's patience with bytes that are not moving. Past it each
+/// recheck records a failure, so the op enters the ordinary backoff and, at
+/// [`FAILING_ATTEMPTS`], is counted and named by `Response::Status`.
+///
+/// [`Db::effective_node_access`]: pdfs_core::db::Db::effective_node_access
+/// [`FAILING_ATTEMPTS`]: pdfs_core::db::FAILING_ATTEMPTS
+const DRAIN_ACCESS_DEFER_LIMIT: Duration = Duration::from_secs(300);
+
+/// A registered cancellation flag for one in-flight upload, deregistered when
+/// dropped. See [`Core::begin_cancellable_upload`].
+struct UploadCancel {
+    registry: Arc<Mutex<HashMap<NodeUid, Arc<AtomicBool>>>>,
+    uid: NodeUid,
+    flag: Arc<AtomicBool>,
+}
+
+impl UploadCancel {
+    /// Whether this upload was told to stop. Distinguishes an upload we
+    /// abandoned on purpose from one the network broke.
+    fn cancelled(&self) -> bool {
+        self.flag.load(Ordering::Relaxed)
+    }
+
+    fn flag(&self) -> Arc<AtomicBool> {
+        self.flag.clone()
+    }
+}
+
+impl Drop for UploadCancel {
+    fn drop(&mut self) {
+        let mut registry = self.registry.lock();
+        // By identity: a supersede racing this upload's last bytes may already
+        // have registered the next one under the same uid.
+        if registry
+            .get(&self.uid)
+            .is_some_and(|current| Arc::ptr_eq(current, &self.flag))
+        {
+            registry.remove(&self.uid);
+        }
+    }
+}
+
+/// The debounce arithmetic of [`Core::revision_debounce`], without the map:
+/// the last measured upload time for this node, bounded on both sides.
+///
+/// A node nobody has uploaded yet gets the fixed grace period, which is the
+/// same answer the fixed debounce always gave.
+fn adaptive_debounce(measured: Option<Duration>) -> Duration {
+    measured
+        .unwrap_or(DRAIN_REVISION_DEBOUNCE)
+        .clamp(DRAIN_REVISION_DEBOUNCE, DRAIN_REVISION_DEBOUNCE_MAX)
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
 enum DrainDisposition {
     Applied,
     AccessDeferred,
+    /// An authority this op needs is missing from the local tree, so no access
+    /// answer exists for it yet. Carries the uid to ask the remote about.
+    AuthorityUnknown(NodeUid),
+}
+
+/// Why an op went back on the clock without consuming an attempt. Only affects
+/// what the user is told — every variant is deferred and reported identically.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum AccessDeferral {
+    /// An authority the tree knows about refuses the write.
+    NotWritable,
+    /// An authority missing from the tree was just re-read from the remote and
+    /// re-interned; the access check gets another look on the next pass.
+    AuthorityRefetched,
+    /// An authority missing from the tree could not be asked about.
+    RemoteUnreachable,
+}
+
+impl AccessDeferral {
+    fn log_reason(self) -> &'static str {
+        match self {
+            Self::NotWritable => "the node is not writable",
+            Self::AuthorityRefetched => "the node was missing locally and has been re-read",
+            Self::RemoteUnreachable => "the node is missing locally and the remote is unreachable",
+        }
+    }
+
+    /// Phrased to complete "<reason> for 300s." in a recorded `last_error`, so
+    /// the text the user sees names the actual condition rather than the
+    /// permission question it used to be flattened into.
+    fn failure_reason(self) -> &'static str {
+        match self {
+            Self::NotWritable => "the share has not been writable",
+            Self::AuthorityRefetched => {
+                "the node has been missing from the local tree, and re-reading it from the remote \
+                 has not restored it"
+            }
+            Self::RemoteUnreachable => {
+                "the node has been missing from the local tree and the remote has been unreachable"
+            }
+        }
+    }
 }
 
 fn pending_op_authorities(op: &PendingOp) -> Result<Vec<NodeUid>, Box<dyn std::error::Error>> {
@@ -88,7 +208,7 @@ fn pending_op_authorities(op: &PendingOp) -> Result<Vec<NodeUid>, Box<dyn std::e
 
 fn run_authorized_drain(
     op: &PendingOp,
-    mut require: impl FnMut(&NodeUid) -> Result<(), fuser::Errno>,
+    mut authority_of: impl FnMut(&NodeUid) -> WriteAuthority,
     apply: impl FnOnce() -> Result<(), Box<dyn std::error::Error>>,
 ) -> Result<DrainDisposition, Box<dyn std::error::Error>> {
     // This check is the admission/linearization point. A downgrade that lands
@@ -96,15 +216,14 @@ fn run_authorized_drain(
     // attempt. Every later queued operation rechecks. No permission lock is
     // held across remote latency.
     for authority in pending_op_authorities(op)? {
-        match require(&authority) {
+        match authority_of(&authority) {
-            Ok(()) => {}
+            WriteAuthority::Writable => {}
-            Err(error) if error.code() == libc::EACCES => {
+            WriteAuthority::Denied => return Ok(DrainDisposition::AccessDeferred),
-                return Ok(DrainDisposition::AccessDeferred);
+            // Nothing in the tree can answer for this node. Deferring on it
-            }
+            // waits for a permission change that has no reason to come, so the
-            Err(error) => {
+            // caller asks the remote instead (B83).
-                return Err(
+            WriteAuthority::Unknown => {
-                    format!("drain access check failed with errno {}", error.code()).into(),
+                return Ok(DrainDisposition::AuthorityUnknown(authority));
-                );
             }
         }
     }
@@ -126,44 +245,85 @@ impl Core {
     /// that is due — one file wedged against a folder that no longer exists must
     /// not hold up an unrelated upload behind it. The worker only blocks once
     /// nothing is due at all.
-    pub(crate) fn run_pending_drain(&self) {
+    ///
+    /// Several of these run at once ([`DRAIN_WORKERS`]), sharing the queue
+    /// through [`Db::claim_next_due_op`]: the alternative was that a 10 GiB
+    /// upload held every queued rename, trash and small write behind it for as
+    /// long as it took. Ordering only has to hold *per node*, and the claim
+    /// query is what guarantees it — no two workers are ever on one uid.
+    ///
+    /// `primary` marks the one worker that also runs the queue's idle chores.
+    /// They are cheap, but they are not per-op work and doing them in every
+    /// worker would just multiply them.
+    ///
+    /// [`DRAIN_WORKERS`]: super::DRAIN_WORKERS
+    /// [`Db::claim_next_due_op`]: pdfs_core::db::Db::claim_next_due_op
+    pub(crate) fn run_pending_drain(&self, primary: bool) {
         loop {
+            // Between ops, never inside one: an op that has started is either
+            // retired or released, so stopping here cannot leave the queue with
+            // a row claimed by a worker that no longer exists (bugs.md B44).
+            if self.shutdown.is_stopping() {
+                debug!(primary, "drain worker stopping");
+                return;
+            }
             let now = now_millis();
-            // One row, chosen by the database. Reading the whole queue to pick
+            // One row, chosen and *claimed* by the database. Reading the whole
-            // one op made a long queue quadratic to drain, and held the shared
+            // queue to pick one op made a long queue quadratic to drain, and
-            // connection — and so every FUSE metadata call — for the duration.
+            // held the shared connection — and so every FUSE metadata call —
-            let due = self.db.next_due_op(now).unwrap_or_default();
+            // for the duration.
-
+            let due = match self.db.claim_next_due_op(now) {
-            let Some(op) = due.filter(|_| self.online.load(Ordering::Relaxed)) else {
+                Ok(due) => due,
-                self.recover_fsynced_writes();
+                Err(error) => {
-                // A debounced or backed-off op may be waiting: sleep only
+                    error!(%error, "claiming the next pending operation failed");
-                // until it becomes due rather than the full idle-poll.
+                    self.wait_for_drain_work();
-                self.wait_for_drain_work_or_due();
+                    continue;
-                continue;
+                }
+            };
+            let online = self.online.load(Ordering::Relaxed);
+            let op = match due {
+                Some(op) if online => op,
+                idle => {
+                    // Claimed but offline: hand it straight back, or it stays
+                    // invisible to every worker until this one happens to be
+                    // the next to notice the reconnect.
+                    if let Some(op) = idle {
+                        self.release_claim(&op);
+                    }
+                    if primary {
+                        // Nothing to upload is exactly when the connection is
+                        // free, so this is where the read path's buffered LRU
+                        // touches get written (`ContentCache::flush_touches`).
+                        // Cheap and a no-op when empty.
+                        self.cache.flush_touches();
+                        self.recover_fsynced_writes();
+                    }
+                    // A debounced or backed-off op may be waiting: sleep only
+                    // until it becomes due rather than the full idle-poll.
+                    self.wait_for_drain_work_or_due();
+                    continue;
+                }
             };
             let outcome = run_authorized_drain(
                 &op,
-                |uid| self.require_uid_writable(uid),
+                |uid| self.uid_write_authority(uid),
                 || self.drain_op(&op),
             );
             if matches!(outcome, Ok(DrainDisposition::AccessDeferred)) {
-                let next_attempt_at = now_millis() + DRAIN_ACCESS_RECHECK.as_millis() as i64;
+                self.defer_for_access(&op, AccessDeferral::NotWritable);
-                if let Err(error) = self.db.defer_op_without_attempt(op.id, next_attempt_at) {
-                    error!(
-                        uid = %op.uid,
-                        %error,
-                        "deferring access-blocked pending operation failed"
-                    );
-                    self.wait_for_drain_work();
-                } else {
-                    debug!(
-                        uid = %op.uid,
-                        next_attempt_at,
-                        "pending operation deferred until access is writable"
-                    );
-                }
                 continue;
             }
+            if let Ok(DrainDisposition::AuthorityUnknown(ref authority)) = outcome {
+                self.resolve_unknown_authority(&op, authority);
+                continue;
+            }
+            // The access check let this attempt through, so any earlier run of
+            // deferrals is over and must not be counted against the next one.
+            if matches!(outcome, Ok(DrainDisposition::Applied))
+                && let Err(error) = self.db.clear_op_access_deferral(op.id)
+            {
+                debug!(uid = %op.uid, %error, "clearing an access-deferral window failed");
+            }
             if let Err(e) = outcome {
                 let attempts = op.attempts + 1;
                 let err_str = e.to_string();
@@ -183,9 +343,234 @@ impl Core {
                     now_millis() + backoff.as_millis() as i64,
                 ) {
                     error!(uid = %op.uid, error = %e, "recording a drain failure failed");
+                    self.release_claim(&op);
                     self.wait_for_drain_work();
+                    continue;
                 }
             }
+            // Unconditionally, on every path: a handler that retired its own row
+            // leaves nothing to release, and one that returned without retiring
+            // must not leave the row claimed by a worker that has moved on.
+            self.release_claim(&op);
+        }
+    }
+
+    /// Put an op the access check refused back on the clock, and decide whether
+    /// its refusal is still news.
+    ///
+    /// Inside [`DRAIN_ACCESS_DEFER_LIMIT`] a deferral is what it always was: no
+    /// attempt consumed, no error recorded, retried in five seconds. Past it the
+    /// deferral is reported through [`Db::record_op_failure`] like any other
+    /// stuck op, which is what puts it in `attempts`, in `last_error`, and — at
+    /// [`FAILING_ATTEMPTS`] — in the `failing_ops` count and error text that
+    /// `pdfs status` and the GUI show. The row and its staged blob stay exactly
+    /// where they are either way; this changes only whether the user can see
+    /// them.
+    ///
+    /// [`Db::record_op_failure`]: pdfs_core::db::Db::record_op_failure
+    /// [`FAILING_ATTEMPTS`]: pdfs_core::db::FAILING_ATTEMPTS
+    fn defer_for_access(&self, op: &PendingOp, reason: AccessDeferral) {
+        let now = now_millis();
+        let next_attempt_at = now + DRAIN_ACCESS_RECHECK.as_millis() as i64;
+        let since = match self.db.defer_op_for_access(op.id, now, next_attempt_at) {
+            Ok(since) => since,
+            Err(error) => {
+                error!(
+                    uid = %op.uid,
+                    %error,
+                    "deferring access-blocked pending operation failed"
+                );
+                self.release_claim(op);
+                self.wait_for_drain_work();
+                return;
+            }
+        };
+        let blocked = Duration::from_millis(now.saturating_sub(since).max(0) as u64);
+        if since == now {
+            // The first deferral of a run, at `warn!`: a write the mount accepted
+            // is not going anywhere for now, and that is worth a line even when
+            // the next recheck clears it.
+            warn!(
+                uid = %op.uid,
+                kind = %op.kind,
+                reason = reason.log_reason(),
+                "pending operation deferred"
+            );
+        }
+        if blocked >= DRAIN_ACCESS_DEFER_LIMIT {
+            let attempts = op.attempts + 1;
+            let backoff = DRAIN_BACKOFF_MIN
+                .saturating_mul(1u32 << attempts.min(6))
+                .min(DRAIN_BACKOFF_MAX);
+            let error = format!(
+                "{} for {}s. The staged bytes are kept.",
+                reason.failure_reason(),
+                blocked.as_secs()
+            );
+            warn!(uid = %op.uid, attempts, blocked_secs = blocked.as_secs(),
+                  "pending operation has been access-blocked past the limit; reporting it");
+            if let Err(error) =
+                self.db
+                    .record_op_failure(op.id, &error, now_millis() + backoff.as_millis() as i64)
+            {
+                error!(uid = %op.uid, %error, "recording an access-deferral failure failed");
+            }
+        } else {
+            debug!(
+                uid = %op.uid,
+                next_attempt_at,
+                blocked_secs = blocked.as_secs(),
+                reason = reason.log_reason(),
+                "pending operation deferred until access is writable"
+            );
+        }
+        self.release_claim(op);
+    }
+
+    /// Answer an authority the local tree has no row for by asking the remote,
+    /// rather than deferring on a permission question nobody asked (B83).
+    ///
+    /// Three outcomes, and the point of the whole exercise is that they are
+    /// three:
+    ///
+    /// * the node is still there — the tree simply lost it (a pruned subtree, a
+    ///   mount whose registration went away). Re-intern it and the next pass has
+    ///   a real access answer to work with.
+    /// * the node is gone remotely. That is a permanent, *known* condition, so
+    ///   it is recorded as a failure immediately instead of waiting out
+    ///   [`DRAIN_ACCESS_DEFER_LIMIT`] to say so. The row and its staged blob are
+    ///   kept, as on every other failure path — the bytes are still the user's,
+    ///   and `pdfs recover` is how they get them back.
+    /// * we could not ask. Ordinary deferral; the network is the network.
+    fn resolve_unknown_authority(&self, op: &PendingOp, authority: &NodeUid) {
+        match self.fetch_node_remote(authority) {
+            Ok(Some(node)) => {
+                if let Err(error) = self.db.upsert_node(&node) {
+                    error!(uid = %op.uid, %authority, %error,
+                           "re-interning a queued operation's missing authority failed");
+                } else {
+                    info!(uid = %op.uid, %authority,
+                          "re-interned an authority missing from the local tree; retrying");
+                }
+                // Deferred, not applied: the re-read has to go through the same
+                // access check as everything else, on the next pass. The window
+                // keeps running, so a refetch that never actually helps still
+                // gets reported instead of looping in silence.
+                self.defer_for_access(op, AccessDeferral::AuthorityRefetched);
+            }
+            Ok(None) => {
+                let attempts = op.attempts + 1;
+                let backoff = DRAIN_BACKOFF_MIN
+                    .saturating_mul(1u32 << attempts.min(6))
+                    .min(DRAIN_BACKOFF_MAX);
+                let error = format!(
+                    "{authority} no longer exists remotely, so this operation has nothing to \
+                     apply to. The staged bytes are kept."
+                );
+                warn!(uid = %op.uid, %authority, attempts,
+                      "a queued operation's authority is gone remotely; reporting it");
+                if let Err(error) = self.db.record_op_failure(
+                    op.id,
+                    &error,
+                    now_millis() + backoff.as_millis() as i64,
+                ) {
+                    error!(uid = %op.uid, %error, "recording a missing-authority failure failed");
+                }
+                self.release_claim(op);
+            }
+            Err(error) => {
+                debug!(uid = %op.uid, %authority, %error,
+                       "could not ask the remote about a missing authority");
+                self.defer_for_access(op, AccessDeferral::RemoteUnreachable);
+            }
+        }
+    }
+
+    /// Hand a claimed op back to the queue, logging rather than propagating —
+    /// there is no caller left to propagate to, and the drain must not stop.
+    fn release_claim(&self, op: &PendingOp) {
+        if let Err(error) = self.db.release_op_claim(op.id) {
+            error!(uid = %op.uid, %error, "releasing a drain claim failed");
+        }
+    }
+
+    /// How long a freshly queued revision of `uid` should wait before a worker
+    /// may pick it up.
+    ///
+    /// [`DRAIN_REVISION_DEBOUNCE`] exists for a tool that preallocates a file
+    /// and then writes it, where two seconds is the right scale. It is the wrong
+    /// scale for a large file on a slow link: an editor saving a 200 MB project
+    /// every ten seconds queues a write, the drain starts sending it, the next
+    /// save supersedes it mid-flight, and the file never finishes uploading
+    /// while the user keeps working. Waiting roughly as long as the last upload
+    /// of *this* node took moves that supersede into the queue, where replacing
+    /// a row costs nothing.
+    ///
+    /// Never shorter than the fixed debounce and never longer than
+    /// [`DRAIN_REVISION_DEBOUNCE_MAX`]: a node whose upload is genuinely slow
+    /// still has to reach Drive, and a single pathological stall must not park
+    /// it.
+    ///
+    /// [`DRAIN_REVISION_DEBOUNCE`]: super::DRAIN_REVISION_DEBOUNCE
+    /// [`DRAIN_REVISION_DEBOUNCE_MAX`]: super::DRAIN_REVISION_DEBOUNCE_MAX
+    pub(crate) fn revision_debounce(&self, uid: &NodeUid) -> Duration {
+        let measured = self
+            .upload_times
+            .lock()
+            .get(&uid.to_string())
+            .map(|&(ms, _)| Duration::from_millis(ms));
+        adaptive_debounce(measured)
+    }
+
+    /// Remember how long an upload of `uid` took, for the next write's
+    /// debounce.
+    ///
+    /// Only a *completed* upload is a measurement. A cancelled or failed one
+    /// says how long it ran before it stopped, which is not how long the file
+    /// takes to send, and feeding that back would let one network fault widen
+    /// the debounce for good.
+    fn record_upload_time(&self, uid: &NodeUid, took: Duration) {
+        let mut times = self.upload_times.lock();
+        let now = now_millis();
+        if times.len() >= UPLOAD_TIME_MEMORY
+            && !times.contains_key(&uid.to_string())
+            && let Some(oldest) = times
+                .iter()
+                .min_by_key(|(_, (_, at))| *at)
+                .map(|(k, _)| k.clone())
+        {
+            times.remove(&oldest);
+        }
+        times.insert(uid.to_string(), (took.as_millis() as u64, now));
+    }
+
+    /// Register a cancellation flag for an upload of `uid` that is about to
+    /// start, returning a guard that deregisters it.
+    ///
+    /// Deregistration is by identity rather than by key: a supersede that
+    /// arrives just as this upload finishes may already have registered the
+    /// *next* upload's flag under the same uid, and removing that one would
+    /// leave the newer upload uncancellable.
+    fn begin_cancellable_upload(&self, uid: &NodeUid) -> UploadCancel {
+        let flag = Arc::new(AtomicBool::new(false));
+        self.upload_cancel.lock().insert(uid.clone(), flag.clone());
+        UploadCancel {
+            registry: self.upload_cancel.clone(),
+            uid: uid.clone(),
+            flag,
+        }
+    }
+
+    /// Tell an upload of `uid` that is on the wire to stop, if there is one.
+    ///
+    /// Called when a newer revision of the file is queued. The upload does not
+    /// stop instantly — it stops when the SDK next asks its reader for bytes,
+    /// which for a 4 MiB block is soon enough to matter and late enough to be
+    /// safe: the staged blob it is reading stays open until it lets go.
+    pub(crate) fn cancel_upload(&self, uid: &NodeUid) {
+        if let Some(flag) = self.upload_cancel.lock().get(uid) {
+            flag.store(true, Ordering::Relaxed);
+            debug!(%uid, "cancelling a superseded upload");
         }
     }
 
@@ -340,6 +725,7 @@ impl Core {
         match self
             .rt
             .block_on(self.client.trash_nodes(std::slice::from_ref(&uid)))
+            .and_then(batch::into_unit)
         {
             Ok(()) => {}
             Err(e) if is_gone(&e) => {
@@ -349,6 +735,9 @@ impl Core {
         }
         self.db.complete_trash_op(op.id, &uid)?;
         self.own_sealed_revs.lock().remove(&uid);
+        if let Err(e) = self.db.clear_own_sealed_rev(&uid.to_string()) {
+            debug!(%uid, error = %e, "clearing the sealed-revision record failed");
+        }
         self.invalidate_trash();
         self.log_activity(ActivityKind::Trash, &name, "trashed", true);
         info!(%uid, name, "pending trash landed");
@@ -623,7 +1012,16 @@ impl Core {
         // instead of forking — so the finished bytes win the name rather than
         // being exiled to a `(sync-conflict)` copy.
         let remote_rev = node_revision_id(&node);
-        let own_rev = self.own_sealed_revs.lock().get(uid).cloned();
+        // In memory first, then the table it is written through to: the map is
+        // this process's cache of it, and after a restart only the table has
+        // the answer (which is the whole reason it is persisted).
+        let own_rev = match self.own_sealed_revs.lock().get(uid).cloned() {
+            Some(rev) => Some(rev),
+            None => self
+                .db
+                .own_sealed_rev(&uid.to_string(), now_millis())
+                .unwrap_or_default(),
+        };
         if is_own_self_supersede(meta.complete, remote_rev.as_deref(), own_rev.as_deref()) {
             debug!(%uid, ?remote_rev,
                    "queued write chains onto our own sealed revision; not a conflict");
@@ -707,8 +1105,9 @@ impl Core {
         self.db.delete_op(op.id)?;
         // Dropping the pending entry hands the node back to the remote's truth:
         // reads stop coming from the staged blob, and the event sync stops
-        // skipping it as "ahead of the server" (offline.md Phase 3a).
+        // skipping it as "ahead of the server" (offline.md Phase 3a). Only if it
-        self.pending.lock().remove(uid);
+        // is still *this* write's entry — see [`Core::release_pending`].
+        self.release_pending(uid, blob);
         self.cache.discard_staged(blob);
         self.cache.evict(uid);
         self.evict_reader(uid);
@@ -746,7 +1145,7 @@ impl Core {
         error!(%uid, name, reason, staged = %blob.display(),
                "cannot place a conflicted write; bytes kept in staging");
         self.db.delete_op(op.id)?;
-        self.pending.lock().remove(uid);
+        self.release_pending(uid, blob);
         self.cache.evict(uid);
         self.evict_reader(uid);
         self.log_activity(
@@ -758,6 +1157,24 @@ impl Core {
         Ok(())
     }
 
+    /// Drop `uid`'s pending entry, but only while it still names `blob`.
+    ///
+    /// A supersede can replace the entry while the op that owned it is in
+    /// flight, so an unconditional `remove` retires a *newer* write's staged
+    /// blob: reads fall back to a stale remote, the next `remote_baseline` forks
+    /// a spurious `(sync-conflict)` copy of bytes that were never in conflict,
+    /// and the incomplete-write interlock — which keys off the pending entry —
+    /// is disarmed, letting a gap-fill read from a revision that no longer
+    /// describes the file.
+    pub(crate) fn release_pending(&self, uid: &NodeUid, blob: &Path) {
+        let mut pending = self.pending.lock();
+        if let Some(current) = pending.get(uid)
+            && current.path == blob
+        {
+            pending.remove(uid);
+        }
+    }
+
     /// Whether a folder a queued op targets has stopped being a place a node can
     /// go. A failure to ask is not an answer: only a definite "trashed" or "not
     /// there" counts, so a network fault leaves the op to retry normally.
@@ -824,7 +1241,7 @@ impl Core {
     /// root yet, which is not where the drain runs; the drain must not panic
     /// over it regardless, since that would stop the queue for good.
     pub(crate) fn root_uid(&self) -> Option<NodeUid> {
-        let st = self.state.lock();
+        let st = self.state();
         st.entries.get(&ROOT_INO).map(|e| e.uid.clone())
     }
 
@@ -870,28 +1287,43 @@ impl Core {
         let guard =
             self.transfers
                 .begin(&name, meta.uid.clone(), TransferDirection::Upload, meta.len);
-        let reader = CountingReader::new(File::open(&blob)?, &guard);
+        // Registered before the first byte moves, so a write that lands while
-        self.rt.block_on(self.client.upload_new_revision_from(
+        // this is on the wire can stop it rather than paying for a revision the
+        // op it queued will immediately replace.
+        let cancel = self.begin_cancellable_upload(&uid);
+        let reader = CountingReader::new(File::open(&blob)?, &guard).with_cancel(cancel.flag());
+        let started = Instant::now();
+        let sent = self.rt.block_on(self.client.upload_new_revision_from(
             &uid,
             reader,
             meta.len as i64,
             Vec::new(),
             None,
-        ))?;
+        ));
+        let took = started.elapsed();
+        if let Err(e) = sent {
+            if cancel.cancelled() {
+                // Not a failure, and not this op's row to retire: the write that
+                // cancelled us deleted it and took ownership of the staged blob
+                // when it superseded this revision. Leaving the blob alone here
+                // is the whole point — it is either already unlinked or it
+                // belongs to the newer op.
+                info!(%uid, "upload abandoned; a newer write superseded it");
+                return Ok(());
+            }
+            return Err(e.into());
+        }
+        drop(cancel);
         drop(guard);
+        // Only a completed upload times how long this file takes to send, which
+        // is what the next write's debounce is scaled from.
+        self.record_upload_time(&uid, took);
 
         // Retire the op before dropping the blob: a crash between the two leaves
         // an orphaned file (harmless), whereas the reverse would leave a queued
         // op pointing at nothing.
         self.db.delete_op(op.id)?;
-        {
+        self.release_pending(&uid, &blob);
-            let mut p = self.pending.lock();
-            if let Some(op_in_mem) = p.get(&uid)
-                && op_in_mem.path == blob
-            {
-                p.remove(&uid);
-            }
-        }
 
         // The staged blob now matches the sealed revision, so a pinned file keeps
         // it as its cached content rather than re-downloading what we just sent.
@@ -967,7 +1399,16 @@ impl Core {
             // change and does not fork (B70 layer B; consulted in
             // `revision_conflict`).
             if let Some(rev) = sealed_rev.clone() {
-                self.own_sealed_revs.lock().insert(uid.clone(), rev);
+                self.own_sealed_revs.lock().insert(uid.clone(), rev.clone());
+                // Write through: losing this at shutdown reopened the fork
+                // window B70 layer B closed, for the first drain after a
+                // restart.
+                if let Err(e) = self
+                    .db
+                    .set_own_sealed_rev(&uid.to_string(), &rev, now_millis())
+                {
+                    warn!(%uid, error = %e, "persisting our sealed revision failed");
+                }
             }
             self.for_each_state(|st| {
                 for aw in st.active_writes.values_mut() {
@@ -1188,12 +1629,10 @@ mod tests {
         let applied = Cell::new(false);
         let disposition = run_authorized_drain(
             &op,
-            |uid| {
+            |uid| match db.effective_node_access(uid).unwrap() {
-                db.effective_node_access(uid)
+                Some(access) if access.writable() => WriteAuthority::Writable,
-                    .unwrap()
+                Some(_) => WriteAuthority::Denied,
-                    .filter(|access| access.writable())
+                None => WriteAuthority::Unknown,
-                    .map(|_| ())
-                    .ok_or(fuser::Errno::EACCES)
             },
             || {
                 applied.set(true);
@@ -1233,7 +1672,7 @@ mod tests {
 
         let disposition = run_authorized_drain(
             &op,
-            |_| Err(fuser::Errno::EACCES),
+            |_| WriteAuthority::Denied,
             || {
                 applied.set(true);
                 Ok(())
@@ -1254,13 +1693,157 @@ mod tests {
         let _ = std::fs::remove_dir_all(dir);
     }
 
+    /// A deferral that never clears has to stop being silent. Found in the field
+    /// as revision ops whose node had left the local tree: `require_uid_access`
+    /// reads an unknown node as `EACCES`, so they were re-deferred every five
+    /// seconds for thirty days with `attempts` at zero, `last_error` null and
+    /// `failing_ops` at zero — 18 GiB of accepted writes that `pdfs status`
+    /// reported as ordinary queued uploads.
+    #[test]
+    fn an_access_deferral_that_outlives_the_limit_is_reported_as_failing() {
+        use std::sync::atomic::{AtomicU64, Ordering};
+
+        static N: AtomicU64 = AtomicU64::new(0);
+        let dir = std::env::temp_dir().join(format!(
+            "pdfs-drain-defer-limit-{}-{}",
+            std::process::id(),
+            N.fetch_add(1, Ordering::Relaxed)
+        ));
+        std::fs::create_dir_all(&dir).unwrap();
+        let db = Db::open(&dir.join("cache.db")).unwrap();
+        db.enqueue_op(&pending(OP_REVISION)).unwrap();
+        let op = db.pending_ops().unwrap().remove(0);
+
+        // Two deferrals a recheck apart: the window opens on the first and the
+        // second is measured against it, not against itself.
+        let now = 1_000_000i64;
+        let since = db.defer_op_for_access(op.id, now, now + 5_000).unwrap();
+        assert_eq!(since, now, "the first deferral opens the window");
+        let later = now + DRAIN_ACCESS_RECHECK.as_millis() as i64;
+        assert_eq!(
+            db.defer_op_for_access(op.id, later, later + 5_000).unwrap(),
+            now,
+            "a later deferral keeps the original stamp"
+        );
+        let queued = db.pending_ops().unwrap();
+        assert_eq!(queued[0].attempts, 0, "deferrals consume no attempt");
+        assert!(queued[0].last_error.is_none());
+
+        // Past the limit the same deferral is reported like any other stuck op.
+        let past = now + DRAIN_ACCESS_DEFER_LIMIT.as_millis() as i64;
+        assert_eq!(
+            db.defer_op_for_access(op.id, past, past + 5_000).unwrap(),
+            now
+        );
+        db.record_op_failure(op.id, "not writable locally", past + 10_000)
+            .unwrap();
+        let failed = db.pending_ops().unwrap();
+        assert_eq!(failed.len(), 1, "the row and its staged bytes stay queued");
+        assert_eq!(failed[0].attempts, 1);
+        assert_eq!(
+            failed[0].last_error.as_deref(),
+            Some("not writable locally")
+        );
+
+        // Reporting closes the window, so the next deferral starts a fresh one
+        // rather than escalating on every recheck from here on.
+        let after = past + 20_000;
+        assert_eq!(
+            db.defer_op_for_access(op.id, after, after + 5_000).unwrap(),
+            after,
+            "recording the failure re-armed the window"
+        );
+        drop(db);
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    /// An op that gets through the access check is no longer blocked, so a
+    /// deferral after it must not inherit the earlier run's age and escalate
+    /// immediately.
+    #[test]
+    fn clearing_the_window_makes_the_next_deferral_a_fresh_run() {
+        use std::sync::atomic::{AtomicU64, Ordering};
+
+        static N: AtomicU64 = AtomicU64::new(0);
+        let dir = std::env::temp_dir().join(format!(
+            "pdfs-drain-defer-clear-{}-{}",
+            std::process::id(),
+            N.fetch_add(1, Ordering::Relaxed)
+        ));
+        std::fs::create_dir_all(&dir).unwrap();
+        let db = Db::open(&dir.join("cache.db")).unwrap();
+        db.enqueue_op(&pending(OP_REVISION)).unwrap();
+        let op = db.pending_ops().unwrap().remove(0);
+
+        let now = 2_000_000i64;
+        assert_eq!(
+            db.defer_op_for_access(op.id, now, now + 5_000).unwrap(),
+            now
+        );
+        db.clear_op_access_deferral(op.id).unwrap();
+        let later = now + DRAIN_ACCESS_DEFER_LIMIT.as_millis() as i64;
+        assert_eq!(
+            db.defer_op_for_access(op.id, later, later + 5_000).unwrap(),
+            later,
+            "the window reopens at the new deferral, not the old one"
+        );
+        drop(db);
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn an_authority_the_tree_does_not_have_is_reported_as_unknown_not_deferred() {
+        // The B83 distinction, at the point it is made: a uid with no row must
+        // not come back as `AccessDeferred`, because deferring waits on a
+        // permission change that nothing is going to make. The caller answers
+        // an `AuthorityUnknown` by asking the remote instead.
+        let op = pending(OP_REVISION);
+        let applied = Cell::new(false);
+        let disposition = run_authorized_drain(
+            &op,
+            |_| WriteAuthority::Unknown,
+            || {
+                applied.set(true);
+                Ok(())
+            },
+        )
+        .unwrap();
+        assert_eq!(
+            disposition,
+            DrainDisposition::AuthorityUnknown(parse_node_uid(&op.uid).unwrap())
+        );
+        assert!(!applied.get(), "an unresolved authority never applies");
+    }
+
+    #[test]
+    fn a_missing_parent_authority_names_the_parent_not_the_node() {
+        // A create's authority is its parent, so that is the uid the remote has
+        // to be asked about — reporting the node instead would refetch the
+        // thing that does not exist yet.
+        let mut op = pending(OP_CREATE);
+        let parent = folder_node("vanished-parent", None);
+        op.parent_uid = Some(parent.uid.to_string());
+        let disposition =
+            run_authorized_drain(&op, |_| WriteAuthority::Unknown, || Ok(())).unwrap();
+        assert_eq!(
+            disposition,
+            DrainDisposition::AuthorityUnknown(parent.uid.clone())
+        );
+    }
+
     #[test]
     fn owner_and_editor_drain_authorities_apply_normally() {
         for access in [Access::Owner, Access::Editor] {
             let applied = Cell::new(false);
             let disposition = run_authorized_drain(
                 &pending(OP_REVISION),
-                |_| access.writable().then_some(()).ok_or(fuser::Errno::EACCES),
+                |_| {
+                    if access.writable() {
+                        WriteAuthority::Writable
+                    } else {
+                        WriteAuthority::Denied
+                    }
+                },
                 || {
                     applied.set(true);
                     Ok(())
@@ -1374,3 +1957,42 @@ mod tests {
         assert!(!is_own_self_supersede(true, None, None));
     }
 }
+
+#[cfg(test)]
+mod debounce_tests {
+    use super::*;
+
+    #[test]
+    fn a_node_never_uploaded_keeps_the_fixed_grace_period() {
+        assert_eq!(adaptive_debounce(None), DRAIN_REVISION_DEBOUNCE);
+    }
+
+    #[test]
+    fn a_fast_upload_does_not_shorten_the_grace_period() {
+        // The 2 seconds are not about upload time at all — they are the window
+        // in which a preallocate-then-write tool supersedes its own first
+        // close. A file that sends in 50 ms must still get them.
+        assert_eq!(
+            adaptive_debounce(Some(Duration::from_millis(50))),
+            DRAIN_REVISION_DEBOUNCE
+        );
+    }
+
+    #[test]
+    fn a_slow_upload_widens_the_grace_period_to_match() {
+        // The case the fixed debounce got wrong: saves arriving faster than the
+        // upload completes, each superseding one already on the wire.
+        assert_eq!(
+            adaptive_debounce(Some(Duration::from_secs(25))),
+            Duration::from_secs(25)
+        );
+    }
+
+    #[test]
+    fn a_pathological_upload_cannot_park_a_node() {
+        assert_eq!(
+            adaptive_debounce(Some(Duration::from_secs(6000))),
+            DRAIN_REVISION_DEBOUNCE_MAX
+        );
+    }
+}

crates/pdfs-fuse/src/mount.rs

@@ -255,6 +255,14 @@ pub(super) fn spawn_session(
     root: Node,
 ) -> std::io::Result<BackgroundSession> {
     let mut config = Config::default();
+    // `n_threads` stays at fuser's default of 1 (with `clone_fd` off) on
+    // purpose, for now. A concurrent dispatch loop is worth having, but
+    // `release` currently relies on being serialised against the `open`+`read`
+    // an application issues right after `close(2)` — see the comment on
+    // `Filesystem::release`. Raising it before that ordering is made explicit
+    // (a per-node staging-in-flight barrier) reintroduces the acceptance
+    // suite's "concurrent file 1 mismatch". Kernel-side caps that do *not*
+    // depend on that ordering are negotiated in `ProtonFs::init`.
     config.mount_options = vec![
         MountOption::FSName("protondrive".to_string()),
         MountOption::Subtype("protondrive".to_string()),
@@ -349,23 +357,17 @@ pub fn mount(
     let core = Core {
         client: client.clone(),
         rt: rt.clone(),
+        maintenance: Arc::new(Mutex::new(Default::default())),
         primary_root_uid: root.uid.clone(),
         primary: true,
-        state: Arc::new(Mutex::new(State {
+        state: Arc::new(Mutex::new(State::new(db.clone(), share_access, 2))),
-            entries: HashMap::new(),
-            by_uid: HashMap::new(),
-            children: HashMap::new(),
-            next_ino: 2,
-            active_writes: HashMap::new(),
-            handles: HashMap::new(),
-            next_fh: 1,
-            access_changes: HashSet::new(),
-            share_access,
-            db: db.clone(),
-        })),
         cache: Arc::new(cache),
         readers: Arc::new(Mutex::new(HashMap::new())),
-        stream_ring: Arc::new(Mutex::new(StreamRing::default())),
+        block_ring: Arc::new(Mutex::new(BlockRing::default())),
+        block_flight: Arc::new(BlockFlight::default()),
+        content_repairs: Arc::new(tokio::sync::Mutex::new(HashMap::new())),
+        prefetch: Arc::new(Prefetch::default()),
+        prefetch_budget: Arc::new(tokio::sync::Semaphore::new(PREFETCH_BUDGET)),
         workers: Arc::new(Workers::new(FUSE_WORKERS)?),
         db,
         shared_publication: Arc::new(Mutex::new(())),
@@ -375,6 +377,9 @@ pub fn mount(
         pending: Arc::new(Mutex::new(HashMap::new())),
         hidden: Arc::new(Mutex::new(HashSet::new())),
         drain_wake: Arc::new((Mutex::new(false), Condvar::new())),
+        shutdown: Arc::new(crate::shutdown::Shutdown::default()),
+        upload_times: Arc::new(Mutex::new(HashMap::new())),
+        upload_cancel: Arc::new(Mutex::new(HashMap::new())),
         timeline_refreshing: Arc::new(AtomicBool::new(false)),
         albums_refreshing: Arc::new(AtomicBool::new(false)),
         trash_refreshing: Arc::new(AtomicBool::new(false)),
@@ -385,7 +390,9 @@ pub fn mount(
         self_changes: Arc::new(Mutex::new(HashMap::new())),
         thumb_gen: Arc::new(Mutex::new(HashSet::new())),
         no_thumbnail: Arc::new(Mutex::new(HashMap::new())),
+        quota: Arc::new(Mutex::new(None)),
         size_upgrades: Arc::new(Mutex::new(HashMap::new())),
+        size_waiters: Arc::new(Default::default()),
         notifier: Arc::new(OnceLock::new()),
         session_live: Arc::new(AtomicBool::new(false)),
         transfers: TransferRegistry::new(),
@@ -407,16 +414,32 @@ pub fn mount(
     // aside at open. After `hydrate_pending`, so a recovered partial write can
     // see an already-queued write to the same node.
     core.recover_fsynced_writes();
-    {
+    // And finally the staged blobs neither of those accounts for: bytes a
+    // failed release left behind with nothing pointing at them.
+    core.reconcile_staging();
+    // Several drain workers over one queue. One thread meant a single large
+    // upload held every queued rename, trash and small write behind it for as
+    // long as it ran; the claim column (`Db::claim_next_due_op`) keeps the
+    // workers off each other's nodes, which is the only ordering the queue
+    // actually needs. Worker 0 additionally runs the queue's idle chores.
+    //
+    // Every long-lived thread started from here on is kept in `workers` and
+    // joined at the end of this function. Leaving them running turned an
+    // in-process remount into a second generation of drain workers, sync engines
+    // and sweeps all operating on a mount that no longer exists (bugs.md B44).
+    let mut workers: Vec<std::thread::JoinHandle<()>> = Vec::new();
+    for worker in 0..DRAIN_WORKERS {
         let core = core.clone();
-        std::thread::Builder::new()
+        workers.push(
-            .name("pdfs-drain".into())
+            std::thread::Builder::new()
-            .spawn(move || core.run_pending_drain())?;
+                .name(format!("pdfs-drain-{worker}"))
+                .spawn(move || core.run_pending_drain(worker == 0))?,
+        );
     }
 
     // Start the folder-sync engine. It watches every mirror folder, polls the
     // remotes, and reconciles on its own thread — never in front of a FUSE call.
-    sync::spawn(core.clone(), sync_rx);
+    workers.extend(sync::spawn(core.clone(), sync_rx));
 
     // Reconcile leftover `(sync-conflict …)` copies: drop the ones that turned
     // out identical to the live file, surface the ones that genuinely diverge.
@@ -428,18 +451,22 @@ pub fn mount(
     } else {
         info!(mode = ?sweep_mode, "conflict sweep enabled");
         let core = core.clone();
-        std::thread::Builder::new()
+        workers.push(
-            .name("pdfs-conflict-sweep".into())
+            std::thread::Builder::new()
-            .spawn(move || core.run_conflict_sweep_loop())?;
+                .name("pdfs-conflict-sweep".into())
+                .spawn(move || core.run_conflict_sweep_loop())?,
+        );
     }
 
     // Mounted from the cache: watch for the network coming back so the mount can
     // stop being read-only-ish without the user restarting the daemon.
     if !online {
         let core = core.clone();
-        std::thread::Builder::new()
+        workers.push(
-            .name("pdfs-online-probe".into())
+            std::thread::Builder::new()
-            .spawn(move || core.run_online_probe())?;
+                .name("pdfs-online-probe".into())
+                .spawn(move || core.run_online_probe())?,
+        );
     }
 
     // Keep the launcher prompt's "This computer" index fresh. Its own thread:
@@ -449,9 +476,12 @@ pub fn mount(
         let indexing = core.indexing.clone();
         let transfers = core.transfers.clone();
         let mountpoint = mountpoint.to_path_buf();
-        std::thread::Builder::new()
+        let shutdown = core.shutdown.clone();
-            .name("pdfs-localindex".into())
+        workers.push(
-            .spawn(move || run_local_index(db, indexing, transfers, mountpoint))?;
+            std::thread::Builder::new()
+                .name("pdfs-localindex".into())
+                .spawn(move || run_local_index(db, indexing, transfers, mountpoint, shutdown))?,
+        );
     }
 
     // Bind the control socket before the FUSE session takes over the thread. A
@@ -488,23 +518,29 @@ pub fn mount(
         let control_core = core.clone();
         let username = username.clone();
         let mountpoint = mountpoint.to_path_buf();
-        if let Err(error) = std::thread::Builder::new()
+        match std::thread::Builder::new()
             .name("pdfs-control".into())
             .spawn(move || run_control_socket(control_core, username, mountpoint, listener))
         {
-            let secondaries = core.mounts.lock().close_and_drain();
+            Ok(handle) => workers.push(handle),
-            for (id, mount) in secondaries {
+            Err(error) => {
-                if let Err(unmount_error) = mount.teardown() {
+                // A failure here abandons the mount, so the background threads
-                    warn!(id, error = %unmount_error, "secondary teardown after control startup failure failed");
+                // started above have to be told to stop with it.
+                stop_workers(&core, control_socket, workers);
+                let secondaries = core.mounts.lock().close_and_drain();
+                for (id, mount) in secondaries {
+                    if let Err(unmount_error) = mount.teardown() {
+                        warn!(id, error = %unmount_error, "secondary teardown after control startup failure failed");
+                    }
                 }
+                if let Err(unmount_error) = teardown_session(&core.session_live, || {
+                    umount_session_unblocked(bg, main_conn)
+                }) {
+                    warn!(error = %unmount_error, "unmount after control startup failure failed");
+                }
+                let _ = std::fs::remove_file(control_socket);
+                return Err(error);
             }
-            if let Err(unmount_error) = teardown_session(&core.session_live, || {
-                umount_session_unblocked(bg, main_conn)
-            }) {
-                warn!(error = %unmount_error, "unmount after control startup failure failed");
-            }
-            let _ = std::fs::remove_file(control_socket);
-            return Err(error);
         }
     }
     // Re-establish on-demand mounts only after the primary session is live.
@@ -613,10 +649,43 @@ pub fn mount(
         }
     }
 
-    let _ = std::fs::remove_file(control_socket);
+    // Last, because the workers may legitimately be finishing an upload, and
+    // nothing they can still do is harmful once the mounts are down.
+    stop_workers(&core, control_socket, workers);
     Ok(outcome)
 }
 
+/// Signal every background loop, wake the ones that are blocked, and join them.
+///
+/// The mount used to return with its drain workers, sync engine, sweep, online
+/// probe, indexer and control listener all still running on `Core` clones. The
+/// process usually exited straight afterwards and hid it; an in-process remount
+/// did not, and started a second full set on top of the first (bugs.md B44).
+///
+/// Two of the waits need waking rather than merely flagging: the drain workers
+/// block on their own condvar (`wake_drain`), and the control listener blocks
+/// inside `accept`, which only returns when a connection arrives — so it gets
+/// one, from us, after the flag is already set. A join that takes a while is
+/// expected and correct: a worker part-way through an upload finishes it rather
+/// than abandoning the user's bytes mid-flight.
+fn stop_workers(core: &Core, control_socket: &Path, workers: Vec<std::thread::JoinHandle<()>>) {
+    core.shutdown.stop();
+    core.wake_drain();
+    let _ = core.sync_tx.send(sync::SyncMsg::Stop);
+    // Connect while the socket still exists — that is the whole point of the
+    // poke — then unlink it so nothing else can arrive behind us. The listener
+    // re-checks the flag after every accept, so even a connection that races the
+    // unlink cannot put it back to sleep.
+    let _ = std::os::unix::net::UnixStream::connect(control_socket);
+    let _ = std::fs::remove_file(control_socket);
+    for worker in workers {
+        if worker.join().is_err() {
+            warn!("a background worker panicked before shutdown");
+        }
+    }
+    debug!("background workers stopped");
+}
+
 #[cfg(test)]
 mod tests {
     use std::sync::atomic::{AtomicBool, Ordering};

crates/pdfs-fuse/src/photos.rs

@@ -14,7 +14,7 @@ use pdfs_core::{CoreError, CoreResult};
 use std::sync::atomic::Ordering;
 
 use proton_drive_rs::proton_sdk::ids::NodeUid;
-use proton_drive_rs::{NodeKind, ThumbnailType};
+use proton_drive_rs::{NodeKind, PhotoTag, PhotoTagsUpdate, ThumbnailType};
 use tracing::{info, warn};
 
 use super::{
@@ -97,6 +97,7 @@ impl Core {
         limit: usize,
         kind: Option<PhotoKind>,
         range: Option<(i64, i64)>,
+        favorites: bool,
     ) -> CoreResult<Option<Vec<PhotoItem>>> {
         let count = self.db.photos_count().map_err(CoreError::from)?;
         if count == 0 {
@@ -116,7 +117,7 @@ impl Core {
 
         let page = self
             .db
-            .photos_page(offset, limit, kind, range)
+            .photos_page(offset, limit, kind, range, favorites)
             .map_err(CoreError::from)?;
         Ok(Some(page.into_iter().map(|p| self.photo_item(p)).collect()))
     }
@@ -139,9 +140,42 @@ impl Core {
             ratio: photo.ratio,
             no_thumb: photo.thumb_state == db::THUMB_NONE,
             kind: photo.kind,
+            favorite: photo.favorite,
         }
     }
 
+    /// Add or remove Proton's `Favorite` tag on a photo, then record the change
+    /// locally so the gallery reflects it without waiting for a timeline refresh.
+    ///
+    /// The SDK reports one outcome per photo rather than failing the call, so the
+    /// single outcome is unwrapped back into this request's result.
+    pub(crate) fn set_photo_favorite(&self, uid: &NodeUid, favorite: bool) -> CoreResult<()> {
+        let photos = self.photos();
+        let update = PhotoTagsUpdate {
+            node_uid: uid.clone(),
+            tags_to_add: if favorite {
+                vec![PhotoTag::Favorite]
+            } else {
+                Vec::new()
+            },
+            tags_to_remove: if favorite {
+                Vec::new()
+            } else {
+                vec![PhotoTag::Favorite]
+            },
+        };
+        let outcomes = self
+            .rt
+            .block_on(photos.update_photos(std::slice::from_ref(&update)))
+            .map_err(|e| CoreError::from_api(&e, "update photo tags"))?;
+        pdfs_core::batch::into_unit(outcomes)
+            .map_err(|e| CoreError::from_api(&e, "update photo tags"))?;
+        self.db
+            .photos_set_favorite(&uid.to_string(), favorite)
+            .map_err(CoreError::from)?;
+        Ok(())
+    }
+
     /// Thumbnails for `uids`, served from the cache, fetched from the server for
     /// whatever is missing, and — for the photos the server has no thumbnail for
     /// at all — *generated locally* from the full file (see
@@ -381,7 +415,7 @@ impl Core {
         // learned before (or classifies from nothing, i.e. a still photo), so a
         // partial resolve never blanks the timeline.
         let uids: Vec<NodeUid> = items.iter().map(|it| it.uid.clone()).collect();
-        let mut meta: HashMap<String, (Option<String>, Option<String>)> = HashMap::new();
+        let mut meta: HashMap<String, (Option<String>, Option<String>, bool)> = HashMap::new();
         for chunk in uids.chunks(TIMELINE_ENRICH_CHUNK) {
             match photos.enumerate_nodes(chunk).await {
                 Ok(nodes) => {
@@ -390,19 +424,35 @@ impl Core {
                             NodeKind::File { media_type, .. } => Some(media_type.clone()),
                             NodeKind::Folder => None,
                         };
-                        meta.insert(node.uid.to_string(), (Some(node.name), media_type));
+                        // The favourite state is a tag on the photo node, so it
+                        // rides along with the metadata resolve rather than
+                        // costing a listing of its own.
+                        let favorite = node
+                            .photo
+                            .as_ref()
+                            .is_some_and(|p| p.tags.contains(&PhotoTag::Favorite));
+                        meta.insert(
+                            node.uid.to_string(),
+                            (Some(node.name), media_type, favorite),
+                        );
                     }
                 }
                 Err(e) => warn!(error = %e, "resolving photo metadata for a timeline chunk failed"),
             }
         }
 
-        let rows: Vec<(String, i64, Option<String>, Option<String>)> = items
+        let rows: Vec<db::TimelineRow> = items
             .iter()
             .map(|it| {
                 let key = it.uid.to_string();
-                let (name, media_type) = meta.get(&key).cloned().unwrap_or((None, None));
+                // An unresolved photo keeps whatever was learned before, for the
-                (key, it.capture_time, name, media_type)
+                // favourite flag as much as for the name and media type.
+                match meta.get(&key).cloned() {
+                    Some((name, media_type, favorite)) => {
+                        (key, it.capture_time, name, media_type, Some(favorite))
+                    }
+                    None => (key, it.capture_time, None, None, None),
+                }
             })
             .collect();
         self.db.photos_replace(&rows).map_err(CoreError::from)?;

crates/pdfs-fuse/src/profile.rs

@@ -149,10 +149,10 @@ impl Core {
             .pin_list()
             .map_err(|e| CoreError::internal(format!("db: {e:?}")))?
             .into_iter()
-            .map(|(uid, path, recursive)| ProfilePin {
+            .map(|row| ProfilePin {
-                uid,
+                uid: row.uid,
-                path,
+                path: row.path,
-                recursive,
+                recursive: row.recursive,
             })
             .collect();
         let cfg = pdfs_core::config::AppDirs::new()

crates/pdfs-fuse/src/reads.rs

@@ -10,18 +10,35 @@ use super::*;
 /// usual.
 pub(super) const STREAM_BYPASS_MIN: u64 = 256 * 1024 * 1024;
 
-/// How many bytes of streamed blocks the in-memory ring keeps. Bypassing the
+/// How many bytes of decrypted blocks the in-memory ring keeps.
-/// on-disk cache must not mean re-fetching: the kernel asks for a streamed file
+///
-/// in reads far smaller than [`BLOCK_SIZE`], so without a ring every 128 KiB the
+/// The kernel asks for a file in reads far smaller than [`BLOCK_SIZE`], so
-/// player consumes would download and decrypt a whole 4 MiB block again. Sized
+/// without a ring every 128 KiB it consumes costs a whole 4 MiB block again —
-/// for a handful of blocks per concurrently-streamed file.
+/// downloaded and decrypted for a streaming file, or re-read off disk and
-const STREAM_RING_BYTES: u64 = 128 * 1024 * 1024;
+/// re-allocated for a cached one (audit T3: 128 MiB of I/O to deliver 4 MiB).
+/// Sized for a handful of blocks per concurrently-read file. Bounded and only
+/// ever filled by active reads.
+const RING_BYTES: u64 = 128 * 1024 * 1024;
 
-/// Blocks fetched *past* the one a sequential streaming read needed, warmed into
+/// Deepest read-ahead window, in blocks, for a read that has proved sequential.
-/// the ring in the background so the player's next read is already in memory
+const PREFETCH_MAX: u64 = 8;
-/// instead of waiting a round-trip. Kept small so it cannot crowd out the
+
-/// in-flight block governor.
+/// Window a sequential read starts at, and returns to after a seek.
-const STREAM_READAHEAD: u64 = 4;
+const PREFETCH_MIN: u64 = 2;
+
+/// Largest file [`Core::repair_block`] will pull down whole to work around a
+/// revision whose block table understates it. Past this a single read would cost
+/// gigabytes of download, so the read fails instead and says to pin the file.
+pub(super) const REPAIR_MAX: u64 = 512 * 1024 * 1024;
+
+/// Blocks that may be prefetching at once, across every file. Prefetch takes a
+/// permit and gives up rather than queueing, so it can never sit in front of a
+/// demand read in the SDK's flat block semaphore.
+pub(super) const PREFETCH_BUDGET: usize = 8;
+
+/// Cap on tracked sequential streams. Only reads in progress matter, so the map
+/// is cleared wholesale rather than aged — losing the ramp costs one read.
+const MAX_PREFETCH_STREAMS: usize = 256;
 
 /// How many [`RevisionReader`]s stay open at once.
 ///
@@ -76,35 +93,39 @@ pub(super) struct PendingOpen {
 /// does; ids are never compared for order.
 static NEXT_OPEN_ID: AtomicU64 = AtomicU64::new(0);
 
-/// Drive client, a Tokio handle to bridge the synchronous FUSE/socket threads
+/// In-memory LRU of decrypted 4 MiB blocks, in front of both block paths: the
-/// to the async SDK, the inode bookkeeping, and the on-disk content cache.
+/// on-disk block cache, and the disk-bypassing stream of a large unpinned video
-///
+/// (see [`STREAM_BYPASS_MIN`], which stops one film evicting the whole disk
-/// Cheaply cloneable (every field is a handle/`Arc`), so the control-socket task
+/// LRU). Either way the point is the same — the kernel reads a block out in ~32
-/// gets its own copy while the FUSE session keeps another.
+/// pieces, and none of them should cost the block again.
-/// In-memory LRU of blocks belonging to a file streaming past the on-disk cache
-/// (see [`STREAM_BYPASS_MIN`]). Bypassing the disk stops one film evicting the
-/// block LRU; it must not also mean the same 4 MiB block is downloaded once per
-/// 128 KiB the player reads out of it.
 ///
 /// Validated by the same `(mtime, size)` pair the on-disk caches use: a node
 /// whose tag no longer matches has its blocks dropped rather than served, so a
 /// new revision can never be stitched together from the old one.
 #[derive(Default)]
-pub(super) struct StreamRing {
+pub(super) struct BlockRing {
     blocks: HashMap<(NodeUid, u64), Arc<Vec<u8>>>,
-    /// Keys oldest-first, for eviction.
+    /// Keys least-recently-used first, for eviction.
     order: VecDeque<(NodeUid, u64)>,
     /// Per-node validity tag, `(mtime, size)`.
     tags: HashMap<NodeUid, (i64, u64)>,
     bytes: u64,
 }
 
-impl StreamRing {
+impl BlockRing {
     fn get(&mut self, uid: &NodeUid, mtime: i64, size: u64, idx: u64) -> Option<Arc<Vec<u8>>> {
         if self.tags.get(uid) != Some(&(mtime, size)) {
             return None;
         }
-        self.blocks.get(&(uid.clone(), idx)).cloned()
+        let key = (uid.clone(), idx);
+        let hit = self.blocks.get(&key).cloned()?;
+        // Move to the young end: a block being read repeatedly (the whole reason
+        // this exists) must not age out under a sequential read passing through.
+        if let Some(at) = self.order.iter().position(|k| *k == key) {
+            self.order.remove(at);
+            self.order.push_back(key);
+        }
+        Some(hit)
     }
 
     fn insert(&mut self, uid: &NodeUid, mtime: i64, size: u64, idx: u64, bytes: Arc<Vec<u8>>) {
@@ -121,13 +142,18 @@ impl StreamRing {
         self.bytes += bytes.len() as u64;
         self.blocks.insert(key.clone(), bytes);
         self.order.push_back(key);
-        while self.bytes > STREAM_RING_BYTES {
+        while self.bytes > RING_BYTES {
             let Some(victim) = self.order.pop_front() else {
                 break;
             };
             if let Some(dropped) = self.blocks.remove(&victim) {
                 self.bytes -= dropped.len() as u64;
             }
+            // A node whose last block just aged out keeps no tag: otherwise the
+            // tag map is the one thing here that grows with every file ever read.
+            if !self.blocks.keys().any(|(u, _)| *u == victim.0) {
+                self.tags.remove(&victim.0);
+            }
         }
     }
 
@@ -147,6 +173,87 @@ impl StreamRing {
     }
 }
 
+/// The result of fetching one block, shared between everyone who wanted it.
+type BlockResult = Result<Arc<Vec<u8>>, Errno>;
+
+/// Identifies a block *of a revision*: node, validity tag, index.
+type BlockKey = (NodeUid, i64, u64, u64);
+
+/// A claim on a block key: who owns the fetch, and where its result is published.
+type Claim = (u64, tokio::sync::watch::Receiver<Option<BlockResult>>);
+
+/// Block fetches in flight, so a block is downloaded and decrypted once however
+/// many readers want it at that moment (audit T1).
+///
+/// With `FUSE_ASYNC_READ` the demand read and the kernel's read-ahead land in
+/// the same 4 MiB block for 31 of every 32 reads, and read-ahead of our own
+/// (see [`Core::prefetch`]) aims at blocks a demand read may be about to ask
+/// for. Without this each of them pays the full round-trip and decrypt and all
+/// but one result is discarded — roughly double the bandwidth and CPU in steady
+/// state. Same shape as [`ReaderSlot::Pending`] one level up.
+#[derive(Default)]
+pub(super) struct BlockFlight {
+    inflight: Mutex<HashMap<BlockKey, Claim>>,
+}
+
+/// Distinguishes attempts at the same key, so a leader only retires its own.
+static NEXT_FLIGHT_ID: AtomicU64 = AtomicU64::new(0);
+
+/// The leader's claim on a key. Retires it on drop — including when the task is
+/// cancelled mid-fetch, which is what keeps a dropped `JoinSet` from leaving a
+/// key nobody will ever publish.
+struct Flight {
+    flight: Arc<BlockFlight>,
+    key: BlockKey,
+    id: u64,
+}
+
+impl Drop for Flight {
+    fn drop(&mut self) {
+        let mut inflight = self.flight.inflight.lock();
+        if inflight
+            .get(&self.key)
+            .is_some_and(|(id, _)| *id == self.id)
+        {
+            inflight.remove(&self.key);
+        }
+    }
+}
+
+/// Where each file's reader is expected to read next, so sequential reads can be
+/// told from random ones and only the former prefetched (audit T2).
+#[derive(Default)]
+pub(super) struct Prefetch {
+    /// Per node: the block index a sequential reader should ask for next, and
+    /// the window depth it has earned.
+    streams: Mutex<HashMap<NodeUid, (u64, u64)>>,
+}
+
+impl Prefetch {
+    /// How far past `last` to read ahead for a read of blocks `[first, last]`,
+    /// and record where that read leaves the file's cursor.
+    ///
+    /// A read that starts where the last one stopped doubles the window (from
+    /// [`PREFETCH_MIN`], up to [`PREFETCH_MAX`]); anything else is a seek and
+    /// earns nothing, so random access — a database file, a linker — never pays
+    /// for speculative blocks it will not read. The first read of a file counts
+    /// as sequential: `(0, 0)` is both the initial cursor and block zero.
+    fn window(&self, uid: &NodeUid, first: u64, last: u64) -> u64 {
+        let mut streams = self.streams.lock();
+        if streams.len() > MAX_PREFETCH_STREAMS {
+            streams.clear();
+        }
+        let stream = streams.entry(uid.clone()).or_insert((0, 0));
+        let depth = if stream.0 == first {
+            (stream.1 * 2).clamp(PREFETCH_MIN, PREFETCH_MAX)
+        } else {
+            0
+        };
+        *stream = (last + 1, depth);
+        depth
+    }
+}
+
 impl Core {
     /// An open [`RevisionReader`] for `uid`, reusing the cached one when it is
     /// still valid for `(mtime, fsize)` and opening a fresh one otherwise.
@@ -304,6 +411,10 @@ impl Core {
     /// revision is no longer the truth.
     pub(super) fn evict_reader(&self, uid: &NodeUid) {
         self.readers.lock().remove(uid);
+        // The ring holds decrypted bytes of the same revision, and an eviction is
+        // exactly the statement that those are no longer the file's content.
+        self.block_ring.lock().drop_node(uid);
+        self.prefetch.streams.lock().remove(uid);
     }
 
     /// Serve bytes `[offset, offset + len)` of `uid`'s active revision, hitting
@@ -389,20 +500,293 @@ impl Core {
         Ok(out)
     }
 
-    /// Warm the [`STREAM_READAHEAD`] blocks after `last` into the ring, in the
+    /// Fetch block `bidx`, joining a fetch already in flight for it rather than
-    /// background, so a player reading forward finds its next block already in
+    /// issuing a second one, and publish the result to everyone who joined.
-    /// memory rather than paying a fetch + decrypt round-trip at each boundary.
     ///
-    /// Fire-and-forget: a failure here is not an error, it only means the read
+    /// See [`BlockFlight`]. A follower whose leader disappears (a panic, or a
-    /// that needs those bytes will fetch them itself.
+    /// cancelled `JoinSet`) fetches the block itself rather than failing — the
-    fn stream_readahead(&self, uid: &NodeUid, mtime: i64, fsize: u64, last: u64) {
+    /// leader's claim is gone by then, so this cannot recurse.
-        let last_block = (fsize.saturating_sub(1)) / BLOCK_SIZE;
+    async fn fetch_block(
-        let wanted: Vec<u64> = ((last + 1)..=(last + STREAM_READAHEAD).min(last_block))
+        &self,
+        reader: &Arc<RevisionReader>,
+        uid: &NodeUid,
+        mtime: i64,
+        fsize: u64,
+        bidx: u64,
+        cache_blocks: bool,
+    ) -> BlockResult {
+        let key: BlockKey = (uid.clone(), mtime, fsize, bidx);
+        let claim = {
+            let mut inflight = self.block_flight.inflight.lock();
+            match inflight.get(&key) {
+                Some((_, rx)) => Err(rx.clone()),
+                None => {
+                    let id = NEXT_FLIGHT_ID.fetch_add(1, Ordering::Relaxed);
+                    let (tx, rx) = tokio::sync::watch::channel(None);
+                    inflight.insert(key.clone(), (id, rx));
+                    Ok((
+                        tx,
+                        Flight {
+                            flight: self.block_flight.clone(),
+                            key: key.clone(),
+                            id,
+                        },
+                    ))
+                }
+            }
+        };
+        let (tx, flight) = match claim {
+            Ok(lead) => lead,
+            Err(mut rx) => {
+                loop {
+                    if let Some(result) = rx.borrow_and_update().clone() {
+                        return result;
+                    }
+                    if rx.changed().await.is_err() {
+                        break;
+                    }
+                }
+                return self
+                    .read_block(reader, uid, mtime, fsize, bidx, cache_blocks)
+                    .await;
+            }
+        };
+        let result = self
+            .read_block(reader, uid, mtime, fsize, bidx, cache_blocks)
+            .await;
+        // Retire the claim before publishing, so a racer that wakes and re-enters
+        // finds no stale entry to join.
+        drop(flight);
+        let _ = tx.send(Some(result.clone()));
+        result
+    }
+
+    /// Download and decrypt one block, then put it where the next reader will
+    /// find it: the in-memory ring always, the on-disk block cache too unless
+    /// this is a disk-bypassing stream.
+    ///
+    /// The disk store is handed to a blocking thread — it is a 4 MiB write plus
+    /// a cache-index update, and neither the reactor nor the kernel read waiting
+    /// on these bytes should be held up by it.
+    ///
+    /// A block that comes back shorter than the file's size says it must be is
+    /// never served, cached or promoted: it is repaired from the whole-file
+    /// download, or the read fails. See [`Core::repair_block`] (bugs.md B84).
+    async fn read_block(
+        &self,
+        reader: &Arc<RevisionReader>,
+        uid: &NodeUid,
+        mtime: i64,
+        fsize: u64,
+        bidx: u64,
+        cache_blocks: bool,
+    ) -> BlockResult {
+        let bstart = bidx * BLOCK_SIZE;
+        let blen = block_len(fsize, bidx);
+        // The reader derives every block boundary from the revision's recorded
+        // block sizes. If they do not add up to the size the node reports, this
+        // file's boundaries are wrong, and the failure is not confined to short
+        // reads: sizes that *overstate* a block shift every block after it and
+        // return full-length reads of the wrong bytes. So a disagreement of any
+        // kind takes the file off the range path entirely (bugs.md B84).
+        let bytes = if reader.size() != fsize {
+            warn!(
+                %uid, bidx, fsize,
+                reader_size = reader.size(),
+                reader_blocks = reader.block_sizes().len(),
+                "the revision's block table disagrees with the node size"
+            );
+            self.repair_block(uid, mtime, fsize, bidx).await?
+        } else {
+            let bytes = reader.read_at(bstart, blen).await.map_err(|e| {
+                warn!(%uid, bstart, blen, error = %e, "block read failed");
+                Errno::EIO
+            })?;
+            if bytes.len() as u64 == blen {
+                bytes
+            } else {
+                warn!(
+                    %uid, bidx, blen, got = bytes.len(), fsize,
+                    "block came back shorter than the file's size implies"
+                );
+                self.repair_block(uid, mtime, fsize, bidx).await?
+            }
+        };
+        let bytes = Arc::new(bytes);
+        if cache_blocks {
+            let cache = self.cache.clone();
+            let uid = uid.clone();
+            let bytes = bytes.clone();
+            tokio::task::spawn_blocking(move || {
+                let _ = cache.store_block(&uid, mtime, fsize, bidx, &bytes);
+            });
+        }
+        self.block_ring
+            .lock()
+            .insert(uid, mtime, fsize, bidx, bytes.clone());
+        Ok(bytes)
+    }
+
+    /// Recover block `bidx` of a file whose per-block reads cannot be trusted,
+    /// by fetching the whole revision through the manifest-verified download and
+    /// serving the block out of that.
+    ///
+    /// The range path derives every block boundary from the revision's recorded
+    /// block sizes. When those understate the file, reads come back short with
+    /// no error anywhere, and the caller hands userspace a truncated file that
+    /// looks like a clean EOF (bugs.md B84). `download_file_to` does not do that
+    /// arithmetic — it streams the block list — so it returns the whole file
+    /// where the range path cannot, which is why pinning was the workaround.
+    /// This does the same thing on the user's behalf, once, and the resulting
+    /// blob answers every later read of the file before the block path is
+    /// consulted at all.
+    ///
+    /// Bounded by [`REPAIR_MAX`]: past that, one unlucky read would pull down
+    /// gigabytes, and a clear `EIO` plus a `pdfs pin` is the better trade.
+    async fn repair_block(
+        &self,
+        uid: &NodeUid,
+        mtime: i64,
+        fsize: u64,
+        bidx: u64,
+    ) -> Result<Vec<u8>, Errno> {
+        let blen = block_len(fsize, bidx);
+        let bstart = bidx * BLOCK_SIZE;
+        if fsize > REPAIR_MAX {
+            warn!(
+                %uid, fsize,
+                "file is too large to repair from a whole-file download; pin it to read it"
+            );
+            return Err(Errno::EIO);
+        }
+        // One download per file, not per block: every block of a file with a bad
+        // block table discovers the same problem at once.
+        let lock = {
+            let mut locks = self.content_repairs.lock().await;
+            locks.entry(uid.clone()).or_default().clone()
+        };
+        let guard = lock.clone().lock_owned().await;
+        let downloaded = match self.cache.read_range(uid, mtime, fsize, bstart, blen) {
+            // The first arrival did the work; the rest just read its blob.
+            Some(bytes) if bytes.len() as u64 == blen => Ok(Some(bytes)),
+            _ => self
+                .download_whole_revision(uid, mtime, fsize)
+                .await
+                .map(|()| None),
+        };
+        // Before releasing, so the map entry is only dropped once no waiter is
+        // still holding it.
+        drop(guard);
+        self.release_repair_lock(uid, lock).await;
+        if let Some(bytes) = downloaded? {
+            return Ok(bytes);
+        }
+        match self.cache.read_range(uid, mtime, fsize, bstart, blen) {
+            Some(bytes) if bytes.len() as u64 == blen => {
+                info!(%uid, bidx, "served a short block from a repaired whole-file download");
+                Ok(bytes)
+            }
+            _ => {
+                error!(%uid, bidx, fsize, "repairing a short block did not produce the block");
+                Err(Errno::EIO)
+            }
+        }
+    }
+
+    /// Download the whole of `uid`'s active revision to disk and adopt it as the
+    /// cached blob, so the range path is bypassed entirely for this file.
+    ///
+    /// Streamed into a scratch file rather than memory: this runs for files up
+    /// to [`REPAIR_MAX`], and buffering that per concurrent reader is not a cost
+    /// a read should carry. A download that does not produce exactly `fsize`
+    /// bytes is discarded — a short blob would fail the cache's own validity
+    /// check anyway, and storing it would only hide the disagreement one layer
+    /// further down.
+    async fn download_whole_revision(
+        &self,
+        uid: &NodeUid,
+        mtime: i64,
+        fsize: u64,
+    ) -> Result<(), Errno> {
+        let (mut file, path) = self.cache.create_scratch().map_err(|error| {
+            error!(%uid, %error, "creating a scratch file for a repair download failed");
+            Errno::EIO
+        })?;
+        let outcome = self.client.download_file_to(uid, &mut file).await;
+        let stored = (|| {
+            outcome.map_err(|error| {
+                warn!(%uid, %error, "repair download failed");
+                Errno::EIO
+            })?;
+            file.sync_all().map_err(|error| {
+                warn!(%uid, %error, "syncing a repair download failed");
+                Errno::EIO
+            })?;
+            let got = file.metadata().map(|m| m.len()).unwrap_or(0);
+            if got != fsize {
+                warn!(%uid, fsize, got, "repair download did not match the node size");
+                return Err(Errno::EIO);
+            }
+            self.cache
+                .store_file(uid, mtime, fsize, &path)
+                .map_err(|error| {
+                    error!(%uid, %error, "adopting a repair download as cached content failed");
+                    Errno::EIO
+                })
+        })();
+        // The blob is a hardlink to the same inode, so unlinking the scratch
+        // name leaves it intact.
+        let _ = std::fs::remove_file(&path);
+        stored
+    }
+
+    /// Drop a repair lock's map entry once nobody else holds it, so a file
+    /// repaired long ago does not keep a mutex alive forever.
+    async fn release_repair_lock(&self, uid: &NodeUid, lock: Arc<tokio::sync::Mutex<()>>) {
+        let mut locks = self.content_repairs.lock().await;
+        // Two: the map's and ours. Anything more means a waiter still needs it.
+        if Arc::strong_count(&lock) <= 2 {
+            locks.remove(uid);
+        }
+    }
+
+    /// Warm the blocks after a sequential read into the caches, in the
+    /// background, so the next read finds them instead of paying a round-trip.
+    ///
+    /// A read that continues where the last one stopped doubles the window, up
+    /// to [`PREFETCH_MAX`]; a seek drops it back to nothing and one more
+    /// sequential read is needed to earn it again. Without this every read is a
+    /// serial fetch/serve/stall chain: on a 100 ms link that ceilings a file at
+    /// ~24 MB/s of the ~125 MB/s available, and the SDK's block concurrency is
+    /// never exercised at all.
+    ///
+    /// Fire-and-forget, and permit-bounded ([`PREFETCH_BUDGET`]) so speculative
+    /// work never sits in front of a read someone is waiting on. A failure here
+    /// is not an error: the read that needs those bytes will fetch them itself.
+    fn prefetch_ahead(
+        &self,
+        uid: &NodeUid,
+        mtime: i64,
+        fsize: u64,
+        first: u64,
+        last: u64,
+        cache_blocks: bool,
+    ) {
+        let depth = self.prefetch.window(uid, first, last);
+        if depth == 0 {
+            return;
+        }
+        let last_block = fsize.saturating_sub(1) / BLOCK_SIZE;
+        let wanted: Vec<u64> = ((last + 1)..=(last + depth).min(last_block))
             .filter(|&bidx| {
-                self.stream_ring
+                // Blocks already in memory need nothing; blocks already on disk
+                // are cheap enough to serve that spending a round-trip to move
+                // them into the ring would be the wrong trade.
+                self.block_ring
                     .lock()
                     .get(uid, mtime, fsize, bidx)
                     .is_none()
+                    && !(cache_blocks && self.cache.has_block(uid, mtime, fsize, bidx))
             })
             .collect();
         if wanted.is_empty() {
@@ -416,26 +800,25 @@ impl Core {
             };
             // Concurrently, for the same reason the demand path fetches its
             // misses concurrently: serially awaited blocks cost the sum of their
-            // round-trips, and the player catches up with the readahead before it
+            // round-trips, and the reader catches up with the window before it
-            // finishes. The SDK's in-flight block governor bounds the fan-out.
+            // finishes.
             let mut set = tokio::task::JoinSet::new();
             for bidx in wanted {
-                let reader = reader.clone();
+                let Ok(permit) = core.prefetch_budget.clone().try_acquire_owned() else {
-                let bstart = bidx * BLOCK_SIZE;
+                    break; // the budget is spent; the demand path can have it
-                let blen = BLOCK_SIZE.min(fsize - bstart);
+                };
-                set.spawn(async move { (bidx, reader.read_at(bstart, blen).await) });
+                let (core, reader, uid) = (core.clone(), reader.clone(), uid.clone());
-            }
+                set.spawn(async move {
-            while let Some(joined) = set.join_next().await {
+                    let _permit = permit;
-                let Ok((bidx, read)) = joined else { continue };
+                    if let Err(error) = core
-                match read {
+                        .fetch_block(&reader, &uid, mtime, fsize, bidx, cache_blocks)
-                    Ok(bytes) => {
+                        .await
-                        core.stream_ring
+                    {
-                            .lock()
+                        debug!(%uid, bidx, ?error, "prefetch failed");
-                            .insert(&uid, mtime, fsize, bidx, Arc::new(bytes))
                     }
-                    Err(e) => debug!(%uid, bidx, error = %e, "stream readahead failed"),
+                });
-                }
             }
+            while set.join_next().await.is_some() {}
         });
     }
 
@@ -473,17 +856,23 @@ impl Core {
         let mut blocks: Vec<Option<Arc<Vec<u8>>>> = Vec::with_capacity((last - first + 1) as usize);
         let mut misses: Vec<u64> = Vec::new();
         for bidx in first..=last {
-            // A streaming read keeps its blocks only in memory, so the ring is
+            // The in-memory ring comes first on both paths: a streaming read has
-            // the only cache it has — check it before the disk (which will not
+            // no other cache at all, and a cached one would otherwise pay two
-            // hold them) and before the network (which would refetch the same
+            // opens, a JSON parse and a 4 MiB read+alloc for every 128 KiB the
-            // 4 MiB block for every 128 KiB the player consumes).
+            // kernel asks for (audit T3).
-            let hit = if cache_blocks {
+            let hit = self.block_ring.lock().get(uid, mtime, fsize, bidx);
-                self.cache
+            let hit = hit.or_else(|| {
-                    .cached_block(uid, mtime, fsize, bidx)
+                if !cache_blocks {
-                    .map(Arc::new)
+                    return None;
-            } else {
+                }
-                self.stream_ring.lock().get(uid, mtime, fsize, bidx)
+                let bytes = Arc::new(self.cache.cached_block(uid, mtime, fsize, bidx)?);
-            };
+                // Promote it, so the other ~31 reads of this block are answered
+                // from memory.
+                self.block_ring
+                    .lock()
+                    .insert(uid, mtime, fsize, bidx, bytes.clone());
+                Some(bytes)
+            });
             match hit {
                 Some(b) => blocks.push(Some(b)),
                 None => {
@@ -502,19 +891,11 @@ impl Core {
 
                 let mut set = tokio::task::JoinSet::new();
                 for &bidx in &misses {
-                    let reader = reader.clone();
+                    let (core, reader, uid) = (self.clone(), reader.clone(), uid.clone());
-                    let uid = uid.clone();
-                    let bstart = bidx * BLOCK_SIZE;
-                    let blen = BLOCK_SIZE.min(fsize - bstart);
                     set.spawn(async move {
-                        reader
+                        core.fetch_block(&reader, &uid, mtime, fsize, bidx, cache_blocks)
-                            .read_at(bstart, blen)
                             .await
                             .map(|bytes| (bidx, bytes))
-                            .map_err(|e| {
-                                warn!(%uid, bstart, blen, error = %e, "block read failed");
-                                Errno::EIO
-                            })
                     });
                 }
                 let mut out = Vec::with_capacity(misses.len());
@@ -525,29 +906,27 @@ impl Core {
                 Ok::<_, Errno>(out)
             })?;
             for (bidx, bytes) in fetched {
-                // A streaming read (large unpinned video) skips the on-disk cache
-                // so it can't evict the rest of it; it keeps the block in the
-                // in-memory ring instead, which is bounded and dies with the read.
-                let bytes = Arc::new(bytes);
-                if cache_blocks {
-                    let _ = self.cache.store_block(uid, mtime, fsize, bidx, &bytes);
-                } else {
-                    self.stream_ring
-                        .lock()
-                        .insert(uid, mtime, fsize, bidx, bytes.clone());
-                }
                 blocks[(bidx - first) as usize] = Some(bytes);
             }
-            if !cache_blocks {
-                self.stream_readahead(uid, mtime, fsize, last);
-            }
         }
+        // Also after a wholly-cached read: that is what keeps the window sliding
+        // ahead of a sequential reader instead of stalling once it catches up.
+        self.prefetch_ahead(uid, mtime, fsize, first, last, cache_blocks);
 
         for (i, block) in blocks.into_iter().enumerate() {
             let bidx = first + i as u64;
             let bstart = bidx * BLOCK_SIZE;
             // Every slot is populated: cache hits up front, misses by the fetch above.
             let block = block.expect("block fetched or cached");
+            // Both sources guarantee the length the file's size implies — the
+            // cache validates it on read, the network path in `read_block` — so
+            // this refuses rather than quietly contributing fewer bytes than the
+            // range covers, which is what turned a bad block into a truncated
+            // file (bugs.md B84).
+            if block.len() as u64 != block_len(fsize, bidx) {
+                error!(%uid, bidx, len = block.len(), fsize, "assembling a read hit a short block");
+                return Err(Errno::EIO);
+            }
             let s = (offset.max(bstart) - bstart) as usize;
             let e = (end.min(bstart + block.len() as u64) - bstart) as usize;
             if s < e {
@@ -605,6 +984,106 @@ impl Core {
         Ok(out)
     }
 
+    /// The largest amount [`Core::fill_gaps_cached`] will copy out of the local
+    /// caches while a `release(2)` is in progress.
+    ///
+    /// The point of the cached fill is that editing a file the mount already
+    /// holds costs nothing extra; it is not to reconstruct arbitrarily large
+    /// files on the dispatch loop. Past this budget the blob stays incomplete
+    /// and the drain finishes it, which is the same work in a place where it
+    /// blocks nobody.
+    const CACHED_FILL_BUDGET: u64 = 64 * 1024 * 1024;
+
+    /// Bytes `[offset, offset + len)` of `uid`'s base revision, but only if the
+    /// local caches can answer in full — the whole-file blob first, then every
+    /// overlapping block. `None` the moment anything would have to be fetched.
+    fn cached_range(
+        &self,
+        uid: &NodeUid,
+        mtime: i64,
+        fsize: u64,
+        offset: u64,
+        len: u64,
+    ) -> Option<Vec<u8>> {
+        if len == 0 {
+            return Some(Vec::new());
+        }
+        if let Some(bytes) = self.cache.read_range(uid, mtime, fsize, offset, len) {
+            return Some(bytes);
+        }
+        let end = offset.checked_add(len)?.min(fsize);
+        if offset >= end {
+            return None;
+        }
+        let mut out = Vec::with_capacity((end - offset) as usize);
+        for bidx in (offset / BLOCK_SIZE)..=((end - 1) / BLOCK_SIZE) {
+            let ring = self.block_ring.lock().get(uid, mtime, fsize, bidx);
+            let block = match ring {
+                Some(bytes) => bytes,
+                None => Arc::new(self.cache.cached_block(uid, mtime, fsize, bidx)?),
+            };
+            let bstart = bidx * BLOCK_SIZE;
+            let s = (offset.max(bstart) - bstart) as usize;
+            let e = (end.min(bstart + block.len() as u64) - bstart) as usize;
+            if s >= e {
+                return None;
+            }
+            out.extend_from_slice(&block[s..e]);
+        }
+        (out.len() as u64 == end - offset).then_some(out)
+    }
+
+    /// Fill what [`Core::fill_gaps`] would, but only from bytes already on this
+    /// machine, and only up to [`Core::CACHED_FILL_BUDGET`]. Ranges past the
+    /// base are zeros the caller's `set_len` already wrote, so they count as
+    /// filled. `written` is extended with everything that ends up resolved.
+    ///
+    /// This is the release-time half of gap filling. Doing the network half
+    /// there as well is what froze the whole mount for the length of a download
+    /// (audit F1): the closing file's untouched ranges are allowed to stay
+    /// unresolved in the staged blob — `StagedWrite::complete` is false, reads
+    /// resolve the gaps against the base, and `drain_revision` fills them on the
+    /// drain thread before it uploads. What is left here is the case where
+    /// filling is free, which is also the common one: a file that was read
+    /// before it was edited.
+    pub(super) fn fill_gaps_cached(
+        &self,
+        uid: &NodeUid,
+        file: &File,
+        len: u64,
+        base_mtime: i64,
+        base_size: u64,
+        written: &mut Intervals,
+    ) {
+        let mut budget = Self::CACHED_FILL_BUDGET;
+        for (s, e, authored) in written.clone().segments(0, len) {
+            if authored {
+                continue;
+            }
+            let bend = e.min(base_size);
+            if s < bend {
+                let want = bend - s;
+                if want > budget {
+                    continue;
+                }
+                let Some(bytes) = self.cached_range(uid, base_mtime, base_size, s, want) else {
+                    continue;
+                };
+                if let Err(error) = file.write_all_at(&bytes, s) {
+                    warn!(%uid, %error, "cached gap-fill write failed");
+                    continue;
+                }
+                budget -= want;
+                written.add(s, bend);
+            }
+            // Past the base there is nothing to fetch: the resize zeroed it, so
+            // those bytes are already the file's content.
+            if e > base_size {
+                written.add(s.max(base_size), e);
+            }
+        }
+    }
+
     /// Fill every unauthored range of a scratch/staged file that overlaps its
     /// base with the base's bytes, so the file becomes the complete new content.
     ///
@@ -643,3 +1122,145 @@ impl Core {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod block_ring_tests {
+    use super::*;
+
+    fn uid(link: &str) -> NodeUid {
+        NodeUid::new(VolumeId::from("vol"), LinkId::from(link))
+    }
+
+    /// One block's worth of bytes, so byte accounting is exercised at the scale
+    /// the ring actually sees.
+    fn block(byte: u8) -> Arc<Vec<u8>> {
+        Arc::new(vec![byte; BLOCK_SIZE as usize])
+    }
+
+    /// How many whole blocks fit before the ring starts evicting.
+    fn capacity() -> u64 {
+        RING_BYTES / BLOCK_SIZE
+    }
+
+    #[test]
+    fn a_stored_block_is_served_back() {
+        let mut ring = BlockRing::default();
+        let node = uid("a");
+        ring.insert(&node, 7, 100, 3, block(0xab));
+        assert_eq!(ring.get(&node, 7, 100, 3).map(|b| b[0]), Some(0xab));
+    }
+
+    #[test]
+    fn a_block_of_another_revision_is_never_served() {
+        let mut ring = BlockRing::default();
+        let node = uid("a");
+        ring.insert(&node, 7, 100, 0, block(1));
+        // Same node, newer revision: the tag moved, so the old bytes go.
+        assert!(ring.get(&node, 8, 100, 0).is_none());
+        assert!(ring.get(&node, 7, 101, 0).is_none());
+    }
+
+    #[test]
+    fn a_new_revision_drops_what_the_old_one_left() {
+        let mut ring = BlockRing::default();
+        let node = uid("a");
+        ring.insert(&node, 7, 100, 0, block(1));
+        ring.insert(&node, 8, 100, 0, block(2));
+        assert_eq!(ring.get(&node, 8, 100, 0).map(|b| b[0]), Some(2));
+        assert_eq!(ring.bytes, BLOCK_SIZE);
+    }
+
+    #[test]
+    fn the_ring_evicts_the_least_recently_used_block() {
+        let mut ring = BlockRing::default();
+        let node = uid("a");
+        for idx in 0..capacity() {
+            ring.insert(&node, 1, u64::MAX, idx, block(idx as u8));
+        }
+        // Re-reading block 0 makes block 1 the oldest instead.
+        assert!(ring.get(&node, 1, u64::MAX, 0).is_some());
+        ring.insert(&node, 1, u64::MAX, capacity(), block(0xff));
+        assert!(ring.get(&node, 1, u64::MAX, 0).is_some());
+        assert!(ring.get(&node, 1, u64::MAX, 1).is_none());
+        assert_eq!(ring.bytes, RING_BYTES);
+    }
+
+    #[test]
+    fn a_node_whose_last_block_ages_out_keeps_no_tag() {
+        let mut ring = BlockRing::default();
+        let (old, new) = (uid("old"), uid("new"));
+        ring.insert(&old, 1, u64::MAX, 0, block(1));
+        for idx in 0..capacity() {
+            ring.insert(&new, 1, u64::MAX, idx, block(2));
+        }
+        assert!(!ring.tags.contains_key(&old));
+        assert!(ring.tags.contains_key(&new));
+    }
+
+    #[test]
+    fn dropping_a_node_frees_only_its_own_bytes() {
+        let mut ring = BlockRing::default();
+        let (a, b) = (uid("a"), uid("b"));
+        ring.insert(&a, 1, 100, 0, block(1));
+        ring.insert(&b, 1, 100, 0, block(2));
+        ring.drop_node(&a);
+        assert!(ring.get(&a, 1, 100, 0).is_none());
+        assert_eq!(ring.get(&b, 1, 100, 0).map(|x| x[0]), Some(2));
+        assert_eq!(ring.bytes, BLOCK_SIZE);
+    }
+}
+
+#[cfg(test)]
+mod prefetch_tests {
+    use super::*;
+
+    fn uid(link: &str) -> NodeUid {
+        NodeUid::new(VolumeId::from("vol"), LinkId::from(link))
+    }
+
+    #[test]
+    fn a_sequential_reader_ramps_up_to_the_cap() {
+        let prefetch = Prefetch::default();
+        let node = uid("a");
+        let depths: Vec<u64> = (0..6)
+            .map(|next| prefetch.window(&node, next, next))
+            .collect();
+        assert_eq!(depths, vec![2, 4, 8, 8, 8, 8]);
+    }
+
+    #[test]
+    fn a_seek_forfeits_the_window() {
+        let prefetch = Prefetch::default();
+        let node = uid("a");
+        assert_eq!(prefetch.window(&node, 0, 0), PREFETCH_MIN);
+        assert_eq!(prefetch.window(&node, 40, 40), 0);
+        // And has to be earned again from the bottom.
+        assert_eq!(prefetch.window(&node, 41, 41), PREFETCH_MIN);
+    }
+
+    #[test]
+    fn a_multi_block_read_advances_the_cursor_past_all_of_it() {
+        let prefetch = Prefetch::default();
+        let node = uid("a");
+        assert_eq!(prefetch.window(&node, 0, 3), PREFETCH_MIN);
+        assert_eq!(prefetch.window(&node, 4, 7), 4);
+    }
+
+    #[test]
+    fn files_are_tracked_independently() {
+        let prefetch = Prefetch::default();
+        let (a, b) = (uid("a"), uid("b"));
+        assert_eq!(prefetch.window(&a, 0, 0), PREFETCH_MIN);
+        assert_eq!(prefetch.window(&b, 9, 9), 0);
+        assert_eq!(prefetch.window(&a, 1, 1), 4);
+    }
+
+    #[test]
+    fn the_stream_map_cannot_grow_without_bound() {
+        let prefetch = Prefetch::default();
+        for n in 0..=MAX_PREFETCH_STREAMS + 1 {
+            prefetch.window(&uid(&n.to_string()), 0, 0);
+        }
+        assert!(prefetch.streams.lock().len() <= MAX_PREFETCH_STREAMS + 1);
+    }
+}

crates/pdfs-fuse/src/revisions.rs

@@ -0,0 +1,264 @@
+//! File version history: listing a file's revisions, restoring one, deleting
+//! one, and writing an old one out to a local path.
+//!
+//! Proton Drive keeps every revision a client ever committed, and until now the
+//! daemon only ever addressed the active one — a file that a sync pass or a
+//! `(sync-conflict)` fork overwrote could only be recovered from whatever the
+//! local `recovery/` directory happened to hold. This is the remote equivalent,
+//! and it is the reason a *restore* here is not a download-then-upload: the
+//! server re-points the file at an existing revision, so no content crosses the
+//! wire and nothing lands in the drain queue.
+//!
+//! Two things about the SDK surface leak into every method here:
+//!
+//! - **A restore is asynchronous.** The server answers 202 and swaps the active
+//!   revision in the background, so the daemon drops its cached content for the
+//!   file rather than trying to describe the new one. The next read repopulates
+//!   from whatever is live by then.
+//! - **The active revision cannot be deleted**, and the server — not this code —
+//!   is what enforces that. [`Core::delete_revision_for_uid`] refuses locally
+//!   too, so the user gets a sentence instead of an API code.
+
+use std::path::Path;
+
+use pdfs_core::control::{ActivityKind, RevisionInfo};
+use pdfs_core::{CoreError, CoreResult};
+use proton_drive_rs::Revision;
+use proton_drive_rs::proton_sdk::ids::NodeUid;
+use tracing::info;
+
+use super::Core;
+
+/// A [`Revision`] as the control protocol reports it.
+fn revision_info(revision: Revision) -> RevisionInfo {
+    RevisionInfo {
+        is_active: revision.is_active(),
+        id: revision.revision_id,
+        created: revision.creation_time,
+        size_on_storage: revision.size_on_storage,
+        claimed_size: revision.claimed_size,
+        claimed_modified: revision.claimed_modification_time,
+        // An empty signer means the node key signed it anonymously, which is not
+        // an address a front-end can show.
+        signed_by: revision.signature_email.filter(|email| !email.is_empty()),
+        has_thumbnails: revision.has_thumbnails,
+    }
+}
+
+impl Core {
+    /// The version history of the file at mountpoint-relative `rel`.
+    pub(crate) fn list_revisions(&self, rel: &Path) -> CoreResult<Vec<RevisionInfo>> {
+        let (_ino, uid) = self.resolve(rel)?;
+        self.list_revisions_for_uid(&uid)
+    }
+
+    /// [`Core::list_revisions`] for a node addressed through any daemon location.
+    pub(crate) fn list_revisions_by_uid(&self, uid: &str) -> CoreResult<Vec<RevisionInfo>> {
+        let uid = self.resolve_anywhere(uid)?;
+        self.list_revisions_for_uid(&uid)
+    }
+
+    fn list_revisions_for_uid(&self, uid: &NodeUid) -> CoreResult<Vec<RevisionInfo>> {
+        let revisions = self
+            .rt
+            .block_on(self.client.enumerate_revisions(uid))
+            .map_err(|e| CoreError::from_api(&e, "list revisions"))?;
+        Ok(revisions.into_iter().map(revision_info).collect())
+    }
+
+    /// Make `revision_id` the current content of the file at `rel`.
+    pub(crate) fn restore_revision(&self, rel: &Path, revision_id: &str) -> CoreResult<()> {
+        let (_ino, uid) = self.resolve(rel)?;
+        let name = rel
+            .file_name()
+            .map(|n| n.to_string_lossy().into_owned())
+            .unwrap_or_else(|| uid.to_string());
+        self.restore_revision_for_uid(&uid, revision_id, &name)?;
+        // The size and mtime a listing shows describe the revision that was
+        // active a moment ago.
+        self.invalidate_parent_listing(rel);
+        Ok(())
+    }
+
+    /// [`Core::restore_revision`] for a node addressed through any daemon
+    /// location.
+    pub(crate) fn restore_revision_by_uid(&self, uid: &str, revision_id: &str) -> CoreResult<()> {
+        let uid = self.resolve_anywhere(uid)?;
+        let name = uid.to_string();
+        self.restore_revision_for_uid(&uid, revision_id, &name)
+    }
+
+    fn restore_revision_for_uid(
+        &self,
+        uid: &NodeUid,
+        revision_id: &str,
+        name: &str,
+    ) -> CoreResult<()> {
+        // Restoring rewrites the file's content: the same authority a write
+        // needs, not the one a read needs.
+        self.require_uid_writable(uid)
+            .map_err(|error| self.errno_error(error, "restore revision"))?;
+        if let Err(e) = self
+            .rt
+            .block_on(self.client.restore_revision(uid, revision_id))
+        {
+            let error = CoreError::from_api(&e, "restore revision");
+            self.log_activity(ActivityKind::Restore, name, &error, false);
+            return Err(error);
+        }
+        // The active revision is changing behind our back — anything describing
+        // the old one (cached blocks, an open reader, the size in a listing) is
+        // stale from here on, and the server may not have applied the swap yet.
+        self.cache.evict(uid);
+        self.evict_reader(uid);
+        self.log_activity(
+            ActivityKind::Restore,
+            name,
+            format!("restored version {revision_id}"),
+            true,
+        );
+        info!(%uid, revision_id, name, "restored an earlier revision");
+        Ok(())
+    }
+
+    /// Permanently delete `revision_id` from the history of the file at `rel`.
+    pub(crate) fn delete_revision(&self, rel: &Path, revision_id: &str) -> CoreResult<()> {
+        let (_ino, uid) = self.resolve(rel)?;
+        let name = rel
+            .file_name()
+            .map(|n| n.to_string_lossy().into_owned())
+            .unwrap_or_else(|| uid.to_string());
+        self.delete_revision_for_uid(&uid, revision_id, &name)
+    }
+
+    /// [`Core::delete_revision`] for a node addressed through any daemon
+    /// location.
+    pub(crate) fn delete_revision_by_uid(&self, uid: &str, revision_id: &str) -> CoreResult<()> {
+        let uid = self.resolve_anywhere(uid)?;
+        let name = uid.to_string();
+        self.delete_revision_for_uid(&uid, revision_id, &name)
+    }
+
+    fn delete_revision_for_uid(
+        &self,
+        uid: &NodeUid,
+        revision_id: &str,
+        name: &str,
+    ) -> CoreResult<()> {
+        self.require_uid_writable(uid)
+            .map_err(|error| self.errno_error(error, "delete revision"))?;
+        // The server rejects deleting the active revision; saying so here is a
+        // sentence the user can act on instead of an API code, and it costs one
+        // listing the front-end already made to show the version list.
+        let revisions = self
+            .rt
+            .block_on(self.client.enumerate_revisions(uid))
+            .map_err(|e| CoreError::from_api(&e, "list revisions"))?;
+        let target = revisions
+            .iter()
+            .find(|r| r.revision_id == revision_id)
+            .ok_or_else(|| CoreError::not_found(format!("no version {revision_id} on {name}")))?;
+        if target.is_active() {
+            return Err(CoreError::invalid(format!(
+                "version {revision_id} is the current content of {name}; restore another version first"
+            )));
+        }
+        self.rt
+            .block_on(self.client.delete_revision(uid, revision_id))
+            .map_err(|e| CoreError::from_api(&e, "delete revision"))?;
+        self.log_activity(
+            ActivityKind::DeleteForever,
+            name,
+            format!("deleted version {revision_id}"),
+            true,
+        );
+        info!(%uid, revision_id, name, "deleted a revision");
+        Ok(())
+    }
+
+    /// Write `revision_id` of the file at `rel` to the absolute local path
+    /// `dest`, leaving the file itself untouched.
+    pub(crate) fn save_revision_as(
+        &self,
+        rel: &Path,
+        revision_id: &str,
+        dest: &Path,
+    ) -> CoreResult<u64> {
+        let (_ino, uid) = self.resolve(rel)?;
+        let name = rel
+            .file_name()
+            .map(|n| n.to_string_lossy().into_owned())
+            .unwrap_or_else(|| uid.to_string());
+        self.save_revision_for_uid(&uid, revision_id, &name, dest)
+    }
+
+    /// [`Core::save_revision_as`] for a node addressed through any daemon
+    /// location.
+    pub(crate) fn save_revision_as_by_uid(
+        &self,
+        uid: &str,
+        revision_id: &str,
+        dest: &Path,
+    ) -> CoreResult<u64> {
+        let uid = self.resolve_anywhere(uid)?;
+        let name = uid.to_string();
+        self.save_revision_for_uid(&uid, revision_id, &name, dest)
+    }
+
+    fn save_revision_for_uid(
+        &self,
+        uid: &NodeUid,
+        revision_id: &str,
+        name: &str,
+        dest: &Path,
+    ) -> CoreResult<u64> {
+        if !dest.is_absolute() {
+            return Err(CoreError::invalid(format!(
+                "destination must be an absolute path: {}",
+                dest.display()
+            )));
+        }
+        // Never silently replace something the user already has: an old version
+        // written over the wrong file is exactly the loss this feature exists to
+        // undo.
+        if dest.exists() {
+            return Err(CoreError::invalid(format!(
+                "{} already exists",
+                dest.display()
+            )));
+        }
+        let file = std::fs::File::create(dest)
+            .map_err(|e| CoreError::internal(format!("create {}: {e}", dest.display())))?;
+        let mut out = std::io::BufWriter::new(file);
+        let written = match self
+            .rt
+            .block_on(self.client.download_revision_to(uid, revision_id, &mut out))
+            .map_err(|e| CoreError::from_api(&e, "download revision"))
+            .and_then(|()| {
+                use std::io::Write as _;
+                out.flush()
+                    .map_err(|e| CoreError::internal(format!("write {}: {e}", dest.display())))?;
+                let written = std::fs::metadata(dest)
+                    .map(|m| m.len())
+                    .map_err(|e| CoreError::internal(format!("stat {}: {e}", dest.display())))?;
+                Ok(written)
+            }) {
+            Ok(written) => written,
+            Err(error) => {
+                // A half-written file looks like a successful export to every
+                // tool that opens it afterwards.
+                let _ = std::fs::remove_file(dest);
+                self.log_activity(ActivityKind::Download, name, &error, false);
+                return Err(error);
+            }
+        };
+        self.log_activity(
+            ActivityKind::Download,
+            name,
+            format!("saved version {revision_id} to {}", dest.display()),
+            true,
+        );
+        info!(%uid, revision_id, dest = %dest.display(), "wrote an earlier revision to disk");
+        Ok(written)
+    }
+}

crates/pdfs-fuse/src/sharing.rs

@@ -12,6 +12,9 @@ use pdfs_core::control::{
     BookmarkInfo, DirEntry, InvitationInfo, PublicLinkInfo, ShareEntry, ShareEntryKind, SharedItem,
 };
 use pdfs_core::{CoreError, CoreResult};
+use tracing::debug;
+
+use crate::QUOTA_TTL;
 use proton_drive_rs::proton_sdk::ids::NodeUid;
 use proton_drive_rs::{MemberRole, NodeKind};
 
@@ -533,9 +536,33 @@ impl Core {
             .rt
             .block_on(self.client.quota())
             .map_err(|e| CoreError::from_api(&e, "account quota"))?;
+        *self.quota.lock() = Some((std::time::Instant::now(), q.max_space, q.used_space));
         Ok((q.max_space, q.used_space))
     }
 
+    /// The account quota as `statfs(2)` needs it: cached for [`QUOTA_TTL`],
+    /// refetched after that, and `None` when there is no usable answer at all —
+    /// offline with nothing cached.
+    ///
+    /// Never blocks on the network for a *fresh* value when a recent one exists,
+    /// because the callers are `df` and every "is there room?" preflight, and a
+    /// stale byte count is worth more to them than a stalled syscall. Offline,
+    /// the last known figures keep being served rather than degrading to zero.
+    pub(crate) fn account_quota_cached(&self) -> Option<(i64, i64)> {
+        if let Some((at, max_space, used_space)) = *self.quota.lock()
+            && at.elapsed() < QUOTA_TTL
+        {
+            return Some((max_space, used_space));
+        }
+        match self.account_quota() {
+            Ok(q) => Some(q),
+            Err(error) => {
+                debug!(%error, "account quota refresh failed; serving the last known figures");
+                self.quota.lock().map(|(_, max, used)| (max, used))
+            }
+        }
+    }
+
     // ---- shared by me -----------------------------------------------------
 
     /// List the nodes I have shared with others, each with a summary of its share

crates/pdfs-fuse/src/shutdown.rs

@@ -0,0 +1,96 @@
+//! One shutdown signal shared by every long-lived worker in the daemon.
+//!
+//! The mount used to end by unmounting and returning, leaving the drain
+//! workers, the sync engine, the conflict sweep, the online probe and the local
+//! indexer running on `Core` clones. In a process that exits immediately that is
+//! invisible; in an in-process remount — which is how the daemon recovers from a
+//! mount going away underneath it — it leaks a whole generation of threads that
+//! keep writing to the database and calling the API on behalf of a mount that no
+//! longer exists (bugs.md B44).
+//!
+//! The primitive is deliberately small: a flag plus a condvar. Every loop that
+//! would otherwise call `thread::sleep` calls [`Shutdown::sleep`] instead, which
+//! returns early — and reports `false` — the moment [`Shutdown::stop`] is
+//! called, so teardown does not have to wait out a five-minute sweep interval to
+//! join a thread.
+
+use std::time::Duration;
+
+use parking_lot::{Condvar, Mutex};
+
+/// The daemon's stop signal. Set once, never cleared: a `Core` that has been
+/// told to stop belongs to a mount that is going away.
+#[derive(Default)]
+pub(crate) struct Shutdown {
+    stopping: Mutex<bool>,
+    changed: Condvar,
+}
+
+impl Shutdown {
+    /// Whether teardown has begun. Loops check this where they would otherwise
+    /// start another unit of work.
+    pub(crate) fn is_stopping(&self) -> bool {
+        *self.stopping.lock()
+    }
+
+    /// Begin teardown and wake everything waiting in [`sleep`](Self::sleep).
+    /// Idempotent, because more than one path can reach teardown (a signal, the
+    /// kernel mount ending, a failed startup).
+    pub(crate) fn stop(&self) {
+        let mut stopping = self.stopping.lock();
+        *stopping = true;
+        self.changed.notify_all();
+    }
+
+    /// Wait up to `duration`, or until teardown starts.
+    ///
+    /// Returns `false` if the daemon is stopping — including when it was already
+    /// stopping on entry, so `while shutdown.sleep(interval)` is a complete and
+    /// correct loop condition and no separate check is needed at the top.
+    pub(crate) fn sleep(&self, duration: Duration) -> bool {
+        let mut stopping = self.stopping.lock();
+        if !*stopping {
+            self.changed.wait_for(&mut stopping, duration);
+        }
+        !*stopping
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::Arc;
+    use std::time::Instant;
+
+    #[test]
+    fn sleeping_returns_early_once_stopped() {
+        let shutdown = Arc::new(Shutdown::default());
+        assert!(!shutdown.is_stopping());
+
+        let waker = shutdown.clone();
+        std::thread::spawn(move || {
+            std::thread::sleep(Duration::from_millis(20));
+            waker.stop();
+        });
+
+        let started = Instant::now();
+        // An hour's worth of interval, cut short by the stop.
+        assert!(!shutdown.sleep(Duration::from_secs(3600)));
+        assert!(
+            started.elapsed() < Duration::from_secs(5),
+            "stop must interrupt the wait, not wait it out"
+        );
+        assert!(shutdown.is_stopping());
+        // Already stopping: the next wait does not sleep at all.
+        let started = Instant::now();
+        assert!(!shutdown.sleep(Duration::from_secs(3600)));
+        assert!(started.elapsed() < Duration::from_secs(5));
+    }
+
+    #[test]
+    fn sleeping_runs_to_the_timeout_while_running() {
+        let shutdown = Shutdown::default();
+        assert!(shutdown.sleep(Duration::from_millis(10)));
+        assert!(!shutdown.is_stopping());
+    }
+}

crates/pdfs-fuse/src/state.rs

@@ -141,6 +141,11 @@ pub(crate) struct PendingRevision {
     pub(crate) meta: StagedWrite,
 }
 
+/// One directory's entries as `readdir` reports them: `(ino, is_dir, name)` per
+/// entry, in reply order. The kernel's file-type enum is mapped in at reply
+/// time so this module stays free of `fuser`.
+pub(crate) type DirListing = Vec<(u64, bool, String)>;
+
 /// Mutable inode bookkeeping, guarded by a mutex because fuser drives the
 /// `Filesystem` trait through `&self`.
 pub(crate) struct State {
@@ -158,6 +163,16 @@ pub(crate) struct State {
     /// have no entry here.
     pub(crate) handles: HashMap<u64, u64>,
     pub(crate) next_fh: u64,
+    /// One frozen listing per open directory handle, taken at `opendir`.
+    ///
+    /// `readdir` resumes from a byte offset into the listing it is walking, so
+    /// that listing has to stay the same across the calls of one `getdents`
+    /// sequence. Rebuilding it live meant a create or a trash landing between
+    /// two pages shifted every later entry, and the caller silently skipped or
+    /// repeated whatever crossed the page boundary. Each entry is
+    /// `(ino, is_dir, name)` — the kernel type is mapped at reply time so this
+    /// module stays free of `fuser` (bugs.md B43).
+    pub(crate) dir_snapshots: HashMap<u64, Arc<DirListing>>,
     /// Resident inode attributes whose effective access changed during an
     /// intern/root refresh. Core drains this set and notifies the matching
     /// kernel only after releasing the State lock.
@@ -166,13 +181,164 @@ pub(crate) struct State {
     /// on every explicit role/tombstone change. Descendant inheritance reads
     /// this map instead of issuing one SQLite query per interned inode.
     pub(crate) share_access: HashMap<NodeUid, Access>,
-    /// Unified SQLite metadata cache. Every map mutation below writes through to
+    /// Unified SQLite metadata cache. Read from here (`has_children`) but never
-    /// it inside the `State` lock so the DB stays the authoritative copy across
+    /// written: mutations go to [`State::outbox`] and are applied after the lock
-    /// restarts (see plan.md P1).
+    /// is released. See [`StateGuard`].
     pub(crate) db: Arc<Db>,
+    /// Write-throughs this mutation owes SQLite, applied by [`StateGuard`] once
+    /// the inode lock is released.
+    ///
+    /// The DB stays the authoritative copy across restarts, so every map
+    /// mutation still writes through — it just no longer does so with the
+    /// whole-mount lock held. A single listing's write-through is one
+    /// transaction over up to a few thousand rows, and every other FUSE callback
+    /// used to wait behind it for no reason: the maps were already updated
+    /// before the first row was written.
+    outbox: Vec<DbWrite>,
+}
+
+/// A write-through queued by a `State` mutation, applied after the lock drops.
+///
+/// Deliberately a small closed set rather than a boxed closure: these run
+/// outside the lock, and what they can touch should be readable here.
+pub(crate) enum DbWrite {
+    /// One node or a whole listing. Both go through `upsert_nodes`, which is a
+    /// single transaction either way, so there is nothing to gain by splitting
+    /// them — and a `Node` is large enough that a variant holding one inline
+    /// would set the size of every other.
+    Upsert(Vec<Node>),
+    Delete(NodeUid),
+    SetListed(NodeUid, bool),
+    SetShareAccess(NodeUid, Access),
+}
+
+impl DbWrite {
+    fn apply(self, db: &Db) {
+        let outcome = match &self {
+            Self::Upsert(nodes) => db.upsert_nodes(nodes),
+            Self::Delete(uid) => db.delete_node(uid),
+            Self::SetListed(uid, listed) => db.set_listed(uid, *listed),
+            Self::SetShareAccess(uid, access) => db.set_share_access(uid, *access),
+        };
+        if let Err(error) = outcome {
+            let what = match &self {
+                Self::Upsert(_) => "upsert_nodes",
+                Self::Delete(_) => "delete_node",
+                Self::SetListed(..) => "set_listed",
+                Self::SetShareAccess(..) => "set_share_access",
+            };
+            warn!(%error, write = what, "db write-through failed");
+        }
+    }
+}
+
+/// The inode lock, held for the duration of a mutation, plus the write-throughs
+/// that mutation owed the database.
+///
+/// Dropping it releases the lock *first* and only then writes, which is the
+/// whole point: interning a five-thousand-child listing commits one transaction
+/// — several fsyncs' worth — and nothing about that needs the maps frozen. The
+/// write still happens synchronously on this thread before the caller proceeds,
+/// so a read that follows a mutation still sees it.
+pub(crate) struct StateGuard<'a> {
+    guard: Option<parking_lot::MutexGuard<'a, State>>,
+    db: &'a Arc<Db>,
+}
+
+/// Take a mount's inode lock through a [`StateGuard`], for the loops that walk
+/// every live mount rather than this `Core`'s own.
+pub(crate) fn lock_state<'a>(
+    state: &'a parking_lot::Mutex<State>,
+    db: &'a Arc<Db>,
+) -> StateGuard<'a> {
+    StateGuard::new(state.lock(), db)
+}
+
+impl<'a> StateGuard<'a> {
+    pub(crate) fn new(guard: parking_lot::MutexGuard<'a, State>, db: &'a Arc<Db>) -> Self {
+        Self {
+            guard: Some(guard),
+            db,
+        }
+    }
+}
+
+impl std::ops::Deref for StateGuard<'_> {
+    type Target = State;
+
+    fn deref(&self) -> &State {
+        self.guard.as_ref().expect("held until drop")
+    }
+}
+
+impl std::ops::DerefMut for StateGuard<'_> {
+    fn deref_mut(&mut self) -> &mut State {
+        self.guard.as_mut().expect("held until drop")
+    }
+}
+
+impl Drop for StateGuard<'_> {
+    fn drop(&mut self) {
+        let Some(mut guard) = self.guard.take() else {
+            return;
+        };
+        let writes = std::mem::take(&mut guard.outbox);
+        // The lock goes before the writes do. That ordering is the feature.
+        drop(guard);
+        for write in writes {
+            write.apply(self.db);
+        }
+    }
 }
 
 impl State {
+    /// A fresh, empty inode space over `db`.
+    ///
+    /// `next_ino` differs by caller: a real mount hands out [`crate::ROOT_INO`]
+    /// to its root and starts allocating above it, while a bare state under test
+    /// has no root and starts at 1.
+    /// Apply the write-throughs this state owes SQLite, here and now.
+    ///
+    /// Production code never calls this: [`StateGuard`] releases the inode lock
+    /// first and then applies them, which is the whole point. A test driving a
+    /// bare `State` has no guard, so it calls this where the daemon would have
+    /// dropped one.
+    #[cfg(test)]
+    pub(crate) fn flush_outbox(&mut self) {
+        let db = self.db.clone();
+        for write in std::mem::take(&mut self.outbox) {
+            write.apply(&db);
+        }
+    }
+
+    /// The database, with everything this state owes it already written.
+    ///
+    /// What a test means by `st.db` is almost always "the database as of now",
+    /// which in the daemon is the state after the guard dropped. Handing back an
+    /// owned `Arc` rather than a borrow keeps it usable inside an `assert_eq!`
+    /// that also touches `st`.
+    #[cfg(test)]
+    pub(crate) fn flushed_db(&mut self) -> Arc<Db> {
+        self.flush_outbox();
+        self.db.clone()
+    }
+
+    pub(crate) fn new(db: Arc<Db>, share_access: HashMap<NodeUid, Access>, next_ino: u64) -> Self {
+        Self {
+            entries: HashMap::new(),
+            by_uid: HashMap::new(),
+            children: HashMap::new(),
+            next_ino,
+            active_writes: HashMap::new(),
+            handles: HashMap::new(),
+            next_fh: 1,
+            dir_snapshots: HashMap::new(),
+            access_changes: HashSet::new(),
+            share_access,
+            db,
+            outbox: Vec::new(),
+        }
+    }
     /// Whether `uid` names an owned node currently reachable from this mount's
     /// root. Resident entries can outlive their dentries for open-handle and
     /// access-revocation semantics, so `by_uid` membership alone is not proof
@@ -278,11 +444,9 @@ impl State {
                 || stored.unwrap_or(Access::Viewer),
                 |membership| access_for(membership.role_exact(), parent_access, true),
             );
-            if let Err(error) = self.db.set_share_access(&node.uid, access) {
+            self.outbox
-                warn!(uid = %node.uid, ?access, %error, "db set_share_access failed");
+                .push(DbWrite::SetShareAccess(node.uid.clone(), access));
-            } else {
+            self.share_access.insert(node.uid.clone(), access);
-                self.share_access.insert(node.uid.clone(), access);
-            }
             return access;
         }
         parent_access
@@ -313,11 +477,9 @@ impl State {
             None => (None, Access::Unknown),
         };
         let access = access_for(role, parent_access, true);
-        if let Err(error) = self.db.set_share_access(uid, access) {
+        self.outbox
-            warn!(%uid, ?access, %error, "db set observed share access failed");
+            .push(DbWrite::SetShareAccess(uid.clone(), access));
-        } else {
+        self.share_access.insert(uid.clone(), access);
-            self.share_access.insert(uid.clone(), access);
-        }
         let Some(root) = root else {
             return Vec::new();
         };
@@ -602,18 +764,14 @@ impl State {
             })
             .collect();
         for (uid, access) in discovered {
-            if let Err(error) = self.db.set_share_access(&uid, access) {
+            self.outbox
-                warn!(%uid, ?access, %error, "db set hydrated share access failed");
+                .push(DbWrite::SetShareAccess(uid.clone(), access));
-            } else {
+            self.share_access.insert(uid, access);
-                self.share_access.insert(uid, access);
-            }
         }
     }
 
     pub(crate) fn intern(&mut self, parent: u64, node: Node) -> u64 {
-        if let Err(e) = self.db.upsert_node(&node) {
+        self.outbox.push(DbWrite::Upsert(vec![node.clone()]));
-            warn!(uid = %node.uid, error = %e, "db upsert_node failed");
-        }
         self.intern_mem(parent, node)
     }
 
@@ -685,9 +843,7 @@ impl State {
     /// This is what keeps `ls` on a large folder quick: one commit for the
     /// listing, rather than one autocommit — and one fsync — per child.
     pub(crate) fn intern_batch(&mut self, parent: u64, nodes: Vec<Node>) -> Vec<u64> {
-        if let Err(e) = self.db.upsert_nodes(&nodes) {
+        self.outbox.push(DbWrite::Upsert(nodes.clone()));
-            warn!(error = %e, "db upsert_nodes failed");
-        }
         nodes
             .into_iter()
             .map(|node| self.intern_mem(parent, node))
@@ -769,9 +925,7 @@ impl State {
     /// `(parent_ino, name)` when the node was known, so the caller can notify
     /// the kernel.
     pub(crate) fn forget(&mut self, uid: &NodeUid) -> Option<(u64, String)> {
-        if let Err(e) = self.db.delete_node(uid) {
+        self.outbox.push(DbWrite::Delete(uid.clone()));
-            warn!(%uid, error = %e, "db delete_node failed");
-        }
         self.forget_mem(uid)
     }
 
@@ -834,9 +988,7 @@ impl State {
                 kids.push(ino);
             }
         }
-        if let Err(e) = self.db.upsert_node(&node) {
+        self.outbox.push(DbWrite::Upsert(vec![node]));
-            warn!(uid = %node.uid, error = %e, "db upsert_node failed for a queued rename");
-        }
         self.recompute_descendant_access(ino);
     }
 
@@ -851,9 +1003,7 @@ impl State {
         self.children.remove(&ino);
         if let Some(e) = self.entries.get(&ino) {
             let uid = e.uid.clone();
-            if let Err(err) = self.db.set_listed(&uid, false) {
+            self.outbox.push(DbWrite::SetListed(uid, false));
-                warn!(%uid, error = %err, "db set_listed(false) failed");
-            }
         }
     }
 
@@ -920,14 +1070,15 @@ impl State {
     /// file is as long as the caller was told it is. Without it a restart serves
     /// the stale size and the file reads as truncated — or empty — while its
     /// bytes sit safely in staging (offline.md Phase 3).
-    pub(crate) fn record_pending_write(&mut self, ino: u64, size: u64, mtime: i64) {
+    /// Returns the node to persist rather than queueing it in the outbox, and is
+    /// the one mutation here whose write-through the caller must do itself:
+    /// failure has to be reported, not logged. Dropping the row silently means
+    /// the daemon acknowledged a write and then serves the old size for it, so
+    /// the caller has to be able to turn it into a failed `release`.
+    pub(crate) fn record_pending_write(&mut self, ino: u64, size: u64, mtime: i64) -> Option<Node> {
         self.set_size(ino, size);
         self.touch_mtime(ino, mtime);
-        if let Some(e) = self.entries.get(&ino)
+        self.entries.get(&ino).map(|e| e.node.clone())
-            && let Err(err) = self.db.upsert_node(&e.node)
-        {
-            warn!(uid = %e.uid, error = %err, "db upsert_node failed for a queued write");
-        }
     }
 }
 
@@ -1008,18 +1159,7 @@ mod tests {
         let dir = TempDir::new();
         let db = Db::open(&dir.0.join("cache.db")).unwrap();
         let share_access = db.all_share_access().unwrap();
-        let st = State {
+        let st = State::new(Arc::new(db), share_access, 1);
-            entries: HashMap::new(),
-            by_uid: HashMap::new(),
-            children: HashMap::new(),
-            next_ino: 1,
-            active_writes: HashMap::new(),
-            handles: HashMap::new(),
-            next_fh: 1,
-            access_changes: HashSet::new(),
-            share_access,
-            db: Arc::new(db),
-        };
         (st, dir)
     }
 
@@ -1032,8 +1172,8 @@ mod tests {
         let f = st.intern(src, node("f", "src", "f.txt", false));
         st.children.insert(src, vec![f]);
         st.children.insert(dst, vec![]);
-        st.db.set_listed(&uid("src"), true).unwrap();
+        st.flushed_db().set_listed(&uid("src"), true).unwrap();
-        st.db.set_listed(&uid("dst"), true).unwrap();
+        st.flushed_db().set_listed(&uid("dst"), true).unwrap();
         (st, dir, src, dst)
     }
 
@@ -1047,11 +1187,17 @@ mod tests {
         st.relocate(f, src, dst, &uid("dst"), "f.txt");
 
         assert!(
-            st.db.children_if_listed(&uid("dst")).unwrap().is_none(),
+            st.flushed_db()
+                .children_if_listed(&uid("dst"))
+                .unwrap()
+                .is_none(),
             "destination re-enumerates: it gained a child whose row was just deleted"
         );
         assert!(
-            st.db.children_if_listed(&uid("src")).unwrap().is_none(),
+            st.flushed_db()
+                .children_if_listed(&uid("src"))
+                .unwrap()
+                .is_none(),
             "source re-enumerates: its listing predates the move, and a stale \
              `listed` flag would hide every later remote change under it"
         );
@@ -1074,12 +1220,41 @@ mod tests {
         let (mut st, _dir, src, _dst) = two_folders();
         let f = st.by_uid[&uid("f")];
         st.relocate(f, src, src, &uid("src"), "renamed.txt");
-        assert!(st.db.children_if_listed(&uid("src")).unwrap().is_none());
+        assert!(
+            st.flushed_db()
+                .children_if_listed(&uid("src"))
+                .unwrap()
+                .is_none()
+        );
         assert!(!st.children.contains_key(&src));
         assert_eq!(st.by_uid.get(&uid("f")), Some(&f), "the inode is stable");
         assert_eq!(st.entries[&f].node.name, "renamed.txt");
     }
 
+    /// DB1: a mutation's write-through must not happen with the inode lock
+    /// held. Interning a listing commits a transaction over every child, and
+    /// every other FUSE callback used to wait behind that for no reason — the
+    /// maps it needs were updated before the first row was written.
+    #[test]
+    fn a_mutation_writes_through_only_after_the_lock_is_released() {
+        let (st, _dir) = state();
+        let db = st.db.clone();
+        let root = uid("root").to_string();
+        let state = parking_lot::Mutex::new(st);
+        {
+            let mut guard = lock_state(&state, &db);
+            guard.intern(0, node("root", "none", "My Files", true));
+            assert!(
+                db.node_by_uid(&root).unwrap().is_none(),
+                "the row must not be written while the lock is held"
+            );
+        }
+        assert!(
+            db.node_by_uid(&root).unwrap().is_some(),
+            "…and must be written by the time the guard is gone"
+        );
+    }
+
     /// The failure mode the fix exists for, stated directly: forgetting the node
     /// prunes it from the resident listing but leaves the DB claiming the source
     /// is fully enumerated. This pins *why* `relocate` cannot just call `forget`.
@@ -1087,7 +1262,7 @@ mod tests {
     fn forget_alone_leaves_the_source_claiming_a_complete_listing() {
         let (mut st, _dir, _src, _dst) = two_folders();
         st.forget(&uid("f"));
-        let listed = st.db.children_if_listed(&uid("src")).unwrap();
+        let listed = st.flushed_db().children_if_listed(&uid("src")).unwrap();
         assert!(
             listed.is_some(),
             "forget does not clear the flag — which is exactly why relocate must"
@@ -1136,7 +1311,7 @@ mod tests {
         assert!(!st.has_children(folder), "cleared memory children");
 
         // DB children
-        st.db
+        st.flushed_db()
             .upsert_node(&node("file2_uid", "dir_uid", "file2.txt", false))
             .unwrap();
         assert!(
@@ -1162,7 +1337,7 @@ mod tests {
         assert_eq!(st.entries[&shared_ino].access, Access::Editor);
         assert_eq!(st.entries[&child].access, Access::Editor);
         assert_eq!(
-            st.db.share_access(&uid("shared")).unwrap(),
+            st.flushed_db().share_access(&uid("shared")).unwrap(),
             Some(Access::Editor)
         );
     }
@@ -1174,8 +1349,8 @@ mod tests {
         let virtual_uid = NodeUid::new(VolumeId::from("virtual"), LinkId::from("sharedwithme"));
         let mut virtual_root = node("placeholder", "root", "Shared with me", true);
         virtual_root.uid = virtual_uid.clone();
-        st.db.upsert_node(&virtual_root).unwrap();
+        st.flushed_db().upsert_node(&virtual_root).unwrap();
-        st.db
+        st.flushed_db()
             .set_share_access(&virtual_uid, Access::Viewer)
             .unwrap();
         let virtual_ino = st.intern_published_share_root(owned_root, virtual_root, Access::Viewer);
@@ -1183,15 +1358,17 @@ mod tests {
         let mut shared = node("shared", "placeholder", "Retained", true);
         shared.parent_uid = Some(virtual_uid.clone());
         shared.membership = Some(membership(6));
-        st.db.upsert_node(&shared).unwrap();
+        st.flushed_db().upsert_node(&shared).unwrap();
-        st.db.set_share_access(&shared.uid, Access::Editor).unwrap();
+        st.flushed_db()
+            .set_share_access(&shared.uid, Access::Editor)
+            .unwrap();
         let shared_ino =
             st.intern_published_share_root(virtual_ino, shared.clone(), Access::Editor);
         let child = st.intern(
             shared_ino,
             node("shared-child", "shared", "pending.txt", false),
         );
-        st.db
+        st.flushed_db()
             .enqueue_op(&pdfs_core::db::PendingOp {
                 id: 0,
                 kind: pdfs_core::db::OP_RENAME.to_string(),
@@ -1209,20 +1386,20 @@ mod tests {
         assert_eq!(st.entries[&shared_ino].access, Access::Editor);
         assert_eq!(st.entries[&child].access, Access::Editor);
 
-        st.db
+        st.flushed_db()
             .publish_shared_roots(&virtual_uid, std::slice::from_ref(&shared.uid), &[])
             .unwrap();
-        let snapshot = st.db.visible_children(&virtual_uid).unwrap();
+        let snapshot = st.flushed_db().visible_children(&virtual_uid).unwrap();
         assert_eq!(snapshot.len(), 1);
         st.intern_published_share_root(virtual_ino, snapshot[0].clone(), Access::Viewer);
 
         assert_eq!(
-            st.db.share_access(&shared.uid).unwrap(),
+            st.flushed_db().share_access(&shared.uid).unwrap(),
             Some(Access::Viewer)
         );
         assert_eq!(st.entries[&shared_ino].access, Access::Viewer);
         assert_eq!(st.entries[&child].access, Access::Viewer);
-        assert_eq!(st.db.pending_ops().unwrap().len(), 1);
+        assert_eq!(st.flushed_db().pending_ops().unwrap().len(), 1);
     }
 
     #[test]
@@ -1233,12 +1410,12 @@ mod tests {
         let child_node = node("offline-child", "offline-share", "nested folder", true);
         let leaf_node = node("offline-leaf", "offline-child", "child.txt", false);
         for node in [&root_node, &shared_node, &child_node, &leaf_node] {
-            st.db.upsert_node(node).unwrap();
+            st.flushed_db().upsert_node(node).unwrap();
         }
-        st.db
+        st.flushed_db()
             .set_share_access(&uid("offline-share"), Access::Viewer)
             .unwrap();
-        st.share_access = st.db.all_share_access().unwrap();
+        st.share_access = st.flushed_db().all_share_access().unwrap();
 
         // Reconstruct in deliberately non-topological order, matching the
         // database hydration path that first allocates every inode and only
@@ -1296,7 +1473,7 @@ mod tests {
     /// `ORPHAN_INO`. `nodes[0]` becomes the mount root.
     fn hydrate_from(st: &mut State, nodes: &[Node]) -> Vec<u64> {
         for node in nodes {
-            st.db.upsert_node(node).unwrap();
+            st.flushed_db().upsert_node(node).unwrap();
         }
         let inos: Vec<u64> = nodes
             .iter()
@@ -1394,10 +1571,10 @@ mod tests {
     #[test]
     fn persisted_authority_outranks_the_own_volume_fail_open() {
         let (mut st, _dir) = state();
-        st.db
+        st.flushed_db()
             .set_share_access(&uid("device-root"), Access::Viewer)
             .unwrap();
-        st.share_access = st.db.all_share_access().unwrap();
+        st.share_access = st.flushed_db().all_share_access().unwrap();
         let nodes = [
             node("root", "none", "My Files", true),
             node("documents", "device-root", "Documents", true),
@@ -1431,7 +1608,7 @@ mod tests {
             assert_eq!(st.require_writable(ino).unwrap_err().code(), libc::EACCES);
         }
         assert_eq!(
-            st.db.share_access(&uid("shared")).unwrap(),
+            st.flushed_db().share_access(&uid("shared")).unwrap(),
             Some(Access::Viewer)
         );
     }
@@ -1441,8 +1618,10 @@ mod tests {
         for persisted in [Access::Viewer, Access::Editor] {
             let (mut st, _dir) = state();
             let owned_root = st.intern(0, node("root", "none", "My Files", true));
-            st.db.set_share_access(&uid("shared"), persisted).unwrap();
+            st.flushed_db()
-            st.share_access = st.db.all_share_access().unwrap();
+                .set_share_access(&uid("shared"), persisted)
+                .unwrap();
+            st.share_access = st.flushed_db().all_share_access().unwrap();
             let shared = st.intern(
                 owned_root,
                 node("shared", "root", "Shared without membership", true),
@@ -1454,7 +1633,10 @@ mod tests {
 
             assert_eq!(st.entries[&shared].access, persisted);
             assert_eq!(st.entries[&child].access, persisted);
-            assert_eq!(st.db.share_access(&uid("shared")).unwrap(), Some(persisted));
+            assert_eq!(
+                st.flushed_db().share_access(&uid("shared")).unwrap(),
+                Some(persisted)
+            );
         }
     }
 
@@ -1462,7 +1644,7 @@ mod tests {
     fn explicit_missing_share_role_fails_closed_and_marks_kernel_attrs() {
         let (mut st, _dir) = state();
         let owned_root = st.intern(0, node("root", "none", "My Files", true));
-        st.db
+        st.flushed_db()
             .set_share_access(&uid("shared"), Access::Editor)
             .unwrap();
         let shared = st.intern(owned_root, node("shared", "root", "Shared", true));
@@ -1474,7 +1656,7 @@ mod tests {
         assert_eq!(st.entries[&shared].access, Access::Viewer);
         assert_eq!(st.entries[&child].access, Access::Viewer);
         assert_eq!(
-            st.db.share_access(&uid("shared")).unwrap(),
+            st.flushed_db().share_access(&uid("shared")).unwrap(),
             Some(Access::Viewer)
         );
         assert!(changed.contains(&shared));
@@ -1491,7 +1673,7 @@ mod tests {
         let virtual_uid = NodeUid::new(VolumeId::from("virtual"), LinkId::from("sharedwithme"));
         let mut virtual_node = node("sharedwithme", "root", "Shared with me", true);
         virtual_node.uid = virtual_uid.clone();
-        st.db
+        st.flushed_db()
             .set_share_access(&virtual_uid, Access::Viewer)
             .unwrap();
         st.share_access.insert(virtual_uid.clone(), Access::Viewer);
@@ -1558,7 +1740,7 @@ mod tests {
         let child = st.intern(shared, node("child", "shared", "folder", true));
         let leaf = st.intern(child, node("leaf", "child", "leaf.txt", false));
 
-        st.db
+        st.flushed_db()
             .set_share_access(&uid("shared"), Access::Viewer)
             .unwrap();
         let changed = st.downgrade_shared_subtree(&uid("shared"));
@@ -1572,7 +1754,7 @@ mod tests {
         assert_eq!(st.entries[&leaf].access, Access::Viewer);
         assert_eq!(st.require_writable(leaf).unwrap_err().code(), libc::EACCES);
         assert_eq!(
-            st.db.effective_node_access(&uid("leaf")).unwrap(),
+            st.flushed_db().effective_node_access(&uid("leaf")).unwrap(),
             Some(Access::Viewer)
         );
 
@@ -1628,7 +1810,7 @@ mod tests {
         let shared = st.intern(owned_root, shared_node);
         let shared_child = st.intern(shared, node("child", "shared", "child.txt", false));
 
-        st.db.downgrade_all_share_access().unwrap();
+        st.flushed_db().downgrade_all_share_access().unwrap();
         let changed = st.downgrade_known_shared_access();
 
         assert!(changed.contains(&shared));
@@ -1652,7 +1834,7 @@ mod tests {
             let parent_link = st.entries[&parent].uid.link_id.to_string();
             parent = st.intern(parent, node(&link, &parent_link, &link, true));
         }
-        st.db.downgrade_all_share_access().unwrap();
+        st.flushed_db().downgrade_all_share_access().unwrap();
 
         let changed = st.downgrade_known_shared_access();
 

crates/pdfs-fuse/src/sweep.rs

@@ -21,6 +21,7 @@
 use std::collections::HashMap;
 use std::time::Duration;
 
+use pdfs_core::batch;
 use pdfs_core::config::SweepMode;
 use pdfs_core::control::ActivityKind;
 use proton_drive_rs::proton_sdk::ids::NodeUid;
@@ -66,10 +67,16 @@ impl Core {
     /// Sweep for stale conflict copies forever, on its own thread. See the module
     /// docs for the identical/divergent policy.
     pub(crate) fn run_conflict_sweep_loop(&self) {
-        std::thread::sleep(CONFLICT_SWEEP_WARMUP);
+        // Both waits are interruptible, so teardown does not have to sit out a
+        // five-minute interval to join this thread (bugs.md B44).
+        if !self.shutdown.sleep(CONFLICT_SWEEP_WARMUP) {
+            return;
+        }
         loop {
             self.sweep_conflicts_once();
-            std::thread::sleep(CONFLICT_SWEEP_INTERVAL);
+            if !self.shutdown.sleep(CONFLICT_SWEEP_INTERVAL) {
+                return;
+            }
         }
     }
 
@@ -137,9 +144,9 @@ impl Core {
     /// enumerated every node up front and has been doing network I/O since. Before
     /// touching anything remote this re-reads the node and refuses to act unless
     /// it is *still* the same revision, still untrashed, still unwritten and still
-    /// unopened. Without that, a user edit landing inside the window is destroyed
+    /// unopened (`docs/BUGS.md` B71). Nothing on this path discards a queued write
-    /// — `discard_queued_ops` below drops the queued write *and its staged blob*,
+    /// or its staged blob: a write that arrives after that check is left for the
-    /// which may hold the only copy of those bytes (`docs/BUGS.md` B71).
+    /// drain to resolve against the now-trashed node.
     fn remove_conflict_copy(&self, snapshot: &proton_drive_rs::Node, base: &str) {
         let uid = &snapshot.uid;
         let name = snapshot.name.as_str();
@@ -149,6 +156,7 @@ impl Core {
         match self
             .rt
             .block_on(self.client.trash_nodes(std::slice::from_ref(uid)))
+            .and_then(batch::into_unit)
         {
             Ok(()) => {}
             Err(e) if super::is_gone(&e) => {}
@@ -164,10 +172,13 @@ impl Core {
         self.for_each_state(|st| {
             st.forget_or_unlink(uid);
         });
-        if let Err(error) = self.discard_queued_ops(uid) {
+        // Deliberately *not* `discard_queued_ops`: `duplicate_still_removable`
-            warn!(%uid, ?error, "conflict sweep: queued-op cleanup failed");
+        // proved the queue empty before the trash above, but that proof is stale
-            return;
+        // the moment `trash_nodes` goes to the network. A `close(2)` landing in
-        }
+        // that window stages bytes, and discarding here would unlink the staged
+        // blob holding the only copy of them. Leaving the op queued is the
+        // non-destructive outcome: the drain re-reads the node, sees it trashed,
+        // and `revision_conflict` routes it to `keep_as_conflict_copy`.
         self.cache.evict(uid);
         self.evict_reader(uid);
         if let Err(e) = self.db.delete_node(uid) {
@@ -192,8 +203,8 @@ impl Core {
         let uid = &snapshot.uid;
         let name = snapshot.name.as_str();
 
-        // A queued op means bytes are still owed an upload. `discard_queued_ops`
+        // A queued op means bytes are still owed an upload; trashing the node
-        // would throw those away along with the staged blob holding them.
+        // under them turns an ordinary upload into a conflict fork.
         match self.db.has_any_op(&uid.to_string()) {
             Ok(false) => {}
             Ok(true) => {

crates/pdfs-fuse/src/sync.rs

@@ -38,6 +38,7 @@ use tracing::{debug, info, warn};
 
 use crate::transfers::{CountingWriter, OwnedCountingReader};
 use crate::{Core, now_secs, parse_uid};
+use pdfs_core::batch;
 use pdfs_core::control::{ActivityKind, TransferDirection};
 use pdfs_core::db::{StoredSyncEntry, StoredSyncFolder};
 use pdfs_core::syncignore::IgnoreRules;
@@ -53,7 +54,7 @@ use engine::{classify, settle_with};
 #[cfg(test)]
 use local_scan::is_write_mode;
 use local_scan::open_for_write_set;
-use model::{LocalItem, Outcome, PassAbort, Pending, RemoteItem};
+use model::{LocalItem, LocalSig, Outcome, PassAbort, Pending, RemoteItem};
 pub(crate) use planner::base_name;
 #[cfg(test)]
 use planner::conflict_path;
@@ -513,7 +514,11 @@ impl Core {
                 let _ = self.db.sync_entry_remove(folder_id, rel);
                 continue;
             };
-            if let Err(e) = self.rt.block_on(self.client.trash_nodes(&[uid])) {
+            if let Err(e) = self
+                .rt
+                .block_on(self.client.trash_nodes(&[uid]))
+                .and_then(batch::into_unit)
+            {
                 warn!(rel, error = %e, "sync: trash remote failed");
                 self.log_activity(ActivityKind::Trash, base_name(rel), e.to_string(), false);
                 outcome.errors += 1;
@@ -682,6 +687,7 @@ impl Core {
                             rel_path: rel.clone(),
                             remote_uid: Some(remote.uid.to_string()),
                             local_mtime: local.mtime,
+                            local_mtime_ns: local.mtime_ns,
                             local_size: local.size,
                             remote_rev: Some(remote.mtime.to_string()),
                             remote_hash: Some(remote.size.to_string()),
@@ -712,6 +718,9 @@ impl Core {
                         uid: remote.uid.clone(),
                         mtime: remote.mtime,
                         size: remote.size,
+                        // What the walk saw here, so the apply step can tell a
+                        // stale plan from a live one before it overwrites.
+                        local: l.map(LocalSig::from),
                     });
                 }
                 FilePlan::Conflict => {
@@ -734,7 +743,9 @@ impl Core {
                     }
                 },
                 FilePlan::DeleteLocal => {
-                    if let Err(e) = std::fs::remove_file(local_root.join(rel_to_path(rel))) {
+                    if let Err(e) =
+                        removed_locally(std::fs::remove_file(local_root.join(rel_to_path(rel))))
+                    {
                         warn!(rel, error = %e, "sync: remove local file failed");
                         self.log_activity(
                             ActivityKind::Trash,
@@ -754,6 +765,7 @@ impl Core {
                     if let Err(e) = self
                         .rt
                         .block_on(self.client.trash_nodes(std::slice::from_ref(&remote.uid)))
+                        .and_then(batch::into_unit)
                     {
                         warn!(rel, error = %e, "sync: trash remote failed");
                         self.log_activity(
@@ -791,7 +803,9 @@ impl Core {
         // Deferred folder deletions, deepest first.
         delete_local_dirs.sort_by_key(|p| std::cmp::Reverse(p.matches('/').count()));
         for rel in delete_local_dirs {
-            if let Err(e) = std::fs::remove_dir_all(local_root.join(rel_to_path(&rel))) {
+            if let Err(e) =
+                removed_locally(std::fs::remove_dir_all(local_root.join(rel_to_path(&rel))))
+            {
                 warn!(rel, error = %e, "sync: remove local folder failed");
                 self.log_activity(ActivityKind::Trash, base_name(&rel), e.to_string(), false);
                 outcome.errors += 1;
@@ -808,7 +822,11 @@ impl Core {
         }
         delete_remote_dirs.sort_by_key(|(p, _)| std::cmp::Reverse(p.matches('/').count()));
         for (rel, uid) in delete_remote_dirs {
-            if let Err(e) = self.rt.block_on(self.client.trash_nodes(&[uid])) {
+            if let Err(e) = self
+                .rt
+                .block_on(self.client.trash_nodes(&[uid]))
+                .and_then(batch::into_unit)
+            {
                 warn!(rel, error = %e, "sync: trash remote folder failed");
                 self.log_activity(ActivityKind::Trash, base_name(&rel), e.to_string(), false);
                 outcome.errors += 1;
@@ -875,6 +893,7 @@ impl Core {
                     LocalItem {
                         is_dir: true,
                         mtime: 0,
+                        mtime_ns: None,
                         size: 0,
                         open_for_write: false,
                     },
@@ -893,6 +912,7 @@ impl Core {
                     LocalItem {
                         is_dir: false,
                         mtime: system_mtime(&meta),
+                        mtime_ns: system_mtime_ns(&meta),
                         size: meta.len() as i64,
                         open_for_write: ofw,
                     },
@@ -1059,6 +1079,7 @@ impl Core {
                     rel_path: rel.to_string(),
                     remote_uid: Some(uid.to_string()),
                     local_mtime: 0,
+                    local_mtime_ns: None,
                     local_size: 0,
                     remote_rev: None,
                     remote_hash: None,
@@ -1182,8 +1203,9 @@ impl Core {
                 uid,
                 mtime,
                 size,
+                local,
             } => {
-                self.download_file(folder_id, local_root, rel, uid, *mtime, *size)
+                self.download_file(folder_id, local_root, rel, uid, *mtime, *size, *local)
                     .await?;
                 Ok(Applied::Downloaded)
             }
@@ -1201,7 +1223,11 @@ impl Core {
                         .map_err(|e| format!("set aside conflict copy for {rel}: {e}"))?;
                     info!(rel, "sync: kept local changes as a conflict copy");
                 }
-                self.download_file(folder_id, local_root, rel, uid, *mtime, *size)
+                // The local copy has just been moved aside, so the state this
+                // download expects to find at the path is "nothing" — anything
+                // that appears while it runs is a *new* racing write, and gets
+                // its own conflict copy rather than being overwritten (B39).
+                self.download_file(folder_id, local_root, rel, uid, *mtime, *size, None)
                     .await?;
                 Ok(Applied::Conflict)
             }
@@ -1240,6 +1266,9 @@ impl Core {
         let file = std::fs::File::open(&path).map_err(|e| format!("open {rel}: {e}"))?;
         let meta = file.metadata().map_err(|e| format!("stat {rel}: {e}"))?;
         let mtime = system_mtime(&meta);
+        // Taken from the descriptor being streamed, so it names the content that
+        // actually goes up rather than whatever is at the path when we finish.
+        let streamed = LocalSig::from(&meta);
         // Count the bytes as they are read, so this upload shows up in
         // `GetQueueStatus` next to a manual one. The uid isn't known until the
         // draft is sealed, so the transfer registers without one.
@@ -1266,7 +1295,9 @@ impl Core {
             )
             .await
             .map_err(|e| format!("upload {rel}: {e}"))?;
-        self.record_file_baseline(folder_id, rel, &path, &uid).await
+        warn_if_torn(rel, &path, streamed);
+        self.record_file_baseline(folder_id, rel, Some(streamed), &uid)
+            .await
     }
 
     /// Upload a changed local file as a new revision of an existing remote node.
@@ -1281,6 +1312,7 @@ impl Core {
         let file = std::fs::File::open(&path).map_err(|e| format!("open {rel}: {e}"))?;
         let meta = file.metadata().map_err(|e| format!("stat {rel}: {e}"))?;
         let mtime = system_mtime(&meta);
+        let streamed = LocalSig::from(&meta);
         let reader = OwnedCountingReader::new(
             file,
             self.transfers.begin(
@@ -1294,11 +1326,20 @@ impl Core {
             .upload_new_revision_from(uid, reader, meta.len() as i64, Vec::new(), Some(mtime))
             .await
             .map_err(|e| format!("upload revision {rel}: {e}"))?;
-        self.record_file_baseline(folder_id, rel, &path, uid).await
+        warn_if_torn(rel, &path, streamed);
+        self.record_file_baseline(folder_id, rel, Some(streamed), uid)
+            .await
     }
 
     /// Download a remote file to its local path (atomically via a temp file),
     /// stamp the local mtime to match the remote, then record baseline.
+    ///
+    /// `expected_local` is the identity planning saw at the destination. The
+    /// rename below is the destructive step, and the download in between can run
+    /// for minutes, so the destination is re-examined right before it: a local
+    /// file that no longer matches the plan is set aside as a conflict copy
+    /// instead of being replaced (bugs.md B39).
+    #[allow(clippy::too_many_arguments)]
     async fn download_file(
         &self,
         folder_id: i64,
@@ -1307,6 +1348,7 @@ impl Core {
         uid: &NodeUid,
         mtime: i64,
         size: i64,
+        expected_local: Option<LocalSig>,
     ) -> Result<(), String> {
         let path = local_root.join(rel_to_path(rel));
         if let Some(parent) = path.parent() {
@@ -1341,6 +1383,13 @@ impl Core {
             out.flush().map_err(|e| format!("flush tmp {rel}: {e}"))?;
             out.sync_all().map_err(|e| format!("sync tmp {rel}: {e}"))?;
         }
+        // The last moment at which the destination can still be saved. Anything
+        // other than the state planning classified means a writer got there
+        // first, and its bytes are the ones nothing else has a copy of.
+        if let Err(e) = keep_racing_local_edit(&path, expected_local) {
+            let _ = std::fs::remove_file(&tmp);
+            return Err(format!("set aside racing local edit for {rel}: {e}"));
+        }
         std::fs::rename(&tmp, &path).map_err(|e| format!("place {rel}: {e}"))?;
         // Match local mtime to the remote's so neither side looks "changed" next pass.
         let f = std::fs::File::options()
@@ -1356,23 +1405,36 @@ impl Core {
                 .and_then(|dir| dir.sync_all())
                 .map_err(|e| format!("sync directory for {rel}: {e}"))?;
         }
-        self.record_file_baseline(folder_id, rel, &path, uid).await
+        // Here the file on disk *is* the transferred content: it was published
+        // by a rename and stamped just above, so its stat is the identity.
+        self.record_file_baseline(folder_id, rel, local_sig(&path), uid)
+            .await
     }
 
-    /// Refresh a file's baseline from ground truth: the local stat and the
+    /// Refresh a file's baseline from ground truth: the local identity these
-    /// remote node's reported signature. Called after every upload/download so
+    /// bytes came from and the remote node's reported signature. Called after
-    /// the very next reconcile sees the path as unchanged.
+    /// every upload/download so the very next reconcile sees the path as
+    /// unchanged.
+    ///
+    /// `local` is the identity the *transferred content* corresponds to, which
+    /// is not always the file's current stat. An upload streams the live file,
+    /// so it passes the identity it read the first byte at: if a writer changed
+    /// the file mid-stream, the remote now holds a torn revision, and recording
+    /// the pre-upload identity is what makes the next pass see the path as
+    /// locally changed and upload a whole, clean revision over it. Recording the
+    /// post-upload stat instead declared the torn revision synchronized and left
+    /// it as the file's content on Drive (bugs.md B40).
     async fn record_file_baseline(
         &self,
         folder_id: i64,
         rel: &str,
-        local_path: &Path,
+        local: Option<LocalSig>,
         uid: &NodeUid,
     ) -> Result<(), String> {
-        let (lmtime, lsize) = match std::fs::metadata(local_path) {
+        let Some(local) = local else {
-            Ok(m) => (system_mtime(&m), m.len() as i64),
+            return Err(format!("stat {rel}: no local identity to baseline"));
-            Err(e) => return Err(format!("stat {rel}: {e}")),
         };
+        let (lmtime, lsize) = (local.mtime, local.size);
         // Re-fetch the node so the stored remote signature is exactly what a walk
         // will report next time.
         let (rmtime, rsize) = match self.client.enumerate_nodes(std::slice::from_ref(uid)).await {
@@ -1392,6 +1454,7 @@ impl Core {
                     rel_path: rel.to_string(),
                     remote_uid: Some(uid.to_string()),
                     local_mtime: lmtime,
+                    local_mtime_ns: local.mtime_ns,
                     local_size: lsize,
                     remote_rev: Some(rmtime.to_string()),
                     remote_hash: Some(rsize.to_string()),
@@ -1401,6 +1464,88 @@ impl Core {
     }
 }
 
+/// Say so when a file changed under an upload that was streaming it.
+///
+/// Purely diagnostic — the correction is already in place, because the baseline
+/// records the identity the upload *read* rather than the one on disk now, so
+/// the next pass classifies the path as locally changed and replaces the torn
+/// revision. Without the log there is nothing in the journal to explain the
+/// extra revision (bugs.md B40).
+fn warn_if_torn(rel: &str, path: &Path, streamed: LocalSig) {
+    let now = local_sig(path);
+    if !now.is_some_and(|now| now.same_content(&streamed)) {
+        warn!(
+            rel,
+            ?streamed,
+            ?now,
+            "sync: file changed while uploading; the remote revision may be torn \
+             and will be replaced on the next pass"
+        );
+    }
+}
+
+/// The identity a reconcile pass uses to recognise a local file it has already
+/// looked at: `None` when nothing is at the path.
+fn local_sig(path: &Path) -> Option<LocalSig> {
+    std::fs::metadata(path).ok().map(|m| LocalSig {
+        mtime: system_mtime(&m),
+        mtime_ns: system_mtime_ns(&m),
+        size: m.len() as i64,
+    })
+}
+
+/// Guard the destination of a download: if what is at `path` is no longer what
+/// planning classified, move it aside as a conflict copy before the caller
+/// renames over it.
+///
+/// A reconcile pass decides what to do from a walk that finished before the
+/// transfer started, and a download of a large file can run for minutes. Without
+/// this, a local edit completed inside that window was replaced by the remote
+/// version with no copy of it kept anywhere — the one shape of loss a sync
+/// engine must not have (bugs.md B39). Keeping the copy makes it re-upload as a
+/// new file on the next pass, which is the same resolution a both-sides-changed
+/// conflict already gets.
+///
+/// A path that is empty when it was expected to be is not a conflict: the
+/// download is about to recreate it, and there is nothing to preserve.
+fn keep_racing_local_edit(path: &Path, expected: Option<LocalSig>) -> std::io::Result<()> {
+    let actual = local_sig(path);
+    let unchanged = match (actual, expected) {
+        (Some(a), Some(e)) => a.same_content(&e),
+        // Nothing there: the download is about to create it, and there is
+        // nothing to preserve either way.
+        (None, _) => true,
+        (Some(_), None) => false,
+    };
+    if unchanged {
+        return Ok(());
+    }
+    warn!(
+        path = %path.display(),
+        ?expected,
+        ?actual,
+        "sync: local file changed while downloading; keeping it as a conflict copy"
+    );
+    preserve_conflict_copy(path, now_secs()).map(|_| ())
+}
+
+/// Read a local removal as the sync engine has to read it: the *state* it was
+/// asking for is "this path is gone", so a path that was already gone is a
+/// success, not a failure.
+///
+/// It matters because the baseline is only dropped on success. Treating
+/// `NotFound` as an error left the baseline in place for a file that no longer
+/// exists, so the same removal was re-attempted and re-reported as an error on
+/// every pass, forever. Every other error is still an error, and keeping the
+/// baseline is exactly right there: the surviving file must not be mistaken for
+/// a new local creation on the next pass and uploaded back (bugs.md B42).
+fn removed_locally(result: std::io::Result<()>) -> std::io::Result<()> {
+    match result {
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        other => other,
+    }
+}
+
 /// Publish a conflict copy without overwriting an earlier conflict bearing the
 /// same timestamp. The original is removed only after the new copy is durable.
 fn preserve_conflict_copy(path: &Path, stamp: i64) -> std::io::Result<PathBuf> {
@@ -1466,10 +1611,77 @@ fn system_mtime(meta: &std::fs::Metadata) -> i64 {
         .map(|d| d.as_secs() as i64)
         .unwrap_or(0)
 }
+
+/// The same modification time in nanoseconds, when the filesystem reports one.
+///
+/// Whole seconds cannot distinguish an edit made in the same second as the last
+/// sync from no edit at all, and if the size did not change either, that file
+/// was never uploaded (bugs.md B25). `None` for a clock or filesystem that
+/// cannot answer, which falls the comparison back to seconds rather than
+/// asserting an mtime of zero.
+fn system_mtime_ns(meta: &std::fs::Metadata) -> Option<i64> {
+    meta.modified()
+        .ok()
+        .and_then(|t| t.duration_since(SystemTime::UNIX_EPOCH).ok())
+        .and_then(|d| i64::try_from(d.as_nanos()).ok())
+}
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    /// A removal of something already gone has produced the state the sync
+    /// engine wanted, so its baseline is dropped rather than retried forever.
+    /// Anything else stays an error and keeps the baseline (bugs.md B42).
+    #[test]
+    fn an_already_absent_path_counts_as_removed() {
+        let root = std::env::temp_dir().join(format!("pdfs-b42-{}", std::process::id()));
+        let missing = root.join("never-existed");
+        assert!(removed_locally(std::fs::remove_file(&missing)).is_ok());
+        assert!(removed_locally(std::fs::remove_dir_all(&missing)).is_ok());
+
+        // A directory in the way of `remove_file` is a real failure, and must
+        // stay one: the file survives, and its baseline has to survive with it.
+        let occupied = root.join("a-directory");
+        std::fs::create_dir_all(&occupied).unwrap();
+        assert!(removed_locally(std::fs::remove_file(&occupied)).is_err());
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    /// The download guard: a destination that still matches the plan is
+    /// replaced silently, one that has moved on since is kept (bugs.md B39).
+    #[test]
+    fn a_download_keeps_a_local_edit_it_did_not_plan_for() {
+        let root = std::env::temp_dir().join(format!("pdfs-b39-{}", std::process::id()));
+        std::fs::create_dir_all(&root).unwrap();
+        let path = root.join("report.txt");
+
+        // Nothing there, nothing expected: the download simply creates it.
+        assert!(keep_racing_local_edit(&path, None).is_ok());
+        assert!(!path.exists());
+
+        // Unchanged since planning: no copy, the caller overwrites it.
+        std::fs::write(&path, b"planned").unwrap();
+        let planned = local_sig(&path).unwrap();
+        keep_racing_local_edit(&path, Some(planned)).unwrap();
+        assert_eq!(std::fs::read(&path).unwrap(), b"planned");
+
+        // Changed since planning: the racing bytes are the only copy of
+        // themselves, so they must survive the overwrite as a conflict copy.
+        std::fs::write(&path, b"a much longer local edit").unwrap();
+        keep_racing_local_edit(&path, Some(planned)).unwrap();
+        let kept: Vec<_> = std::fs::read_dir(&root)
+            .unwrap()
+            .filter_map(|e| e.ok())
+            .map(|e| std::fs::read(e.path()).unwrap_or_default())
+            .collect();
+        assert!(
+            kept.iter()
+                .any(|bytes| bytes == b"a much longer local edit"),
+            "the racing edit must still exist somewhere: {kept:?}"
+        );
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
     /// Feed `n` `Reconcile` events `gap` apart on another thread, starting
     /// immediately. Returns the sender's join handle so the test can keep it
     /// alive (dropping the sender early would look like a disconnect).
@@ -1555,6 +1767,7 @@ mod tests {
 
     fn local_item(is_dir: bool) -> LocalItem {
         LocalItem {
+            mtime_ns: None,
             is_dir,
             mtime: 1,
             size: 1,
@@ -1754,6 +1967,7 @@ mod tests {
                 remote_uid: Some("v~l".into()),
                 local_mtime: 0,
                 local_size: 0,
+                local_mtime_ns: None,
                 remote_rev: Some(mtime.to_string()),
                 remote_hash: Some(size.to_string()),
             },
@@ -1791,6 +2005,7 @@ mod tests {
                 remote_uid: Some("v~l".into()),
                 local_mtime: 0,
                 local_size: 0,
+                local_mtime_ns: None,
                 remote_rev: None,
                 remote_hash: None,
             },
@@ -1805,6 +2020,7 @@ mod tests {
             remote_uid: Some("v~l".into()),
             local_mtime: 10,
             local_size: 20,
+            local_mtime_ns: None,
             remote_rev: Some("1700".into()),
             remote_hash: Some("4096".into()),
         };
@@ -1818,6 +2034,7 @@ mod tests {
             remote_uid: Some("v~l".into()),
             local_mtime: 0,
             local_size: 0,
+            local_mtime_ns: None,
             remote_rev: None,
             remote_hash: None,
         };
@@ -1853,6 +2070,7 @@ mod tests {
             uid: uid(),
             mtime: 0,
             size: 10,
+            local: None,
         };
         assert_eq!(op.kind(), ActivityKind::Download);
     }

crates/pdfs-fuse/src/sync/engine.rs

@@ -32,17 +32,24 @@ pub(crate) enum SyncMsg {
     ReconcileAll,
     /// Re-read the folder set and adjust the filesystem watches (after add/remove).
     Rewatch,
+    /// The daemon is tearing down: finish the current pass and end the engine
+    /// thread, so the mount can join it (bugs.md B44).
+    Stop,
 }
 
 /// Start the sync engine: a control thread that owns the filesystem watcher and
 /// serialises reconcile passes, plus a periodic poll thread. The engine receives
 /// on `rx`; senders live in [`Core::sync_tx`].
-pub(crate) fn spawn(core: Core, rx: Receiver<SyncMsg>) {
+pub(crate) fn spawn(core: Core, rx: Receiver<SyncMsg>) -> Option<std::thread::JoinHandle<()>> {
-    if let Err(e) = std::thread::Builder::new()
+    match std::thread::Builder::new()
         .name("pdfs-sync".into())
         .spawn(move || engine_loop(core, rx))
     {
-        warn!(error = %e, "failed to start sync engine");
+        Ok(handle) => Some(handle),
+        Err(e) => {
+            warn!(error = %e, "failed to start sync engine");
+            None
+        }
     }
 }
 
@@ -74,11 +81,11 @@ fn engine_loop(core: Core, rx: Receiver<SyncMsg>) {
     // Periodic remote poll.
     {
         let tx = core.sync_tx.clone();
+        let shutdown = core.shutdown.clone();
         std::thread::Builder::new()
             .name("pdfs-sync-poll".into())
             .spawn(move || {
-                loop {
+                while shutdown.sleep(POLL_INTERVAL) {
-                    std::thread::sleep(POLL_INTERVAL);
                     if tx.send(SyncMsg::ReconcileAll).is_err() {
                         break;
                     }
@@ -94,8 +101,12 @@ fn engine_loop(core: Core, rx: Receiver<SyncMsg>) {
         let mut ids: HashSet<i64> = HashSet::new();
         let mut all = false;
         let mut do_rewatch = false;
-        classify(msg, &mut ids, &mut all, &mut do_rewatch);
+        if !classify(msg, &mut ids, &mut all, &mut do_rewatch)
-        settle(&rx, &mut ids, &mut all, &mut do_rewatch);
+            || !settle(&rx, &mut ids, &mut all, &mut do_rewatch)
+        {
+            info!("sync engine stopping");
+            return;
+        }
 
         if do_rewatch {
             rewatch(&core, &mut watcher, &watched);
@@ -116,9 +127,9 @@ fn engine_loop(core: Core, rx: Receiver<SyncMsg>) {
 fn poll_only_loop(core: &Core, rx: Receiver<SyncMsg>) {
     {
         let tx = core.sync_tx.clone();
+        let shutdown = core.shutdown.clone();
         std::thread::spawn(move || {
-            loop {
+            while shutdown.sleep(POLL_INTERVAL) {
-                std::thread::sleep(POLL_INTERVAL);
                 if tx.send(SyncMsg::ReconcileAll).is_err() {
                     break;
                 }
@@ -130,8 +141,12 @@ fn poll_only_loop(core: &Core, rx: Receiver<SyncMsg>) {
         let mut ids: HashSet<i64> = HashSet::new();
         let mut all = false;
         let mut do_rewatch = false;
-        classify(msg, &mut ids, &mut all, &mut do_rewatch);
+        if !classify(msg, &mut ids, &mut all, &mut do_rewatch)
-        settle(&rx, &mut ids, &mut all, &mut do_rewatch);
+            || !settle(&rx, &mut ids, &mut all, &mut do_rewatch)
+        {
+            info!("sync engine stopping");
+            return;
+        }
         if all {
             reconcile_all(core);
         } else {
@@ -158,7 +173,7 @@ pub(super) fn settle_with(
     do_rewatch: &mut bool,
     quiet: Duration,
     cap: Duration,
-) {
+) -> bool {
     let deadline = Instant::now() + cap;
     loop {
         let now = Instant::now();
@@ -170,28 +185,49 @@ pub(super) fn settle_with(
         match rx.recv_timeout(wait) {
             // Another event: the burst is still going, so the quiet window
             // starts again from here.
-            Ok(m) => classify(m, ids, all, do_rewatch),
+            // A stop lands mid-burst: give up the rest of the burst rather
+            // than settling for it, and let the caller end the loop.
+            Ok(m) => {
+                if !classify(m, ids, all, do_rewatch) {
+                    return false;
+                }
+            }
             // Quiet for a full window: whatever was being written has stopped.
             Err(RecvTimeoutError::Timeout) => break,
             // Every sender is gone; the caller's loop is about to end anyway.
             Err(RecvTimeoutError::Disconnected) => break,
         }
     }
+    true
 }
 
 /// [`settle_with`] at the real timings.
-fn settle(rx: &Receiver<SyncMsg>, ids: &mut HashSet<i64>, all: &mut bool, do_rewatch: &mut bool) {
+fn settle(
-    settle_with(rx, ids, all, do_rewatch, DEBOUNCE, MAX_SETTLE);
+    rx: &Receiver<SyncMsg>,
+    ids: &mut HashSet<i64>,
+    all: &mut bool,
+    do_rewatch: &mut bool,
+) -> bool {
+    settle_with(rx, ids, all, do_rewatch, DEBOUNCE, MAX_SETTLE)
 }
 
-pub(super) fn classify(msg: SyncMsg, ids: &mut HashSet<i64>, all: &mut bool, rewatch: &mut bool) {
+/// Fold one message into the pending work of the current burst. Returns `false`
+/// for [`SyncMsg::Stop`], which is not work but an instruction to end the loop.
+pub(super) fn classify(
+    msg: SyncMsg,
+    ids: &mut HashSet<i64>,
+    all: &mut bool,
+    rewatch: &mut bool,
+) -> bool {
     match msg {
         SyncMsg::Reconcile(id) => {
             ids.insert(id);
         }
         SyncMsg::ReconcileAll => *all = true,
         SyncMsg::Rewatch => *rewatch = true,
+        SyncMsg::Stop => return false,
     }
+    true
 }
 
 /// Reconcile every mirror folder in turn.

crates/pdfs-fuse/src/sync/model.rs

@@ -2,9 +2,73 @@
 
 use super::*;
 
+/// What a reconcile pass remembers about the local side of one path: enough to
+/// recognise the same content again, and no more.
+///
+/// `mtime_ns` is the whole reason this is a struct rather than a pair — see
+/// [`StoredSyncEntry::local_mtime_ns`](pdfs_core::db::StoredSyncEntry).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(super) struct LocalSig {
+    pub(super) mtime: i64,
+    pub(super) mtime_ns: Option<i64>,
+    pub(super) size: i64,
+}
+
+impl LocalSig {
+    /// Whether these two observations describe the same local content.
+    ///
+    /// Nanoseconds decide it when both sides have them; otherwise the comparison
+    /// falls back to whole seconds, which is what a baseline row written before
+    /// schema 28 — or a filesystem that reports no sub-second time — can support
+    /// (bugs.md B25).
+    pub(super) fn same_content(&self, other: &Self) -> bool {
+        if self.size != other.size {
+            return false;
+        }
+        match (self.mtime_ns, other.mtime_ns) {
+            (Some(a), Some(b)) => a == b,
+            _ => self.mtime == other.mtime,
+        }
+    }
+}
+
+impl From<&LocalItem> for LocalSig {
+    fn from(item: &LocalItem) -> Self {
+        Self {
+            mtime: item.mtime,
+            mtime_ns: item.mtime_ns,
+            size: item.size,
+        }
+    }
+}
+
+impl From<&std::fs::Metadata> for LocalSig {
+    fn from(meta: &std::fs::Metadata) -> Self {
+        Self {
+            mtime: system_mtime(meta),
+            mtime_ns: system_mtime_ns(meta),
+            size: meta.len() as i64,
+        }
+    }
+}
+
+/// The baseline's record of the local side, as [`LocalSig`] compares it.
+impl From<&StoredSyncEntry> for LocalSig {
+    fn from(entry: &StoredSyncEntry) -> Self {
+        Self {
+            mtime: entry.local_mtime,
+            mtime_ns: entry.local_mtime_ns,
+            size: entry.local_size,
+        }
+    }
+}
+
 pub(super) struct LocalItem {
     pub(super) is_dir: bool,
     pub(super) mtime: i64,
+    /// [`LocalItem::mtime`] to nanosecond precision, when the filesystem
+    /// reports one.
+    pub(super) mtime_ns: Option<i64>,
     pub(super) size: i64,
     /// True when another process holds this file open for writing (detected via
     /// `/proc/*/fd`). An open-for-write file is kept in the map — so it is not
@@ -91,11 +155,18 @@ pub(super) enum Pending {
     UploadRevision { rel: String, uid: NodeUid },
     /// Download remote `uid` to the local path, stamping `mtime`. `size` is the
     /// remote's reported size, used as the transfer's expected total.
+    ///
+    /// `local` is what the planning walk saw at this path, or `None` if nothing
+    /// was there. A download can run for minutes, so the apply step revalidates
+    /// against it immediately before it renames over the destination: a writer
+    /// that finished an edit in the meantime must not be overwritten without a
+    /// conflict copy (bugs.md B39).
     Download {
         rel: String,
         uid: NodeUid,
         mtime: i64,
         size: i64,
+        local: Option<LocalSig>,
     },
     /// Both sides changed: set the local copy aside, then download remote `uid`.
     Conflict {

crates/pdfs-fuse/src/sync/planner.rs

@@ -218,7 +218,10 @@ pub(super) fn plan_file(
     }
 
     let local_changed = local.is_some_and(|item| {
-        baseline.is_none_or(|base| base.local_mtime != item.mtime || base.local_size != item.size)
+        // Nanoseconds where both sides have them (bugs.md B25): whole seconds
+        // could not see an edit made in the same second as the last sync that
+        // left the file the same length, so it was never uploaded.
+        baseline.is_none_or(|base| !LocalSig::from(item).same_content(&LocalSig::from(base)))
     });
     let remote_changed = remote.is_some_and(|item| {
         baseline.is_none_or(|base| remote_sig(base) != Some((item.mtime, item.size)))
@@ -252,6 +255,7 @@ mod file_plan_tests {
 
     fn local(mtime: i64, size: i64) -> LocalItem {
         LocalItem {
+            mtime_ns: None,
             is_dir: false,
             mtime,
             size,
@@ -278,12 +282,49 @@ mod file_plan_tests {
             rel_path: "file".into(),
             remote_uid: Some("v~l".into()),
             local_mtime,
+            local_mtime_ns: None,
             local_size,
             remote_rev: Some(remote_mtime.to_string()),
             remote_hash: Some(remote_size.to_string()),
         }
     }
 
+    /// Whole seconds cannot see an edit made inside the same second that leaves the
+    /// file the same length, so a mirror silently stopped uploading it. With a
+    /// nanosecond time on both sides it is an ordinary local change (bugs.md B25).
+    #[test]
+    fn a_same_second_same_size_edit_is_still_a_local_change() {
+        let mut base = baseline(10, 20, 30, 40);
+        base.local_mtime_ns = Some(10_000_000_000);
+        let edited = LocalItem {
+            mtime_ns: Some(10_400_000_000),
+            ..local(10, 20)
+        };
+        let remote = remote(30, 40);
+        assert_eq!(
+            plan_file(Some(&edited), Some(&remote), Some(&base)),
+            FilePlan::UploadRevision
+        );
+
+        // The same file untouched still reads as unchanged.
+        let same = LocalItem {
+            mtime_ns: Some(10_000_000_000),
+            ..local(10, 20)
+        };
+        assert_eq!(
+            plan_file(Some(&same), Some(&remote), Some(&base)),
+            FilePlan::Unchanged
+        );
+
+        // And a row from before the column exists compares on seconds, exactly
+        // as it did when it was written — no mass re-upload on upgrade.
+        let old = baseline(10, 20, 30, 40);
+        assert_eq!(
+            plan_file(Some(&edited), Some(&remote), Some(&old)),
+            FilePlan::Unchanged
+        );
+    }
+
     #[test]
     fn file_plan_covers_every_presence_and_change_shape() {
         let same_local = local(10, 20);

crates/pdfs-fuse/src/transfers.rs

@@ -19,7 +19,7 @@ use parking_lot::Mutex;
 use std::collections::HashMap;
 use std::io::{Read, Write};
 use std::sync::Arc;
-use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
 use std::time::Instant;
 
 use pdfs_core::control::{JobItem, TransferDirection, TransferItem};
@@ -272,20 +272,50 @@ impl<R: Read> Read for OwnedCountingReader<R> {
     }
 }
 
-/// A [`Read`] that tallies bytes read through a [`TransferGuard`] (upload path).
+/// A [`Read`] that tallies bytes read through a [`TransferGuard`] (upload path),
+/// and can be told to stop.
 pub struct CountingReader<'a, R> {
     inner: R,
     guard: &'a TransferGuard,
+    cancel: Option<Arc<AtomicBool>>,
 }
 
 impl<'a, R: Read> CountingReader<'a, R> {
     pub fn new(inner: R, guard: &'a TransferGuard) -> Self {
-        Self { inner, guard }
+        Self {
+            inner,
+            guard,
+            cancel: None,
+        }
+    }
+
+    /// Abandon the upload as soon as the SDK asks for its next bytes when
+    /// `cancel` is set.
+    ///
+    /// This is the only cancellation point an upload has: the SDK takes a plain
+    /// blocking [`Read`] and pulls from it a block at a time, so refusing to
+    /// hand over the next block is what stops it. Used when a newer revision of
+    /// the same file is queued — the bytes on the wire have already been
+    /// superseded, and finishing them only spends uplink on a revision the next
+    /// op replaces.
+    pub fn with_cancel(mut self, cancel: Arc<AtomicBool>) -> Self {
+        self.cancel = Some(cancel);
+        self
     }
 }
 
 impl<R: Read> Read for CountingReader<'_, R> {
     fn read(&mut self, buf: &mut [u8]) -> std::io::Result<usize> {
+        if let Some(cancel) = &self.cancel
+            && cancel.load(Ordering::Relaxed)
+        {
+            // Not `Ok(0)`: a short read is how this reader says "end of file",
+            // and the SDK would seal a truncated revision from it.
+            return Err(std::io::Error::new(
+                std::io::ErrorKind::Interrupted,
+                "upload superseded by a newer write",
+            ));
+        }
         let n = self.inner.read(buf)?;
         self.guard.add(n as u64);
         Ok(n)

crates/pdfs-fuse/src/upload.rs

@@ -171,7 +171,7 @@ impl Core {
                     stats.bytes += size;
                     match self.fetch_node(&uid) {
                         Ok(node) => {
-                            let mut st = self.state.lock();
+                            let mut st = self.state();
                             let ino = st.intern(parent_ino, node);
                             if let Some(kids) = st.children.get_mut(&parent_ino)
                                 && !kids.contains(&ino)
@@ -216,7 +216,7 @@ impl Core {
         self.ensure_children(pino)
             .map_err(|e| self.errno_error(e, "enumerate"))?;
         let existing = {
-            let st = self.state.lock();
+            let st = self.state();
             st.children.get(&pino).and_then(|kids| {
                 kids.iter().find_map(|ino| {
                     st.entries
@@ -243,7 +243,7 @@ impl Core {
         let node = self
             .fetch_node(&new_uid)
             .map_err(|e| self.errno_error(e, "fetch node"))?;
-        let mut st = self.state.lock();
+        let mut st = self.state();
         let ino = st.intern(pino, node);
         if let Some(kids) = st.children.get_mut(&pino)
             && !kids.contains(&ino)

crates/pdfs-gui/src/activation.rs

@@ -1,12 +1,17 @@
 //! Shared Drive-result activation policy for the GTK browser and quick prompt.
 //!
 //! Media should be handed to its mounted path so players can issue range reads
-//! through FUSE. Other files retain the materialize-then-open behaviour because
+//! through FUSE. Everything else opens through the mount too whenever the mount
-//! many desktop applications expect a stable ordinary file.
+//! exposes it, and only falls back to materialize-then-open when it does not —
+//! see [`mounted_target`].
+//!
+//! Both binaries `#[path]`-include this file, so each compiles its own copy and
+//! anything only one of them calls looks dead in the other. That is what the
+//! `dead_code` allowances below are for — not code nobody uses.
 
 use std::path::{Path, PathBuf};
 
-use pdfs_core::control::PhotoKind;
+use pdfs_core::control::{PhotoKind, SearchHit};
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub(crate) enum DriveActivation {
@@ -29,6 +34,49 @@ pub(crate) fn mounted_path(mountpoint: &Path, relative_path: &str) -> PathBuf {
     mountpoint.join(relative_path)
 }
 
+/// Where a Drive hit should be opened from, when a mount exposes it.
+///
+/// Materialised content is a *copy*: it lives in the cache under its content
+/// hash, so an editor saving into it writes somewhere Drive will never look,
+/// and the cache is free to evict it afterwards. The mounted path is the real
+/// file — reads pull 4 MiB blocks on demand and a write becomes a new revision
+/// — so it wins for every kind of file, not just streamable media.
+///
+/// [`Request::OpenFile`](pdfs_core::control::Request::OpenFile) stays the
+/// fallback for hits no mount exposes: the search index also covers nodes
+/// outside the mounted tree (a mirror folder's contents, a stale row), and
+/// those can still be read, just not edited in place.
+///
+/// The `stat` is why this returns an `Option` rather than a path: it is the
+/// only way to tell those two cases apart, and it costs one syscall on a path
+/// the caller is about to hand to an application anyway.
+#[allow(dead_code)] // prompt only
+pub(crate) fn mounted_target(mountpoint: &Path, hit: &SearchHit) -> Option<PathBuf> {
+    present(mounted_or_relative(mountpoint, hit))
+}
+
+/// [`mounted_target`] for callers holding a mountpoint-relative path rather
+/// than a search hit — the browser's listing entries, which are by definition
+/// paths in the primary mount's tree.
+#[allow(dead_code)] // browser only
+pub(crate) fn mounted_target_rel(mountpoint: &Path, relative_path: &str) -> Option<PathBuf> {
+    present(mounted_path(mountpoint, relative_path))
+}
+
+fn present(path: PathBuf) -> Option<PathBuf> {
+    path.symlink_metadata().is_ok().then_some(path)
+}
+
+/// The mount path for a hit, whether or not anything is there — for callers
+/// that have no fallback (a folder cannot be materialised) or already know the
+/// entry came from a mount listing.
+#[allow(dead_code)] // prompt only
+pub(crate) fn mounted_or_relative(mountpoint: &Path, hit: &SearchHit) -> PathBuf {
+    hit.mounted_path
+        .as_deref()
+        .map_or_else(|| mounted_path(mountpoint, &hit.path), PathBuf::from)
+}
+
 fn is_streamable_media(name: &str) -> bool {
     if PhotoKind::classify(Some(name), None) == PhotoKind::Video {
         return true;

crates/pdfs-gui/src/app/main.rs

@@ -18,6 +18,7 @@ use pages::trash::*;
 use pages::verify::*;
 use widgets::details::*;
 use widgets::share_dialog::*;
+use widgets::versions_dialog::*;
 
 use std::cell::{Cell, RefCell};
 
@@ -424,6 +425,8 @@ fn build_window(app: &adw::Application) {
             dates: gallery_widgets.dates.clone(),
             date_ranges: RefCell::new(vec![None]),
             range: Cell::new(None),
+            favorites_btn: gallery_widgets.favorites_btn.clone(),
+            favorites: Cell::new(false),
             date_suppress: Cell::new(false),
             loading: Cell::new(false),
             width: Cell::new(0),
@@ -993,11 +996,18 @@ fn capitalize(s: &str) -> String {
     }
 }
 
-/// Open a local path with the user's default handler.
+/// Open a local path with the handler the user configured — `xdg-open` unless
+/// `open_with` in `config.json` overrides it for this kind of file.
 fn open_path(path: &str) {
-    if let Err(e) = Command::new("xdg-open").arg(path).spawn() {
+    let path = Path::new(path);
-        tracing::error!("xdg-open {path} failed: {e}");
+    pdfs_core::opener::open_default(path, path.is_dir());
-    }
+}
+
+/// [`open_path`] for a file the daemon materialised into the content cache,
+/// where the on-disk name is a content hash and carries no extension for the
+/// rules (or `xdg-open`) to key off. `name` is the Drive name it was opened as.
+pub(crate) fn open_named_path(path: &str, name: &str) {
+    pdfs_core::opener::open_default_named(Path::new(path), name, false);
 }
 
 /// Format a byte count as a short binary-unit string (e.g. `1.2 GiB`).

crates/pdfs-gui/src/app/pages/browser.rs

@@ -1,4 +1,4 @@
-use crate::activation::{DriveActivation, drive_activation, mounted_path};
+use crate::activation::{DriveActivation, drive_activation, mounted_path, mounted_target_rel};
 use crate::*;
 
 pub(crate) struct BrowserState {
@@ -659,21 +659,35 @@ pub(crate) fn activate_entry(ui: &Rc<Ui>, entry: &DirEntry) {
     }
 }
 
-/// Download a file's full content into the cache and hand it to the user's
+/// Hand a file to the user's default application: through the mount when it is
-/// default application. The download-and-open path behind both a plain
+/// there, otherwise downloaded into the cache first. The open path behind both
-/// double-click and the context menu's "Open" (including for a video, when the
+/// a plain double-click and the context menu's "Open" (including for a video,
-/// user explicitly wants a local copy rather than to stream it).
+/// when the user wants their default application rather than the player).
+///
+/// The mount comes first because the cache blob is a *copy* keyed by content
+/// hash — an application saving into it writes where Drive will never look, and
+/// the cache may evict it afterwards. See
+/// [`mounted_target`](crate::activation::mounted_target).
 pub(crate) fn download_and_open(ui: &Rc<Ui>, entry: &DirEntry) {
     let rel = entry_rel(ui, entry);
+    let mountpoint = ui.dirs.resolved_mountpoint(&ui.dirs.load_config());
+    if let Some(path) = mounted_target_rel(&mountpoint, &rel) {
+        open_path(&path.to_string_lossy());
+        return;
+    }
     // Ignore a repeat activation of a file already downloading, so an impatient
     // double-click doesn't kick off a second round-trip.
     if !ui.opening.borrow_mut().insert(rel.clone()) {
         return;
     }
     ui.busy_begin();
+    let name = entry.name.clone();
     let rx = spawn_request(
         ui.dirs.control_socket(),
-        Request::OpenFile { path: rel.clone() },
+        Request::OpenFile {
+            path: rel.clone(),
+            uid: Some(entry.uid.clone()),
+        },
     );
     let ui = ui.clone();
     glib::spawn_future_local(async move {
@@ -681,7 +695,9 @@ pub(crate) fn download_and_open(ui: &Rc<Ui>, entry: &DirEntry) {
         ui.busy_end();
         ui.opening.borrow_mut().remove(&rel);
         match result {
-            Ok(Ok(Response::FilePath { path })) => open_path(&path),
+            // A cache blob is named by content hash: match the open rules
+            // against the Drive name the user clicked, not that path.
+            Ok(Ok(Response::FilePath { path })) => open_named_path(&path, &name),
             Ok(Ok(Response::Error { message, kind })) => {
                 toast_failure(&ui, "Couldn't open file", &message, kind)
             }

crates/pdfs-gui/src/app/pages/photo_viewer.rs

@@ -19,6 +19,11 @@ pub(crate) struct Viewer {
     pub(crate) info_map: gtk4::Button,
     /// Coordinates behind `info_map`, once a photo with GPS tags is shown.
     pub(crate) coords: RefCell<Option<(f64, f64)>>,
+    /// The favourite toggle in the top bar, and whether it is being set from
+    /// the model rather than by the user — the same suppression the details pane
+    /// uses for its pin switch, so painting a photo doesn't fire a round-trip.
+    pub(crate) favorite: gtk4::ToggleButton,
+    pub(crate) favorite_suppress: Cell<bool>,
     /// uid of the photo currently on screen.
     pub(crate) uid: RefCell<String>,
     /// On-disk path of the full-size photo, once it has been downloaded.
@@ -41,6 +46,38 @@ pub(crate) struct ExifInfo {
     pub(crate) coords: Option<(f64, f64)>,
 }
 
+/// Paint the favourite toggle without firing its handler.
+pub(crate) fn show_favorite(viewer: &Rc<Viewer>, favorite: bool) {
+    viewer.favorite_suppress.set(true);
+    viewer.favorite.set_active(favorite);
+    set_favorite_icon(&viewer.favorite, favorite);
+    viewer.favorite_suppress.set(false);
+}
+
+/// Filled star for a favourite, outline for the rest.
+fn set_favorite_icon(button: &gtk4::ToggleButton, favorite: bool) {
+    button.set_icon_name(if favorite {
+        "starred-symbolic"
+    } else {
+        "non-starred-symbolic"
+    });
+}
+
+/// Write a favourite change back into the loaded gallery page, so returning to
+/// the grid (or reopening the photo) shows what was just set without a reload.
+fn set_gallery_favorite(ui: &Rc<Ui>, uid: &str, favorite: bool) {
+    let Some(idx) = find_photo_index(&ui.gallery.model, uid) else {
+        return;
+    };
+    let Some(boxed) = ui.gallery.model.item(idx).and_downcast::<BoxedAnyObject>() else {
+        return;
+    };
+    let mut item = boxed.borrow::<PhotoItem>().clone();
+    item.favorite = favorite;
+    ui.gallery.model.remove(idx);
+    ui.gallery.model.insert(idx, &BoxedAnyObject::new(item));
+}
+
 /// Show the photo behind `uid`: paint its (already cached) thumbnail immediately
 /// so the lightbox never opens on a blank screen, ask the daemon for the
 /// full-size file, and swap it in — plus its EXIF — when it lands.
@@ -52,6 +89,14 @@ pub(crate) fn load_photo(ui: &Rc<Ui>, viewer: &Rc<Viewer>, uid: String) {
     *viewer.path.borrow_mut() = None;
     clear_info(viewer);
 
+    // The favourite state comes from the timeline page the gallery already has,
+    // so the button is right on the first frame instead of after a round-trip.
+    let favorite = find_photo_index(&ui.gallery.model, &uid)
+        .and_then(|idx| ui.gallery.model.item(idx))
+        .and_downcast::<BoxedAnyObject>()
+        .is_some_and(|boxed| boxed.borrow::<PhotoItem>().favorite);
+    show_favorite(viewer, favorite);
+
     // The thumbnail the gallery already decoded stands in for the full photo
     // while it downloads: blurry for a moment beats black for a second.
     match ui.gallery.photo_tex.borrow().get(&uid) {
@@ -450,6 +495,14 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
     info_toggle.add_css_class("flat");
     info_toggle.add_css_class("viewer-action-btn");
 
+    let favorite_btn = gtk4::ToggleButton::builder()
+        .icon_name("non-starred-symbolic")
+        .tooltip_text("Favourite")
+        .valign(gtk4::Align::Center)
+        .build();
+    favorite_btn.add_css_class("flat");
+    favorite_btn.add_css_class("viewer-action-btn");
+
     let download_btn = action("document-save-symbolic", "Save a copy…");
     let open_ext_btn = action("document-open-symbolic", "Open with another app");
     let close_btn = action("window-close-symbolic", "Close (Esc)");
@@ -460,6 +513,7 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
     top_bar.set_valign(gtk4::Align::Start);
     top_bar.set_hexpand(true);
     top_bar.append(&titles);
+    top_bar.append(&favorite_btn);
     top_bar.append(&info_toggle);
     top_bar.append(&download_btn);
     top_bar.append(&open_ext_btn);
@@ -558,6 +612,8 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
         info_revealer: info_revealer.clone(),
         info_rows,
         info_map: info_map.clone(),
+        favorite: favorite_btn.clone(),
+        favorite_suppress: Cell::new(false),
         coords: RefCell::new(None),
         uid: RefCell::new(initial_uid.clone()),
         path: RefCell::new(None),
@@ -601,6 +657,44 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
         }
     });
 
+    let ui_fav = ui.clone();
+    let viewer_fav = viewer.clone();
+    favorite_btn.connect_toggled(move |btn| {
+        if viewer_fav.favorite_suppress.get() {
+            return;
+        }
+        let favorite = btn.is_active();
+        set_favorite_icon(btn, favorite);
+        let uid = viewer_fav.uid.borrow().clone();
+        let rx = spawn_request(
+            ui_fav.dirs.control_socket(),
+            Request::SetPhotoFavorite {
+                uid: uid.clone(),
+                favorite,
+            },
+        );
+        let ui_result = ui_fav.clone();
+        let viewer_result = viewer_fav.clone();
+        glib::spawn_future_local(async move {
+            let failed = match rx.recv().await {
+                Ok(Ok(Response::Ok { .. })) => {
+                    set_gallery_favorite(&ui_result, &uid, favorite);
+                    None
+                }
+                Ok(Ok(Response::Error { message, .. })) => Some(message),
+                _ => Some("The mount service didn't respond.".to_string()),
+            };
+            if let Some(detail) = failed {
+                toast_error(&ui_result, "Couldn't change the favourite", &detail);
+                // The server refused, so the button must go back to describing
+                // what is actually stored — without firing this handler again.
+                if *viewer_result.uid.borrow() == uid {
+                    show_favorite(&viewer_result, !favorite);
+                }
+            }
+        });
+    });
+
     let w_download = window.clone();
     let viewer_download = viewer.clone();
     download_btn.connect_clicked(move |_| {

crates/pdfs-gui/src/app/pages/photos.rs

@@ -63,6 +63,10 @@ pub(crate) struct GalleryState {
     /// The capture-time window the timeline is currently filtered to, or `None`
     /// for the whole span. Read by [`load_gallery`], set by the date dropdown.
     pub(crate) range: Cell<Option<(i64, i64)>>,
+    /// The favourites toggle, and whether it is on. When on, the timeline is
+    /// restricted to photos carrying Proton's `Favorite` tag.
+    pub(crate) favorites_btn: gtk4::ToggleButton,
+    pub(crate) favorites: Cell<bool>,
     /// Set while the date dropdown is being repopulated, so resetting its model
     /// doesn't fire the selection handler and kick off a spurious reload.
     pub(crate) date_suppress: Cell<bool>,
@@ -188,6 +192,7 @@ pub(crate) struct GalleryWidgets {
     /// The All / Photos / Videos / Raw filter toggles, in that order (index maps
     /// to [`kind_for_tab`]).
     pub(crate) tabs: [gtk4::ToggleButton; 4],
+    pub(crate) favorites_btn: gtk4::ToggleButton,
     /// The date-jump dropdown, populated with the timeline's months.
     pub(crate) dates: gtk4::DropDown,
 }
@@ -314,6 +319,15 @@ pub(crate) fn build_gallery_page() -> (gtk4::Widget, GalleryWidgets) {
         tab_group.append(btn);
     }
 
+    // Favourites: a filter, not a tab — it cuts across Photos / Videos / Raw, so
+    // it stays outside the segmented control rather than becoming a fifth option
+    // that would silently drop the kind the user picked.
+    let favorites_btn = gtk4::ToggleButton::builder()
+        .icon_name("starred-symbolic")
+        .tooltip_text("Show only favourites")
+        .build();
+    favorites_btn.add_css_class("pill");
+
     // Date jump: "All dates" plus a row per month, filled in once the timeline's
     // months are known (see [`refresh_photo_months`]). Pushed to the far end of
     // the filter row, opposite the kind toggles.
@@ -326,6 +340,7 @@ pub(crate) fn build_gallery_page() -> (gtk4::Widget, GalleryWidgets) {
     let filters = gtk4::Box::new(gtk4::Orientation::Horizontal, 8);
     filters.set_hexpand(true);
     filters.append(&tab_group);
+    filters.append(&favorites_btn);
     let spacer = gtk4::Box::new(gtk4::Orientation::Horizontal, 0);
     spacer.set_hexpand(true);
     filters.append(&spacer);
@@ -415,6 +430,7 @@ pub(crate) fn build_gallery_page() -> (gtk4::Widget, GalleryWidgets) {
             upload,
             refresh,
             tabs,
+            favorites_btn,
             dates,
             albums,
             albums_stack,
@@ -679,6 +695,19 @@ pub(crate) fn wire_gallery(ui: &Rc<Ui>, list: &gtk4::ListView, scroll: &gtk4::Sc
         });
     }
 
+    // Favourites: reload the timeline restricted to favourites (or back to all).
+    // Independent of the kind tabs and the date jump, both of which keep their
+    // current value across the toggle.
+    let ui_fav = ui.clone();
+    ui.gallery.favorites_btn.connect_toggled(move |btn| {
+        let on = btn.is_active();
+        if ui_fav.gallery.favorites.get() == on {
+            return;
+        }
+        ui_fav.gallery.favorites.set(on);
+        load_gallery(&ui_fav, false);
+    });
+
     // Date jump: selecting a month loads that window; "All dates" (row 0) clears
     // it. Skipped while the model is being repopulated (see `gallery_date_suppress`).
     let ui_dates = ui.clone();
@@ -1378,6 +1407,7 @@ pub(crate) fn load_gallery(ui: &Rc<Ui>, append: bool) {
             limit: PHOTOS_PAGE,
             kind: ui.gallery.kind.get(),
             range: ui.gallery.range.get(),
+            favorites: ui.gallery.favorites.get(),
         },
     };
     let rx = spawn_request(ui.dirs.control_socket(), request);

crates/pdfs-gui/src/app/pages/shared.rs

@@ -388,12 +388,15 @@ fn open_shared_file(ui: &Rc<Ui>, uid: &str, name: &str) {
     );
     let ui = ui.clone();
     let uid = uid.to_string();
+    let name = name.to_string();
     glib::spawn_future_local(async move {
         let result = rx.recv().await;
         ui.busy_end();
         ui.opening.borrow_mut().remove(&uid);
         match result {
-            Ok(Ok(Response::FilePath { path })) => open_path(&path),
+            // A cache blob is named by content hash, so the open rules key off
+            // the shared node's name instead.
+            Ok(Ok(Response::FilePath { path })) => open_named_path(&path, &name),
             Ok(Ok(Response::Error { message, kind })) => {
                 toast_failure(&ui, "Couldn't open file", &message, kind)
             }

crates/pdfs-gui/src/app/widgets/details.rs

@@ -26,6 +26,8 @@ pub(crate) struct DetailsWidgets {
     pub(crate) pin_row: adw::SwitchRow,
     pub(crate) open_button: gtk4::Button,
     pub(crate) rename_button: gtk4::Button,
+    /// Files only — folders have no revision history.
+    pub(crate) versions_button: gtk4::Button,
     pub(crate) trash_button: gtk4::Button,
     pub(crate) close_button: gtk4::Button,
 }
@@ -96,6 +98,8 @@ pub(crate) fn build_details_pane() -> (gtk4::Widget, DetailsWidgets) {
     open_button.add_css_class("pill");
     let rename_button = gtk4::Button::builder().label("Rename").build();
     rename_button.add_css_class("pill");
+    let versions_button = gtk4::Button::builder().label("Versions").build();
+    versions_button.add_css_class("pill");
     let trash_button = gtk4::Button::builder().label("Move to Trash").build();
     trash_button.add_css_class("destructive-action");
     trash_button.add_css_class("pill");
@@ -104,6 +108,7 @@ pub(crate) fn build_details_pane() -> (gtk4::Widget, DetailsWidgets) {
     actions.set_margin_top(6);
     actions.append(&open_button);
     actions.append(&rename_button);
+    actions.append(&versions_button);
     actions.append(&trash_button);
 
     let inner = gtk4::Box::new(gtk4::Orientation::Vertical, 12);
@@ -137,6 +142,7 @@ pub(crate) fn build_details_pane() -> (gtk4::Widget, DetailsWidgets) {
             pin_row,
             open_button,
             rename_button,
+            versions_button,
             trash_button,
             close_button,
         },
@@ -190,6 +196,16 @@ pub(crate) fn wire_details(ui: &Rc<Ui>) {
             prompt_rename(&ui_rename, &entry);
         }
     });
+    let ui_versions = ui.clone();
+    ui.details
+        .details
+        .versions_button
+        .connect_clicked(move |_| {
+            let entry = ui_versions.details.details_entry.borrow().clone();
+            if let Some(entry) = entry {
+                open_versions_dialog(&ui_versions, &entry);
+            }
+        });
     let ui_trash = ui.clone();
     ui.details.details.trash_button.connect_clicked(move |_| {
         let entry = ui_trash.details.details_entry.borrow().clone();
@@ -246,6 +262,9 @@ pub(crate) fn show_details(ui: &Rc<Ui>, entry: &DirEntry) {
     d.pin_row.set_sensitive(*ui.mounted.borrow());
     d.open_button
         .set_label(if entry.is_dir { "Open folder" } else { "Open" });
+    // Only files have revisions, and only a connected daemon can fetch them.
+    d.versions_button.set_visible(!entry.is_dir);
+    d.versions_button.set_sensitive(*ui.mounted.borrow());
     ui.details.details_suppress.set(false);
 
     *ui.details.details_entry.borrow_mut() = Some(entry.clone());

crates/pdfs-gui/src/app/widgets/mod.rs

@@ -1,2 +1,3 @@
 pub(crate) mod details;
 pub(crate) mod share_dialog;
+pub(crate) mod versions_dialog;

crates/pdfs-gui/src/app/widgets/versions_dialog.rs

@@ -0,0 +1,353 @@
+//! The per-file **Versions** dialog: what Proton Drive still holds of a file's
+//! earlier content, and the three things a user can do with one.
+//!
+//! Every row is one revision the server kept. Restoring re-points the file at an
+//! old revision (server-side, so nothing is uploaded and the mount may take a
+//! moment to catch up); saving writes an old revision out to a local file
+//! without touching the live one; deleting is permanent, and the active revision
+//! cannot be deleted at all — that row simply has no delete button.
+
+use crate::*;
+
+use pdfs_core::control::RevisionInfo;
+
+/// How an open Versions dialog addresses its file — the same split as
+/// [`ShareTarget`](super::share_dialog::ShareTarget), for the same reason: a
+/// node reached from Shared or a device folder may have no path in the primary
+/// mount's namespace, and an older daemon must reject the request rather than
+/// resolve an empty path to the mount root.
+pub(crate) enum VersionTarget {
+    Path(String),
+    Uid(String),
+}
+
+impl VersionTarget {
+    fn list(&self) -> Request {
+        match self {
+            VersionTarget::Path(path) => Request::ListRevisions { path: path.clone() },
+            VersionTarget::Uid(uid) => Request::ListRevisionsByUid { uid: uid.clone() },
+        }
+    }
+
+    fn restore(&self, revision_id: String) -> Request {
+        match self {
+            VersionTarget::Path(path) => Request::RestoreRevision {
+                path: path.clone(),
+                revision_id,
+            },
+            VersionTarget::Uid(uid) => Request::RestoreRevisionByUid {
+                uid: uid.clone(),
+                revision_id,
+            },
+        }
+    }
+
+    fn delete(&self, revision_id: String) -> Request {
+        match self {
+            VersionTarget::Path(path) => Request::DeleteRevision {
+                path: path.clone(),
+                revision_id,
+            },
+            VersionTarget::Uid(uid) => Request::DeleteRevisionByUid {
+                uid: uid.clone(),
+                revision_id,
+            },
+        }
+    }
+
+    fn save_as(&self, revision_id: String, dest: String) -> Request {
+        match self {
+            VersionTarget::Path(path) => Request::SaveRevisionAs {
+                path: path.clone(),
+                revision_id,
+                dest,
+            },
+            VersionTarget::Uid(uid) => Request::SaveRevisionAsByUid {
+                uid: uid.clone(),
+                revision_id,
+                dest,
+            },
+        }
+    }
+}
+
+/// The state behind an open Versions dialog, so an action can rebuild the list
+/// in place instead of tearing the dialog down.
+pub(crate) struct VersionsDialog {
+    pub(crate) ui: Rc<Ui>,
+    pub(crate) target: VersionTarget,
+    /// The file's name, for the save dialog's suggested filename and for toasts.
+    pub(crate) name: String,
+    pub(crate) group: adw::PreferencesGroup,
+    pub(crate) rows: RefCell<Vec<gtk4::Widget>>,
+}
+
+/// Open the Versions dialog for a file.
+pub(crate) fn open_versions_dialog(ui: &Rc<Ui>, entry: &DirEntry) {
+    if !*ui.mounted.borrow() {
+        toast_error(ui, "Can't load versions", "Proton Drive isn't connected.");
+        return;
+    }
+    if entry.is_dir {
+        toast_error(ui, "No versions", "Folders don't have versions.");
+        return;
+    }
+    let target = if entry.path.is_empty() {
+        VersionTarget::Uid(entry.uid.clone())
+    } else {
+        VersionTarget::Path(entry_rel(ui, entry))
+    };
+
+    let toolbar = adw::ToolbarView::new();
+    let header = adw::HeaderBar::new();
+    header.set_title_widget(Some(&adw::WindowTitle::new("Versions", &entry.name)));
+    toolbar.add_top_bar(&header);
+
+    let group = adw::PreferencesGroup::builder()
+        .title("Version history")
+        .description("Proton Drive keeps earlier versions of a file until you delete them.")
+        .build();
+
+    let content = gtk4::Box::new(gtk4::Orientation::Vertical, 18);
+    content.set_margin_top(12);
+    content.set_margin_bottom(12);
+    content.set_margin_start(12);
+    content.set_margin_end(12);
+    content.append(&group);
+    let clamp = adw::Clamp::builder().child(&content).build();
+    let scroll = gtk4::ScrolledWindow::builder()
+        .vexpand(true)
+        .hscrollbar_policy(gtk4::PolicyType::Never)
+        .child(&clamp)
+        .build();
+    toolbar.set_content(Some(&scroll));
+
+    let dialog = adw::Dialog::builder()
+        .title("Versions")
+        .content_width(520)
+        .content_height(520)
+        .child(&toolbar)
+        .build();
+
+    let state = Rc::new(VersionsDialog {
+        ui: ui.clone(),
+        target,
+        name: entry.name.clone(),
+        group,
+        rows: RefCell::new(Vec::new()),
+    });
+
+    versions_dialog_reload(&state);
+    dialog.present(ui_window(ui).as_ref());
+}
+
+/// Re-fetch the file's revisions and rebuild the rows.
+pub(crate) fn versions_dialog_reload(state: &Rc<VersionsDialog>) {
+    let rx = spawn_request(state.ui.dirs.control_socket(), state.target.list());
+    let state = state.clone();
+    glib::spawn_future_local(async move {
+        match rx.recv().await {
+            Ok(Ok(Response::Revisions { items })) => repaint_versions(&state, &items),
+            Ok(Ok(Response::Error { message, .. })) => {
+                toast_error(&state.ui, "Couldn't load versions", &message)
+            }
+            _ => toast_error(
+                &state.ui,
+                "Couldn't load versions",
+                "The mount service didn't respond.",
+            ),
+        }
+    });
+}
+
+/// Rebuild the version rows from a fresh listing.
+fn repaint_versions(state: &Rc<VersionsDialog>, items: &[RevisionInfo]) {
+    for row in state.rows.borrow_mut().drain(..) {
+        state.group.remove(&row);
+    }
+    let mut rows: Vec<gtk4::Widget> = Vec::new();
+    if items.is_empty() {
+        let row = dim_row("No earlier versions.");
+        state.group.add(&row);
+        rows.push(row.upcast());
+        *state.rows.borrow_mut() = rows;
+        return;
+    }
+
+    for item in items {
+        // The uploader's claimed plaintext size is the one that matches what the
+        // user sees in a listing; the storage figure counts ciphertext.
+        let size = item
+            .claimed_size
+            .filter(|size| *size >= 0)
+            .unwrap_or(item.size_on_storage)
+            .max(0) as u64;
+        let mut subtitle = format!("{} · {}", activity_time(item.created), human_bytes(size));
+        if let Some(email) = &item.signed_by {
+            subtitle.push_str(" · ");
+            subtitle.push_str(email);
+        }
+        let title = if item.is_active {
+            "Current version".to_string()
+        } else {
+            format!("Version {}", item.id)
+        };
+        let row = adw::ActionRow::builder()
+            .title(title)
+            .subtitle(subtitle)
+            .build();
+
+        let save = gtk4::Button::builder()
+            .icon_name("document-save-symbolic")
+            .tooltip_text("Save a copy…")
+            .valign(gtk4::Align::Center)
+            .build();
+        save.add_css_class("flat");
+        let state_save = state.clone();
+        let id = item.id.clone();
+        save.connect_clicked(move |_| prompt_save_version(&state_save, &id));
+        row.add_suffix(&save);
+
+        if !item.is_active {
+            let restore = gtk4::Button::builder()
+                .icon_name("edit-undo-symbolic")
+                .tooltip_text("Restore this version")
+                .valign(gtk4::Align::Center)
+                .build();
+            restore.add_css_class("flat");
+            let state_restore = state.clone();
+            let id = item.id.clone();
+            restore.connect_clicked(move |_| prompt_restore_version(&state_restore, &id));
+            row.add_suffix(&restore);
+
+            let delete = gtk4::Button::builder()
+                .icon_name("user-trash-symbolic")
+                .tooltip_text("Delete this version permanently")
+                .valign(gtk4::Align::Center)
+                .build();
+            delete.add_css_class("flat");
+            let state_delete = state.clone();
+            let id = item.id.clone();
+            delete.connect_clicked(move |_| prompt_delete_version(&state_delete, &id));
+            row.add_suffix(&delete);
+        }
+
+        state.group.add(&row);
+        rows.push(row.upcast());
+    }
+    *state.rows.borrow_mut() = rows;
+}
+
+/// Confirm, then restore. Confirmed because it replaces the file's content for
+/// every device on the account, not only this one.
+fn prompt_restore_version(state: &Rc<VersionsDialog>, revision_id: &str) {
+    let dialog = adw::AlertDialog::builder()
+        .heading("Restore version")
+        .body(format!(
+            "Make this version the current content of “{}”? The version it replaces stays in the history.",
+            state.name
+        ))
+        .build();
+    dialog.add_response("cancel", "Cancel");
+    dialog.add_response("restore", "Restore");
+    dialog.set_response_appearance("restore", adw::ResponseAppearance::Suggested);
+    dialog.set_default_response(Some("cancel"));
+    dialog.set_close_response("cancel");
+
+    let window = ui_window(&state.ui);
+    let state = state.clone();
+    let revision_id = revision_id.to_string();
+    dialog.connect_response(None, move |_, resp| {
+        if resp != "restore" {
+            return;
+        }
+        versions_dialog_op(
+            &state,
+            state.target.restore(revision_id.clone()),
+            // The server applies the swap in the background, so the wording
+            // promises the request, not the result.
+            "Restoring that version",
+            "Couldn't restore that version",
+        );
+    });
+    dialog.present(window.as_ref());
+}
+
+/// Confirm, then permanently delete one revision.
+fn prompt_delete_version(state: &Rc<VersionsDialog>, revision_id: &str) {
+    let dialog = adw::AlertDialog::builder()
+        .heading("Delete version")
+        .body("Delete this version permanently? Its content can't be recovered.")
+        .build();
+    dialog.add_response("cancel", "Cancel");
+    dialog.add_response("delete", "Delete");
+    dialog.set_response_appearance("delete", adw::ResponseAppearance::Destructive);
+    dialog.set_default_response(Some("cancel"));
+    dialog.set_close_response("cancel");
+
+    let window = ui_window(&state.ui);
+    let state = state.clone();
+    let revision_id = revision_id.to_string();
+    dialog.connect_response(None, move |_, resp| {
+        if resp != "delete" {
+            return;
+        }
+        versions_dialog_op(
+            &state,
+            state.target.delete(revision_id.clone()),
+            "Version deleted",
+            "Couldn't delete that version",
+        );
+    });
+    dialog.present(window.as_ref());
+}
+
+/// Ask where to write an old version, then have the daemon download it there.
+///
+/// The daemon writes the file, so the chosen location has to be one it can see:
+/// a path from the portal-free `FileDialog` is a real filesystem path, which it
+/// can.
+fn prompt_save_version(state: &Rc<VersionsDialog>, revision_id: &str) {
+    let window = ui_window(&state.ui);
+    let dialog = gtk4::FileDialog::builder()
+        .title("Save version")
+        .initial_name(&state.name)
+        .build();
+    let state = state.clone();
+    let revision_id = revision_id.to_string();
+    dialog.save(window.as_ref(), gio::Cancellable::NONE, move |res| {
+        let Ok(file) = res else { return };
+        let Some(dest) = file.path().and_then(|p| p.to_str().map(str::to_string)) else {
+            toast_error(
+                &state.ui,
+                "Couldn't save that version",
+                "That location isn't a local file.",
+            );
+            return;
+        };
+        versions_dialog_op(
+            &state,
+            state.target.save_as(revision_id.clone(), dest),
+            "Version saved",
+            "Couldn't save that version",
+        );
+    });
+}
+
+/// Send one version request, toast the outcome, and refresh the list.
+fn versions_dialog_op(state: &Rc<VersionsDialog>, request: Request, done: &str, failed: &str) {
+    let rx = spawn_request(state.ui.dirs.control_socket(), request);
+    let state = state.clone();
+    let done = done.to_string();
+    let failed = failed.to_string();
+    glib::spawn_future_local(async move {
+        match rx.recv().await {
+            Ok(Ok(Response::Ok { .. })) => {
+                toast(&state.ui, &done);
+                versions_dialog_reload(&state);
+            }
+            Ok(Ok(Response::Error { message, .. })) => toast_error(&state.ui, &failed, &message),
+            _ => toast_error(&state.ui, &failed, "The mount service didn't respond."),
+        }
+    });
+}

crates/pdfs-gui/src/dmenu.rs

@@ -0,0 +1,348 @@
+//! `pdfs-prompt --dmenu`: the same search, presented in the user's own launcher.
+//!
+//! Everything here is blocking and GTK-free — the process exists for one
+//! round-trip and then exits, so there is no main loop to keep off. It reuses
+//! the GTK prompt's [`Hit`](crate::Hit) model and ranking, and its Drive
+//! activation policy, so the two front ends cannot drift on what "open" means.
+//!
+//! Launchers filter a static list; they cannot call back for a new one per
+//! keystroke. So the interaction is a loop: the first menu shows pinned files
+//! and accepts free text, and any text that matches no entry becomes the next
+//! search. Escape (an empty selection) ends it.
+
+use std::path::{Path, PathBuf};
+
+use pdfs_core::config::AppDirs;
+use pdfs_core::control::{
+    Request, Response, SearchFilters, SearchHit, SearchKind, SearchSource, send,
+};
+use pdfs_core::menu::{self, MenuChoice, MenuItem, PromptConfig};
+use pdfs_core::opener::{self, OpenWith};
+
+use crate::activation::{DriveActivation, drive_activation, mounted_or_relative, mounted_target};
+use crate::{Hit, file_name, is_document, is_image, is_media, rank_hits};
+
+/// Guard against a launcher that keeps handing back text we cannot satisfy —
+/// without it a scripted (non-interactive) menu could spin forever.
+const MAX_ROUNDS: usize = 64;
+
+pub(crate) struct Options {
+    /// Launcher argv from `--menu`, overriding the configured/detected one.
+    pub menu: Option<Vec<String>>,
+    /// Skip the pinned-files round and search for this immediately.
+    pub query: Option<String>,
+}
+
+/// Run the launcher flow. Returns an error only for conditions the user must
+/// act on (no daemon, no launcher); a plain cancel is `Ok`.
+pub(crate) fn run(options: Options) -> Result<(), String> {
+    let dirs = AppDirs::new().map_err(|e| format!("cannot resolve app dirs: {e}"))?;
+    let config = dirs.load_config();
+    let prompt: PromptConfig = config.resolved_prompt();
+    let policy: OpenWith = config.resolved_open_with();
+    let socket = dirs.control_socket();
+
+    let menu_argv =
+        menu::resolve_menu(options.menu.as_ref().or(prompt.menu.as_ref())).ok_or_else(|| {
+            "no launcher found — install fuzzel/rofi/wofi, or set prompt.menu in config.json"
+                .to_string()
+        })?;
+
+    let mountpoint = match request(&socket, Request::Status)? {
+        Response::Status { mountpoint, .. } => PathBuf::from(mountpoint),
+        _ => dirs.default_mountpoint(),
+    };
+
+    let mut query = options
+        .query
+        .map(|q| q.trim().to_string())
+        .filter(|q| !q.is_empty());
+    for _ in 0..MAX_ROUNDS {
+        let hits = match &query {
+            Some(text) => search(&socket, text, prompt.resolved_menu_limit())?,
+            None => pins(&socket)?,
+        };
+        let items: Vec<MenuItem> = if hits.is_empty() {
+            vec![MenuItem::new(placeholder(query.as_deref()), None)]
+        } else {
+            label_all(&hits)
+        };
+
+        match menu::run(&menu_argv, &title(query.as_deref()), &items).map_err(|e| e.to_string())? {
+            MenuChoice::Item(index) => {
+                let Some(hit) = hits.get(index) else {
+                    // The placeholder row. Selecting it is not a cancel — the
+                    // user pressed Enter on "type to search", so start over
+                    // with the pinned list rather than quitting on them.
+                    query = None;
+                    continue;
+                };
+                return open(&socket, &mountpoint, &policy, hit, query.is_none());
+            }
+            // No entry matched what was typed: treat it as the next query.
+            MenuChoice::Custom(text) => query = Some(text),
+            MenuChoice::Cancelled => return Ok(()),
+        }
+    }
+    Ok(())
+}
+
+/// The launcher's prompt string.
+///
+/// A launcher renders this immediately left of the input, so it is the only
+/// place to say what typing here does. "Drive" alone read as a label and left
+/// the two-step nature of the flow — type, Enter, *then* results — invisible;
+/// the verb and the chevron make it a search box, and echoing the current query
+/// shows which round you are in.
+fn title(query: Option<&str>) -> String {
+    match query {
+        Some(text) => format!("Drive: {text} › "),
+        None => "Search Drive › ".to_string(),
+    }
+}
+
+/// Text for the one row shown when there is nothing to list.
+///
+/// A launcher handed an empty list shows a bare prompt, and some refuse to
+/// return anything at all from an empty menu — which would strand the user on
+/// the very first round, since a fresh account has no pins. A single row keeps
+/// the menu non-empty and says why it is empty.
+///
+/// A fuzzy launcher can match this row against what the user types, and the
+/// selection comes back as a label with no way to tell the two apart — so the
+/// wording is parenthesised and avoids words that read like a filename query.
+fn placeholder(query: Option<&str>) -> String {
+    match query {
+        Some(text) => format!("(no matches for “{text}”)"),
+        None => "(no pinned files — type to search)".to_string(),
+    }
+}
+
+/// Pinned files — the same "you asked to keep these" set the GTK prompt opens
+/// with, and the only listing the daemon offers without a query.
+fn pins(socket: &Path) -> Result<Vec<Hit>, String> {
+    let Response::Pins { pins } = request(socket, Request::ListPins)? else {
+        return Ok(Vec::new());
+    };
+    Ok(pins
+        .into_iter()
+        .map(|pin| {
+            Hit::Drive(SearchHit {
+                name: file_name(&pin.path),
+                path: pin.path,
+                is_dir: pin.is_dir.unwrap_or(pin.recursive),
+                size: 0,
+                modified: 0,
+                pinned: true,
+                uid: pin.uid,
+                mounted_path: None,
+                score: 0,
+            })
+        })
+        .collect())
+}
+
+fn search(socket: &Path, query: &str, limit: usize) -> Result<Vec<Hit>, String> {
+    let reply = request(
+        socket,
+        Request::SearchV2 {
+            query: query.to_string(),
+            limit,
+            filters: SearchFilters {
+                sources: vec![SearchSource::Drive, SearchSource::Local],
+                kind: SearchKind::All,
+            },
+        },
+    )?;
+    let Response::SearchResultsV2 {
+        drive_hits,
+        local_hits,
+        ..
+    } = reply
+    else {
+        return Ok(Vec::new());
+    };
+    let mut hits: Vec<Hit> = drive_hits.into_iter().map(Hit::Drive).collect();
+    hits.extend(local_hits.into_iter().map(Hit::Local));
+    rank_hits(&mut hits);
+    hits.truncate(limit);
+    Ok(hits)
+}
+
+/// One launcher line per hit. Labels must be unique: they are how the selection
+/// is matched back, and two files of the same name in the same folder listing
+/// would otherwise be indistinguishable.
+fn label_all(hits: &[Hit]) -> Vec<MenuItem> {
+    let mut items: Vec<MenuItem> = Vec::with_capacity(hits.len());
+    for hit in hits {
+        let mut label = format!("{}   ·   {}", hit.name(), hit.location());
+        let mut suffix = 2;
+        while items.iter().any(|item| item.label == label) {
+            label = format!("{}   ·   {} ({suffix})", hit.name(), hit.location());
+            suffix += 1;
+        }
+        items.push(MenuItem::new(label, Some(icon_name(hit))));
+    }
+    items
+}
+
+/// Icon theme name for a hit.
+///
+/// Coarse on purpose: `content_type_guess` would give an exact MIME name, but
+/// only with file *contents* to sniff — a Drive hit is metadata, and passing it
+/// an empty buffer answers `application-x-zerosize` for everything. The generic
+/// names below exist in every icon theme.
+fn icon_name(hit: &Hit) -> String {
+    if hit.is_dir() {
+        return "folder".to_string();
+    }
+    let name = hit.name();
+    if is_image(name) {
+        "image-x-generic"
+    } else if is_media(name) {
+        "video-x-generic"
+    } else if is_document(name) {
+        "text-x-generic"
+    } else {
+        "application-x-generic"
+    }
+    .to_string()
+}
+
+/// Open a chosen hit, mirroring the GTK prompt: local files are already on
+/// disk, a Drive folder or streamable file goes through the mount, and anything
+/// else is materialised by the daemon first.
+fn open(
+    socket: &Path,
+    mountpoint: &Path,
+    policy: &OpenWith,
+    hit: &Hit,
+    from_pins: bool,
+) -> Result<(), String> {
+    match hit {
+        Hit::Local(local) => {
+            opener::open(policy, Path::new(&local.path), local.is_dir);
+            Ok(())
+        }
+        Hit::Drive(drive) => {
+            // A folder has no materialised form, and a pin row's `is_dir` is pin
+            // policy rather than node kind, so both go to the mount unchecked.
+            let unconditional = from_pins
+                || matches!(
+                    drive_activation(&drive.name, drive.is_dir),
+                    DriveActivation::Folder | DriveActivation::MountedMedia
+                );
+            if unconditional {
+                opener::open(
+                    policy,
+                    &mounted_or_relative(mountpoint, drive),
+                    drive.is_dir,
+                );
+                return Ok(());
+            }
+            // Anything else the mount exposes opens there too, so an editor
+            // saves back into Drive instead of into a cache blob.
+            if let Some(path) = mounted_target(mountpoint, drive) {
+                opener::open(policy, &path, false);
+                return Ok(());
+            }
+            match request(
+                socket,
+                Request::OpenFile {
+                    path: drive.path.clone(),
+                    uid: Some(drive.uid.clone()),
+                },
+            )? {
+                Response::FilePath { path } => {
+                    // The reply is a content-hash blob; the rules key off the
+                    // Drive name, which is what the user actually opened.
+                    opener::open_named(policy, Path::new(&path), &drive.name, false);
+                    Ok(())
+                }
+                Response::Error { message, .. } => Err(format!("could not open: {message}")),
+                _ => Err("unexpected reply from the daemon".to_string()),
+            }
+        }
+    }
+}
+
+/// One control-socket round-trip, with the daemon-is-down case phrased for a
+/// terminal rather than a status page.
+fn request(socket: &Path, request: Request) -> Result<Response, String> {
+    send(socket, &request).map_err(|e| format!("cannot reach the Proton Drive daemon: {e}"))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use pdfs_core::control::LocalHit;
+
+    fn drive(name: &str, path: &str, is_dir: bool) -> Hit {
+        Hit::Drive(SearchHit {
+            name: name.into(),
+            path: path.into(),
+            is_dir,
+            size: 0,
+            modified: 0,
+            pinned: false,
+            uid: "uid".into(),
+            mounted_path: None,
+            score: 0,
+        })
+    }
+
+    #[test]
+    fn labels_are_unique_so_a_selection_maps_back_to_one_hit() {
+        let hits = vec![
+            drive("notes.md", "Docs/notes.md", false),
+            Hit::Local(LocalHit {
+                name: "notes.md".into(),
+                path: "/home/me/Docs/notes.md".into(),
+                is_dir: false,
+                size: 0,
+                modified: 0,
+                score: 0,
+            }),
+            drive("notes.md", "Docs/notes.md", false),
+        ];
+        let items = label_all(&hits);
+        assert_eq!(items.len(), 3);
+        assert_ne!(items[0].label, items[2].label);
+        let unique: std::collections::HashSet<_> =
+            items.iter().map(|item| item.label.clone()).collect();
+        assert_eq!(unique.len(), 3);
+    }
+
+    #[test]
+    fn the_prompt_says_a_search_is_what_enter_does() {
+        let first = title(None);
+        assert!(first.to_lowercase().contains("search"), "{first}");
+        // The launcher renders the input immediately after the prompt, so the
+        // prompt has to carry its own separator or it runs into what is typed.
+        assert!(first.ends_with(' '), "{first:?}");
+
+        let refined = title(Some("md"));
+        assert!(refined.contains("md"), "{refined}");
+        assert!(refined.ends_with(' '), "{refined:?}");
+    }
+
+    #[test]
+    fn an_empty_round_still_has_a_row_explaining_itself() {
+        assert!(placeholder(None).contains("type to search"));
+        assert!(placeholder(Some("md")).contains("md"));
+    }
+
+    #[test]
+    fn icons_are_theme_names_the_launcher_can_look_up() {
+        assert_eq!(icon_name(&drive("Photos", "Photos", true)), "folder");
+        assert_eq!(
+            icon_name(&drive("a.png", "a.png", false)),
+            "image-x-generic"
+        );
+        assert_eq!(icon_name(&drive("a.md", "a.md", false)), "text-x-generic");
+        assert_eq!(
+            icon_name(&drive("a.bin", "a.bin", false)),
+            "application-x-generic"
+        );
+    }
+}

crates/pdfs-gui/src/main.rs

@@ -134,9 +134,7 @@ fn poll_state(socket: &Path, default_mountpoint: &Path) -> DriveState {
 }
 
 fn open_folder(mountpoint: &Path) {
-    if let Err(e) = Command::new("xdg-open").arg(mountpoint).spawn() {
+    pdfs_core::opener::open_default(mountpoint, true);
-        tracing::error!("failed to xdg-open {}: {e}", mountpoint.display());
-    }
 }
 
 /// Launch (or, since it's `SingleMainWindow`, raise) the settings/management

crates/pdfs-gui/src/prompt.rs

@@ -9,7 +9,6 @@
 
 use std::cell::{Cell, RefCell};
 use std::path::{Path, PathBuf};
-use std::process::Command;
 use std::rc::Rc;
 use std::time::Duration;
 
@@ -20,9 +19,12 @@ use pdfs_core::config::AppDirs;
 use pdfs_core::control::{
     LocalHit, Request, Response, SearchFilters, SearchHit, SearchKind, SearchSource, send,
 };
+use pdfs_core::menu::PromptMode;
+use pdfs_core::opener::{self, OpenWith};
 
 mod activation;
-use activation::{DriveActivation, drive_activation, mounted_path};
+mod dmenu;
+use activation::{DriveActivation, drive_activation, mounted_or_relative, mounted_target};
 
 const APP_ID: &str = "io.narl.proton-drive-linux-prompt";
 
@@ -145,29 +147,26 @@ impl Hit {
     }
 
     /// The dimmed second line: the containing folder, as the user thinks of it.
+    ///
+    /// A Drive hit is only "My files" when it really sits in the primary mount.
+    /// A node inside a device folder resolves to a path on this machine
+    /// (`~/Downloads/…`) — the daemon has already worked that out in
+    /// `mounted_path`, and saying "My files / Downloads" for it names a folder
+    /// the user cannot find and does not match where activating the row opens.
     fn location(&self) -> String {
         match self {
-            Hit::Drive(h) => {
+            Hit::Drive(h) => match h.mounted_path.as_deref() {
-                let parent = parent_of(&h.path);
+                Some(mounted) => home_relative(&parent_of(mounted)),
-                if parent.is_empty() {
+                None => {
-                    "My files".to_string()
+                    let parent = parent_of(&h.path);
-                } else {
+                    if parent.is_empty() {
-                    format!("My files / {}", parent.replace('/', " / "))
+                        "My files".to_string()
+                    } else {
+                        format!("My files / {}", parent.replace('/', " / "))
+                    }
                 }
-            }
+            },
-            Hit::Local(h) => {
+            Hit::Local(h) => home_relative(&parent_of(&h.path)),
-                let parent = parent_of(&h.path);
-                match dirs_home().and_then(|home| {
-                    Path::new(&parent)
-                        .strip_prefix(&home)
-                        .ok()
-                        .map(|rel| rel.display().to_string())
-                }) {
-                    Some(rel) if rel.is_empty() => "Home".to_string(),
-                    Some(rel) => format!("Home / {}", rel.replace('/', " / ")),
-                    None => parent,
-                }
-            }
         }
     }
 
@@ -220,6 +219,10 @@ fn rank_hits(hits: &mut [Hit]) {
 struct Ui {
     socket: PathBuf,
     mountpoint: RefCell<PathBuf>,
+    /// How a chosen file is launched. Read once at window build: the prompt is
+    /// resident, but a config edit is rare enough that a restart is a fair
+    /// price for not re-reading the file on every Enter.
+    opener: OpenWith,
 
     entry: gtk4::Entry,
     spinner: gtk4::Spinner,
@@ -328,6 +331,71 @@ impl Section {
     }
 }
 
+const USAGE: &str = "\
+pdfs-prompt — search Proton Drive and this computer
+
+Usage: pdfs-prompt [OPTIONS]
+
+Options:
+  --dmenu               Present the results in an external launcher (fuzzel,
+                        rofi, …) instead of the built-in GTK window. Also
+                        settable permanently as \"prompt\": { \"mode\": \"dmenu\" }
+                        in config.json.
+  --gtk                 Force the built-in window, overriding that setting.
+  --menu <COMMAND>      Launcher command line for --dmenu, e.g.
+                        --menu 'fuzzel --dmenu --width 60'. Overrides
+                        \"prompt\": { \"menu\": [...] }.
+  --query <TEXT>        Search for TEXT immediately instead of opening on the
+                        pinned-files list (--dmenu only).
+  -h, --help            Show this help.
+";
+
+/// What the command line asked for, before any GTK setup happens: the launcher
+/// path must not pay for — or fail on — a display connection it never uses.
+struct Args {
+    mode: Option<PromptMode>,
+    menu: Option<Vec<String>>,
+    query: Option<String>,
+}
+
+fn parse_args(argv: impl Iterator<Item = String>) -> Result<Args, String> {
+    let mut args = Args {
+        mode: None,
+        menu: None,
+        query: None,
+    };
+    let mut argv = argv.peekable();
+    while let Some(arg) = argv.next() {
+        match arg.as_str() {
+            "--dmenu" => args.mode = Some(PromptMode::Dmenu),
+            "--gtk" => args.mode = Some(PromptMode::Gtk),
+            // A launcher command is one shell-ish string so it can live in a
+            // keybinding; splitting on whitespace is enough for flags, and a
+            // launcher argument needing spaces belongs in config.json.
+            "--menu" => {
+                let value = argv
+                    .next()
+                    .ok_or_else(|| "--menu needs a command".to_string())?;
+                let parts: Vec<String> = value.split_whitespace().map(str::to_string).collect();
+                if parts.is_empty() {
+                    return Err("--menu needs a command".to_string());
+                }
+                args.menu = Some(parts);
+                // A launcher was named explicitly; that only makes sense here.
+                args.mode.get_or_insert(PromptMode::Dmenu);
+            }
+            "--query" => {
+                args.query = Some(
+                    argv.next()
+                        .ok_or_else(|| "--query needs a search term".to_string())?,
+                );
+            }
+            other => return Err(format!("unrecognised argument: {other}")),
+        }
+    }
+    Ok(args)
+}
+
 fn main() -> glib::ExitCode {
     tracing_subscriber::fmt()
         .with_env_filter(
@@ -335,6 +403,37 @@ fn main() -> glib::ExitCode {
         )
         .init();
 
+    let raw: Vec<String> = std::env::args().skip(1).collect();
+    if raw.iter().any(|arg| arg == "-h" || arg == "--help") {
+        print!("{USAGE}");
+        return glib::ExitCode::SUCCESS;
+    }
+    let args = match parse_args(raw.into_iter()) {
+        Ok(args) => args,
+        Err(message) => {
+            eprintln!("pdfs-prompt: {message}\n\n{USAGE}");
+            return glib::ExitCode::FAILURE;
+        }
+    };
+
+    // The stored mode makes an existing keybinding switch front ends without
+    // being re-bound; an explicit flag still wins.
+    let stored = AppDirs::new()
+        .map(|dirs| dirs.load_config().resolved_prompt().resolved_mode())
+        .unwrap_or_default();
+    if args.mode.unwrap_or(stored) == PromptMode::Dmenu {
+        return match dmenu::run(dmenu::Options {
+            menu: args.menu,
+            query: args.query,
+        }) {
+            Ok(()) => glib::ExitCode::SUCCESS,
+            Err(message) => {
+                eprintln!("pdfs-prompt: {message}");
+                glib::ExitCode::FAILURE
+            }
+        };
+    }
+
     let app = adw::Application::builder().application_id(APP_ID).build();
     // GtkApplication normally remains active while it owns a window, including
     // when that window is hidden. Hold it explicitly as well: residency is a
@@ -354,7 +453,8 @@ fn main() -> glib::ExitCode {
         };
         ui.activate();
     });
-    app.run()
+    // GTK must not try to parse our own flags; they were consumed above.
+    app.run_with_args::<&str>(&[])
 }
 
 fn build_window(app: &adw::Application) -> Option<Rc<Ui>> {
@@ -478,6 +578,7 @@ fn build_window(app: &adw::Application) -> Option<Rc<Ui>> {
     let ui = Rc::new(Ui {
         socket: dirs.control_socket(),
         mountpoint: RefCell::new(dirs.default_mountpoint()),
+        opener: dirs.load_config().resolved_open_with(),
         entry: entry.clone(),
         spinner,
         stack,
@@ -686,6 +787,20 @@ impl Ui {
         self.entry.grab_focus();
     }
 
+    /// Hand a resolved path to the configured opener — `xdg-open` unless
+    /// `open_with` in `config.json` says otherwise (a terminal editor for text
+    /// files, say).
+    fn open_path(&self, path: &Path, is_dir: bool) {
+        opener::open(&self.opener, path, is_dir);
+    }
+
+    /// Open a file the daemon just materialised into the content cache. The
+    /// blob is named after its content hash, so the open rules have to be
+    /// matched against the Drive name instead.
+    fn open_materialized(&self, path: &Path, name: &str) {
+        opener::open_named(&self.opener, path, name, false);
+    }
+
     /// Dismiss without destroying the application window. GTK continues to
     /// associate the hidden window with the single application instance, so a
     /// later desktop shortcut invocation is a cheap `activate` round-trip.
@@ -751,7 +866,7 @@ impl Ui {
                     .map(|pin| SearchHit {
                         name: file_name(&pin.path),
                         path: pin.path,
-                        is_dir: pin.recursive,
+                        is_dir: pin.is_dir.unwrap_or(pin.recursive),
                         size: 0,
                         modified: 0,
                         pinned: true,
@@ -1081,7 +1196,7 @@ impl Ui {
 
         match hit {
             Hit::Local(local) => {
-                xdg_open(Path::new(&local.path));
+                self.open_path(Path::new(&local.path), local.is_dir);
                 self.dismiss();
             }
             Hit::Drive(drive) => {
@@ -1091,25 +1206,28 @@ impl Ui {
                 // this handles non-recursively pinned folders without mistaking
                 // them for files and sending an invalid OpenFile request.
                 if self.rendered_query.borrow().is_empty() {
-                    let path = drive.mounted_path.as_deref().map_or_else(
+                    let path = mounted_or_relative(&self.mountpoint.borrow(), &drive);
-                        || mounted_path(&self.mountpoint.borrow(), &drive.path),
+                    self.open_path(&path, drive.is_dir);
-                        PathBuf::from,
-                    );
-                    xdg_open(&path);
                     self.dismiss();
                     return;
                 }
                 match drive_activation(&drive.name, drive.is_dir) {
                     DriveActivation::Folder | DriveActivation::MountedMedia => {
-                        let path = drive.mounted_path.as_deref().map_or_else(
+                        let path = mounted_or_relative(&self.mountpoint.borrow(), &drive);
-                            || mounted_path(&self.mountpoint.borrow(), &drive.path),
+                        self.open_path(&path, drive.is_dir);
-                            PathBuf::from,
-                        );
-                        xdg_open(&path);
                         self.dismiss();
                         return;
                     }
-                    DriveActivation::Materialize => {}
+                    // The mount holds the real file; the cache holds a copy an
+                    // editor would save into for nothing. Prefer the mount, and
+                    // materialise only what it does not expose.
+                    DriveActivation::Materialize => {
+                        if let Some(path) = mounted_target(&self.mountpoint.borrow(), &drive) {
+                            self.open_path(&path, false);
+                            self.dismiss();
+                            return;
+                        }
+                    }
                 }
 
                 self.opening.set(true);
@@ -1121,6 +1239,7 @@ impl Ui {
                     self.socket.clone(),
                     Request::OpenFile {
                         path: drive.path.clone(),
+                        uid: Some(drive.uid.clone()),
                     },
                 );
                 let ui = self.clone();
@@ -1131,7 +1250,7 @@ impl Ui {
                     ui.opening.set(false);
                     match reply {
                         Ok(Ok(Response::FilePath { path })) => {
-                            xdg_open(Path::new(&path));
+                            ui.open_materialized(Path::new(&path), &drive.name);
                             ui.dismiss();
                         }
                         Ok(Ok(Response::Error { message, .. })) => {
@@ -1224,13 +1343,6 @@ fn spawn_request(
     rx
 }
 
-fn xdg_open(path: &Path) {
-    tracing::info!(path = %path.display(), "opening");
-    if let Err(e) = Command::new("xdg-open").arg(path).spawn() {
-        tracing::error!("xdg-open failed: {e}");
-    }
-}
-
 fn dirs_home() -> Option<PathBuf> {
     AppDirs::new().ok().and_then(|dirs| dirs.home_dir())
 }
@@ -1243,6 +1355,21 @@ fn file_name(path: &str) -> String {
         .to_string()
 }
 
+/// An absolute directory path as "Home / …", falling back to the path itself
+/// for anything outside the home directory.
+fn home_relative(parent: &str) -> String {
+    match dirs_home().and_then(|home| {
+        Path::new(parent)
+            .strip_prefix(&home)
+            .ok()
+            .map(|rel| rel.display().to_string())
+    }) {
+        Some(rel) if rel.is_empty() => "Home".to_string(),
+        Some(rel) => format!("Home / {}", rel.replace('/', " / ")),
+        None => parent.to_string(),
+    }
+}
+
 fn parent_of(path: &str) -> String {
     Path::new(path)
         .parent()
@@ -1466,4 +1593,42 @@ mod tests {
         assert!(matches!(&hits[0], Hit::Local(hit) if hit.name == "better.pdf"));
         assert!(matches!(&hits[1], Hit::Drive(hit) if hit.name == "alpha.pdf"));
     }
+
+    fn parse(args: &[&str]) -> Result<Args, String> {
+        parse_args(args.iter().map(|a| (*a).to_string()))
+    }
+
+    #[test]
+    fn no_arguments_defer_the_mode_to_config() {
+        let args = parse(&[]).unwrap();
+        assert_eq!(args.mode, None);
+        assert_eq!(args.menu, None);
+        assert_eq!(args.query, None);
+    }
+
+    #[test]
+    fn naming_a_launcher_implies_dmenu_but_an_explicit_mode_still_wins() {
+        let args = parse(&["--menu", "fuzzel --dmenu"]).unwrap();
+        assert_eq!(args.mode, Some(PromptMode::Dmenu));
+        assert_eq!(
+            args.menu,
+            Some(vec!["fuzzel".to_string(), "--dmenu".to_string()])
+        );
+
+        let args = parse(&["--gtk", "--menu", "rofi -dmenu"]).unwrap();
+        assert_eq!(args.mode, Some(PromptMode::Gtk));
+    }
+
+    #[test]
+    fn a_flag_without_its_value_is_an_error_not_a_default() {
+        assert!(parse(&["--menu"]).is_err());
+        assert!(parse(&["--query"]).is_err());
+        assert!(parse(&["--nonsense"]).is_err());
+    }
+
+    #[test]
+    fn a_query_is_taken_verbatim_including_spaces() {
+        let args = parse(&["--dmenu", "--query", "tax return 2024"]).unwrap();
+        assert_eq!(args.query.as_deref(), Some("tax return 2024"));
+    }
 }

docs/ARCHITECTURE.md

@@ -153,8 +153,9 @@ Because Proton Drive does not support partial byte writes, modified files must b
 2. **Close/Release (`queue_revision`):** When the application closes the file descriptor, the daemon:
    - Fetches any untouched gaps from the remote base file to compile the full file.
    - Durably publishes the scratch data and authored-range sidecar into `staging` under a `{uid}-{millis}-{counter}` name. Temporary data and metadata are synced before atomic rename, and their directory is synced before the source is removed.
-   - Transactionally queues or supersedes a pending database operation (`PendingOp`), so insertion failure cannot erase the previously acknowledged upload. For `OP_REVISION` ops, execution is debounced by 2 seconds (`DRAIN_REVISION_DEBOUNCE = 2s`) to give rapid follow-up writes (e.g. `aria2c` preallocation followed by writing) time to supersede the staged blob before network transmission.
+   - Transactionally queues or supersedes a pending database operation (`PendingOp`), so insertion failure cannot erase the previously acknowledged upload. For `OP_REVISION` ops, execution is debounced to give rapid follow-up writes (e.g. `aria2c` preallocation followed by writing) time to supersede the staged blob before network transmission. The debounce is adaptive (`Core::revision_debounce`): it starts at `DRAIN_REVISION_DEBOUNCE = 2s` and, once a node has been uploaded, widens toward how long that upload actually took, bounded by `DRAIN_REVISION_DEBOUNCE_MAX = 60s`. A file saved faster than it can be sent therefore supersedes in the queue rather than mid-upload.
-3. **Async Drain Thread (`run_pending_drain`):** The background drain worker picks up the database operations queue, handles revision uploads, resolves conflicts, and cleans up staging files. Upon landing a revision upload (`refresh_after_upload`), it rebaselines both still-queued ops (`rebaseline_pending`) and open write handles targeting the same node to prevent false self-conflict copies on subsequent writes.
+   - Signals `Core::cancel_upload` for the node before touching the queue. A drain worker may already be reading the blob this write supersedes; the flag is read by the upload's `CountingReader`, which refuses the SDK's next block. `queue_trash` and `discard_queued_ops` do the same, because they unlink the blob outright.
+3. **Async Drain Threads (`run_pending_drain`):** `DRAIN_WORKERS = 3` background workers share the operations queue. They pick work up through `Db::claim_next_due_op`, which marks the row `claimed_at` in the same transaction that selects it and excludes any op whose uid another worker already holds — ordering only has to hold *per node*, and that exclusion is what guarantees it. Worker 0 additionally runs the queue's idle chores (LRU touch flush, `recover_fsynced_writes`). A claim is process-local state: the single-writer `flock` means one found at open belongs to a crashed run, and `Db::clear_op_claims` drops the lot so those ops are not invisible forever. Each worker handles revision uploads, resolves conflicts, and cleans up staging files. Upon landing a revision upload (`refresh_after_upload`), it rebaselines both still-queued ops (`rebaseline_pending`) and open write handles targeting the same node to prevent false self-conflict copies on subsequent writes.
 
 ```mermaid
 sequenceDiagram

docs/BUGS.md

@@ -12,6 +12,356 @@ Conventions:
 
 ---
 
+## B84 — A block read that comes back short truncates the file, silently
+
+**Status:** Fixed and **live-verified 2026-08-16**. **Data correctness** — an application reading a large
+file through the mount could get a truncated copy that reported success. The truncation is now
+impossible: a disagreement is repaired from the whole-file download, or the read fails `EIO`.
+Unverified because the repair path has not yet been driven against the three known files on a
+live mount, and the metadata question below is still open.
+**Found:** 2026-08-16, chasing what looked like log noise. GNOME's file indexer
+(`localsearch-3`) was filling the journal with `libpng error: Read Error`,
+`libpng error: IDAT: CRC error` and `File too small to be a PNG` on files under
+`~/ProtonDrive/Pictures`, interleaved with 49 `ERROR fuser::reply: Failed to send FUSE reply:
+Invalid argument (os error 22)` from the daemon in one afternoon. The indexer was right and we
+were wrong.
+
+**Where:** `Core::read_block` (`crates/pdfs-fuse/src/reads.rs:566`), the assembly loop in
+`Core::read_range_remote` (`reads.rs:759-769`); upstream, `RevisionReader::read_at` /
+`splice_block` and `rank_block_sizes` (`proton-drive-rs` 0.6.0, `revision.rs`,
+`transport.rs:256`).
+
+**Repro.** Deterministic per file, no account state needed beyond the files themselves:
+
+```bash
+stat -c %s FILE            # what the mount reports
+cat FILE | wc -c           # what the mount can actually deliver
+```
+
+| file | `nodes.size` / `stat` | bytes readable |
+|---|---|---|
+| `Pictures/old/92433593_p0.png` | 4317497 | 4194304 (tail block yields **0**) |
+| `Pictures/old/79779657_p0.png` | 11574982 | 10567052 |
+| `Pictures/old/2022-07-09_04-53.png` | 6388959 | 4389310 |
+
+`pdfs pin` on the third file, then re-read: **6388959 bytes, a fully valid PNG** — every chunk
+CRC passes, IEND is reached, the IDAT stream inflates to 44.8 MB. So the remote data is intact,
+`nodes.size` is right, and the whole-file (manifest-verified) download path is right. Only the
+block/range path truncates. Pinning is the workaround.
+
+**Root cause.** `read_block` asks the SDK for `blen = BLOCK_SIZE.min(fsize - bstart)` bytes and
+never checks how many it got:
+
+```rust
+let bytes = reader.read_at(bstart, blen).await.map_err(...)?;   // reads.rs:577
+```
+
+`RevisionReader::read_at` clamps the range to its own `file_size` — summed from the *believed*
+per-block sizes `rank_block_sizes` resolved — and `splice_block` clamps again to
+`plaintext.len()`. Both are silent. A short block then vanishes in the assembly loop: with
+`block.len()` short, `e = (end.min(bstart + block.len()) - bstart)` collapses, and for an empty
+block `s < e` is false, so nothing is appended at all. The FUSE read returns fewer bytes than
+asked for, the kernel hands userspace a short read, and every tool reads a short read as EOF.
+The `EINVAL` reply errors are the same mismatch seen from the other side.
+
+Nothing on this path validates a block against the length the file's own size implies
+(`block_len(fsize, bidx)` — which the *cache* does check, in `ContentCache::cached_block`, and
+which is why a short blob on disk is rejected and refetched while a short blob from the network
+is served).
+
+**Not yet known:** which rung of `rank_block_sizes` these revisions land on. The three
+reader-vs-node deltas fit no constant ratio, so this is per-revision metadata rather than block
+padding — the terminal `block_count <= 1` fallback (`vec![4 MiB; block_count]`) would explain
+the file that stops at exactly 4 MiB but not the other two. Needs a live probe printing
+`RevisionReader::block_sizes()` against `nodes.size` for these three uids. That answer decides
+whether the real fix belongs in this repo or in `proton-sdk-rs`.
+
+**Fix (2026-08-16).** `Core::read_block` no longer trusts the range path blindly.
+
+1. **The disagreement is caught before any bytes are read.** If `reader.size() != fsize`, the
+   revision's block table does not describe this file and *no* block of it can be trusted — not
+   just the short ones. Sizes that overstate a block shift every block after it and return
+   full-length reads of the wrong bytes, which no length check would ever catch (the SDK's
+   `rank_block_sizes` documents exactly this failure). So the whole file leaves the range path.
+2. **A short block is caught as a second net,** compared against `block_len(fsize, bidx)` — now
+   `pub` in `pdfs-core::cache`, because it is the contract the read path shares with the cache
+   rather than a detail of the cache. The assembly loop in `read_range_remote` re-checks the same
+   thing and fails `EIO` rather than contributing fewer bytes than the range it covers, which is
+   the line that actually turned a bad block into a truncated file.
+3. **A file that fails either check is repaired, not just refused.** `Core::repair_block` pulls
+   the whole revision through `download_file_to` — the manifest-verified path, which does no
+   boundary arithmetic and is why pinning worked — into a scratch file, checks it against
+   `nodes.size`, and adopts it as the cached blob via `store_file`. Every later read of the file
+   is then answered by `ContentCache::read_range` before the block path is consulted at all. One
+   download per file, not per block: `content_repairs` holds a lock per file so the concurrent
+   block reads that all discover the same bad table share it. Bounded by `REPAIR_MAX` (512 MiB) —
+   past that one unlucky read would pull down gigabytes, so it fails `EIO` and says to pin.
+
+Nothing short is cached or promoted: `read_block` only reaches `store_block` and the `block_ring`
+insert with bytes that passed. `store_block` itself deliberately does *not* check — its fixtures
+store 4 KiB "blocks" of notional 1 GiB files to keep the budget tests cheap, and the read side
+(`cached_block`, `has_block`) already rejects a wrong-length block as a miss. Validation is the
+reader's job, at the point of fetch.
+
+`getattr` needs no change after all: `pdfs pin` proved `nodes.size` is the correct one and the
+reader's belief is the wrong one, so the fix is to stop serving the reader's belief — not to
+publish it through `stat`.
+
+**Verified live (2026-08-16).** Four multi-block PNGs under `Pictures/wallpaper/` were read whole
+through the mount on the running 1.8.1 daemon; every one delivered exactly its `stat` size
+(5558846, 1098729, 2015463, 2291122 bytes), and no `fuser::reply … Invalid argument` appeared. The
+journal shows the second net firing and the repair path serving each of them:
+
+```
+WARN block came back shorter than the file's size implies bidx=0 blen=4194304 got=4939506 …
+INFO served a short block from a repaired whole-file download bidx=0 …
+```
+
+**Answered, and not as expected.** The open question was which rung of `rank_block_sizes` these
+revisions take. The evidence says the reader is not the confused party: `reader.size()` equals
+`fsize` in every case — the gate in step 1 never fires — and the blocks it returns are *larger*
+than 4 MiB, not smaller (4939506 for a whole 4.9 MB file; 5239804 and 5670228 as first blocks).
+This client's fixed 4 MiB block geometry is the thing that is wrong. Filed as **B85**; the repair
+path above is what keeps those files readable in the meantime, at the cost of a whole-file
+download on first read.
+
+## B85 — The read path assumes 4 MiB blocks; some revisions do not have them
+
+**Status:** Open — **data correctness**, currently masked by B84's repair path
+**Found:** 2026-08-16, while live-verifying B84 (see its journal evidence)
+**Where:** `crates/pdfs-fuse/src/reads.rs`, `crates/pdfs-core/src/cache.rs` (`BLOCK_SIZE`,
+`block_len`)
+
+**Cause:** The whole range path is built on one assumption — that a revision is a series of
+`BLOCK_SIZE` (4 MiB) blocks with a remainder at the end. `block_len(size, idx)` encodes it, the
+on-disk block cache is keyed by that index, and `read_block` asks the SDK's `RevisionReader` for
+`[idx * BLOCK_SIZE, block_len)`.
+
+Some revisions on this account are not laid out that way, and B84's diagnostic caught it in the
+act. The warning it logs reads "shorter", but the numbers say the opposite:
+
+```
+bidx=0 blen=4194304 got=4939506 fsize=4939506     # one block holding the whole file
+bidx=1 blen=745202  got=0       fsize=4939506     # …so there is no block 1
+bidx=0 blen=4194304 got=5239804 fsize=11537412    # first block is ~5.0 MiB, not 4
+bidx=1 blen=4194304 got=5670228 fsize=11106988    # …and they are not even uniform
+bidx=2 blen=4194304 got=5233034 fsize=19932790
+```
+
+`reader.size()` agrees with `fsize` in every one of these, so B84's primary gate — the one that
+catches a block table that does not add up — correctly does *not* fire. The file is intact and
+the reader knows its real boundaries; it is this client that is asking for the wrong ones.
+
+**Why it is not currently losing data:** B84's length check catches every one of these and routes
+the file through the whole-file manifest-verified download, so reads are correct. The cost is
+real, though: any file with non-4-MiB blocks is downloaded whole on first read, however few bytes
+were asked for, and one above `REPAIR_MAX` (512 MiB) fails `EIO` and can only be read by pinning
+it.
+
+**Fix direction:** take the geometry from the revision instead of assuming it.
+`RevisionReader::block_sizes()` already exposes it and B84 already logs it. That means block
+offsets become a prefix sum over the real sizes rather than `idx * BLOCK_SIZE`, and — the part
+that makes this its own change rather than a patch — the on-disk block cache is keyed and
+length-validated on the 4 MiB assumption too (`block_len`), so its key scheme has to follow the
+file's own geometry or the cache has to hold ranges rather than blocks.
+
+**Open question:** what produced these revisions. Uniform-but-not-4-MiB would suggest another
+client's chunk size; these are *not* uniform (5239804, 5670228, 5233034), which looks more like a
+size recorded per block after some transformation. Worth answering before choosing the fix, since
+"blocks are whatever the revision says" and "blocks are a different constant" lead to different
+designs.
+
+---
+
+## B83 — An access-deferred op retries forever and is reported as an ordinary queued upload
+
+**Status:** Fixed (partly verified) 2026-08-16 — both halves are in and
+unit-tested. The reporting half was confirmed against the live 28-op backlog on
+1.8.0 (schema migrated to v27, all 28 rows window-stamped, `WARN` lines per op);
+the resolution half has not yet been observed draining that backlog.
+**Found:** 2026-08-16, running `scripts/fuse-acceptance.sh --live` on a
+throwaway CLI-made mount. Four regression cases (B69, B70, B74, B79) failed with
+`TimeoutError: daemon mutation queue did not drain` — the suite's
+`wait_for_queue()` polls the *global* `status.mount.pending_uploads`, which had
+been sitting at 28 for 30 days on the development machine. `pdfs status` called
+them 28 queued uploads holding 18.4 GiB; `pdfs transfers` showed nothing;
+`failing_ops` and `parked_uploads` were both 0.
+**Where:** `run_pending_drain` / `run_authorized_drain`
+(`crates/pdfs-fuse/src/drain.rs`), `require_uid_writable`
+(`crates/pdfs-fuse/src/lib.rs`), `Db::effective_node_access`
+(`crates/pdfs-core/src/db/share_access.rs`),
+`Db::defer_op_without_attempt` (`crates/pdfs-core/src/db/ops.rs`).
+
+**Root cause.** `effective_node_access` returns `Ok(None)` when the uid has no
+row in `nodes`, and `require_uid_access` maps that to `EACCES` — "I have never
+heard of this node" and "you may not write this node" are the same answer. The
+drain reads `EACCES` as `DrainDisposition::AccessDeferred` and calls
+`defer_op_without_attempt`, which by design touches neither `attempts` nor
+`last_error`. So the op was re-deferred every `DRAIN_ACCESS_RECHECK` (5s)
+indefinitely, and every channel that could have surfaced it stayed empty:
+`attempts` 0, `last_error` NULL, `parked` counts only `PARK_UNTIL` rows,
+`failing` counts only `attempts >= FAILING_ATTEMPTS`, and the one log line was
+`debug!`. On the machine that found it, all 28 uids were absent from `nodes`:
+
+```sql
+select (select count(*) from pending_op p
+          where exists(select 1 from nodes n where n.uid = p.uid)) as in_nodes,
+       (select count(*) from pending_op) as total;
+-- 0 | 28
+```
+
+**Fix, part 1 — stop guessing.** `WriteAuthority { Writable, Denied, Unknown }`
+replaces the `Result<(), Errno>` the drain's access check used to return
+(`Core::uid_write_authority`). `require_uid_writable` still collapses both
+refusals to `EACCES`, which is right for a syscall: a stale handle must not be
+admitted because the tree forgot the node. The drain does not collapse them —
+`Unknown` becomes `DrainDisposition::AuthorityUnknown(uid)`, and
+`Core::resolve_unknown_authority` asks the remote:
+
+- node still there → `upsert_node` re-interns it and the op is deferred for one
+  recheck, so the next pass gets a real access answer;
+- node gone (`Ok(None)` / `is_gone`) → `record_op_failure` **immediately**, with
+  a message naming the vanished uid, rather than waiting out the 5-minute window
+  to say something vaguer;
+- could not ask → ordinary deferral.
+
+The authority asked about is the op's own (`pending_op_authorities`), so a
+`create`/`mkdir` refetches its *parent*, not the node it has not made yet. The
+row and its staged blob survive every branch.
+
+**Fix, part 2 — say something.** Schema v27 adds `pending_op.access_deferred_since`.
+`Db::defer_op_for_access` stamps it on the first deferral of a run and returns
+the stamp on every one; `Core::defer_for_access` warns on the first deferral and,
+once the run passes `DRAIN_ACCESS_DEFER_LIMIT` (5 min), reports it through
+`record_op_failure` so it enters the ordinary backoff and shows up in
+`failing_ops` and the status error text. `record_op_failure` clears the window so
+each escalation re-arms it rather than firing every recheck, and an attempt the
+access check admits clears it too (`clear_op_access_deferral`). The row and its
+staged blob are untouched on every path — this changes only what the user can
+see.
+
+The deferral window stays as the backstop for everything that does not resolve,
+including a refetch that keeps not helping, and `AccessDeferral` now carries the
+reason into both the log line and the recorded `last_error`.
+
+**Still open:** the acceptance runner waits on the *global* queue
+(`ManagedSyncPair.wait_for_queue`), so any unrelated stuck op fails those four
+cases on a machine that has one — that is what turned this backlog into four
+apparent FUSE regressions.
+
+## B82 — A `parent_uid` cycle hangs the daemon on any short search
+
+**Status:** Fixed (unverified) 2026-08-12 — unit-tested, not driven against a
+real corrupted database (nobody has one).
+**Found:** 2026-08-12, writing a test for B80. The test built a two-node cycle
+and called `search`; `cargo test -p pdfs-core` then sat at
+`search_excludes_a_parent_cycle` for 29 minutes with **zero CPU** before it was
+killed. Two earlier runs had already been abandoned to the same stall without
+the cause being understood — it looks exactly like a cargo lock contention
+problem, which is what it was first blamed on.
+**Where:** `path_of` (`crates/pdfs-core/src/db/utils.rs`), `upsert_node_tx`'s
+`descendants` CTE (`db/nodes.rs`).
+
+**Root cause.** Both walks are recursive CTEs using `UNION ALL`, which does not
+deduplicate, so `a.parent = b, b.parent = a` never terminates. The index side
+was never exposed — `node_is_indexable_tx` rejects a cycle — but a query shorter
+than `TRIGRAM_MIN` (3 chars) takes the `LIKE` lane, and **that lane reads
+`nodes` directly and never consults the index**. Every row it returns is then
+handed to `path_of`. So typing two characters into the prompt was enough, and
+the spin happens while holding the daemon's only SQLite connection: the mount,
+the drain, and every control request stop with it.
+
+The API is what would produce such a cycle (a rename/move race, a malformed
+event), so this is not a "corrupt your own DB" scenario only.
+
+**Fix.** `path_of` is depth-capped at 256 and returns the truncated path rather
+than hanging; `path_relative_to` already carried a 1024 cap, which is the
+precedent. The `descendants` CTE in `upsert_node_tx` got the same guard for the
+write side. Cycles also stay out of the index (see B80).
+
+**Still open:** `pin_is_pinned`'s ancestor walk (`db/pins.rs`) has the same
+shape and no guard. Not reached from search, so it was left alone.
+
+## B81 — Prompt labels every Drive hit "My files", including device folders
+
+**Status:** Fixed (unverified) 2026-08-12 — needs a GUI/dmenu run.
+**Found:** 2026-08-12, reading the prompt while fixing B80: with B80 fixed, a
+device-folder hit would render as `My files / Downloads`, a folder that does not
+exist under the primary mount, while activating the same row opens
+`~/Downloads/…`. Label and action disagreed.
+**Where:** `Hit::location()` (`crates/pdfs-gui/src/prompt.rs`), shared by the
+GTK prompt and the dmenu front-end.
+
+The label was built from `SearchHit::path` with a hardcoded `My files /` prefix.
+The daemon already resolves a device/sync-folder hit to a real local path in
+`mounted_path` (`Core::mounted_search_path`), which is also what activation
+uses; the label now derives from that when it is set, and falls back to
+`My files` only for the primary mount.
+
+**Second defect, same area.** Pin rows set `is_dir` from `Pin::recursive`
+(`prompt.rs`, `dmenu.rs`). That flag is pin *policy* — whether the subtree is
+kept on disk — not node kind, so a folder pinned non-recursively drew a file
+icon and sent an invalid `OpenFile`. `Pin` now carries an `is_dir: Option<bool>`
+resolved from the `nodes` row by `pin_list`, serde-defaulted so an older daemon
+(which omits it) still parses; front-ends fall back to `recursive` only when the
+node is not cached.
+
+## B80 — 29% of the account is absent from the search index
+
+**Status:** Fixed (unverified) 2026-08-12 — migration replayed against a
+read-only copy of the live DB; not yet run by the daemon itself.
+**Found:** 2026-08-12, auditing `cache.db` after a user report that search felt
+unreliable. `pdfs search tickets` returned only the My Files folder
+`Documents/Tickets`, never the `tickets.pdf` sitting in the device folder
+`Downloads`. Counting the tables explained it:
+
+```
+nodes                     9252
+nodes_fts                 6547     ← 2705 rows never indexed
+nodes in orphan subtrees  2705     ← exactly the missing set
+```
+
+**Where:** `node_is_indexable_tx` (`crates/pdfs-core/src/db/nodes.rs`).
+
+**Root cause — the same one as B79.** A node was indexed only if walking
+`parent_uid` reached a row with `parent_uid IS NULL`. Exactly one row is stored
+that way (the My Files root). A device folder's root lives in `device` /
+`sync_folder` and is **never persisted as a `nodes` row**, so `Downloads`,
+`Pictures`, `Documents`, `Music` and `Videos` walk up to a parent that does not
+exist and were judged unindexable, along with everything beneath them. Stale
+`pdfs-acceptance-*` roots hit the same path.
+
+The v16 backfill did *not* share the bug — it rooted its walk at any node whose
+parent is null **or absent**. So the index was correct immediately after
+migrating and then lost each subtree the first time one of its nodes was
+rewritten. That divergence between backfill and write path is why this survived:
+a fresh install looks fine.
+
+**Fix.** Indexability now requires only that the walk terminates with nothing
+trashed on the way; a cycle is still rejected explicitly (B82). `MIGRATION_V21`
+(`SCHEMA_VERSION` → 21) rebuilds `nodes_fts` so existing installs recover
+without waiting for each node to be rewritten, and fixes two gaps in the v16
+walk it replays: descendants of a trashed folder stay out, and the walk is
+depth-capped.
+
+Replayed against a `.backup` of the live DB: **9276 non-trashed nodes → 9276
+indexed** (from 6547), 300 rows under `Downloads`, `tickets.pdf` at
+`Downloads/tickets.pdf`.
+
+**Watch for.** That path is the second thing this uncovered: the backfill first
+seeded an uncached-parent root with an empty path, so the migration indexed
+`tickets.pdf` while a later upsert indexed `Downloads/tickets.pdf` — the same
+node with two paths depending on which code wrote it. Any future rebuild of this
+index has to match `path_of`, not invent its own root rule.
+
+**Related, not a defect.** The local half of the prompt indexes 110,187 files,
+63,399 of them (58%) the Go module cache. Candidates are capped at 1000 and
+scored *after* SQLite, so for a common term the pool filled with vendored files
+before a real one was considered — for "test", 367 of the 500 best-ranked
+candidates came from `go/pkg/mod`. `SKIP_DIRS` gained `dist`/`build`, a new
+`SKIP_PATH_SUFFIXES` covers `go/pkg/mod`, and both candidate functions gained a
+whole-query prefix lane ahead of the existing single-character one.
+
 ## B79 — Every write in an on-demand device-folder mount fails EACCES
 
 **Status:** Fixed (verified live 2026-07-31, running in a locally rebuilt 1.2.1
@@ -1391,12 +1741,26 @@ silently undoing the hole at commit.
 
 ## B22 — Synchronous `block_on` inside Mutex Guard (HIGH-02)
 
-**Status:** Open / In Progress  
+**Status:** Fixed (unverified under load) 2026-08-16 — the systematic audit this was waiting on
+has been done and found nothing left.
 **Found:** 2026-07-21, multi-agent concurrency audit (`audit_bugs.md` HIGH-02)  
 **Where:** `crates/pdfs-fuse/src/lib.rs`, `sync.rs`, `devices.rs`
 
 **Cause:** Invoking `rt.block_on(...)` while holding `state.lock()` deadlocks worker threads and the main FUSE loop under high concurrency. Most major handlers have been refactored to drop `state.lock()` before invoking async runtime methods, but a full systematic audit across all background tasks and FUSE callbacks is required to eliminate all instances.
 
+**Audit (2026-08-16).** All 131 `block_on` sites in `pdfs-fuse` were scanned mechanically: for
+each, every guard binding (`self.state()` or any `.lock()`) still lexically live at that point,
+accounting for explicit `drop(..)` and scope exits. Two hits, both false positives —
+`devices.rs:570` binds `taken`, the `Option<Mount>` *taken out of* the map (the guard is a
+temporary, and `_guard` is explicitly dropped above), and `lib.rs:1917/1927` binds `resident`,
+a `bool` read out of a temporary guard. `pdfs-core` contains no `block_on` at all. The reverse
+direction — a guard held across an `.await` — is covered by `clippy::await_holding_lock`, which
+is on in the CI gate.
+
+The scan is lexical, so it cannot see a guard passed into a callee; it is evidence, not proof,
+which is why this is *unverified*. What would settle it is the concurrency half of the acceptance
+suite run against a heavily loaded drain.
+
 ---
 
 ## B23 — Un-fsynced Scratch Wipe on Daemon Restart (HIGH-03)
@@ -1431,12 +1795,44 @@ silently undoing the hole at commit.
 
 ## B25 — Weak Conflict Baseline Detection `(mtime, size)` (HIGH-05)
 
-**Status:** Open  
+**Status:** Fixed (unverified) 2026-08-16 — the FUSE-write half was closed by **B69**; the
+mirror half is closed here.  
 **Found:** 2026-07-21, multi-agent sync engine audit (`audit_bugs.md` HIGH-05)  
 **Where:** `crates/pdfs-core/src/cache.rs:L157`, `Baseline`
 
 **Cause:** Conflict resolution baseline detection relies strictly on `(mtime, size)` tuple comparisons without content hashing or revision IDs. Concurrent edits landing within the same second that produce identical file sizes match baselines, causing offline edits to overwrite remote changes silently without creating `(sync-conflict <ts>)` copies.
 
+**Fix (2026-08-16), part one — the FUSE write path.** Closed by **B69**: `Baseline` gained
+`revision_id`, and `revision_changed` keys on the server revision id — the true identity, which
+advances if and only if a new revision was sealed — falling back to `(mtime, size)` only for a
+sidecar written before the field existed.
+
+**Fix (2026-08-16), part two — the mirror sync path.** B69 did not reach it: a mirror folder's
+baseline is `sync_entry`, and its local side was still whole seconds. An edit made in the same
+second as the last sync that left the file the same length — a fixed-size record rewritten in
+place, an image re-exported, a database page updated — read as *unchanged* and was never
+uploaded, leaving the remote silently behind until something else about the file moved.
+
+`sync_entry` gains `local_mtime_ns` (schema **28**), and the comparison moved into
+`LocalSig::same_content`, which uses nanoseconds when both sides have them and whole seconds
+otherwise. The column is nullable rather than a converted `local_mtime * 1e9` on purpose: the
+sub-second part of an existing baseline is genuinely unknown, and inventing zero for it would make
+every already-synced file compare as changed and re-upload an entire mirror on first start. `NULL`
+means "compare seconds", which is exactly the behaviour that row was written under; each row gains
+a real value the next time its path syncs.
+
+Covered by `db::tests::migration_v28_adds_sub_second_local_times_without_disturbing_a_v27_baseline`
+and `sync::planner::file_plan_tests::a_same_second_same_size_edit_is_still_a_local_change`.
+
+**Still open (deliberately):** the *remote* side of a mirror baseline is still `(mtime, size)`
+(`remote_rev`/`remote_hash`). Re-keying it onto `active_revision_id` the way B69 did for the FUSE
+path is the same idea and the same size of change, but the stored column already holds
+mtime-shaped strings, and telling an old row from a new one would need a heuristic on the value's
+shape. That deserves its own column and its own pass rather than a guess.
+
+**To verify:** on a mirror folder, `printf %s aaaa > f && sync && printf %s bbbb > f` inside one
+second, then a reconcile pass — expect an upload, and the remote content to be `bbbb`.
+
 ---
 
 ## B26 — Broken Open-Unlinked File Semantics (HIGH-06)
@@ -1507,32 +1903,92 @@ queueing when it retires the last handle of an unlinked inode.
 
 ## B30 — SQLite Write Lock & Mutex Contention under Heavy Drain (MED-03)
 
-**Status:** Open / In Progress  
+**Status:** Fixed (unverified under load) 2026-08-16 — closed by the work filed under the
+performance audit rather than by a change made for this entry.  
 **Found:** 2026-07-21, multi-agent database audit (`audit_bugs.md` MED-03)  
 **Where:** `crates/pdfs-core/src/db/ops.rs`, `crates/pdfs-core/src/db/mod.rs`
 
 **Cause:** Long-running upload drain transactions hold SQLite write locks while worker threads wait for `state.lock()`, causing periodic FUSE response latency spikes during heavy sync operations.
 
+**Audit (2026-08-16).** Each of the three mechanisms behind that sentence is gone:
+
+1. **No transaction spans a network call.** Every `Db` method opens its transaction, commits and
+   returns; nothing holds one open across calls (the invariant is stated on `Db::read`). A drain
+   op's upload happens between database calls, not inside one.
+2. **Reads no longer queue behind the writer.** The read-only connection pool (`Db::read`) gives
+   `SELECT`-only methods their own connections, so a FUSE metadata call does not wait on whatever
+   is committing. Asserted by `db::tests::a_read_does_not_wait_for_the_write_connection`, which
+   holds the write connection for the whole measurement.
+3. **The queue is no longer read whole to pick one op.** `Db::claim_next_due_op` selects and
+   claims a single row in the database, which is what made a long queue quadratic to drain while
+   holding the shared connection.
+
+The `state.lock()` half is covered from the other side: **B75** moved network work off fuser's
+dispatch thread, and **B22**'s audit found no `block_on` under a `State` guard.
+
+Unverified because "periodic latency spikes" is a load property, not a code property: it is
+closed by construction and wants the concurrency acceptance case under a loaded drain to confirm
+it in the field.
+
 ---
 
 ## B31 — Unimplemented Special Files & Attribute Modifications (MED-04)
 
-**Status:** Open  
+**Status:** Not a bug — by design, verified 2026-08-16  
 **Found:** 2026-07-21, multi-agent POSIX audit (`audit_bugs.md` MED-04)  
 **Where:** `crates/pdfs-fuse/src/lib.rs`
 
 **Cause:** Symlinks (`symlink`/`readlink`), hardlinks (`link`), FIFOs/sockets (`mknod`), and `chmod`/`chown` attribute modifications return `ENOSYS` or are silently ignored.
 
+**Verdict (2026-08-16).** Each of these is the correct answer, not a gap, and each errno is now a
+deliberate choice with a comment saying why:
+
+- `symlink` → **EPERM**. The operation is meaningful; Drive simply cannot represent it. Callers
+  treat `EPERM` as a definite "no" instead of retrying against an older interface.
+- `link` → **EPERM**. A node has exactly one parent on Drive, so there are no hard links. git
+  falls back to `rename()` on `EPERM`, which this filesystem supports.
+- `mknod` → **ENOSYS**. Devices, FIFOs and sockets have no representation at all. Regular files
+  arrive through `create`, never here.
+- `chmod`/`chown`/`utimes` → accepted and ignored, so tools that chmod or restamp after writing
+  succeed rather than failing on a filesystem with no per-file mode to set.
+
+Implementing any of them would mean inventing a local-only representation that no other Proton
+client can read — a worse outcome than a clean refusal. The errno contract is asserted by the
+acceptance suite's clean-refusal case so it cannot drift, and **B73** removed the per-probe WARN
+that made these look like incidents in the journal.
+
 ---
 
 ## B32 — Race Condition in Concurrent Handle Release and Open (MED-05)
 
-**Status:** Open  
+**Status:** Fixed (unverified) 2026-08-16  
 **Found:** 2026-07-21, multi-agent concurrency audit (`audit_bugs.md` MED-05)  
 **Where:** `crates/pdfs-fuse/src/lib.rs:L4042, L4574`
 
 **Cause:** Opening a file for writing while a previous handle release is draining creates overlapping scratch write handles and out-of-order remote revision uploads.
 
+**Fix (2026-08-16).** The concrete hole was in `serve_open`: it sampled the queued revision
+(`Core::pending`), then copied that blob into a fresh scratch file, then took the `State` lock to
+install the handle. A `release` publishing a newer revision anywhere inside that gap — which spans
+a copy the size of the whole file — left the new handle carrying the *older* base, and its own
+release then published content that silently discarded the revision closed a moment earlier.
+
+The install is now guarded: the pending blob path (which changes on every publication, so it
+identifies the revision) is re-read immediately before the `State` lock, and if it moved, the
+scratch file is discarded and the open goes around again — up to `OPEN_BASE_ATTEMPTS` (3), after
+which it fails with `EIO` rather than spinning a FUSE worker. Only a handle the open is about to
+*create* is checked; if one already exists, that handle is authoritative and the scratch is
+discarded regardless.
+
+The re-read is deliberately **not** taken under the `State` lock: no site in the daemon holds
+`pending` and `state` at once (the invariant is stated on `stamp_pending_sizes`) and this is not
+the place to become the first. What that costs is a residual window of a few instructions instead
+of a lock-tight comparison; what it removes is the multi-gigabyte window, which is the one that
+actually loses data.
+
+**To verify:** the acceptance suite's concurrency case, with a large file, closing and reopening
+it for write from two processes while the drain is loaded.
+
 ---
 
 ## B33 — Lack of Partial Transfer Resumption & Head-of-Line Queue Blocking (MED-06)
@@ -1591,12 +2047,25 @@ second-account and live FUSE acceptance have not been run and remain required in
 
 ## B36 — Unicode Normalization Discrepancy (NFC vs NFD) (LOW-01)
 
-**Status:** Open  
+**Status:** Open (verified 2026-08-16, deliberately not fixed)  
 **Found:** 2026-07-21, multi-agent sync audit (`audit_bugs.md` LOW-01)  
 **Where:** `crates/pdfs-fuse/src/lib.rs`, `crates/pdfs-fuse/src/sync.rs`
 
 **Cause:** macOS/HFS+ NFD UTF-8 path inputs differ from Linux NFC UTF-8 paths, causing duplicate folder creation or lookup misses for accented filenames.
 
+**Verified (2026-08-16), not fixed.** The claim is accurate: names are compared as bytes
+throughout — the mirror engine's rel paths, `by_uid`/`children` interning, and the planner's
+classification union — so `café` written by a Proton client on macOS or iOS (NFD) and `café`
+written here (NFC) are two different paths, and a mirror folder holding both would sync both.
+
+Not fixed here on purpose. A normalizing comparison changes what "the same file" *means* across
+the whole daemon, and it changes it in the unsafe direction: two names that are genuinely distinct
+on the remote would start colliding locally, and a collision in the sync engine is a deletion or
+an overwrite, not a warning. Doing it properly means a normalization dependency, a decision about
+which form is canonical on the wire, and a migration for baselines keyed on the other form — its
+own change with its own acceptance case, not a line in a sweep. Left LOW because it needs
+cross-platform authorship of the *same* accented name to bite at all.
+
 ---
 
 ## B37 — Failed Remote Trash Removed the Local Dentry (CRIT-04)
@@ -1632,7 +2101,7 @@ pass from being treated as successfully settled.
 
 ## B39 — Sync Download Can Overwrite a Concurrent Local Edit (HIGH-09)
 
-**Status:** Open
+**Status:** Fixed (unverified) 2026-08-16
 **Found:** 2026-07-22, sync concurrency audit
 **Where:** `crates/pdfs-fuse/src/sync.rs`, download classification and apply path
 
@@ -1646,11 +2115,28 @@ revalidate immediately before rename. Preserve a conflict copy on mismatch. A
 deterministic test should pause the download, edit the target, resume it, and
 verify that neither version is lost.
 
+**Fix (2026-08-16).** `Pending::Download` now carries `local: Option<LocalSig>` — what the
+planning walk actually saw at that path, or `None` for nothing there — and `download_file` calls
+`keep_racing_local_edit` in the last moment before the rename that publishes the download. A
+destination that no longer matches the plan is moved aside by `preserve_conflict_copy` first, so
+the racing bytes survive and re-upload as a new file on the next pass: the same resolution a
+both-sides-changed conflict already gets. A path that is *empty* when something was expected is
+not a conflict — the download is about to recreate it and there is nothing to preserve.
+
+`Pending::Conflict` passes `None` deliberately: it has just moved the local copy aside itself, so
+the state its download expects to find is "nothing", and anything that appears while it runs is a
+new racing write that gets its own copy.
+
+Covered by `sync::tests::a_download_keeps_a_local_edit_it_did_not_plan_for` (unchanged destination
+overwritten silently; changed destination preserved). Unverified against a real timing race —
+the deterministic pause-mid-download test the entry asks for is not in place; the unit test drives
+the guard directly instead.
+
 ---
 
 ## B40 — Sync Upload Can Stream Torn Live Content (HIGH-10)
 
-**Status:** Open
+**Status:** Fixed (unverified) 2026-08-16
 **Found:** 2026-07-22, sync concurrency audit
 **Where:** `crates/pdfs-fuse/src/sync.rs`, upload apply and baseline update
 
@@ -1662,11 +2148,32 @@ and falsely declare them synchronized.
 **Required fix/test:** Upload an immutable staged snapshot, or validate an open
 descriptor before and after streaming and refuse baseline settlement on change.
 
+**Fix (2026-08-16).** The second option, and the correction is structural rather than a check.
+`record_file_baseline` no longer stats the path when it is done; it is *given* the identity the
+transferred content corresponds to, and both upload paths pass the `LocalSig` taken from the
+descriptor they streamed. So a file that changed mid-stream records a baseline describing the
+bytes that went up, not the bytes on disk now — which makes the very next pass classify the path
+as locally changed and upload a whole, clean revision over the torn one. The old behaviour stated
+the opposite: it declared the torn revision synchronized and left it as the file's content on
+Drive.
+
+`warn_if_torn` compares before and after purely so the journal explains the extra revision; the
+correction does not depend on it. Downloads are unaffected — there the file on disk *is* the
+transferred content, published by a rename and stamped, so its stat is the identity.
+
+Note the pre-existing mitigation this backs up: the `/proc/*/fd` scan already defers any file held
+open for writing (`FilePlan::Deferred`), so this covers the residual — a writer that opens, writes
+and closes entirely inside one upload.
+
+**To verify:** upload a large file from a mirror folder while appending to it, then check that the
+following pass uploads a new revision and the final remote content matches the local file.
+
 ---
 
 ## B41 — Sync Folder Removal Races Active Reconciliation (HIGH-11)
 
-**Status:** Open
+**Status:** Fixed (verified by inspection) 2026-08-16 — already correct in the code by the time
+this was revisited
 **Found:** 2026-07-22, sync lifecycle audit
 **Where:** `crates/pdfs-fuse/src/devices.rs`, `remove_sync_folder`
 
@@ -1678,11 +2185,26 @@ baseline state.
 **Required fix/test:** Serialize removal with reconciliation, cancel/disable the
 folder, await active work, then unmount and remove durable state.
 
+**Audit (2026-08-16).** `Core::remove_sync_folder` opens by taking `self.sync_lock(id)` and holds
+it across the whole removal, and `reconcile_pass` takes the same lock for the whole pass — so a
+removal requested mid-pass blocks until that pass finishes, which is the serialization this asked
+for. The ordering inside the lock is also the one specified: unmount the on-demand session first
+(before trashing the remote tree it serves, which would otherwise leave it answering for deleted
+nodes), then drop the row.
+
+The one step outside the lock is the remote trash, and that is safe by construction rather than by
+accident: the row is already gone, and `reconcile_pass` re-reads `sync_folder_get` **under the
+lock** and returns when it finds nothing, so no pass can start against a folder being removed. The
+mode re-check on that same re-read is what makes this hold for a switch racing a removal too.
+
+No code change. Recorded as verified-by-inspection: a live removal during an active pass has not
+been driven.
+
 ---
 
 ## B42 — Local Delete Failure Is Recorded as Sync Success (HIGH-12)
 
-**Status:** Open
+**Status:** Fixed (unverified) 2026-08-16.
 **Found:** 2026-07-22, sync error-path audit
 **Where:** `crates/pdfs-fuse/src/sync.rs`, local file/directory deletion branches
 
@@ -1693,11 +2215,23 @@ next pass and can resurrect content that was deleted remotely.
 **Required fix/test:** Treat `ENOENT` as success; for every other removal error,
 retain the baseline and increment `Outcome.errors`.
 
+**Fix (2026-08-16).** The error half was already in place by the time this was revisited: both
+`FilePlan::DeleteLocal` and the deferred folder removals log the failure, increment
+`outcome.errors` and `continue` without touching `sync_entry_remove`, so the baseline survives
+and the survivor is not mistaken for a new local file next pass.
+
+The `ENOENT` half was not, and it failed the opposite way: a path that was *already* gone was
+counted as an error and kept its baseline, so the same removal was retried and re-reported on
+every pass forever. Both call sites now go through `removed_locally`, which reads `NotFound` as
+the state the engine was asking for. Covered by
+`sync::tests::an_already_absent_path_counts_as_removed`. Unverified because no live sync pass has
+been driven over an externally-deleted file yet.
+
 ---
 
 ## B43 — FUSE Directory Cookies Are Not Stable (MED-09)
 
-**Status:** Open
+**Status:** Fixed (unverified) 2026-08-16
 **Found:** 2026-07-22, FUSE/POSIX audit
 **Where:** `crates/pdfs-fuse/src/filesystem.rs`, `ProtonFs::serve_readdir`
 
@@ -1709,11 +2243,31 @@ indexes and cause entries to be skipped or repeated.
 directory handle, or assign stable per-entry cookies. Test with deliberately
 small reply pages and mutation between calls.
 
+**Fix (2026-08-16).** The first option. `opendir` is now implemented: it enumerates the folder if
+it is cold, freezes the listing, and publishes it under a fresh `fh` in `State::dir_snapshots`;
+`readdir` serves from that snapshot; `releasedir` drops it. The kernel pairs each `opendir` with
+exactly one `releasedir`, so the snapshot lives exactly as long as the enumeration it belongs to,
+and a create or a trash landing between two pages can no longer shift the indexes the continuation
+cookie is expressed in.
+
+The `fh` comes from the same `State::next_fh` counter write handles use, so a directory handle can
+never collide with a file handle. Serving from the snapshot is a pure in-memory walk with no
+chance of a remote call, so `readdir` no longer needs a worker at all; the live path
+(`serve_readdir`) stays as a fallback for a handle that has no snapshot, and both build their
+listing through the same `build_listing` so they cannot disagree.
+
+Enumeration cost is unchanged — it moved from the first `readdir` to `opendir`, one call earlier —
+and a folder that cannot be enumerated now fails at `opendir`, where the caller can still act on
+the errno.
+
+**To verify:** the acceptance suite with deliberately small reply pages, creating and trashing
+entries between `getdents` calls, asserting no entry is skipped or repeated.
+
 ---
 
 ## B44 — FUSE Background Workers Have No Coordinated Shutdown (MED-10)
 
-**Status:** Open
+**Status:** Fixed (unverified) 2026-08-16
 **Found:** 2026-07-22, daemon lifecycle audit
 **Where:** `crates/pdfs-fuse/src/mount.rs`, mount lifecycle; drain/index/sync loops
 
@@ -1726,6 +2280,31 @@ continue DB/client activity after teardown.
 handles, and ordered shutdown. Repeated mount/unmount tests should return thread
 counts to baseline and observe no post-unmount DB work.
 
+**Fix (2026-08-16).** All four, in `crates/pdfs-fuse/src/shutdown.rs` plus the loops:
+
+1. **Shared cancellation.** `Shutdown` — a flag and a condvar, set once and never cleared — lives
+   on `Core`, so every clone a worker was given carries it.
+2. **Interruptible waits.** Every loop that called `thread::sleep` in a `loop {}` with no exit now
+   calls `Shutdown::sleep`, which returns `false` the moment teardown starts: the conflict sweep
+   (warmup *and* interval), the online probe, the local indexer, and both sync poll threads. The
+   drain workers check between ops — never inside one, so an op is always either retired or
+   released — and the sync engine gained a `SyncMsg::Stop` that ends its loop and abandons any
+   burst it was settling.
+3. **Owned join handles.** `run_mount` collects every long-lived thread it starts into one
+   `workers` vec.
+4. **Ordered shutdown.** `stop_workers` sets the flag, wakes the two waits that need waking — the
+   drain's own condvar via `wake_drain`, and the control listener, which blocks inside `accept`
+   and is woken by a connection from us before the socket is unlinked — then joins them all. It
+   runs after the mounts are down, because nothing a worker can still do is harmful at that point,
+   and it also runs on the startup-failure path, which abandons the mount just as completely.
+
+A join that takes a while is expected and correct: a drain worker part-way through an upload
+finishes it rather than abandoning the user's bytes mid-flight.
+
+Covered by `shutdown::tests` (a stop cuts an hour-long wait short; an already-stopped signal does
+not wait at all). Unverified for the property that motivated the entry — repeated in-process
+mount/unmount returning thread counts to baseline — which wants the acceptance suite.
+
 ---
 
 ## B45 — Truncate After a Queued Rewrite Corrupts or Returns EIO

docs/CHANGELOG.md

@@ -0,0 +1,361 @@
+# Changelog
+
+All notable changes to the Linux client since the 1.0.0 release. Format follows
+[Keep a Changelog](https://keepachangelog.com/1.1.0/); versions follow semver, and every
+release is tagged `vX.Y.Z` with `Cargo.toml` and `packaging/PKGBUILD` in agreement.
+
+`Schema:` lines record the SQLite `SCHEMA_VERSION` (`pdfs-core/src/db/migrations.rs`) a
+release ships. Migrations are forward-only — a database written by a newer client is a hard
+refuse-to-open, not a downgrade, so rolling back a release means restoring the cache from
+scratch (user data in `staging/` and `recovery/` is never touched by this).
+
+## [1.8.1] — 2026-08-16
+
+Some files read short through the mount and reported success — an application got a truncated
+copy with nothing anywhere saying so (`docs/BUGS.md` B84). Found because GNOME's file indexer
+kept complaining that PNGs under `~/ProtonDrive/Pictures` were corrupt; it was right. The rest
+of this release is the long-standing architectural backlog from the July concurrency audits
+(B25, B32, B39, B40, B43, B44), each verified against the current code before being fixed.
+Schema: **28** — migration V28 adds `sync_entry.local_mtime_ns`.
+
+### Fixed
+- A read no longer trusts a revision whose recorded block sizes disagree with the file's size.
+  Such a file leaves the block/range path entirely: it is fetched through the whole-file,
+  manifest-verified download — the same path `pdfs pin` uses, and the reason pinning was the
+  workaround — and served from the resulting cached blob. One download per file however many
+  reads discover the problem at once, and files above 512 MiB fail `EIO` with a note to pin
+  them rather than pulling down gigabytes for one read.
+- A block that comes back shorter than the file's size implies is never served, cached or kept
+  in memory. Assembling a read out of short blocks is what quietly produced the truncation:
+  the missing bytes were simply not appended, the kernel handed userspace a short read, and
+  every tool reads a short read as end-of-file.
+- A synced folder no longer reports the same deletion as an error on every pass. Deleting a
+  local file that something else had already deleted counted as a failure, which kept its
+  baseline and made the next pass try again — forever. A path that is already gone is the
+  state the sync pass wanted (`docs/BUGS.md` B42).
+- A mirror folder no longer misses an edit made in the same second as its last sync. Change
+  detection compared whole seconds, so rewriting a file in place without changing its length
+  read as "unchanged" and never uploaded — the remote silently stayed behind until something
+  else about the file moved. Baselines now record the modification time to nanoseconds
+  (`docs/BUGS.md` B25).
+- A sync download no longer overwrites an edit that finished while it was running. The
+  destination is re-checked in the last moment before the download is published, and a local
+  file that has moved on since the pass planned for it is kept as a conflict copy — the same
+  resolution a both-sides-changed conflict gets (`docs/BUGS.md` B39).
+- An upload interrupted by a writer no longer reports itself as synchronized. The baseline now
+  records the content that actually went up rather than whatever is on disk when the transfer
+  ends, so a revision torn by a concurrent write is replaced by a clean one on the next pass
+  instead of standing as the file's content on Drive (`docs/BUGS.md` B40).
+- Listing a directory that changes while it is being read no longer skips or repeats entries.
+  `readdir` resumed by index into a listing rebuilt on every call, so a create or a trash
+  between two pages shifted everything after it. The listing is now frozen for the life of the
+  directory handle (`docs/BUGS.md` B43).
+- Opening a file for writing while a previous close is still publishing no longer discards that
+  close's revision. The base is re-checked at the moment the write handle is installed, rather
+  than trusted across a copy that can be the size of the whole file (`docs/BUGS.md` B32).
+- Unmounting now stops and joins the daemon's background workers instead of leaving them
+  running. The drain, sync engine, conflict sweep, online probe, local indexer and control
+  listener share a stop signal and interruptible waits, so an in-process remount no longer
+  starts a second set on top of the first (`docs/BUGS.md` B44).
+
+### Notes
+- The size `stat` reports was always the correct one; it is the reader's belief about where
+  blocks end that was wrong, so nothing about reported sizes changes.
+- Verified live on the affected account: four multi-block PNGs that had been reading short now
+  deliver their full size, and the journal shows each one repaired. The diagnostics also
+  answered the open question, and not as expected — the revision metadata is fine; those files
+  simply do not have 4 MiB blocks, and this client assumes they do. Filed as `docs/BUGS.md`
+  B85. Until that is fixed, a file with non-4-MiB blocks is downloaded whole on its first read.
+- Migration V28's new column is nullable rather than converted from the existing seconds. A
+  baseline row written before this release has no sub-second time to recover, and inventing
+  zero for it would make every already-synced file compare as changed and re-upload an entire
+  mirror on first start; `NULL` keeps those rows comparing exactly as they did, and each gains
+  a real value the next time its path syncs.
+- Three audit entries closed without a code change, having been fixed already or being correct
+  as they stand: sync-folder removal is serialized against reconciliation (B41), the drain's
+  database contention was removed by the read-only connection pool and the claim column (B30),
+  and the refusals for symlinks, hard links, device nodes and `chmod` are deliberate — Drive
+  cannot represent them, and a local-only representation no other Proton client can read would
+  be worse than a clean refusal (B31).
+
+## [1.8.0] — 2026-08-16
+
+A queued write whose node had left the local tree was retried every five seconds forever and
+counted as an ordinary pending upload — 28 of them, holding 18.4 GiB, had been doing that for
+30 days on the machine that found it (`docs/BUGS.md` B83). Schema: 27 — migration V27 adds
+`pending_op.access_deferred_since`.
+
+### Fixed
+- The drain no longer reads "I have never heard of this node" as "you may not write this
+  node". A missing authority is now resolved against the remote: the node is re-interned if
+  it is still there, and reported as a real failure if it is gone. Ops that had been stuck
+  invisibly for weeks now say what is wrong with them on the first pass.
+- A create or mkdir resolves its *parent* as the authority, so the refetch asks about the
+  folder rather than the node it has not made yet.
+
+### Added
+- Access deferrals are bounded. A deferral still costs no attempt and records no error for
+  the first five minutes — the case it exists for is a share downgraded mid-queue and undone
+  a moment later — but past that window each recheck records a failure, so the op enters the
+  ordinary backoff and appears in `failing_ops` and the `pdfs status` error text like any
+  other stuck operation. The first deferral of a run is logged at `warn` rather than `debug`.
+
+### Notes
+- No staged data is touched by any of this. A reported failure keeps its `pending_op` row and
+  its staged blob exactly as before; the change is in what the user is told, and in the queue
+  no longer waiting on a permission change that was never coming.
+
+## [1.7.1] — 2026-08-16
+
+Write-back throughput follow-up to 1.7.0, same audit
+(`docs/plans/audit-2026-08-15-perf-locks.md`). Schema: 26 — migration V26 adds
+`pending_op.claimed_at`.
+
+### Added
+- Parallel write-back drain: three workers share the queue through a `pending_op.claimed_at`
+  claim column (migration V26), so a large upload no longer holds every queued rename, trash
+  and small write behind it. Ordering is preserved per node — the claim query never offers
+  two workers ops for the same uid — and claims left by a crashed run are cleared at open.
+- An upload already on the wire is cancelled when a newer write, a trash or a discard
+  supersedes it, instead of spending the uplink on a revision the next operation replaces.
+
+### Changed
+- The revision debounce is adaptive: it widens toward how long that node's last upload
+  actually took (bounded to 2–60 s), so a file saved faster than it can be sent supersedes
+  in the queue rather than mid-upload.
+- Workspace deps bumped to `proton-sdk` / `proton-drive-rs` 0.6.0.
+
+## [1.7.0] — 2026-08-16
+
+Performance and robustness pass over the mount, from the architecture audit in
+`docs/plans/audit-2026-08-15-perf-locks.md`. Schema: 25.
+
+### Added
+- Sequential-read prefetch (`Core::prefetch_ahead`): per-file sequential detection, depth
+  doubling 2→8, reset to 0 after a seek, skipping blocks already cached, and bounded by its
+  own permit budget so it can never queue ahead of a demand read.
+- Single-flight block fetching (`BlockFlight`) keyed on `(uid, mtime, size, block)`, so a
+  demand read, kernel read-ahead and prefetch of the same block share one download+decrypt.
+- In-memory block LRU (`BlockRing`) in front of *both* block paths; a block read off disk is
+  promoted into it, so the following ~31 kernel reads of that 4 MiB block cost nothing.
+- Read-only SQLite connection pool (`ReadPool` / `Db::read`) with every `SELECT`-only method
+  routed at it, so a read no longer waits on the write connection.
+- `nodes.path` persisted and backfilled, replacing the recursive `path_of` walk.
+- Single-writer `flock` on the database; a `SQLITE_CORRUPT`/`NOTADB` file is quarantined as
+  `cache.db.corrupt-<ts>` (WAL sidecars too) and rebuilt rather than failing the mount.
+- `VACUUM` and the deep `integrity_check` now ack immediately and run as background jobs;
+  `pdfs doctor` polls for the verdict.
+- Staging reconcile at mount: staged blobs no queued operation refers to are re-queued, or
+  named in the log when they cannot be addressed.
+- Queue/staging visibility — `Status` gained `parked_uploads`, `failing_ops`,
+  `failing_error`, `staged_bytes`, `staged_oldest_secs`; `pdfs status` prints them when
+  non-zero.
+- `statfs` implemented against the account quota; FUSE `init` negotiates `max_readahead`,
+  `max_background`, `PARALLEL_DIROPS` and `CACHE_SYMLINKS`; `blksize` raised to 1 MiB.
+
+### Changed
+- `State` no longer writes to SQLite under the inode lock — mutations queue into an outbox
+  applied after the lock is released, so interning a 5000-child listing no longer commits a
+  transaction with the whole mount frozen.
+- Re-listing an unchanged folder no longer touches its subtree; when a subtree really moved,
+  one recursive walk carries both the new path and the inherited trashed flag.
+- `release(2)` no longer gap-fills from the network: it stages an incomplete blob from local
+  caches only and the drain thread finishes it off the dispatch loop.
+- A partial write over an undrained one is merged instead of refused.
+- Size-upgrade waiters park on a queue instead of occupying a worker thread, capped at 8
+  folders in flight; past the cap `stat` answers provisionally.
+- Block-cache disk writes moved off the read's critical path; no more fsync per cached block.
+- Cache LRU touches buffered in memory and flushed in one transaction.
+- Search: sync-folder list and pin lookups hoisted out of the per-hit loop.
+- SQLite tuned (`cache_size`, `mmap_size`, `temp_store=MEMORY`, `wal_autocheckpoint`) and
+  three new indexes added.
+- Mount registry lock released before FUSE teardown/join; kernel notifications batched under
+  the state lock and flushed after it.
+
+### Fixed
+- **Data loss:** `ENOSPC` is now propagated from `write`/`fsync`/staging instead of being
+  swallowed, with emergency eviction wired up and scratch marked durable before any staging
+  error; a failed `record_pending_write` fails `release` rather than dropping the write.
+- **Data loss:** the conflict sweep no longer discards queued operations after the trash
+  round trip.
+- **Data loss:** `rescue_scratch` moves a blob with an unreadable sidecar to `recovery/`
+  unaccompanied instead of fabricating a sidecar for it.
+- Own-sealed revisions are persisted (7-day TTL), so a restart no longer reopens the
+  transient-download fork window fixed in 1.1.0.
+- Depth-capped `is_pinned` (cycle-safe), daemon write timeout, and every client-supplied
+  `limit` clamped.
+- `recover_fsynced_writes` no longer scans the recovery directory on every idle pass.
+
+## [1.6.0] — 2026-08-12
+
+Search-index correctness and ranking (`docs/plans/search-index.md`). Schema: 21 —
+migration V21 rebuilds `nodes_fts`.
+
+### Fixed
+- **B80** — 29% of the account was missing from the search index. `node_is_indexable_tx`
+  required a null-parent ancestor, which only the My Files root has, so every node under a
+  device folder was dropped from `nodes_fts` on its first upsert after the v16 backfill
+  (2,705 of 9,252 nodes on the account this was diagnosed against). The rule now matches the
+  backfill, migration V21 replays it, nodes under a trashed folder stay out, and the walk is
+  depth-capped.
+- **B81** — the prompt labelled every Drive hit "My files", including device folders; pin
+  rows also took `is_dir` from `Pin::recursive`.
+- **B82** — a `parent_uid` cycle hung the daemon on any short search: the recursive CTEs in
+  `path_of` and the pin walk use `UNION ALL`, which does not deduplicate. `path_of` is now
+  depth-capped at 256 and returns the truncated path.
+
+### Changed
+- Local search ranking: whole-query prefix matches get their own lane (newest first) ahead
+  of trigram rank, which on a home directory full of dependency trees was burying the
+  obvious answer — 73% of the 500 best-ranked candidates for "test" came from one Go module
+  cache. The single-character lane, which recovers a typo that destroys every trigram, stays
+  behind it.
+
+## [1.5.0] — 2026-08-11
+
+Schema: 20.
+
+### Added
+- **`pdfs-prompt --dmenu`** — the same search through an external dmenu-style launcher
+  (fuzzel, rofi, wofi, tofi, bemenu, dmenu) instead of the built-in GTK HUD, so the prompt
+  matches a tiling-WM desktop. A launcher filters a fixed list rather than re-querying per
+  keystroke, so searching is a two-step loop; `--query` skips the first step, fuzzel and rofi
+  get file-type icons. Configurable as `"prompt": { "mode": "dmenu", "menu": [...] }`, with
+  `--gtk` overriding for one invocation.
+- **Configurable open-with rules** (`pdfs-core/src/opener.rs`): an ordered list of name/class
+  patterns in `config.json` under `open_with`, each mapped to argv and optionally wrapped in
+  a terminal, first match wins, falling back to `xdg-open`. Lets "open a text file" mean
+  `nvim` in a terminal without breaking every graphical caller. Absent config reproduces the
+  old behaviour exactly.
+
+### Fixed
+- The prompt and dmenu openers hand applications the cached file while matching rules
+  against the *original* Drive filename, so e.g. `.md` files stop being routed by their
+  cache-path extension.
+
+## [1.4.0] — 2026-08-10
+
+Schema: 20.
+
+### Added
+- **File version history** (`pdfs-fuse/src/revisions.rs` + a GTK versions dialog): list a
+  file's revisions, restore one, delete one, or write an old one out to a local path. A
+  restore re-points the file server-side, so no content crosses the wire and nothing enters
+  the drain queue; the daemon drops its cached content and repopulates on the next read.
+- **Persistent SDK entity cache** (`pdfs-core/src/sdkcache.rs`): the SDK's decrypted node
+  metadata now survives a daemon restart instead of re-walking the tree. It lives in its own
+  `sdk_cache.db`, deliberately off the daemon's hot `cache.db` mutex, holds no key material,
+  needs no migrations, and is cleared on logout.
+- Per-node outcomes for batch operations (`pdfs-core/src/batch.rs`): `trash`/`restore`/
+  `delete`/`move` report one result per node, so a node the server rejects no longer fails
+  the whole batch.
+- Photo viewer page in the GUI and richer photo metadata in the details pane.
+
+### Changed
+- SDK telemetry routed into `tracing`, so its transfer/block-storage/request spans land in
+  the daemon log instead of a no-op sink.
+- A file that fits in one block uploads as a single atomic request rather than the
+  draft/block/commit sequence.
+
+## [1.3.0] — 2026-07-31
+
+Schema: 19.
+
+### Added
+- **Photo albums** — `PhotoAlbums` / `AlbumPhotos` control requests, daemon-side `albums.rs`
+  and a GUI albums page (the former gallery view, renamed). Albums other people share with
+  you are included; their photos are persisted per album because a shared album's photos
+  never appear in your own timeline. Served stale-while-refreshing like the timeline.
+- **GUI "Locations" page** — one row per mount spec: the primary `~/ProtonDrive` mount
+  alongside every folder this computer backs up, mirrored or on-demand. Called *Locations*
+  rather than *Mounts* because a mirror folder is a plain directory with no FUSE session.
+  It absorbs the old Computers page's actions and the mountpoint chooser from Settings.
+- `role` on shared-node metadata (`viewer`/`editor`/`admin`), defaulted for wire-compat with
+  older clients and daemons.
+- FUSE acceptance coverage for the permission-based mounts.
+
+## [1.2.1] — 2026-07-31
+
+Schema: 18.
+
+### Fixed
+- Migration bug that could leave the `ProtonDrive` mount unwritable after upgrade.
+- Permission error on on-demand mounts.
+- B78.
+
+### Changed
+- Release pipeline: `.deb` signing added and `.rpm` signing fixed.
+
+## [1.2.0] — 2026-07-29
+
+Sharing and multi-mount release. Schema: 18.
+
+### Added
+- **Shared with me**: shares others sent you are listed, verified and mountable, including on
+  the primary mount.
+  They appear under a synthetic `Shared with me` directory on a virtual volume
+  (`pdfs-fuse/src/virtual.rs`), with name collisions and over-long components resolved by
+  its own naming rules.
+- Per-share access model (`db/share_access.rs`): the effective role of each shared root is
+  persisted and kept resident in mount state, so interning an inode never costs a query. The
+  database stays the restart/offline authority — every role change is written through before
+  the cache updates. A share you cannot write is presented POSIX read-only.
+- Unified location model (`pdfs-core/src/mounts.rs`, `db/mounts.rs`): one presentation shape
+  for every local Proton Drive location, joining device sync state with a new `mount` table.
+  `MountMode` is `Mirror` (full local copy, reconciled both ways) or `OnDemand` (FUSE session
+  fetching on access), with an `Unknown` fallback so a mode written by a newer client does
+  not break an older one.
+
+## [1.1.1] — 2026-07-27
+
+Schema: 16.
+
+### Fixed
+- Trash refresh did not pull updates.
+- Packaging: `PKGBUILD` was left at 1.1.0 by the 1.1.1 version bump, failing the release
+  workflow's tag/manifest/PKGBUILD agreement check.
+
+## [1.1.0] — 2026-07-26
+
+Conflict-handling and concurrency release. Schema: 16.
+
+### Added
+- Conflict sweep (`pdfs-fuse/src/sweep.rs`, 5-minute cadence): removes conflict copies proven
+  identical by size + `content_sha1`, surfaces divergent ones once as an activity entry, and
+  never removes what it cannot prove.
+- Sweep mode and `.pdfsignore`-driven conflict handling; ignore rules are rebuilt per sync
+  pass so edits take effect without a restart.
+- Substantially extended FUSE acceptance suite.
+
+### Fixed
+- **B69** — spurious `(sync-conflict)` copies. Revision identity now uses the server's
+  `revision_id` rather than `(mtime, size)`, which the server re-stamps on seal; the planner
+  gained `AdoptBaseline` so an equal-size no-baseline pair is recorded instead of forked on
+  first reconcile.
+- **B70** — browser downloads into an on-demand mount had their in-flight temporaries sealed
+  as canonical revisions. Transient names are recognised and held until the name is finalized.
+- Assorted race conditions and concurrency bugs on the write/drain paths.
+
+### Changed
+- Workspace deps bumped to `proton-sdk` / `proton-drive-rs` 0.2.2.
+
+## [1.0.0] — 2026-07-22
+
+First stable release: FUSE files-on-demand mount, sync daemon under `proton-drive.service`,
+`pdfs` CLI and the GTK4 app, on top of the pure-Rust Proton Drive SDK. Schema: 16.
+
+### Fixed
+- The outstanding FUSE defects tracked in `docs/BUGS.md`, plus a truncate defect, validated
+  by a new POSIX compliance suite for the filesystem.
+
+[1.7.1]: https://github.com/narrrl/proton-drive-linux/releases/tag/v1.7.1
+[1.7.0]: https://github.com/narrrl/proton-drive-linux/releases/tag/v1.7.0
+[1.6.0]: https://github.com/narrrl/proton-drive-linux/releases/tag/v1.6.0
+[1.5.0]: https://github.com/narrrl/proton-drive-linux/releases/tag/v1.5.0
+[1.4.0]: https://github.com/narrrl/proton-drive-linux/releases/tag/v1.4.0
+[1.3.0]: https://github.com/narrrl/proton-drive-linux/releases/tag/v1.3.0
+[1.2.1]: https://github.com/narrrl/proton-drive-linux/releases/tag/v1.2.1
+[1.2.0]: https://github.com/narrrl/proton-drive-linux/releases/tag/v1.2.0
+[1.1.1]: https://github.com/narrrl/proton-drive-linux/releases/tag/v1.1.1
+[1.1.0]: https://github.com/narrrl/proton-drive-linux/releases/tag/v1.1.0
+[1.0.0]: https://github.com/narrrl/proton-drive-linux/releases/tag/v1.0.0

docs/DEVELOPMENT.md

@@ -7,21 +7,20 @@ This document summarizes the work still pending after the 1.0.0 release branch a
 ## 1. Core Feature Roadmap (Horizon Tasks)
 Consolidated from the historical feature roadmap; current bug status lives in [`BUGS.md`](BUGS.md).
 
-* **Local Cache & Metadata Encryption at Rest (Priority 5 / Horizon 1)**: Encrypt the SQLite database `cache.db` on disk using SQLCipher (`rusqlite` feature `bundled-sqlcipher`), and encrypt raw content cache blocks (`content/blocks/` and `content/scratch/`) using a fast symmetric scheme like AES-GCM or ChaCha20-Poly1305. The encryption key should be derived from the OS Keyring.
+* **Local Cache & Metadata Encryption at Rest (Priority 5 / Horizon 1)**: Encrypt the SQLite database `cache.db` on disk using SQLCipher (`rusqlite` feature `bundled-sqlcipher`), and encrypt raw content cache blocks (`content/blocks/` and `content/scratch/`) using a fast symmetric scheme like AES-GCM or ChaCha20-Poly1305. The encryption key should be derived from the OS Keyring. (The SDK entity cache in `sdk_cache.db` is already encrypted at rest — see *Persistent SDK Entity Cache* below — but `cache.db` and the content cache are not.)
 * **Active Bandwidth Throttling & Traffic Shaping (Horizon 1)**: Add speed governors for daemon uploads and downloads. Support configuration variables `max_upload_rate_kbps` and `max_download_rate_kbps` in `config.json` that can be dynamically adjusted over the Unix control socket.
 * **Interactive & Policy-Based Conflict Resolution (Horizon 1)**: Implement configurable conflict resolution policies (`rename-local`, `rename-remote`, `prefer-local`, `prefer-remote`, `interactive`). Add a "Conflicts" tab to the GUI to notify the user, block sync, and launch external visual diff tools (like Meld or KDiff3).
 * **Multi-Account / Multi-Profile Support (Horizon 3)**: Enable running multiple profiles concurrently. Support separate configuration namespaces (e.g. `profiles/<profile_name>/`), independent SQLite databases, distinct mount paths (e.g. `~/ProtonDrive/Personal` and `~/ProtonDrive/Work`), and multiple daemon processes.
 * **Custom FUSE Mount Options (Horizon 1)**: Expose custom mounting parameters in configuration (e.g. `ro` for read-only, `direct_io` to bypass kernel caching, `allow_other`). Auto-generate systemd user mount units upon sync folder configuration.
 * **Symbolic Link & Hard Link Virtualization (Horizon 2)**: Add symbolic link virtualization inside the metadata store (`NodeType::Symlink`) by intercepting `readlink(2)` and `symlink(2)`. Targets should sync remotely as small encrypted metadata placeholder files on Drive (`proton-vfs-symlink: <target>`).
 * **Desktop File Manager Integration (Horizon 2)**: Develop shell extension plugins for popular Linux file managers (Nautilus Python plugin, Dolphin Service Menus, Thunar custom actions) to offer context-menu shortcuts ("Pin", "Unpin", "Copy Share Link", "View Version History") and file overlay sync badges.
-* **Integrated Photo Gallery Enhancements (Horizon 2)**: Extract and display Exif metadata (camera model, exposure, coordinates) from photos locally, support creating and editing Proton Photo Albums, build a date-based timeline scrollbar, and create an auto-upload Pictures folder pipeline.
+* **Integrated Photo Gallery Enhancements (Horizon 2)**: Support creating and editing Proton Photo Albums (album *writes* are unported in the SDK too) and create an auto-upload Pictures folder pipeline. Exif display, the date-based timeline scrubber and favourites are implemented.
 * **Random-Access Media Streaming seek support (Horizon 2)**: Intercept out-of-order sparse reads (player seeks) in `pdfs-fuse` and prioritize downloading blocks around the seek offset, aborting/postponing sequential pre-fetches.
 * **Dynamic Sync Dashboard & Queue Visualization (Horizon 2)**: GUI real-time transfer list (progress bars, speed, ETA), sync history feed, storage usage breakdown, and global pause/resume sync controls.
 * **Interactive Terminal UI (TUI) Mode (Horizon 3)**: Implement `pdfs tui` using the `ratatui` crate to show transfer speed, sync status, active transfer queue with progress bars, and scrolling daemon logs.
 * **Shutdown Safety & Write Queue Visibility (Horizon 1 / P4)**: Register systemd inhibitor locks in `pdfs-fuse` when there are outstanding staging writes to prevent shutdown or sleep, pop up warnings when exiting the GUI, and build a blocking `pdfs sync flush` command.
 * **Block-Level Deduplication (Horizon 3)**: Transition to a Content-Addressable block cache where cached blocks are stored on disk by their SHA-256 hash. Map logical ranges in the database: `(node_uid, block_idx) -> block_hash` to avoid storing or downloading identical blocks.
 * **Pre-emptive Sync Debouncing & File System Events (Horizon 3)**: Group filesystem write events on paths and delay sync queue insertion until a quiet period has elapsed (e.g. 5 seconds of inactivity) to prevent thrashing the Proton API.
-* **File Version History (Horizon 2)**: Expose past file revisions and version history inside the GUI browser tabs.
 
 ---
 
@@ -122,6 +121,45 @@ Derived from: [`BUGS.md`](BUGS.md)
 
 ## 6. Recently Implemented Features
 
+### File Version History (Implemented)
+**Files**: [`revisions.rs`](../crates/pdfs-fuse/src/revisions.rs), [`control.rs`](../crates/pdfs-core/src/control.rs), [`versions_dialog.rs`](../crates/pdfs-gui/src/app/widgets/versions_dialog.rs)
+
+Proton Drive keeps every revision a client committed; the daemon only ever addressed the active one, so a file overwritten by a sync pass could be recovered only from whatever the local `recovery/` directory happened to hold.
+
+The control protocol gained `ListRevisions` / `RestoreRevision` / `DeleteRevision` / `SaveRevisionAs` (each with a `…ByUid` twin for nodes the primary mount cannot name), the CLI gained `pdfs versions list|restore|save|rm`, and the browser's details pane gained a **Versions** button opening a per-file dialog.
+
+Three properties that shape the code:
+
+- **A restore is server-side and asynchronous.** No content crosses the wire and nothing enters the drain queue; the server answers 202 and swaps the active revision in the background, so the daemon evicts the file's cached blocks and open readers rather than describing the new state, and the UI wording promises the request, not the result.
+- **The active revision cannot be deleted.** `Core::delete_revision_for_uid` checks that locally so the user gets a sentence rather than an API code, and the dialog gives the current row no delete button.
+- **Saving a version never overwrites.** `SaveRevisionAs` refuses an existing destination and removes a partial file if the download fails — a half-written export looks identical to a good one to every tool that opens it afterwards.
+
+### Photo Favourites (Implemented)
+**Files**: [`photos.rs`](../crates/pdfs-fuse/src/photos.rs), [`photo_viewer.rs`](../crates/pdfs-gui/src/app/pages/photo_viewer.rs)
+
+The gallery can mark and filter favourites, through the SDK's photo-tag API (`update_photos`). Schema **v20** adds `photos.favorite`; the flag is learned in the timeline enrichment pass that already resolves each photo's name and media type, and is kept across a refresh that could not resolve a photo — the same learned-and-kept rule as `media_type`. The lightbox carries a star toggle, the Photos header a favourites filter, and the CLI has `pdfs favorite <uid> [--remove]` plus `pdfs photos --favorites`.
+
+Favouriting a photo that is not on this account's own photos volume (shared with us, or album-only) needs it re-encrypted for our timeline root, which the SDK does not implement; the daemon surfaces that as an error rather than silently doing nothing.
+
+### Persistent SDK Entity Cache (Implemented)
+**Files**: [`sdkcache.rs`](../crates/pdfs-core/src/sdkcache.rs), [`auth.rs`](../crates/pdfs-core/src/auth.rs), [`background.rs`](../crates/pdfs-fuse/src/background.rs)
+
+The SDK's Drive entity cache (decrypted node metadata: name, size, parent, signing share) defaulted to memory, so every daemon restart re-fetched and re-decrypted the tree the previous run had already walked. It is now backed by SQLite.
+
+- **Its own file** (`sdk_cache.db` in the state directory), not `cache.db`: the daemon's `Db` is one `Mutex<Connection>` shared by every FUSE thread and the control socket, and this traffic is frequent, small and entirely reconstructible. A separate file also means no schema migration — the store can be deleted at any time.
+- **Encrypted at rest** by wrapping it in the SDK's `EncryptedCacheRepository`, keyed by the mailbox password. A password change reads as a cold cache (the SDK treats an undecryptable entry as a miss and clears the store), not as an error.
+- **Staleness** is closed by the event loop, which already replays from a persisted cursor and calls `invalidate_caches_for_event` for every event — including those raised while the daemon was down. The one case with no trail is a *seeded* cursor (first-ever mount, or a lost cursor), where the seed path now clears the store instead of trusting it. `auth::logout` removes the file.
+
+Needed a small additive SDK change (`ProtonDriveClient::with_entity_repository`, 0.5.1): `with_entity_cache` is a constructor and so could not be combined with `with_key_salts`, which the daemon requires.
+
+### Per-node Batch Outcomes (Implemented)
+**File**: [`batch.rs`](../crates/pdfs-core/src/batch.rs)
+
+SDK 0.5.0 made `trash_nodes` / `restore_nodes` / `delete_nodes` report one outcome per node instead of failing the whole call (mirroring upstream's streamed `NodeActionResult`). `pdfs_core::batch::into_unit` collapses the single-node calls back to a `Result`; `batch::split` handles a collected batch.
+
+The trash view's restore and permanent-delete use the SDK's **streaming** variants (`restore_nodes_streaming` / `delete_nodes_streaming`) and apply local state per node as each batch lands rather than after the last one. For a permanent delete — which is irreversible — that means a daemon interrupted mid-batch has forgotten exactly the nodes the server destroyed, no more and no fewer. Both report per-node failures and count only what actually succeeded; only a batch where nothing succeeded is an error.
+
+
 ### Open-for-Write Deferral for Mirror Sync (Implemented)
 **File**: [`sync.rs`](../crates/pdfs-fuse/src/sync.rs)
 

packaging/PKGBUILD

@@ -9,7 +9,7 @@
 # Build + install:   cd packaging && makepkg -fi
 
 pkgname=proton-drive-linux
-pkgver=1.3.0
+pkgver=1.8.1
 pkgrel=1
 pkgdesc="Proton Drive client for Linux: FUSE files-on-demand mount, CLI, GTK4 app + tray"
 arch=('x86_64')