chore(version) bumped to 1.10.0

feat(fuse,core,gui,cli): one-request move+rename drain, show who shared an item
- A queued rename that also changes folder now lands as one `move-multiple` request carrying the target name instead of rename-then-move, so there is no half-applied state and no second call for stale name requirements to hit (B46 follow-up). A destination name collision moves under a conflict name in one step; same-folder renames still use the rename endpoint. - Shared with me shows the inviter and invite date (GUI subtitle, `pdfs shared-with-me`), with a warning when the invitation signature does not verify against the claimed inviter's keys. `DirEntry` gains `shared_by`, `shared_at` and `shared_by_unverified`, all serde-defaulted. - Bump `proton-sdk` / `proton-drive-rs` to 0.6.3 (anonymous-node moves, `TrashTime` trashed detection).
2026-11-04 16:56:59 +01:00 · 2026-09-15 13:59:24 +02:00 · 2026-09-15 13:59:13 +02:00 · 2026-09-08 14:58:48 +02:00 · 2026-09-01 17:00:43 +02:00 · 2026-09-01 16:38:29 +02:00
61 changed files with 5600 additions and 596 deletions
@@ -0,0 +1,76 @@
 name: Bug report
 description: Something in the client misbehaves
 labels: ["bug"]
 body:
  - type: markdown
    attributes:
      value: |
        Please check [`docs/BUGS.md`](../blob/main/docs/BUGS.md) first — the issue may already be
        tracked there with context.
        **Do not report a security vulnerability here.** See [SECURITY.md](../blob/main/SECURITY.md).
  - type: textarea
    id: what
    attributes:
      label: What happened
      description: What you did, what you expected, and what happened instead.
    validations:
      required: true
  - type: textarea
    id: repro
    attributes:
      label: Steps to reproduce
      placeholder: |
        1. …
        2. …
    validations:
      required: true
  - type: input
    id: version
    attributes:
      label: Version
      description: Output of `pdfs --version`, and how you installed it (deb / rpm / AUR / source).
    validations:
      required: true
  - type: input
    id: environment
    attributes:
      label: Distribution and desktop
      placeholder: "Fedora 44, GNOME 48 (Wayland)"
    validations:
      required: true
  - type: dropdown
    id: surface
    attributes:
      label: Where does it happen
      multiple: true
      options:
        - FUSE mount / file operations
        - Sync or backed-up folders (Computers)
        - CLI (pdfs)
        - Desktop app (pdfs-app)
        - Tray (pdfs-tray)
        - Search launcher (pdfs-prompt)
        - Login / keyring
        - Photos
        - Packaging / installation
    validations:
      required: true
  - type: textarea
    id: diagnose
    attributes:
      label: "`pdfs diagnose` output"
      description: Redact paths or the account address if you prefer.
      render: console
  - type: textarea
    id: logs
    attributes:
      label: Daemon logs
      description: "`journalctl --user -u proton-drive.service -n 200 --no-pager`"
      render: console
  - type: checkboxes
    id: dataloss
    attributes:
      label: Data
      options:
        - label: This bug involved missing, truncated, or overwritten file content.
@@ -0,0 +1,11 @@
 blank_issues_enabled: false
 contact_links:
  - name: Security vulnerability
    url: https://github.com/narrrl/proton-drive-linux/security/advisories/new
    about: Report privately — never in a public issue.
  - name: Known issues
    url: https://github.com/narrrl/proton-drive-linux/blob/main/docs/BUGS.md
    about: The authoritative ledger of tracked bugs and their status.
  - name: Proton Drive service problems
    url: https://proton.me/support
    about: This is an unofficial client. Account or service issues go to Proton AG.
@@ -0,0 +1,37 @@
 name: Feature request
 description: Suggest a capability or an improvement
 labels: ["enhancement"]
 body:
  - type: textarea
    id: problem
    attributes:
      label: The problem
      description: What are you trying to do that the client makes hard or impossible today?
    validations:
      required: true
  - type: textarea
    id: proposal
    attributes:
      label: What you'd like to see
    validations:
      required: true
  - type: dropdown
    id: surface
    attributes:
      label: Which part of the client
      multiple: true
      options:
        - FUSE mount
        - Sync / Computers
        - CLI (pdfs)
        - Desktop app (pdfs-app)
        - Tray (pdfs-tray)
        - Search launcher (pdfs-prompt)
        - Photos
        - Packaging
    validations:
      required: true
  - type: textarea
    id: alternatives
    attributes:
      label: Alternatives you considered
@@ -0,0 +1,26 @@
 ## What this changes
 <!-- The user-visible effect, in a sentence or two. -->
 **Crates touched:**
 **Related `docs/BUGS.md` entries:**
 ## Verification
 ```bash
 cargo fmt --all -- --check
 cargo clippy --workspace --all-targets -- -D warnings
 cargo test --workspace --locked
 ```
 <!-- Plus whatever else you ran: acceptance suite, a live mount, manual steps. -->
 ## Implications
 - [ ] Adds a SQLite migration (new `MIGRATION_V*`, `SCHEMA_VERSION` bumped — no shipped migration edited)
 - [ ] Touches recovery, staging, or anything that can be the only copy of user data
 - [ ] Changes packaging, the systemd unit, or desktop entries
 - [ ] Changes the control protocol (daemon and front ends updated together)
 - [ ] None of the above
 <!-- Screenshots for GTK changes. -->
@@ -122,13 +122,14 @@ jobs:
          Priority: optional
          Architecture: amd64
          Maintainer: Nils Pukropp <contact@narl.io>
-          Depends: fuse3, libgtk-4-1 (>= 4.12.0), libadwaita-1-0 (>= 1.5.0), libsecret-1-0, libwebkitgtk-6.0-4
+          Depends: fuse3, libgtk-4-1 (>= 4.12.0), libadwaita-1-0 (>= 1.5.0), libsecret-1-0, libwebkitgtk-6.0-4, libimage-exiftool-perl
          Installed-Size: ${INSTALLED_SIZE}
-          Description: Proton Drive client for Linux
+          Homepage: https://github.com/narrrl/proton-drive-linux
-           Proton Drive client for Linux featuring:
+          Description: Unofficial Proton Drive client for Linux
-           - FUSE files-on-demand mount
+           Files-on-demand Proton Drive for the Linux desktop, unaffiliated with Proton AG:
-           - Command-line interface (CLI)
+           - FUSE virtual mount with block-level caching
-           - GTK4 system tray, desktop application, and search launcher
+           - Scriptable command-line interface (pdfs)
           - GTK4 desktop application, system tray, and search launcher
          EOF
          # Build Debian package
@@ -0,0 +1,32 @@
 # Code of Conduct
 ## Our pledge
 We want participation in this project to be a harassment-free experience for everyone, regardless
 of age, body size, disability, ethnicity, sex characteristics, gender identity and expression,
 level of experience, education, socioeconomic status, nationality, personal appearance, race,
 religion, or sexual identity and orientation.
 ## Standards
 Examples of behavior that helps:
 - being respectful of differing viewpoints and experience levels,
 - giving and accepting constructive feedback gracefully,
 - focusing on what is best for the project and its users.
 Examples of unacceptable behavior:
 - sexualized language or imagery, and unwelcome sexual attention,
 - trolling, insulting or derogatory comments, and personal or political attacks,
 - public or private harassment,
 - publishing others' private information without explicit permission.
 ## Scope and enforcement
 This applies in all project spaces — issues, pull requests, discussions — and when representing the
 project in public. Report unacceptable behavior to <contact@narl.io>. Reports are handled
 confidentially. Maintainers may edit, remove, or reject contributions that violate this document,
 and may temporarily or permanently ban any contributor for behavior they deem inappropriate.
 Adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1.
@@ -0,0 +1,70 @@
 # Contributing
 Thanks for taking the time. This is an unofficial Proton Drive client that people trust with real
 files, so the bar for changes that touch the filesystem, the sync engine, or the database is
 deliberately high — everything else is ordinary Rust review.
 ## Before you start
 - Read [`AGENTS.md`](AGENTS.md) for repository conventions and
  [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for how the daemon, front ends, and SDK fit
  together.
 - Check [`docs/BUGS.md`](docs/BUGS.md) — it is the authoritative issue ledger, and your problem may
  already be tracked there with context.
 - For anything larger than a fix, open an issue first so the design can be discussed before you
  spend the time.
 ## Development setup
 ```bash
 git clone https://github.com/narrrl/proton-drive-linux.git
 cd proton-drive-linux
 cargo build --workspace
 ```
 GUI and FUSE targets need the GTK4, libadwaita, WebKitGTK 6, libsecret, D-Bus, and FUSE3
 development packages listed in the [README](README.md#prerequisites). Minimum supported Rust
 version is 1.96.
 ## Quality gates
 CI runs exactly these, and they must pass with zero warnings:
 ```bash
 cargo fmt --all -- --check
 cargo clippy --workspace --all-targets -- -D warnings
 cargo test --workspace --locked
 scripts/fuse-acceptance.sh --offline-only
 ```
 Changes to the FUSE layer, sync, or the pending-operation queue should also be exercised against a
 real mount before review — see [`docs/TESTING.md`](docs/TESTING.md). Live runs are destructive:
 use a dedicated test account, never one holding data you cannot lose.
 ## Making changes
 - **Keep shared logic in `pdfs-core`.** The CLI and GUI never touch the database or the network;
  they speak the control protocol to the daemon.
 - **The SQLite schema is forward-only.** Never edit a shipped migration — add a new one and bump
  `SCHEMA_VERSION` in `crates/pdfs-core/src/db/migrations.rs`.
 - **Typed errors and `?` over panics** on runtime paths. Blocking filesystem, keyring, or
  control-socket work stays off GTK's main thread.
 - **`staging/` and `recovery/` may hold the only copy of user data.** Nothing may clear or purge
  them opportunistically.
 ## Commits and pull requests
 Commits follow scoped [Conventional Commits](https://www.conventionalcommits.org), e.g.
 `fix(fuse,core): keep truncate composable with queued revisions`.
 A pull request should state:
 - the user-visible effect and which crates it touches,
 - the `docs/BUGS.md` entries it fixes or affects,
 - the commands you ran to verify it,
 - screenshots for GTK changes,
 - and, explicitly, any migration, recovery, data-loss, or packaging implications.
 ## Security
 Do not open a public issue for a vulnerability — see [SECURITY.md](SECURITY.md).
@@ -3538,7 +3538,7 @@ checksum = "35fb2e5f958ec131621fdd531e9fc186ed768cbe395337403ae56c17a74c68ec"
 [[package]]
 name = "pdfs-cli"
-version = "1.9.0"
+version = "1.10.0"
 dependencies = [
 "anyhow",
 "clap 4.6.4",
@@ -3553,7 +3553,7 @@ dependencies = [
 [[package]]
 name = "pdfs-core"
-version = "1.9.0"
+version = "1.10.0"
 dependencies = [
 "async-trait",
 "directories",
@@ -3576,8 +3576,9 @@ dependencies = [
 [[package]]
 name = "pdfs-fuse"
-version = "1.9.0"
+version = "1.10.0"
 dependencies = [
 "base64",
 "fuser",
 "futures",
 "image",
@@ -3595,7 +3596,7 @@ dependencies = [
 [[package]]
 name = "pdfs-gui"
-version = "1.9.0"
+version = "1.10.0"
 dependencies = [
 "anyhow",
 "async-channel",
@@ -3604,6 +3605,7 @@ dependencies = [
 "ksni",
 "libadwaita",
 "pdfs-core",
 "serde",
 "serde_json",
 "tokio",
 "tracing",
@@ -3856,9 +3858,9 @@ dependencies = [
 [[package]]
 name = "proton-drive-rs"
-version = "0.6.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58322795538d66137d2eb071590375c5287e69059c429e2309dc37368ab5b588"
+checksum = "11faa95cf40bd87d4d48435cdf9b16fff5f14caf45b3a565a941fd4a6e18cefe"
 dependencies = [
 "async-trait",
 "base64",
@@ -3883,9 +3885,9 @@ dependencies = [
 [[package]]
 name = "proton-sdk"
-version = "0.6.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d77482a3160d14926c65537c64bc95cf27d609597a524c97d97d97d1777e9603"
+checksum = "7de99acbd776f7bad5e1e1f3c40d7df3e4ef7411984d02370008ba1ff270a047"
 dependencies = [
 "aes-gcm 0.11.0",
 "async-trait",
@@ -3,15 +3,20 @@ resolver = "2"
 members = ["crates/pdfs-core", "crates/pdfs-fuse", "crates/pdfs-cli", "crates/pdfs-gui"]
 [workspace.package]
-version = "1.9.0"
+version = "1.10.0"
 edition = "2024"
 license = "MIT"
 authors = ["Nils Pukropp <contact@narl.io>"]
 rust-version = "1.96"
 repository = "https://github.com/narrrl/proton-drive-linux"
 homepage = "https://github.com/narrrl/proton-drive-linux"
 readme = "README.md"
 keywords = ["proton", "drive", "fuse", "sync", "linux"]
 categories = ["filesystem", "command-line-utilities"]
 [workspace.dependencies]
-proton-sdk = { version = "0.6.1" }
+proton-sdk = { version = "0.6.3" }
-proton-drive-rs = { version = "0.6.1" }
+proton-drive-rs = { version = "0.6.3" }
 # Internal crates.
 pdfs-core = { path = "crates/pdfs-core" }
@@ -20,6 +25,7 @@ pdfs-fuse = { path = "crates/pdfs-fuse" }
 tokio = { version = "1", features = ["rt-multi-thread", "macros", "sync", "fs", "io-util", "time", "signal"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 base64 = "0.22"
 thiserror = "2"
 anyhow = "1"
 # Non-poisoning mutexes. A handler that panics while holding a lock must not
@@ -1,17 +1,75 @@
-# Proton Drive client for Linux (unofficial)
+<div align="center">
-A fast, unofficial Proton Drive client for Linux. This client features an advanced files-on-demand FUSE virtual mount with block-level caching, a command-line interface (CLI), and a fully non-blocking GTK4 desktop application with system tray integration.
+<img src="images/logo.svg" alt="" width="112" height="112">
 # Proton Drive for Linux
 **Files-on-demand Proton Drive for the Linux desktop** — a FUSE virtual mount with block-level
 caching, a scriptable CLI, and a native GTK4 app with tray and search launcher.
 [![CI](https://github.com/narrrl/proton-drive-linux/actions/workflows/ci.yml/badge.svg)](https://github.com/narrrl/proton-drive-linux/actions/workflows/ci.yml)
 [![Release](https://img.shields.io/github/v/release/narrrl/proton-drive-linux?sort=semver)](https://github.com/narrrl/proton-drive-linux/releases/latest)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Rust 1.96+](https://img.shields.io/badge/rust-1.96%2B-orange.svg)](https://www.rust-lang.org)
 [![Platform: Linux](https://img.shields.io/badge/platform-linux-lightgrey.svg)](#prerequisites)
 <img src="images/files.png" alt="The GTK4 file browser" width="820">
 </div>
 > [!IMPORTANT]
 > This is an **unofficial**, community-built client. It is not affiliated with, endorsed by, or
 > supported by Proton AG. "Proton" and "Proton Drive" are trademarks of Proton AG, used here only
 > to describe what the software talks to. Use a test account first, and read
 > [`docs/RECOVERY.md`](docs/RECOVERY.md) before trusting it with data you cannot lose.
 ## Install
 ```bash
 # Debian / Ubuntu
 sudo apt install ./proton-drive-linux_*.deb
 # Fedora
 sudo dnf install ./proton-drive-linux-*.rpm
 # Arch Linux
 cd packaging && makepkg -fi
 ```
 Packages for each release are attached to the [latest
 release](https://github.com/narrrl/proton-drive-linux/releases/latest); see
 [Installation & Packages](#installation--packages) for details and
 [Building from Source](#building-from-source) to compile it yourself.
 ```bash
 pdfs login          # sign in (SRP + 2FA, credentials go to the system keyring)
 pdfs status         # mount state, queued writes, cache usage
 pdfs-app            # the desktop app
 ```
 ## Contents
 - [Features](#features) · [Quick search](#quick-search-and-media-opening) · [Opening files](#choosing-how-files-open)
 - [Selective sync](#selective-sync-pdfsignore) · [Diagnostics](#diagnostics--maintenance) · [Scripting](#scripting---json)
 - [Performance](#performance--caching) · [Filesystem safety](#filesystem-safety) · [Screenshots](#screenshots)
 - [Prerequisites](#prerequisites) · [Building](#building-from-source) · [Packages](#installation--packages) · [Releases](#automated-releases-cicd)
 **Documentation:** [Architecture](docs/ARCHITECTURE.md) · [Testing](docs/TESTING.md) ·
 [Recovery](docs/RECOVERY.md) · [Development](docs/DEVELOPMENT.md) ·
 [Known issues](docs/BUGS.md) · [Changelog](docs/CHANGELOG.md) ·
 [Contributing](CONTRIBUTING.md) · [Security policy](SECURITY.md)
 ## Features
 - **Files-on-Demand (FUSE)**: Mount your Proton Drive as a virtual filesystem where files are downloaded only when opened, utilizing smart block-level caching and disk-backed writes.
 - **Command-Line Interface (CLI)**: Manage your drive, authenticate, and monitor sync status directly from the terminal.
 - **Non-Blocking GTK4 Desktop App**: Browse files, manage pins, configure options, and monitor active transfers through a modern, native GUI with a fully non-blocking asynchronous main loop.
 - **File Thumbnails**: Browse locally cached image previews in Files, Shared, and Trash, including embedded previews from camera RAW files. Build a whole folder tree from the Files toolbar and resize the grid from the status bar.
 - **Shared Links & Invites**: Browse files shared with you by other users, and view/manage your own public shared links directly in the GUI.
 - **Local Backup (Computers)**: Sync and back up local directories (like Downloads, Documents, Pictures, etc.) directly to your Proton Drive account.
 - **Locations**: One page (and `pdfs locations`) listing every place Proton Drive occupies on this machine — the main mount plus each backed-up folder — with its mode, sync state, and whether it is read-only. Switching a folder between a full local copy and on-demand happens here.
 - **System Tray Integration**: Background indicator for status monitoring, quick actions, and fast sync controls.
- **Unified Search Launcher (HUD)**: A resident Google Drive-style launcher (`pdfs-prompt`) that searches Proton Drive and local files together, ranks the best matches, tolerates abbreviations and typos, and is ideal for a system-wide hotkey.
+- **Unified Search Launcher (HUD)**: A resident Google Drive-style launcher (`pdfs-prompt`) that searches Proton Drive and local files together, ranks the best matches, tolerates abbreviations and typos, and is ideal for a system-wide hotkey. It can also present the same search in your own launcher (`--dmenu`) or, searching live as you type, in `fzf` (`--fzf`).
 - **Secure Credential Storage**: Integrates with the system Secret Service (GNOME Keyring, KWallet, etc.) with smart in-memory credential caching to avoid UI thread blockages.
 - **Proton Photos Support**: Access your Proton Photos timeline, view thumbnails, and download backed-up media natively (available in the GUI as a navigation tab and via the CLI).
 - **File Version History**: Every revision Proton Drive still holds for a file, from the browser's details pane (**Versions**) or `pdfs versions list|restore|save|rm`. Restoring is server-side — no re-upload — and an old version can be written out to a local file without touching the live one.
@@ -66,6 +124,51 @@ launcher command, set them in `config.json`:
 anywhere in `menu` is replaced by the prompt text; without one, the launcher's
 own prompt flag is appended.
 ### Live launcher search (fzf)
 The two-step above exists because no dmenu-style launcher can call back for new
 results per keystroke. `fzf` can, so `pdfs-prompt --fzf` searches as you type,
 exactly like the built-in window:
 ```bash
 pdfs-prompt --fzf                    # pinned files, then live results as you type
 pdfs-prompt --fzf --query invoice    # start on a search
 ```
 Every keystroke re-queries the daemon (debounced, like the GTK prompt) and fzf's
 own matcher is switched off, so the ordering you see is the daemon's ranking —
 abbreviations and typos included, which a launcher filtering a fixed list cannot
 do. Enter opens; Escape closes.
 fzf is a terminal program, so when it is started without one — from a WM
 keybinding — it spawns a terminal for itself: foot, ghostty, kitty, alacritty,
 wezterm or xterm, whichever is installed. Each is launched with the app-id/class
 `pdfs-prompt`, so one window rule floats it whichever terminal you have. In
 Hyprland:
 ```
 windowrulev2 = float, class:^(pdfs-prompt)$
 windowrulev2 = size 900 500, class:^(pdfs-prompt)$
 windowrulev2 = center, class:^(pdfs-prompt)$
 bind = SUPER, space, exec, pdfs-prompt --fzf
 ```
 Set it as the default front end, and pick the terminal explicitly, in
 `config.json`:
 ```json
 {
  "prompt": {
    "mode": "fzf",
    "terminal": ["foot", "--app-id=pdfs-prompt", "--"],
    "menu_limit": 50
  }
 }
 ```
 A `{cmd}` token anywhere in `terminal` is replaced by the command to run;
 without one it is appended, which is what every detected terminal expects.
 ## Choosing How Files Open
 By default every result is handed to `xdg-open`. An `open_with` block in
@@ -270,19 +373,21 @@ sudo apt-get install -y \
  libadwaita-1-dev \
  libwebkitgtk-6.0-dev \
  libsecret-1-dev \
-  libdbus-1-dev
+  libdbus-1-dev \
  libimage-exiftool-perl
 ```
 ### Arch Linux
 ```bash
-sudo pacman -S --needed pkgconf fuse3 gtk4 libadwaita libsecret dbus webkitgtk-6.0
+sudo pacman -S --needed pkgconf fuse3 gtk4 libadwaita libsecret dbus webkitgtk-6.0 perl-image-exiftool
 ```
 ### Fedora (44+)
 ```bash
 sudo dnf install -y \
  pkgconf-pkg-config fuse3-devel gtk4-devel libadwaita-devel \
-  webkitgtk6.0-devel libsecret-devel dbus-devel glib2-devel cargo rust
+  webkitgtk6.0-devel libsecret-devel dbus-devel glib2-devel \
  perl-Image-ExifTool cargo rust
 ```
 Runtime extras (pick your desktop):
@@ -302,7 +407,7 @@ Ensure you have Rust and Cargo installed (minimum supported Rust version is 1.96
 1. Clone the repository and navigate into the project directory:
   ```bash
-   git clone https://github.com/narl/proton-drive-linux.git
+   git clone https://github.com/narrrl/proton-drive-linux.git
   cd proton-drive-linux
   ```
 2. Build the workspace in release mode:
@@ -372,6 +477,15 @@ This project has a GitHub Actions CI workflow configured under `.github/workflow
 ---
 ## Contributing
 Bug reports, packaging fixes, and patches are welcome — see [CONTRIBUTING.md](CONTRIBUTING.md) for
 the workflow and the quality gates CI enforces, and [SECURITY.md](SECURITY.md) for reporting a
 vulnerability privately.
 ## License
-This project is licensed under the [MIT License](LICENSE).
+Released under the [MIT License](LICENSE).
 Proton Drive is a service of Proton AG. This project is an independent client and carries no
 affiliation with or endorsement from Proton AG.
@@ -0,0 +1,34 @@
 # Security Policy
 ## Supported versions
 Fixes land on the latest release. Please reproduce on the most recent version before reporting.
 ## Reporting a vulnerability
 **Do not open a public issue.** Report privately through GitHub's
 [private vulnerability reporting](https://github.com/narrrl/proton-drive-linux/security/advisories/new),
 or by email to <contact@narl.io>.
 Please include the version (`pdfs --version`), your distribution and desktop environment, what an
 attacker gains, and a reproduction if you have one. You can expect an acknowledgement within a few
 days; a fix ships in the next release, and you are credited in the advisory unless you ask
 otherwise.
 ## Scope
 This client holds Proton account credentials and decrypted file content on the local machine, so
 the interesting boundaries are:
 - **Credentials.** Sessions and the mailbox password live in the system Secret Service. Anything
  that writes them elsewhere — logs, temp files, crash dumps — is a vulnerability.
 - **The control socket.** Anything that can connect to `control.sock` has the daemon's
  authenticated session. It is `0600`, and the state, cache, and config directories must be real,
  current-user-owned `0700` directories; the daemon fails closed otherwise. Reports that defeat
  those checks are in scope.
 - **Local cache and staging.** Decrypted block content and staged writes on disk.
 - **Cryptography.** Key derivation, signature handling, and anything that could publish plaintext
  or the wrong key material to Proton.
 Out of scope: vulnerabilities in Proton's own service (report those to Proton AG), and issues that
 require an attacker who already has your user account on the machine.
@@ -5,6 +5,8 @@ edition.workspace = true
 license.workspace = true
 authors.workspace = true
 rust-version.workspace = true
 repository.workspace = true
 homepage.workspace = true
 description = "CLI for the Proton Drive Linux client"
 [[bin]]
@@ -17,6 +17,7 @@ use pdfs_core::control::{
    RestoreItem as CtlRestoreItem, ShareEntryKind, SyncPhase, pending_summary,
 };
 use pdfs_core::db::Db;
 use pdfs_core::service;
 #[derive(Parser)]
 #[command(
@@ -176,6 +177,43 @@ enum Command {
        #[arg(long)]
        wait: bool,
    },
    /// Fix photos filed under the day they were imported instead of the day
    /// they were taken.
    ///
    /// A Takeout whose metadata sidecars did not match imports with no capture
    /// time, and Proton then stamps every photo with the moment it arrived. The
    /// date is still in the file name (`IMG-20230219-WA0001.jpg`), so this finds
    /// photos whose name disagrees with their capture time by more than a day
    /// and rewrites them at the right time.
    ///
    /// Proton cannot edit a sealed capture time, so a rewrite means re-uploading
    /// the photo and trashing the original — favourites and albums are carried
    /// across, and the original goes to Proton's trash, not away. Run it with
    /// `--dry-run` first.
    RedatePhotos {
        /// Report what would be re-dated without uploading or trashing anything.
        #[arg(long)]
        dry_run: bool,
        /// Stop after this many photos.
        #[arg(long)]
        limit: Option<usize>,
        /// Only touch photos whose current capture time is on or after this
        /// date (`YYYY-MM-DD`, UTC) — aim the repair at the days an import
        /// landed on.
        #[arg(long)]
        from: Option<String>,
        /// Only touch photos whose current capture time is before this date
        /// (`YYYY-MM-DD`, UTC).
        #[arg(long)]
        to: Option<String>,
        /// Stay attached and print the report when the run finishes.
        #[arg(long)]
        wait: bool,
    },
    /// Show how the running (or last) photo re-date is doing.
    RedateStatus,
    /// Stop the running photo re-date.
    CancelRedate,
    /// Show how the running (or last) Google Photos import is doing.
    ImportStatus,
    /// Stop the running Google Photos import.
@@ -616,6 +654,15 @@ fn main() -> Result<()> {
            dry_run,
            wait,
        } => cmd_import_google_photos(archives, dry_run, wait),
        Command::RedatePhotos {
            dry_run,
            limit,
            from,
            to,
            wait,
        } => cmd_redate_photos(dry_run, limit, from, to, wait),
        Command::RedateStatus => cmd_redate_status(),
        Command::CancelRedate => cmd_cancel_redate(),
        Command::ImportStatus => cmd_import_status(),
        Command::CancelImport => cmd_cancel_import(),
        Command::Album { uid, limit, offset } => cmd_album(uid, limit, offset),
@@ -1082,6 +1129,9 @@ fn cmd_shared_with_me(uid: Option<String>) -> Result<()> {
                    format!("  ({})", e.role)
                };
                println!("{kind} {:>12}  {}{role}  [{}]", e.size, e.name, e.uid);
                if let Some(line) = shared_by_line(&e) {
                    println!("{:>15}{line}", "");
                }
            }
        }
        CtlResponse::Error { message, kind } => bail!("{}", cli_error(kind, &message)),
@@ -1090,6 +1140,39 @@ fn cmd_shared_with_me(uid: Option<String>) -> Result<()> {
    Ok(())
 }
 /// Who shared an entry with me, and when, as a line printed under it — `None`
 /// when the invitation said nothing (owned content, or a node inside a shared
 /// folder rather than its root). An inviter whose signature did not verify is
 /// said to be claimed, not stated: the name may be forged.
 fn shared_by_line(entry: &pdfs_core::control::DirEntry) -> Option<String> {
    if entry.shared_by.is_empty() {
        return None;
    }
    let mut line = format!("shared by {}", entry.shared_by);
    if entry.shared_at > 0 {
        line.push_str(&format!(" at {}", format_epoch_utc(entry.shared_at)));
    }
    if entry.shared_by_unverified {
        line.push_str("  WARNING: invitation signature did not verify; the sender may be forged");
    }
    Some(line)
 }
 /// `YYYY-MM-DD` (UTC) for epoch seconds, without pulling a date crate into the
 /// CLI for one column. Civil-from-days per Howard Hinnant's algorithm.
 fn format_epoch_utc(secs: i64) -> String {
    let z = secs.div_euclid(86_400) + 719_468;
    let era = z.div_euclid(146_097);
    let doe = z - era * 146_097;
    let yoe = (doe - doe / 1_460 + doe / 36_524 - doe / 146_096) / 365;
    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
    let mp = (5 * doy + 2) / 153;
    let day = doy - (153 * mp + 2) / 5 + 1;
    let month = if mp < 10 { mp + 3 } else { mp - 9 };
    let year = yoe + era * 400 + i64::from(month <= 2);
    format!("{year:04}-{month:02}-{day:02}")
 }
 /// Download a file shared with me. The daemon puts the plaintext in its content
 /// cache and replies with that path; with a `dest` we copy it out, so the caller
 /// gets a file it owns rather than one the cache may later evict.
@@ -1309,6 +1392,15 @@ fn cmd_login(username: Option<String>) -> Result<()> {
            other => anyhow::Error::new(other).context("login failed"),
        })?;
    // A daemon that is already up is parked in `wait_for_session`, sleeping
    // between keyring checks; restart it so the mount appears now instead of
    // whenever the next poll fires. Only when it is already active — `pdfs
    // login` deliberately does not enable the unit the way the GUI does, so a
    // headless user driving `pdfs daemon` by hand keeps that setup.
    if service::is_active() {
        service::restart();
    }
    println!("Logged in as {username}. Session stored in the system keyring.");
    Ok(())
 }
@@ -1448,6 +1540,59 @@ fn cmd_mount(mountpoint: Option<PathBuf>) -> Result<()> {
    Ok(())
 }
 /// How long to wait before the next login check, after `attempts` checks have
 /// already come back [`pdfs_core::Error::NotLoggedIn`].
 ///
 /// Doubles from 3s to a 15s ceiling. The interval is not just a sleep:
 /// [`auth::load`] builds a fresh `keyring::Entry` on every call, so each check
 /// opens a new D-Bus connection to the Secret Service and negotiates an
 /// encrypted session over it. A flat 3s poll meant 28,800 of those a day from a
 /// daemon that had nothing to do; the ceiling cuts that by 80%.
 ///
 /// The ceiling stays low because the sleep is also the worst-case login →
 /// mount latency for anything that does *not* poke systemd: front-ends restart
 /// the unit on login (`service::enable_start`), which interrupts the sleep
 /// immediately, but a hand-run `pdfs daemon` has no such wake-up path.
 fn login_poll_delay(attempts: u32) -> std::time::Duration {
    const BASE_SECS: u64 = 3;
    const MAX_SECS: u64 = 15;
    // `checked_shl` rather than `<<`: the daemon can sit unauthenticated for
    // weeks, and a shift past the width of the type is a panic, not a big number.
    let factor = 1u64.checked_shl(attempts).unwrap_or(u64::MAX);
    std::time::Duration::from_secs(BASE_SECS.saturating_mul(factor).min(MAX_SECS))
 }
 /// Block until a session is stored, backing off between checks.
 ///
 /// `load` and `sleep` are parameters rather than direct calls so the backoff
 /// schedule can be tested without a keyring and without real time passing.
 fn wait_for_session<L, S>(mut load: L, mut sleep: S) -> Result<()>
 where
    L: FnMut() -> std::result::Result<(), pdfs_core::Error>,
    S: FnMut(std::time::Duration),
 {
    let mut attempts: u32 = 0;
    loop {
        match load() {
            Ok(()) => return Ok(()),
            Err(pdfs_core::Error::NotLoggedIn) => {
                let delay = login_poll_delay(attempts);
                // Say it once at INFO. Repeating it every interval buried the
                // journal in tens of thousands of identical lines a day.
                if attempts == 0 {
                    tracing::info!("not logged in; waiting for a session…");
                } else {
                    tracing::debug!(delay_secs = delay.as_secs(), "still not logged in");
                }
                sleep(delay);
                attempts = attempts.saturating_add(1);
            }
            Err(e) => return Err(e.into()),
        }
    }
 }
 /// Run the auto-mount daemon loop. Waits for a stored login, mounts, and keeps
 /// the mount alive: a clean stop (SIGTERM via `systemctl --user stop`) exits 0;
 /// an external unmount triggers a remount; errors back off and retry. This is
@@ -1456,16 +1601,7 @@ fn cmd_daemon(mountpoint: Option<PathBuf>) -> Result<()> {
    loop {
        // Wait until a session is stored. The GUI enables this service on login,
        // but the service may also start at boot before the user has logged in.
-        loop {
+        wait_for_session(|| auth::load().map(|_| ()), std::thread::sleep)?;
            match auth::load() {
                Ok(_) => break,
                Err(pdfs_core::Error::NotLoggedIn) => {
                    tracing::info!("not logged in; waiting…");
                    std::thread::sleep(std::time::Duration::from_secs(3));
                }
                Err(e) => return Err(e.into()),
            }
        }
        match mount_once(mountpoint.clone()) {
            Ok(pdfs_fuse::MountOutcome::Shutdown) => {
@@ -1787,6 +1923,115 @@ fn cmd_import_google_photos(archives: Vec<PathBuf>, dry_run: bool, wait: bool) -
    }
 }
 fn cmd_redate_photos(
    dry_run: bool,
    limit: Option<usize>,
    from: Option<String>,
    to: Option<String>,
    wait: bool,
 ) -> Result<()> {
    let range = match (from.as_deref(), to.as_deref()) {
        (None, None) => None,
        (from, to) => Some((
            from.map(parse_day).transpose()?.unwrap_or(i64::MIN),
            to.map(parse_day).transpose()?.unwrap_or(i64::MAX),
        )),
    };
    match control_request(CtlRequest::RedatePhotos {
        dry_run,
        limit,
        range,
    })? {
        CtlResponse::Ok { message } => println!("{message}"),
        CtlResponse::Error { message, kind } => bail!("{}", cli_error(kind, &message)),
        other => bail!("unexpected response: {other:?}"),
    }
    if !wait {
        println!("Run `pdfs redate-status` to follow it.");
        return Ok(());
    }
    // Polled for the same reason the import is: request/response protocol, and a
    // run over a whole library is a download plus an upload per photo.
    loop {
        std::thread::sleep(std::time::Duration::from_secs(2));
        match control_request(CtlRequest::RedateStatus)? {
            CtlResponse::RedateStatus { running: true, .. } => continue,
            CtlResponse::RedateStatus { summary, .. } => {
                print_redate_summary(summary.as_ref());
                return Ok(());
            }
            CtlResponse::Error { message, kind } => bail!("{}", cli_error(kind, &message)),
            other => bail!("unexpected response: {other:?}"),
        }
    }
 }
 /// A `YYYY-MM-DD` day as epoch seconds at UTC midnight. Reuses the Takeout
 /// scanner's date reader, which already accepts exactly this spelling.
 fn parse_day(day: &str) -> Result<i64> {
    pdfs_core::takeout::capture_time_from_name(day)
        .ok_or_else(|| anyhow!("not a date (expected YYYY-MM-DD): {day}"))
 }
 fn cmd_redate_status() -> Result<()> {
    match control_request(CtlRequest::RedateStatus)? {
        CtlResponse::RedateStatus { running, summary } => {
            if running {
                println!("Re-date running. `pdfs transfers` shows its progress.");
            }
            print_redate_summary(summary.as_ref());
        }
        CtlResponse::Error { message, kind } => bail!("{}", cli_error(kind, &message)),
        other => bail!("unexpected response: {other:?}"),
    }
    Ok(())
 }
 fn cmd_cancel_redate() -> Result<()> {
    match control_request(CtlRequest::CancelRedate)? {
        CtlResponse::Ok { message } => println!("{message}"),
        CtlResponse::Error { message, kind } => bail!("{}", cli_error(kind, &message)),
        other => bail!("unexpected response: {other:?}"),
    }
    Ok(())
 }
 fn print_redate_summary(summary: Option<&pdfs_core::control::RedateSummary>) {
    let Some(summary) = summary else {
        println!("No re-date has run yet.");
        return;
    };
    println!("Photos examined  : {}", summary.examined);
    println!("Mis-dated        : {}", summary.candidates);
    if summary.dry_run {
        println!("(dry run — nothing was uploaded or trashed)");
    } else {
        println!("Re-dated         : {}", summary.redated);
        if summary.album_links > 0 {
            println!("Albums refiled   : {}", summary.album_links);
        }
        if summary.failed > 0 {
            println!("Failed           : {}", summary.failed);
        }
        if summary.bytes > 0 {
            println!("Uploaded bytes   : {}", summary.bytes);
        }
    }
    for (name, stored, wanted) in &summary.samples {
        // Epoch seconds, as `pdfs photos` prints capture times.
        println!("  {name}: {stored} -> {wanted}");
    }
    if summary.candidates > summary.samples.len() {
        println!(
            "  … and {} more",
            summary.candidates - summary.samples.len()
        );
    }
    if summary.cancelled {
        println!("Run was cancelled before it finished.");
    }
 }
 fn cmd_import_status() -> Result<()> {
    match control_request(CtlRequest::ImportStatus)? {
        CtlResponse::ImportStatus { running, summary } => {
@@ -2537,3 +2782,98 @@ mod diagnose_tests {
        std::fs::remove_dir(dir).unwrap();
    }
 }
 #[cfg(test)]
 mod login_wait_tests {
    use super::*;
    use std::time::Duration;
    #[test]
    fn poll_delay_doubles_then_holds_at_the_ceiling() {
        assert_eq!(login_poll_delay(0), Duration::from_secs(3));
        assert_eq!(login_poll_delay(1), Duration::from_secs(6));
        assert_eq!(login_poll_delay(2), Duration::from_secs(12));
        assert_eq!(login_poll_delay(3), Duration::from_secs(15));
        assert_eq!(login_poll_delay(4), Duration::from_secs(15));
        // A daemon left unauthenticated for weeks reaches attempt counts well
        // past the width of the shift; that must cap, not panic.
        assert_eq!(login_poll_delay(64), Duration::from_secs(15));
        assert_eq!(login_poll_delay(u32::MAX), Duration::from_secs(15));
    }
    #[test]
    fn waiting_for_a_session_stops_hammering_the_keyring() {
        let mut checks_left = 20;
        let mut slept: Vec<Duration> = Vec::new();
        wait_for_session(
            || {
                if checks_left == 0 {
                    Ok(())
                } else {
                    checks_left -= 1;
                    Err(pdfs_core::Error::NotLoggedIn)
                }
            },
            |delay| slept.push(delay),
        )
        .unwrap();
        assert_eq!(slept.len(), 20, "one wait per failed check");
        assert!(
            slept.windows(2).all(|w| w[1] >= w[0]),
            "the interval must never shrink: {slept:?}"
        );
        // The point of the change. Every check is a fresh D-Bus session against
        // the Secret Service, so 20 of them must not fit inside a single minute
        // the way a flat 3s poll did.
        let total: Duration = slept.iter().sum();
        assert!(
            total >= Duration::from_secs(4 * 60),
            "20 checks should span at least 4 minutes, spanned {total:?}"
        );
    }
    #[test]
    fn a_stored_session_is_not_waited_for_at_all() {
        let mut slept = 0;
        wait_for_session(|| Ok(()), |_| slept += 1).unwrap();
        assert_eq!(slept, 0);
    }
    #[test]
    fn epoch_seconds_format_as_utc_calendar_dates() {
        assert_eq!(format_epoch_utc(0), "1970-01-01");
        assert_eq!(format_epoch_utc(951_782_400), "2000-02-29");
        assert_eq!(format_epoch_utc(1_700_000_000), "2023-11-14");
        assert_eq!(format_epoch_utc(-86_400), "1969-12-31");
    }
    #[test]
    fn a_forged_looking_invitation_is_flagged_not_stated() {
        let mut entry = pdfs_core::control::DirEntry {
            name: "Budget.ods".into(),
            is_dir: false,
            size: 1,
            modified: 0,
            pinned: false,
            cached: false,
            uid: "vol~link".into(),
            path: String::new(),
            role: "viewer".into(),
            shared_by: String::new(),
            shared_at: 0,
            shared_by_unverified: false,
        };
        assert_eq!(shared_by_line(&entry), None, "no invitation, no line");
        entry.shared_by = "alice@proton.me".into();
        entry.shared_at = 1_700_000_000;
        assert_eq!(
            shared_by_line(&entry).as_deref(),
            Some("shared by alice@proton.me at 2023-11-14")
        );
        entry.shared_by_unverified = true;
        assert!(shared_by_line(&entry).unwrap().contains("WARNING"));
    }
 }
@@ -5,6 +5,8 @@ edition.workspace = true
 license.workspace = true
 authors.workspace = true
 rust-version.workspace = true
 repository.workspace = true
 homepage.workspace = true
 description = "Core auth/session/config for the Proton Drive Linux client"
 [dependencies]
@@ -19,6 +19,7 @@
 use std::collections::{BTreeMap, HashMap, HashSet};
 use std::fmt;
 use std::io::{Read, Seek, SeekFrom};
 use std::os::unix::fs::PermissionsExt as _;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
 use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
@@ -415,6 +416,10 @@ pub struct ContentCache {
    /// Subdirectory holding cached thumbnails (`<key>.t<n>` + `.meta`). Kept out
    /// of `content_dir` so the budget scan never sees thumbnail files.
    thumb_dir: PathBuf,
    /// Owner-protected scratch space for decrypted camera RAWs passed to
    /// exiftool. Files are removed on drop and swept on the next cache open after
    /// an unclean shutdown.
    raw_thumb_dir: PathBuf,
    /// Subdirectory holding on-demand block-cache files (`<key>.b<idx>` +
    /// `.meta`). Kept out of `content_dir` so the whole-file budget scan never
    /// sees them; blocks carry their own LRU budget.
@@ -507,6 +512,19 @@ impl ContentCache {
        std::fs::create_dir_all(&content_dir)?;
        let thumb_dir = content_dir.join("thumbs");
        std::fs::create_dir_all(&thumb_dir)?;
        let raw_thumb_dir = content_dir.join("raw-thumbnails");
        std::fs::create_dir_all(&raw_thumb_dir)?;
        std::fs::set_permissions(&raw_thumb_dir, std::fs::Permissions::from_mode(0o700))?;
        if let Ok(entries) = std::fs::read_dir(&raw_thumb_dir) {
            for entry in entries.flatten() {
                let name = entry.file_name();
                if name.to_string_lossy().starts_with("pdfs-raw-")
                    && entry.file_type().is_ok_and(|kind| kind.is_file())
                {
                    let _ = std::fs::remove_file(entry.path());
                }
            }
        }
        let block_dir = content_dir.join("blocks");
        std::fs::create_dir_all(&block_dir)?;
        // Scratch holds disk-backed write buffers. A previous run's leftovers are
@@ -530,6 +548,7 @@ impl ContentCache {
        let cache = Self {
            content_dir,
            thumb_dir,
            raw_thumb_dir,
            block_dir,
            scratch_dir,
            staging_dir,
@@ -1666,6 +1685,12 @@ impl ContentCache {
            .join(format!("{}.t{ttype}.meta", Self::key(uid)))
    }
    /// Owner-protected transient directory used to stage decrypted camera RAWs
    /// for metadata helpers. Callers still remove individual files promptly.
    pub fn raw_thumbnail_staging_dir(&self) -> &Path {
        &self.raw_thumb_dir
    }
    /// Serve a cached thumbnail of `ttype` for `uid`, or `None` on miss/stale.
    /// Validated by node `mtime` alone: a new revision (which is what changes the
    /// thumbnail) bumps the mtime, so a stale thumbnail is detected. Thumbnails
@@ -93,6 +93,32 @@ pub enum Request {
    /// already cached (one batched round-trip) and replying with their on-disk
    /// paths. Keep the batch small — it is served on demand, as tiles scroll in.
    PhotoThumbs { uids: Vec<String> },
    /// Fetch thumbnails for ordinary Drive image files shown outside the Photos
    /// timeline. The modification time is the cache validity tag, so replacing
    /// an image can never reuse its previous revision's thumbnail.
    FileThumbs {
        items: Vec<FileThumbRequest>,
        /// Identifies the front-end's current listing. Moving to another page or
        /// folder advances it, allowing the daemon to stop work for rows that
        /// are no longer visible.
        #[serde(default)]
        generation: u64,
    },
    /// Reserve a daemon-issued generation for ordinary-file thumbnail work.
    /// The daemon is the ordering authority, so GUI restarts and wall-clock
    /// corrections cannot make a new listing look older than an earlier one.
    ReserveFileThumbGeneration,
    /// Stop ordinary-file thumbnail work belonging to older listings. Photos
    /// timeline work and an explicit recursive build are deliberately separate.
    CancelFileThumbs { generation: u64 },
    /// Start building local thumbnails for every supported image below `path`.
    /// The request returns immediately; progress is read with
    /// [`Request::ThumbnailBuildStatus`].
    StartThumbnailBuild { path: String },
    /// Stop the current recursive ordinary-file thumbnail build, if any.
    CancelThumbnailBuild,
    /// Read progress for the recursive ordinary-file thumbnail build.
    ThumbnailBuildStatus,
    /// Download a photo's full content into the cache; replies with its path.
    OpenPhoto { uid: String },
    /// Add or remove Proton's `Favorite` tag on a photo. Replies with
@@ -123,6 +149,43 @@ pub enum Request {
        #[serde(default)]
        dry_run: bool,
    },
    /// Re-date photos whose capture time is when they were *imported* rather
    /// than when they were taken.
    ///
    /// Proton has no API for editing a photo's capture time — it is sealed into
    /// the revision — so the only repair is to upload the photo again with the
    /// right time and trash the original. That is what this does, for photos
    /// whose file name carries a date that disagrees with their stored capture
    /// time by more than a day: `IMG-20230219-WA0001.jpg` filed under 2026 is
    /// the signature of an import whose metadata sidecars did not match.
    ///
    /// Favourites and album memberships are carried across; the original is
    /// **trashed**, not deleted, so a bad run is recoverable from Proton's
    /// trash. With `dry_run` nothing is uploaded or trashed and the report says
    /// what would have been done.
    ///
    /// Acks immediately with [`Response::Ok`] and works in the background — each
    /// photo is a download plus an upload. Progress shows up in
    /// [`Request::GetQueueStatus`] as a job, and the counts in
    /// [`Request::RedateStatus`].
    RedatePhotos {
        #[serde(default)]
        dry_run: bool,
        /// Stop after this many photos. `None` is the whole library.
        #[serde(default)]
        limit: Option<usize>,
        /// Only consider photos whose *stored* capture time falls in this
        /// `[from, to)` window — the way to aim the repair at the days an
        /// import landed on and leave the rest of the library untouched.
        #[serde(default)]
        range: Option<(i64, i64)>,
    },
    /// How the running (or last finished) re-date is doing. Replies with
    /// [`Response::RedateStatus`].
    RedateStatus,
    /// Ask the running re-date to stop. It finishes the photo on the wire, then
    /// reports `cancelled`. Replies with [`Response::Ok`].
    CancelRedate,
    /// How the running (or last finished) Takeout import is doing. Replies with
    /// [`Response::ImportStatus`].
    ImportStatus,
@@ -679,6 +742,10 @@ pub struct SharedItem {
    /// The shared node's decrypted name.
    pub name: String,
    pub is_dir: bool,
    /// Modification time used to validate an image thumbnail. Older daemons
    /// omit it, in which case clients use `0` as a conservative fallback tag.
    #[serde(default)]
    pub modified: i64,
    /// Mountpoint-relative path, when the daemon can resolve it (the node lives in
    /// my own tree). Empty when the path is unknown.
    #[serde(default)]
@@ -839,6 +906,22 @@ pub struct DirEntry {
    /// report. Defaulted for wire-compat with clients/daemons predating it.
    #[serde(default)]
    pub role: String,
    /// Who shared this node with me, as the invitation claims it — empty for
    /// content I own, for a node reached *inside* a shared folder (only the share
    /// root carries the invitation), and when the API did not say. Trust it only
    /// as far as [`shared_by_unverified`](Self::shared_by_unverified) allows.
    /// Defaulted for wire-compat with clients/daemons predating it.
    #[serde(default)]
    pub shared_by: String,
    /// When it was shared with me, epoch seconds; 0 when unknown.
    #[serde(default)]
    pub shared_at: i64,
    /// The invitation's signature did not check out against `shared_by`'s keys,
    /// so the name may be forged. False when it verified *and* when it could not
    /// be checked at all (no signature, no keys): only an actual mismatch is a
    /// warning worth showing.
    #[serde(default)]
    pub shared_by_unverified: bool,
 }
 /// One hit in a [`Request::Search`] result. Like [`DirEntry`] but carries the
@@ -1079,6 +1162,35 @@ pub struct PhotoMonth {
    pub count: usize,
 }
 /// How a photo re-date is going, or how the last one ended
 /// ([`Response::RedateStatus`]). Cumulative for the run, so the same shape
 /// serves progress and the final report.
 #[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq)]
 pub struct RedateSummary {
    /// Photos examined.
    pub examined: usize,
    /// Photos whose name implies a capture time more than a day from the one
    /// they carry — what the run would (or did) repair.
    pub candidates: usize,
    /// Photos re-uploaded with the right capture time, their original trashed.
    pub redated: usize,
    /// Photos that could not be downloaded, re-uploaded, or trashed. The
    /// original is left alone in every failure case.
    pub failed: usize,
    /// Album memberships re-created on the new copies.
    pub album_links: usize,
    /// Bytes uploaded.
    pub bytes: u64,
    /// True when the run stopped early because it was cancelled.
    pub cancelled: bool,
    /// True when nothing was actually uploaded or trashed.
    pub dry_run: bool,
    /// Up to a handful of examples, as `(name, stored capture time, the time the
    /// name implies)` — what a dry run is read for.
    #[serde(default)]
    pub samples: Vec<(String, i64, i64)>,
 }
 /// How a Google Photos Takeout import is going, or how the last one ended
 /// ([`Response::ImportStatus`]).
 ///
@@ -1187,6 +1299,76 @@ pub struct PhotoThumb {
    pub pending: bool,
 }
 /// One ordinary Drive file whose thumbnail a front-end wants to paint.
 #[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct FileThumbRequest {
    /// Node uid in `volume~link` form.
    pub uid: String,
    /// File modification time, used as the thumbnail cache validity tag.
    pub modified: i64,
    /// Original Drive name. Local RAW-preview extraction uses the extension as a
    /// format hint; defaulted for wire compatibility with older front-ends.
    #[serde(default)]
    pub name: String,
 }
 /// Whether a Drive name is a raster image that the built-in decoder can read,
 /// or a concrete camera RAW format whose embedded preview exiftool can extract.
 /// Keep this list shared by the daemon and every GUI surface so a visible tile
 /// is never advertised without a matching generation path.
 pub fn is_thumbnail_image_name(name: &str) -> bool {
    let Some((_, extension)) = name.rsplit_once('.') else {
        return false;
    };
    let extension = extension.to_ascii_lowercase();
    STANDARD_THUMBNAIL_EXTENSIONS.contains(&extension.as_str())
        || RAW_THUMBNAIL_EXTENSIONS.contains(&extension.as_str())
 }
 /// Whether `name` is one of the concrete RAW formats handled by the exiftool
 /// embedded-preview path. Deliberately excludes generic/legacy grab-bags whose
 /// preview availability is not dependable.
 pub fn is_raw_image_name(name: &str) -> bool {
    let Some((_, extension)) = name.rsplit_once('.') else {
        return false;
    };
    let extension = extension.to_ascii_lowercase();
    RAW_THUMBNAIL_EXTENSIONS.contains(&extension.as_str())
 }
 const STANDARD_THUMBNAIL_EXTENSIONS: &[&str] =
    &["bmp", "gif", "jpeg", "jpg", "png", "tif", "tiff", "webp"];
 /// Concrete camera RAW formats with embedded previews handled by exiftool.
 /// This is the single source used by both RAW classification and the broader
 /// thumbnail capability check.
 const RAW_THUMBNAIL_EXTENSIONS: &[&str] = &[
    "arw", "cr2", "cr3", "crw", "dng", "k25", "kdc", "mrw", "nef", "nrw", "orf", "pef", "raf",
    "raw", "rw2", "sr2", "srf", "x3f",
 ];
 /// Progress of the one recursive ordinary-file thumbnail build the daemon may
 /// run at a time.
 #[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq)]
 pub struct ThumbnailBuildStatus {
    pub running: bool,
    /// True while folders are still being discovered, before the final image
    /// count is known and the progress bar can become determinate.
    pub scanning: bool,
    /// Mountpoint-relative root selected when the build started.
    pub path: String,
    pub folders_scanned: u64,
    pub images_found: u64,
    /// Images already cached or processed during this build. Includes failures,
    /// so `completed == images_found` still means the job has finished.
    pub completed: u64,
    /// Images that could not be downloaded or decoded.
    pub failed: u64,
    /// A traversal-level problem, such as a folder that could not be listed.
    #[serde(default)]
    pub message: Option<String>,
 }
 /// A daemon too old to report connectivity is assumed online — it could not
 /// have mounted at all otherwise.
 fn default_online() -> bool {
@@ -1334,11 +1516,28 @@ pub enum Response {
        #[serde(default)]
        summary: Option<ImportSummary>,
    },
    /// How the photo re-date is doing (reply to [`Request::RedateStatus`]).
    /// `running` is false once it has finished, when `summary` is the final
    /// report; `summary` is `None` when no re-date has run this session.
    RedateStatus {
        running: bool,
        #[serde(default)]
        summary: Option<RedateSummary>,
    },
    /// The months the timeline spans (reply to [`Request::PhotoMonths`]),
    /// newest first.
    PhotoMonths { months: Vec<PhotoMonth> },
    /// Thumbnails for a [`Request::PhotoThumbs`] batch.
    Thumbs { items: Vec<PhotoThumb> },
    /// A [`Request::FileThumbs`] generation is no longer current. This is
    /// retryable after reserving a fresh generation and must never be interpreted
    /// as a permanent "no thumbnail" verdict.
    FileThumbsStale,
    /// Daemon-issued generation reserved by
    /// [`Request::ReserveFileThumbGeneration`].
    FileThumbGeneration { generation: u64 },
    /// Current recursive thumbnail-build progress.
    ThumbnailBuild { status: ThumbnailBuildStatus },
    /// An on-disk path the front-end can open (e.g. a downloaded photo).
    FilePath { path: String },
    /// Full-text search results (reply to [`Request::Search`]).
@@ -1473,7 +1672,7 @@ impl ErrorKind {
 }
 /// Send one [`Request`] to the daemon listening on `socket` and read its
-/// [`Response`]. Errors (e.g. [`Error::Io`]) if no daemon is listening.
+/// [`Response`]. Returns a crate [`crate::Error`] if no daemon is listening.
 ///
 /// Shared by the CLI and GUI so both speak the wire format identically.
 pub fn send(socket: &Path, req: &Request) -> Result<Response> {
@@ -1632,6 +1831,86 @@ mod tests {
        }
    }
    #[test]
    fn file_thumbnail_requests_keep_their_revision_tags() {
        let request = Request::FileThumbs {
            items: vec![
                FileThumbRequest {
                    uid: "volume~first".into(),
                    modified: 1_700_000_001,
                    name: "first.jpg".into(),
                },
                FileThumbRequest {
                    uid: "volume~second".into(),
                    modified: 1_700_000_002,
                    name: "second.nef".into(),
                },
            ],
            generation: 42,
        };
        let line = serde_json::to_string(&request).unwrap();
        let decoded: Request = serde_json::from_str(&line).unwrap();
        assert_eq!(line, serde_json::to_string(&decoded).unwrap());
    }
    #[test]
    fn legacy_file_thumbnail_requests_default_the_name() {
        let decoded: Request = serde_json::from_str(
            r#"{"FileThumbs":{"items":[{"uid":"volume~first","modified":1700000001}],"generation":42}}"#,
        )
        .unwrap();
        let Request::FileThumbs { items, generation } = decoded else {
            panic!("decoded the wrong request variant");
        };
        assert_eq!(generation, 42);
        assert_eq!(items.len(), 1);
        assert!(items[0].name.is_empty());
    }
    #[test]
    fn thumbnail_build_requests_and_progress_roundtrip() {
        let requests = [
            Request::ReserveFileThumbGeneration,
            Request::CancelFileThumbs { generation: 43 },
            Request::StartThumbnailBuild {
                path: "pictures/events".into(),
            },
            Request::CancelThumbnailBuild,
            Request::ThumbnailBuildStatus,
        ];
        for request in requests {
            let line = serde_json::to_string(&request).unwrap();
            let decoded: Request = serde_json::from_str(&line).unwrap();
            assert_eq!(line, serde_json::to_string(&decoded).unwrap());
        }
        let response = Response::ThumbnailBuild {
            status: ThumbnailBuildStatus {
                running: true,
                scanning: false,
                path: "pictures/events".into(),
                folders_scanned: 12,
                images_found: 80,
                completed: 25,
                failed: 1,
                message: None,
            },
        };
        let line = serde_json::to_string(&response).unwrap();
        let decoded: Response = serde_json::from_str(&line).unwrap();
        assert_eq!(line, serde_json::to_string(&decoded).unwrap());
        let response = Response::FileThumbGeneration { generation: 44 };
        let line = serde_json::to_string(&response).unwrap();
        let decoded: Response = serde_json::from_str(&line).unwrap();
        assert_eq!(line, serde_json::to_string(&decoded).unwrap());
        let response = Response::FileThumbsStale;
        let line = serde_json::to_string(&response).unwrap();
        let decoded: Response = serde_json::from_str(&line).unwrap();
        assert_eq!(line, serde_json::to_string(&decoded).unwrap());
    }
    #[test]
    fn unified_search_request_and_response_roundtrip() {
        let request = Request::SearchV2 {
@@ -188,6 +188,19 @@ impl Db {
        Ok(rows)
    }
    /// Which albums hold `uid`, by album node uid. Read by the photo re-date,
    /// which has to put the re-uploaded copy back into the albums the original
    /// was in.
    pub fn albums_of_photo(&self, uid: &str) -> Result<Vec<String>> {
        let conn = self.read();
        let mut stmt =
            conn.prepare("SELECT DISTINCT album_uid FROM album_photos WHERE uid = ?1")?;
        let rows = stmt
            .query_map([uid], |r| r.get(0))?
            .collect::<rusqlite::Result<_>>()?;
        Ok(rows)
    }
    /// How many photos of `album_uid` are persisted.
    pub fn album_photos_count(&self, album_uid: &str) -> Result<usize> {
        let conn = self.read();
@@ -165,6 +165,31 @@ impl Db {
        Ok(rows)
    }
    /// The whole persisted timeline, in stored order. Only for whole-library
    /// passes (the photo re-date) — the gallery pages with
    /// [`Db::photos_page`].
    pub fn photos_all(&self) -> Result<Vec<StoredPhoto>> {
        let conn = self.read();
        let mut stmt = conn.prepare(
            "SELECT uid, capture_time, name, ratio, thumb_state, kind, favorite \
             FROM photos ORDER BY seq",
        )?;
        let rows = stmt
            .query_map([], |r| {
                Ok(StoredPhoto {
                    uid: r.get(0)?,
                    capture_time: r.get(1)?,
                    name: r.get(2)?,
                    ratio: r.get(3)?,
                    thumb_state: r.get(4)?,
                    kind: crate::control::PhotoKind::from_i64(r.get(5)?),
                    favorite: r.get::<_, i64>(6)? != 0,
                })
            })?
            .collect::<rusqlite::Result<_>>()?;
        Ok(rows)
    }
    /// The months the timeline spans, newest first, each with how many photos it
    /// holds — the data behind the date scrubber. Buckets are local-time
    /// `(year, month)` so they line up with the day headings the gallery draws
@@ -3201,6 +3201,8 @@ fn test_db_has_children_and_trashed_filtering() {
        photo: None,
        album: None,
        verification: Default::default(),
        direct_role: None,
        share_id: None,
    };
    db.upsert_node(&parent_node).unwrap();
@@ -3227,6 +3229,8 @@ fn test_db_has_children_and_trashed_filtering() {
        photo: None,
        album: None,
        verification: Default::default(),
        direct_role: None,
        share_id: None,
    };
    db.upsert_node(&child_node).unwrap();
@@ -72,6 +72,25 @@ const KNOWN_MENUS: [MenuFlavor; 6] = [
    },
 ];
 /// Terminals that can host `pdfs-prompt --fzf`, most-preferred first.
 ///
 /// The fzf front end is a terminal program, so a keybinding that has no tty
 /// needs one spawned for it. Each entry sets a stable app-id/class
 /// ([`TERMINAL_APP_ID`]) so a tiling WM can be told to float exactly this
 /// window, and ends with the flag after which the command to run follows.
 const KNOWN_TERMINALS: [&[&str]; 6] = [
    &["foot", "--app-id=pdfs-prompt", "--"],
    &["ghostty", "--class=pdfs-prompt", "-e"],
    &["kitty", "--class", "pdfs-prompt"],
    &["alacritty", "--class", "pdfs-prompt", "-e"],
    &["wezterm", "start", "--class", "pdfs-prompt", "--"],
    &["xterm", "-class", "pdfs-prompt", "-e"],
 ];
 /// The app-id/class every [`KNOWN_TERMINALS`] entry sets, so the window rule a
 /// user writes for one terminal keeps working if they switch.
 pub const TERMINAL_APP_ID: &str = "pdfs-prompt";
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 enum PromptFlag {
    /// `--prompt=TEXT`
@@ -105,6 +124,13 @@ pub struct PromptConfig {
    /// the prompt text; without one the launcher's own prompt flag is appended.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub menu: Option<Vec<String>>,
    /// Terminal argv for `pdfs-prompt --fzf` when it is started without a tty.
    /// Unset means "find one" — see [`resolve_terminal`]. A `{cmd}` token
    /// anywhere in the argv is replaced by the command to run; without one the
    /// command is appended, which is what every [`KNOWN_TERMINALS`] entry
    /// expects.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub terminal: Option<Vec<String>>,
    /// How many results to feed the launcher. Unset means
    /// [`DEFAULT_MENU_LIMIT`].
    #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -124,6 +150,8 @@ pub enum PromptMode {
    Gtk,
    /// The user's own launcher, driven over stdin/stdout.
    Dmenu,
    /// `fzf` in a terminal, re-querying the daemon on every keystroke.
    Fzf,
 }
 /// Rows an external launcher can show without becoming a scroll exercise. Larger
@@ -186,6 +214,43 @@ pub fn resolve_menu(configured: Option<&Vec<String>>) -> Option<Vec<String>> {
    Some(argv)
 }
 /// The terminal to host `pdfs-prompt --fzf` in: the configured one, or the
 /// first [`KNOWN_TERMINALS`] entry on `PATH`. Returns the argv up to and
 /// including the "run this command" flag — the caller appends the command, or
 /// substitutes it for a `{cmd}` token, via [`with_command`].
 pub fn resolve_terminal(configured: Option<&Vec<String>>) -> Option<Vec<String>> {
    if let Some(argv) = configured.filter(|argv| !argv.is_empty()) {
        return Some(argv.clone());
    }
    let flavor = KNOWN_TERMINALS
        .iter()
        .find(|argv| argv.first().is_some_and(|program| on_path(program)))?;
    Some(flavor.iter().map(|arg| (*arg).to_string()).collect())
 }
 /// Place `command` into a terminal argv: substituted for a `{cmd}` token if the
 /// user wrote one, otherwise appended.
 ///
 /// The token exists for terminals that want the command in the middle of their
 /// own arguments; appending is right for every [`KNOWN_TERMINALS`] entry, whose
 /// last element is the flag the command follows.
 pub fn with_command(argv: &[String], command: &[String]) -> Vec<String> {
    if !argv.iter().any(|arg| arg == "{cmd}") {
        let mut argv = argv.to_vec();
        argv.extend_from_slice(command);
        return argv;
    }
    let mut out = Vec::with_capacity(argv.len() + command.len());
    for arg in argv {
        if arg == "{cmd}" {
            out.extend_from_slice(command);
        } else {
            out.push(arg.clone());
        }
    }
    out
 }
 /// Show `items` in the launcher named by `argv` and wait for a choice.
 ///
 /// Blocking by design: the caller is a one-shot CLI invocation whose entire job
@@ -305,7 +370,8 @@ fn flavor_of(program: &str) -> Option<&'static MenuFlavor> {
    KNOWN_MENUS.iter().find(|flavor| flavor.program == base)
 }
-fn on_path(program: &str) -> bool {
+/// Whether `program` is an executable file on `PATH`.
 pub fn on_path(program: &str) -> bool {
    let Some(path) = std::env::var_os("PATH") else {
        return false;
    };
@@ -408,6 +474,47 @@ mod tests {
        );
    }
    #[test]
    fn a_configured_terminal_is_used_verbatim() {
        let configured = vec!["my-term".to_string(), "-e".to_string()];
        assert_eq!(
            resolve_terminal(Some(&configured)),
            Some(configured.clone())
        );
        // An empty list is "not configured", not "run nothing".
        assert_eq!(
            resolve_terminal(Some(&Vec::new())),
            resolve_terminal(None),
            "an empty terminal list must fall back to detection"
        );
    }
    #[test]
    fn the_command_is_appended_unless_the_user_placed_it() {
        let command = vec!["pdfs-prompt".to_string(), "--fzf".to_string()];
        assert_eq!(
            with_command(&["foot".into(), "--".into()], &command),
            vec!["foot", "--", "pdfs-prompt", "--fzf"]
        );
        assert_eq!(
            with_command(
                &["term".into(), "-e".into(), "{cmd}".into(), "--hold".into()],
                &command
            ),
            vec!["term", "-e", "pdfs-prompt", "--fzf", "--hold"]
        );
    }
    #[test]
    fn every_known_terminal_sets_the_same_app_id() {
        for argv in KNOWN_TERMINALS {
            assert!(
                argv.iter().any(|arg| arg.contains(TERMINAL_APP_ID)),
                "{argv:?} must be floatable by one window rule"
            );
        }
    }
    #[test]
    fn a_configured_launcher_is_used_verbatim() {
        let configured = vec!["my-menu".to_string(), "--pick".to_string()];
@@ -23,8 +23,9 @@
 //! ```
 use std::ffi::OsStr;
 use std::os::unix::process::CommandExt;
 use std::path::Path;
-use std::process::Command;
+use std::process::{Command, Stdio};
 use serde::{Deserialize, Serialize};
@@ -165,12 +166,30 @@ pub fn open_named(policy: &OpenWith, path: &Path, name: &str, is_dir: bool) {
    spawn(&argv, path);
 }
 /// Launch `argv`, detached from whatever is opening it.
 ///
 /// The child gets its own process group and no inherited stdio, because the
 /// caller may be about to exit and take its terminal with it: `pdfs-prompt
 /// --fzf` runs inside a terminal it spawned for itself, and that terminal
 /// closes the moment the selection is made. A child left in the terminal's
 /// foreground process group is sent `SIGHUP` when the pty hangs up, so
 /// "open this folder in a terminal" would open a window that dies immediately
 /// — which is exactly what it did. Nothing here needs the caller's stdio in the
 /// first place: every `argv` is another application, and a terminal one is
 /// wrapped in its own emulator by the `terminal` rule flag.
 fn spawn(argv: &[String], path: &Path) {
    let Some((program, args)) = argv.split_first() else {
        return;
    };
    tracing::info!(path = %path.display(), command = ?argv, "opening");
-    if let Err(e) = Command::new(program).args(args).spawn() {
+    let spawned = Command::new(program)
        .args(args)
        .stdin(Stdio::null())
        .stdout(Stdio::null())
        .stderr(Stdio::null())
        .process_group(0)
        .spawn();
    if let Err(e) = spawned {
        tracing::error!(command = ?argv, "open failed: {e}");
    }
 }
@@ -47,10 +47,18 @@ fn systemctl_query(args: &[&str]) -> bool {
        .unwrap_or(false)
 }
-/// Enable the service so it survives reboots/logins and start it now. Called on
+/// Enable the service so it survives reboots/logins, and bring it up now.
-/// successful login.
+/// Called on successful login.
 ///
 /// `restart` rather than `enable --now`: the unit may already be active but
 /// parked in the daemon's login-wait backoff (`pdfs daemon` sleeps between
 /// keyring checks). `--now` is a no-op on an active unit, so the daemon would
 /// keep sleeping and the mount would not appear until the next poll fired.
 /// Restarting makes the new session take effect immediately, and starts the
 /// unit when it is not running at all.
 pub fn enable_start() -> bool {
-    systemctl(&["enable", "--now"])
+    let enabled = systemctl(&["enable"]);
    systemctl(&["restart"]) && enabled
 }
 /// Stop the running mount without disabling it. Called by the tray's
@@ -393,22 +393,27 @@ fn assemble(entries: Vec<RawEntry>, sidecars: &HashMap<String, Vec<u8>>) -> Take
            .unwrap_or(&file_name)
            .to_string();
        // Sidecar first, then the date stamped into the name.
        let capture_time = sidecar
            .photo_taken_time
            .as_ref()
            .and_then(SidecarTime::epoch_seconds)
            .or_else(|| {
                sidecar
                    .creation_time
                    .as_ref()
                    .and_then(SidecarTime::epoch_seconds)
            })
            .or_else(|| capture_time_from_name(&name))
            .or_else(|| capture_time_from_name(&file_name));
        scan.photos.push(TakeoutPhoto {
            archive: raw.archive,
            entry: raw.entry.clone(),
            name,
            size: raw.size,
            media_type: media_type.to_string(),
-            capture_time: sidecar
+            capture_time,
                .photo_taken_time
                .as_ref()
                .and_then(SidecarTime::epoch_seconds)
                .or_else(|| {
                    sidecar
                        .creation_time
                        .as_ref()
                        .and_then(SidecarTime::epoch_seconds)
                }),
            favorite: sidecar.favorited,
            bucket,
        });
@@ -507,34 +512,218 @@ fn unswap_duplicate_marker(stem: &str) -> Option<String> {
    Some(format!("{}{}{}", &head[..dot], marker, &head[dot..]))
 }
 /// The capture time a *file name* implies, in epoch seconds, or `None` when it
 /// carries no plausible date.
 ///
 /// The last resort when a photo has no sidecar. Camera and messenger apps stamp
 /// the date into the name — `PXL_20260818_171030868.jpg`,
 /// `IMG_20230219_171030.jpg`, `Screenshot_20230101-102950.png`,
 /// `IMG-20230219-WA0001.jpg`, `Screenshot from 2023-01-01 10-29-50.png` — and a
 /// date that is merely *approximately* right still files the photo in the right
 /// year, which "the moment it was imported" does not.
 ///
 /// The wall clock in a name has no zone attached, so it is read as UTC. That can
 /// be a few hours out; it is never the years out that the import-time fallback
 /// is. A sidecar always wins over this.
 pub fn capture_time_from_name(name: &str) -> Option<i64> {
    let bytes = name.as_bytes();
    let digit = |i: usize| bytes.get(i).is_some_and(u8::is_ascii_digit);
    let num =
        |start: usize, len: usize| -> Option<i64> { name.get(start..start + len)?.parse().ok() };
    for start in 0..bytes.len() {
        if !digit(start) || (start > 0 && digit(start - 1)) {
            continue;
        }
        let run = |from: usize, len: usize| (0..len).all(|k| digit(from + k));
        // `YYYYMMDD` as one run of exactly eight digits, or `YYYY-MM-DD` with
        // any single separator repeated between the parts.
        let (year, month, day, after) = if run(start, 8) && !digit(start + 8) {
            (
                num(start, 4)?,
                num(start + 4, 2)?,
                num(start + 6, 2)?,
                start + 8,
            )
        } else if run(start, 4)
            && !digit(start + 4)
            && bytes.get(start + 4) == bytes.get(start + 7)
            && run(start + 5, 2)
            && run(start + 8, 2)
            && !digit(start + 10)
        {
            (
                num(start, 4)?,
                num(start + 5, 2)?,
                num(start + 8, 2)?,
                start + 10,
            )
        } else {
            continue;
        };
        if !(1990..=2100).contains(&year) || !(1..=12).contains(&month) || !(1..=31).contains(&day)
        {
            continue;
        }
        // An optional time right behind the date, past one separator character.
        let after = match bytes.get(after) {
            Some(b'_' | b'-' | b' ' | b'.' | b',' | b'T' | b't' | b'@') => after + 1,
            _ => after,
        };
        let time = if run(after, 6) {
            // Six digits, possibly with the milliseconds tail Pixel appends.
            Some((num(after, 2)?, num(after + 2, 2)?, num(after + 4, 2)?))
        } else if run(after, 2)
            && !digit(after + 2)
            && bytes.get(after + 2) == bytes.get(after + 5)
            && run(after + 3, 2)
            && run(after + 6, 2)
        {
            Some((num(after, 2)?, num(after + 3, 2)?, num(after + 6, 2)?))
        } else {
            None
        };
        let (hour, minute, second) = match time {
            Some((h, m, sec)) if h < 24 && m < 60 && sec < 60 => (h, m, sec),
            _ => (0, 0, 0),
        };
        return Some(
            days_from_civil(year, month, day) * 86_400 + hour * 3_600 + minute * 60 + second,
        );
    }
    None
 }
 /// Days between 1970-01-01 and a proleptic-Gregorian date (Howard Hinnant's
 /// `days_from_civil`). Avoids pulling a date crate in for one conversion.
 fn days_from_civil(year: i64, month: i64, day: i64) -> i64 {
    let year = year - i64::from(month <= 2);
    let era = if year >= 0 { year } else { year - 399 } / 400;
    let year_of_era = year - era * 400;
    let day_of_year = (153 * (month + if month > 2 { -3 } else { 9 }) + 2) / 5 + day - 1;
    let day_of_era = year_of_era * 365 + year_of_era / 4 - year_of_era / 100 + day_of_year;
    era * 146_097 + day_of_era - 719_468
 }
 /// The inverse of [`unswap_duplicate_marker`]: `IMG_1234(1).jpg` as Google
 /// writes its sidecar, `IMG_1234.jpg(1)`. `None` when the name carries no
 /// duplicate marker.
 fn swap_duplicate_marker(file_name: &str) -> Option<String> {
    let marker_start = file_name.rfind('(')?;
    let marker_end = marker_start + file_name[marker_start..].find(')')? + 1;
    let marker = &file_name[marker_start..marker_end];
    if !marker[1..marker.len() - 1]
        .chars()
        .all(|c| c.is_ascii_digit())
    {
        return None;
    }
    let tail = &file_name[marker_end..];
    if !tail.starts_with('.') {
        return None;
    }
    Some(format!("{}{}{}", &file_name[..marker_start], tail, marker))
 }
 /// Find the sidecar belonging to `file_name` among the JSON files of its folder.
 ///
-/// Tried in order of confidence: the exact name, the `(N)`-swapped name, then a
+/// Tried in order of confidence: the exact name, the `(N)`-swapped name, an
-/// prefix match for the case where truncation cut into the photo name itself.
+/// unknown trailing suffix, then a prefix match for the case where truncation
 /// cut into the photo name itself. The best-ranked candidate in the folder wins.
 fn find_sidecar<'a>(
    file_name: &str,
    in_folder: &BTreeMap<String, &'a Vec<u8>>,
 ) -> Option<&'a Vec<u8>> {
-    let mut prefix_match: Option<&'a Vec<u8>> = None;
+    let mut best: Option<((u8, usize), &'a Vec<u8>)> = None;
    let mut prefix_len = 0usize;
    for (sidecar_name, body) in in_folder {
-        let stem = strip_sidecar_suffix(sidecar_name);
+        let Some(rank) = sidecar_rank(strip_json_suffix(sidecar_name), file_name) else {
-        if stem == file_name {
+            continue;
-            return Some(body);
+        };
-        }
+        if best.as_ref().is_none_or(|(current, _)| rank < *current) {
-        if unswap_duplicate_marker(&stem).as_deref() == Some(file_name) {
+            best = Some((rank, body));
            return Some(body);
        }
        // Truncated: the stem is a prefix of the photo's name. Keep the longest
        // such prefix — a folder holding `IMG_1.jpg` and `IMG_12.jpg` must not
        // let the shorter stem claim the longer photo.
        if !stem.is_empty() && file_name.starts_with(&stem) && stem.len() > prefix_len {
            prefix_len = stem.len();
            prefix_match = Some(body);
        }
    }
-    prefix_match
+    best.map(|(_, body)| body)
 }
 /// How well a sidecar's `.json`-stripped `stem` matches `file_name`, as a sort
 /// key where **lower is better**: the leading number is the rule that matched,
 /// the second breaks ties within it.
 fn sidecar_rank(stem: &str, file_name: &str) -> Option<(u8, usize)> {
    // 0 — the stem is the photo name once the (English) suffix is off.
    let plain = strip_sidecar_suffix(stem);
    if plain == file_name {
        return Some((0, 0));
    }
    // 1 — the same, for `IMG_1234.jpg(1).json` against `IMG_1234(1).jpg`.
    if unswap_duplicate_marker(&plain).as_deref() == Some(file_name) {
        return Some((1, 0));
    }
    // 2 — the photo name is intact but a suffix we do not recognise follows it.
    // Google *localizes* `.supplemental-metadata` (a German export writes
    // `.ergänzende-Metadaten`) and has shipped misspelt variants of it, so the
    // suffix cannot be enumerated — matching on the intact name in front of it
    // is what stays locale-agnostic. The shortest leftover wins, so a folder
    // holding both `IMG_1.jpg.<suffix>` and `IMG_1.jpg(1).<suffix>` gives each
    // photo its own.
    for candidate in [
        Some(file_name.to_string()),
        swap_duplicate_marker(file_name),
    ]
    .into_iter()
    .flatten()
    {
        if let Some(rest) = stem.strip_prefix(&candidate)
            && looks_like_sidecar_suffix(rest)
        {
            return Some((2, rest.len()));
        }
    }
    // 3 — truncation ate into the photo name itself, leaving only a prefix of
    // it. Every suffix boundary in the stem is tried, so this holds for a
    // localized suffix too; the longest surviving prefix wins, because a folder
    // with `IMG_1.jpg` and `IMG_12.jpg` must not let the shorter stem claim the
    // longer photo.
    let mut longest: Option<usize> = None;
    for head in suffix_boundaries(stem) {
        if !head.is_empty()
            && file_name.starts_with(head)
            && longest.is_none_or(|len| head.len() > len)
        {
            longest = Some(head.len());
        }
    }
    longest.map(|len| (3, usize::MAX - len))
 }
 /// The stem plus each of its prefixes ending before a `.`, longest first — the
 /// possible boundaries between a photo name and a sidecar suffix.
 fn suffix_boundaries(stem: &str) -> impl Iterator<Item = &str> {
    std::iter::once(stem).chain(
        stem.char_indices()
            .filter(|(_, c)| *c == '.')
            .map(|(index, _)| &stem[..index])
            .collect::<Vec<_>>()
            .into_iter()
            .rev(),
    )
 }
 /// Whether `rest` — what follows an intact photo name in a sidecar's stem —
 /// looks like a metadata suffix rather than the tail of a different file's name.
 /// Google's suffixes all start at a `.`, or at the `(N)` duplicate marker.
 fn looks_like_sidecar_suffix(rest: &str) -> bool {
    rest.starts_with('.') || rest.starts_with('(')
 }
 /// Drop a trailing `.json`, case-insensitively.
 fn strip_json_suffix(sidecar: &str) -> &str {
    match sidecar.len().checked_sub(5) {
        Some(cut) if sidecar[cut..].eq_ignore_ascii_case(".json") => &sidecar[..cut],
        _ => sidecar,
    }
 }
 #[cfg(test)]
@@ -663,6 +852,106 @@ mod tests {
        assert_eq!(scan.photos[0].capture_time, Some(1_500_000_000));
    }
    #[test]
    fn a_localized_supplemental_suffix_still_matches() {
        // A German export writes `.ergänzende-Metadaten` where an English one
        // writes `.supplemental-metadata`; the photo name in front of it is
        // what the match hangs on.
        let mut sidecars = HashMap::new();
        sidecar(
            &mut sidecars,
            "Takeout/Google Fotos/Fotos von 2023/IMG-20230219-WA0001.jpg.ergänzende-Metadaten.json",
            r#"{"photoTakenTime":{"timestamp":"1676800000"}}"#,
        );
        let scan = assemble(
            vec![entry(
                0,
                "Takeout/Google Fotos/Fotos von 2023/IMG-20230219-WA0001.jpg",
                10,
            )],
            &sidecars,
        );
        assert_eq!(scan.photos[0].capture_time, Some(1_676_800_000));
    }
    #[test]
    fn a_localized_suffix_does_not_let_one_sidecar_claim_a_sibling() {
        let mut sidecars = HashMap::new();
        for name in ["IMG_1.jpg", "IMG_1(1).jpg"] {
            sidecar(
                &mut sidecars,
                &format!("Takeout/Google Fotos/Album/{name}.ergänzende-Metadaten.json"),
                r#"{"photoTakenTime":{"timestamp":"1"}}"#,
            );
        }
        // Google writes the duplicate's sidecar with the marker after the
        // extension, so this is the spelling that actually ships.
        sidecars.remove("Album/IMG_1(1).jpg.ergänzende-Metadaten.json");
        sidecar(
            &mut sidecars,
            "Takeout/Google Fotos/Album/IMG_1.jpg(1).ergänzende-Metadaten.json",
            r#"{"photoTakenTime":{"timestamp":"2"}}"#,
        );
        let scan = assemble(
            vec![
                entry(0, "Takeout/Google Fotos/Album/IMG_1.jpg", 10),
                entry(0, "Takeout/Google Fotos/Album/IMG_1(1).jpg", 10),
            ],
            &sidecars,
        );
        assert_eq!(scan.photos[0].capture_time, Some(1));
        assert_eq!(scan.photos[1].capture_time, Some(2));
    }
    #[test]
    fn the_file_name_date_is_the_fallback_when_no_sidecar_matches() {
        let scan = assemble(
            vec![entry(
                0,
                "Takeout/Google Fotos/Fotos von 2023/IMG-20230219-WA0001.jpg",
                10,
            )],
            &HashMap::new(),
        );
        // 2023-02-19 00:00:00 UTC.
        assert_eq!(scan.photos[0].capture_time, Some(1_676_764_800));
    }
    #[test]
    fn file_name_dates_cover_the_common_camera_and_messenger_spellings() {
        // 2026-08-18 17:10:30 UTC, with Pixel's milliseconds tail.
        assert_eq!(
            capture_time_from_name("PXL_20260818_171030868.RAW-01.COVER.jpg"),
            Some(1_787_073_030)
        );
        assert_eq!(
            capture_time_from_name("IMG_20260818_171030.jpg"),
            Some(1_787_073_030)
        );
        assert_eq!(
            capture_time_from_name("Screenshot_20260818-171030.png"),
            Some(1_787_073_030)
        );
        assert_eq!(
            capture_time_from_name("Screenshot from 2026-08-18 17-10-30.png"),
            Some(1_787_073_030)
        );
        // A date with no usable time lands at midnight, not at import time.
        assert_eq!(
            capture_time_from_name("IMG-20260818-WA0001.jpg"),
            Some(1_787_011_200)
        );
    }
    #[test]
    fn a_name_without_a_plausible_date_yields_nothing() {
        assert_eq!(capture_time_from_name("100_1234.JPG"), None);
        assert_eq!(capture_time_from_name("DSC00042.jpg"), None);
        // A nine-digit run is not a date; neither is an out-of-range month.
        assert_eq!(capture_time_from_name("IMG_202608181.jpg"), None);
        assert_eq!(capture_time_from_name("IMG_20261818.jpg"), None);
    }
    #[test]
    fn truncated_supplemental_suffixes_still_match() {
        // Google caps the sidecar name at 51 chars, cutting into the suffix.
@@ -5,6 +5,8 @@ edition.workspace = true
 license.workspace = true
 authors.workspace = true
 rust-version.workspace = true
 repository.workspace = true
 homepage.workspace = true
 description = "FUSE on-demand filesystem for Proton Drive"
 [dependencies]
@@ -18,6 +20,7 @@ tracing.workspace = true
 fuser.workspace = true
 libc.workspace = true
 serde_json.workspace = true
 base64.workspace = true
 image.workspace = true
 notify = "8"
 parking_lot.workspace = true
@@ -541,6 +541,8 @@ mod tests {
            photo: None,
            album: None,
            verification: Default::default(),
            direct_role: None,
            share_id: None,
        }
    }
@@ -11,7 +11,7 @@
 use std::io::{BufRead, BufReader, Write as _};
 use std::os::unix::net::{UnixListener, UnixStream};
-use std::path::{Path, PathBuf};
+use std::path::{Component, Path, PathBuf};
 use std::sync::atomic::{AtomicUsize, Ordering};
 use std::time::{Duration, Instant};
@@ -134,12 +134,21 @@ fn route_to_mount(core: &Core, mountpoint: &Path, path: &str) -> CoreResult<(Cor
 /// the mount root.
 fn rel_to_mount(mountpoint: &Path, path: &str) -> CoreResult<PathBuf> {
    let p = Path::new(path);
-    if p.is_absolute() {
+    let relative = if p.is_absolute() {
        p.strip_prefix(mountpoint)
            .map(Path::to_path_buf)
            .map_err(|_| CoreError::invalid(format!("{path} is not under the mountpoint")))
    } else {
        Ok(p.to_path_buf())
    }?;
    if relative
        .components()
        .all(|component| matches!(component, Component::Normal(_) | Component::CurDir))
    {
        Ok(relative)
    } else {
        Err(CoreError::invalid(format!("{path} escapes the mountpoint")))
    }
 }
@@ -320,6 +329,34 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
                items: core.photo_thumbs(&parsed),
            }
        }
        Ok(CtlRequest::FileThumbs { items, generation }) => {
            match core.file_thumbs(&items, generation) {
                Some(items) => CtlResponse::Thumbs { items },
                None => CtlResponse::FileThumbsStale,
            }
        }
        Ok(CtlRequest::ReserveFileThumbGeneration) => CtlResponse::FileThumbGeneration {
            generation: core.reserve_file_thumb_generation(),
        },
        Ok(CtlRequest::CancelFileThumbs { generation }) => {
            core.cancel_file_thumbs(generation);
            CtlResponse::Ok {
                message: "thumbnail requests cancelled".to_string(),
            }
        }
        Ok(CtlRequest::StartThumbnailBuild { path }) => match rel_to_mount(mountpoint, &path) {
            Ok(rel) => match core.start_thumbnail_build(rel) {
                Ok(status) => CtlResponse::ThumbnailBuild { status },
                Err(error) => CtlResponse::error(error),
            },
            Err(error) => CtlResponse::error(error),
        },
        Ok(CtlRequest::CancelThumbnailBuild) => CtlResponse::ThumbnailBuild {
            status: core.cancel_thumbnail_build(),
        },
        Ok(CtlRequest::ThumbnailBuildStatus) => CtlResponse::ThumbnailBuild {
            status: core.thumbnail_build_status(),
        },
        Ok(CtlRequest::OpenPhoto { uid }) => match parse_uid(&uid) {
            Some(u) => match core.open_photo(&u) {
                Ok(p) => CtlResponse::FilePath {
@@ -374,6 +411,36 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
                CtlResponse::error(CoreError::invalid("no import is running"))
            }
        }
        // The scan reads the whole persisted timeline and every candidate is a
        // download plus an upload, so this goes to a background thread and is
        // read back through `RedateStatus`.
        Ok(CtlRequest::RedatePhotos {
            dry_run,
            limit,
            range,
        }) => match core.spawn_redate(dry_run, limit, range) {
            Ok(()) => CtlResponse::Ok {
                message: if dry_run {
                    "checking photo dates".to_string()
                } else {
                    "fixing photo dates".to_string()
                },
            },
            Err(e) => CtlResponse::error(e),
        },
        Ok(CtlRequest::RedateStatus) => {
            let (running, summary) = crate::redate::redate_status();
            CtlResponse::RedateStatus { running, summary }
        }
        Ok(CtlRequest::CancelRedate) => {
            if crate::redate::cancel_redate() {
                CtlResponse::Ok {
                    message: "stopping the re-date".to_string(),
                }
            } else {
                CtlResponse::error(CoreError::invalid("no photo re-date is running"))
            }
        }
        Ok(CtlRequest::UploadPhoto {
            name,
            media_type,
@@ -1221,4 +1288,29 @@ mod request_limit_tests {
            std::io::ErrorKind::InvalidData
        );
    }
    #[test]
    fn accepts_paths_inside_the_mountpoint() {
        let mountpoint = Path::new("/mnt/proton");
        assert_eq!(
            rel_to_mount(mountpoint, "Photos/2026").unwrap(),
            Path::new("Photos/2026")
        );
        assert_eq!(
            rel_to_mount(mountpoint, "/mnt/proton/Photos/2026").unwrap(),
            Path::new("Photos/2026")
        );
        assert_eq!(
            rel_to_mount(mountpoint, "/mnt/proton").unwrap(),
            Path::new("")
        );
    }
    #[test]
    fn rejects_paths_that_escape_the_mountpoint() {
        let mountpoint = Path::new("/mnt/proton");
        assert!(rel_to_mount(mountpoint, "../escape").is_err());
        assert!(rel_to_mount(mountpoint, "Photos/../../escape").is_err());
        assert!(rel_to_mount(mountpoint, "/mnt/elsewhere").is_err());
    }
 }
@@ -29,12 +29,14 @@ use std::time::{Duration, Instant};
 use parking_lot::Mutex;
 use futures::StreamExt;
 use pdfs_core::batch;
 use pdfs_core::cache::{Baseline, StagedWrite};
 use pdfs_core::control::{ActivityKind, TransferDirection};
 use pdfs_core::db::{OP_CREATE, OP_MKDIR, OP_RENAME, OP_REVISION, OP_TRASH, PendingOp, RenameMeta};
-use proton_drive_rs::Node;
+use proton_drive_rs::proton_sdk::error::ProtonError;
 use proton_drive_rs::proton_sdk::ids::NodeUid;
 use proton_drive_rs::{Node, NodeMoveItem};
 use tracing::{debug, error, info, warn};
 use super::state::Intervals;
@@ -642,61 +644,46 @@ impl Core {
                return Ok(());
            }
        };
-        // The name half goes first, so that a collision on the move half below is
+        let landed = if node.parent_uid.as_ref() == Some(&parent) {
-        // about the name the node will actually land under rather than the one it
+            self.drain_rename_in_place(&uid, &node.name, &name)?
-        // is about to lose.
+        } else {
-        let mut landed = node.name.clone();
+            // Move and rename land as one request (`move-multiple` takes a
-        if landed != name {
+            // target name), so there is no half-applied state between them and
-            match self.rt.block_on(self.client.rename_node(&uid, &name, None)) {
+            // no window for the requirements to go stale between two calls —
-                Ok(()) => landed = name.clone(),
+            // the race B46 queued this op to get away from.
-                // Someone took the name while we were offline. Renaming to a
+            let target = (node.name != name).then_some(name.as_str());
            match self.move_renaming(&uid, &parent, target) {
                Ok(()) => name.clone(),
                // The destination holds that name already. Landing under a
                // *different* name is the non-destructive resolution: it neither
                // clobbers their file nor drops ours, and it is visible.
                Err(e) if is_already_exists(&e) => {
                    let alt = conflict_name(&name, now_secs());
-                    warn!(%uid, name, alt, "rename target name is taken; using a conflict name");
+                    warn!(%uid, name, alt, "destination already holds that name; using a conflict name");
-                    self.rt
+                    self.move_renaming(&uid, &parent, Some(&alt))?;
                        .block_on(self.client.rename_node(&uid, &alt, None))?;
                    landed = alt.clone();
                    self.adopt_drained_name(&uid, &alt);
                    self.log_activity(
                        ActivityKind::Rename,
                        &name,
                        format!("name was taken remotely; renamed to {alt}"),
                        false,
                    );
                }
                Err(e) => return Err(e.into()),
            }
        }
        if node.parent_uid.as_ref() != Some(&parent) {
            match self.rt.block_on(self.client.move_node(&uid, &parent)) {
                Ok(()) => {}
                // The destination holds a `landed` of its own. Same resolution as
                // a name collision, and it has to happen before the move: the API
                // has no move-and-rename, so the node is renamed out of the way
                // here and moved second.
                Err(e) if is_already_exists(&e) => {
                    let alt = conflict_name(&landed, now_secs());
                    warn!(%uid, name = %landed, alt, "destination already holds that name; using a conflict name");
                    self.rt
                        .block_on(self.client.rename_node(&uid, &alt, None))?;
                    self.rt.block_on(self.client.move_node(&uid, &parent))?;
                    self.adopt_drained_name(&uid, &alt);
                    self.log_activity(
                        ActivityKind::Rename,
                        &landed,
                        format!("destination already had that name; moved as {alt}"),
                        false,
                    );
                    alt
                }
                // The destination folder is gone. Leaving the node in its current
                // parent is the honest outcome: it is not where the user asked for
-                // it, but it exists, it is where it has always been, and the
+                // it, but it exists and it is where it has always been. The name
-                // rename half above still applied. Retrying could only fail again
+                // the user chose still applies there. Retrying the move could
-                // — the folder is not coming back — and would wedge the queue.
+                // only fail again — the folder is not coming back — and would
                // wedge the queue.
                Err(e) if is_gone(&e) => {
-                    warn!(%uid, name = %landed, %parent, "move destination is gone; leaving the node where it is");
+                    warn!(%uid, name, %parent, "move destination is gone; leaving the node where it is");
                    let landed = match self.drain_rename_in_place(&uid, &node.name, &name) {
                        Ok(landed) => landed,
                        // The node went with it; nothing is left to rename.
                        Err(e) if is_gone(&e) => node.name.clone(),
                        Err(e) => return Err(e.into()),
                    };
                    self.log_activity(
                        ActivityKind::Rename,
                        &landed,
@@ -704,16 +691,73 @@ impl Core {
                            .to_string(),
                        false,
                    );
                    landed
                }
                Err(e) => return Err(e.into()),
            }
-        }
+        };
        self.db.delete_op(op.id)?;
        self.note_self_change(&uid);
        info!(%uid, name = %landed, "pending rename landed");
        Ok(())
    }
    /// Rename `uid` without moving it, from `current` to `name`, and return the
    /// name it landed under. Someone may have taken the name while we were
    /// offline; the node then lands under a conflict name instead.
    fn drain_rename_in_place(
        &self,
        uid: &NodeUid,
        current: &str,
        name: &str,
    ) -> Result<String, ProtonError> {
        if current == name {
            return Ok(current.to_string());
        }
        match self.rt.block_on(self.client.rename_node(uid, name, None)) {
            Ok(()) => Ok(name.to_string()),
            Err(e) if is_already_exists(&e) => {
                let alt = conflict_name(name, now_secs());
                warn!(%uid, name, alt, "rename target name is taken; using a conflict name");
                self.rt.block_on(self.client.rename_node(uid, &alt, None))?;
                self.adopt_drained_name(uid, &alt);
                self.log_activity(
                    ActivityKind::Rename,
                    name,
                    format!("name was taken remotely; renamed to {alt}"),
                    false,
                );
                Ok(alt)
            }
            Err(e) => Err(e),
        }
    }
    /// Move `uid` under `parent` in one request, renaming it to `target_name` on
    /// the way when one is given.
    fn move_renaming(
        &self,
        uid: &NodeUid,
        parent: &NodeUid,
        target_name: Option<&str>,
    ) -> Result<(), ProtonError> {
        let item = NodeMoveItem {
            uid: uid.clone(),
            target_name: target_name.map(str::to_string),
        };
        self.rt.block_on(async {
            let mut outcomes =
                std::pin::pin!(self.client.move_nodes_streaming(vec![item], parent.clone()));
            match outcomes.next().await {
                Some(Ok((_, outcome))) => outcome,
                Some(Err(e)) => Err(e),
                None => Err(ProtonError::invalid_operation(format!(
                    "move of {uid} reported no outcome"
                ))),
            }
        })
    }
    /// Apply a queued trash to the remote.
    ///
    /// A node that is already gone is a success, not a failure: the outcome the
@@ -1587,6 +1631,8 @@ mod tests {
            photo: None,
            album: None,
            verification: Default::default(),
            direct_role: None,
            share_id: None,
        }
    }
@@ -1879,6 +1925,8 @@ mod tests {
            photo: None,
            album: None,
            verification: Default::default(),
            direct_role: None,
            share_id: None,
        }
    }
@@ -60,7 +60,7 @@ use pdfs_core::config::{AppDirs, SweepMode};
 use pdfs_core::control::{
    ActivityEntry, ActivityKind, DirEntry, ErrorKind, LocalHit, PhotoKind, PublicLinkInfo,
    SearchFilters, SearchHit, SearchSource, SyncFolderInfo, SyncPhase, SyncProgress,
-    TransferDirection,
+    ThumbnailBuildStatus, TransferDirection,
 };
 use pdfs_core::db::{
    Db, LOCAL_VOLUME, OP_CREATE, OP_MKDIR, OP_RENAME, OP_REVISION, OP_TRASH, PARK_UNTIL, PendingOp,
@@ -90,6 +90,7 @@ mod mount;
 mod photos;
 mod profile;
 mod reads;
 mod redate;
 mod revisions;
 mod sharing;
 mod shutdown;
@@ -374,6 +375,45 @@ impl SearchRoots {
    }
 }
 /// Negative thumbnail knowledge has two different authorities. A remote miss
 /// only says Proton has no thumbnail to download; it must never suppress local
 /// generation. A local miss says this exact file revision was successfully
 /// inspected and could not be decoded. Both maps are bounded independently.
 #[derive(Default)]
 struct ThumbnailMissCaches {
    remote: HashMap<(NodeUid, i32), i64>,
    local: HashMap<(NodeUid, i32), i64>,
 }
 impl ThumbnailMissCaches {
    fn remote_contains(&self, key: &(NodeUid, i32), tag: i64) -> bool {
        self.remote.get(key) == Some(&tag)
    }
    fn local_contains(&self, key: &(NodeUid, i32), tag: i64) -> bool {
        self.local.get(key) == Some(&tag)
    }
    fn remember_remote(&mut self, key: (NodeUid, i32), tag: i64) {
        Self::remember(&mut self.remote, key, tag);
    }
    fn remember_local(&mut self, key: (NodeUid, i32), tag: i64) {
        Self::remember(&mut self.local, key, tag);
    }
    fn forget_local(&mut self, key: &(NodeUid, i32)) {
        self.local.remove(key);
    }
    fn remember(map: &mut HashMap<(NodeUid, i32), i64>, key: (NodeUid, i32), tag: i64) {
        if map.len() >= MAX_THUMBNAIL_MISSES && !map.contains_key(&key) {
            map.clear();
        }
        map.insert(key, tag);
    }
 }
 /// `path` expressed relative to `root`, or `None` if it is not below it. The
 /// root itself resolves to the empty path; an empty root is the mount itself
 /// and covers everything.
@@ -511,8 +551,22 @@ struct Core {
    /// those downloads is a full-size photo — so an in-flight uid is never started
    /// twice.
    thumb_gen: Arc<Mutex<HashSet<NodeUid>>>,
-    /// Nodes the remote has told us have *no* thumbnail of a given type, keyed by
+    /// Global permit pool for locally generated thumbnails. The old per-request
-    /// `(uid, thumbnail type)` and holding the mtime the answer was learned at.
+    /// limit multiplied when the GUI sent several batches, allowing dozens of
    /// full-size images to download at once.
    thumb_gen_budget: Arc<tokio::sync::Semaphore>,
    /// Current ordinary-file listing generation and a wake-up for tasks waiting
    /// on a permit or a download when that listing is abandoned.
    file_thumb_generation: Arc<AtomicU64>,
    file_thumb_cancel: Arc<tokio::sync::Notify>,
    /// Progress of the explicit recursive build started from the Files toolbar.
    thumbnail_build: Arc<Mutex<ThumbnailBuildStatus>>,
    /// Cancellation for the explicit recursive build. Separate from ordinary
    /// listing cancellation because the two jobs have independent lifetimes.
    thumbnail_build_cancelled: Arc<AtomicBool>,
    thumbnail_build_cancel: Arc<tokio::sync::Notify>,
    /// Negative thumbnail knowledge, separated by whether the remote lacked a
    /// thumbnail or local decoding proved this revision unsupported.
    ///
    /// Absence has to be cached or it costs a round trip every time it is asked
    /// for, and it is asked for constantly: an `ls -l` from an xattr-aware lister
@@ -520,7 +574,7 @@ struct Core {
    /// of videos re-probed 130 times per listing at ~186 ms each (B5). The mtime
    /// is the validity tag — a new revision may well have a thumbnail — matching
    /// how [`ContentCache::read_thumbnail`] validates the positive side.
-    no_thumbnail: Arc<Mutex<HashMap<(NodeUid, i32), i64>>>,
+    thumbnail_misses: Arc<Mutex<ThumbnailMissCaches>>,
    /// Last account quota answer and when it was learned, for `statfs(2)`.
    ///
    /// `df` and the free-space preflight of every file manager and installer ask
@@ -3580,7 +3634,7 @@ impl Core {
        // "This file has no thumbnail" is an answer worth remembering: without
        // it every listing pays a round trip per file to be told nothing (B5).
        let key = (uid.clone(), ttype.as_i32());
-        if self.no_thumbnail.lock().get(&key) == Some(&mtime) {
+        if self.thumbnail_misses.lock().remote_contains(&key, mtime) {
            return Ok(None);
        }
        let bytes = self
@@ -3597,15 +3651,7 @@ impl Core {
                    .store_thumbnail(&uid, ttype.as_i32(), mtime, bytes);
            }
            None => {
-                let mut misses = self.no_thumbnail.lock();
+                self.thumbnail_misses.lock().remember_remote(key, mtime);
                // Bounded by clearing rather than by LRU: the entries are two
                // words each, the cap is far above any plausible working set,
                // and re-learning a miss costs one round trip. Not worth a
                // second data structure to order them.
                if misses.len() >= MAX_THUMBNAIL_MISSES {
                    misses.clear();
                }
                misses.insert(key, mtime);
            }
        }
        Ok(bytes)
@@ -3692,6 +3738,9 @@ impl Core {
                // My own tree: a role only means something under a share, and
                // this listing never crosses into one.
                role: String::new(),
                shared_by: String::new(),
                shared_at: 0,
                shared_by_unverified: false,
            })
            .collect())
    }
@@ -4273,6 +4322,9 @@ impl Core {
                uid: item.uid,
                path: String::new(),
                role: String::new(),
                shared_by: String::new(),
                shared_at: 0,
                shared_by_unverified: false,
            })
            .collect())
    }
@@ -4811,7 +4863,7 @@ fn public_link_info(link: proton_drive_rs::PublicLink) -> PublicLinkInfo {
 /// Parse a `volume~link` uid display string back into a [`NodeUid`]. Front-ends
 /// receive uids as strings over the control socket and pass them back verbatim.
-fn parse_uid(s: &str) -> Option<NodeUid> {
+pub(crate) fn parse_uid(s: &str) -> Option<NodeUid> {
    let (vol, link) = s.split_once('~')?;
    if vol.is_empty() || link.is_empty() || link.contains('~') {
        return None;
@@ -4948,6 +5000,8 @@ fn local_node(uid: NodeUid, parent_uid: NodeUid, name: String, is_dir: bool) ->
        album: None,
        // Nothing signed it: it has never been near the crypto layer.
        verification: Default::default(),
        direct_role: None,
        share_id: None,
    }
 }
@@ -5872,6 +5926,8 @@ mod pending_size_tests {
            photo: None,
            album: None,
            verification: Default::default(),
            direct_role: None,
            share_id: None,
        }
    }
@@ -7082,6 +7138,9 @@ mod tests {
                share_id,
                membership_id: ShareMembershipId::from("membership"),
                permissions,
                invite_time: None,
                inviter_email: None,
                inviter_verification: None,
            });
            node
        };
@@ -7542,10 +7601,44 @@ mod tests {
            photo: None,
            album: None,
            verification: Default::default(),
            direct_role: None,
            share_id: None,
        }
    }
 }
 #[cfg(test)]
 mod thumbnail_miss_tests {
    use super::*;
    #[test]
    fn remote_misses_never_suppress_local_generation() {
        let uid = parse_uid("volume~node").expect("uid");
        let key = (uid, ThumbnailType::Thumbnail.as_i32());
        let mut misses = ThumbnailMissCaches::default();
        misses.remember_remote(key.clone(), 42);
        assert!(misses.remote_contains(&key, 42));
        assert!(!misses.local_contains(&key, 42));
        misses.remember_local(key.clone(), 42);
        assert!(misses.local_contains(&key, 42));
        misses.forget_local(&key);
        assert!(!misses.local_contains(&key, 42));
        assert!(misses.remote_contains(&key, 42));
    }
    #[test]
    fn local_miss_cache_is_bounded_on_gui_only_paths() {
        let mut misses = ThumbnailMissCaches::default();
        for index in 0..=MAX_THUMBNAIL_MISSES {
            let uid = parse_uid(&format!("volume~node-{index}")).expect("uid");
            misses.remember_local((uid, ThumbnailType::Thumbnail.as_i32()), 42);
        }
        assert_eq!(misses.local.len(), 1);
    }
 }
 #[cfg(test)]
 mod search_root_tests {
    use super::*;
@@ -389,7 +389,15 @@ pub fn mount(
        own_sealed_revs: Arc::new(Mutex::new(HashMap::new())),
        self_changes: Arc::new(Mutex::new(HashMap::new())),
        thumb_gen: Arc::new(Mutex::new(HashSet::new())),
-        no_thumbnail: Arc::new(Mutex::new(HashMap::new())),
+        thumb_gen_budget: Arc::new(tokio::sync::Semaphore::new(
            super::photos::THUMB_GEN_CONCURRENCY,
        )),
        file_thumb_generation: Arc::new(AtomicU64::new(0)),
        file_thumb_cancel: Arc::new(tokio::sync::Notify::new()),
        thumbnail_build: Arc::new(Mutex::new(Default::default())),
        thumbnail_build_cancelled: Arc::new(AtomicBool::new(false)),
        thumbnail_build_cancel: Arc::new(tokio::sync::Notify::new()),
        thumbnail_misses: Arc::new(Mutex::new(Default::default())),
        quota: Arc::new(Mutex::new(None)),
        size_upgrades: Arc::new(Mutex::new(HashMap::new())),
        size_waiters: Arc::new(Default::default()),
@@ -0,0 +1,327 @@
 //! Repairing photos whose capture time is when they were *imported* rather than
 //! when they were taken.
 //!
 //! A Google Photos Takeout whose metadata sidecars did not match — a localized
 //! `.supplemental-metadata` spelling, say — imports with no capture time at all,
 //! and the SDK then seals "now" into every revision. A decade of photos lands on
 //! one day.
 //!
 //! Proton has no API for editing a sealed capture time, so the repair is a
 //! rewrite: download the photo, upload it again with the capture time its file
 //! name implies, put the new copy back into the albums and favourites the old
 //! one was in, then **trash** (not delete) the original. Trash rather than
 //! delete so a bad run is recoverable from Proton's own trash for 30 days.
 //!
 //! A photo is a candidate only when its name carries a date that disagrees with
 //! its stored capture time by more than [`DRIFT`]. That is deliberately narrow:
 //! a photo whose name says nothing about its date is left alone, because there
 //! is nothing better to set it to.
 use std::sync::Arc;
 use std::sync::atomic::{AtomicBool, Ordering};
 use pdfs_core::control::{RedateSummary, TransferDirection};
 use pdfs_core::takeout::{capture_time_from_name, media_type_of};
 use pdfs_core::{CoreError, CoreResult};
 use proton_drive_rs::proton_sdk::ids::NodeUid;
 use proton_drive_rs::{PhotoTag, PhotoTagsUpdate, PhotoUploadMetadata};
 use tracing::{info, warn};
 use super::Core;
 use crate::parse_uid as parse_node_uid;
 use crate::transfers::CountingReader;
 /// How far a stored capture time may sit from the one the file name implies
 /// before the photo counts as mis-dated. A day, because a name usually carries
 /// only the date and the stored time carries a clock — and because a timezone
 /// can legitimately move a photo by hours.
 const DRIFT: i64 = 86_400;
 /// How many examples a report carries.
 const SAMPLES: usize = 10;
 /// The one re-date this daemon may be running, and how the last one ended.
 /// Process-global for the same reasons as the Takeout import's state: one run
 /// per daemon however many `Core` clones exist, and a front-end asking after it
 /// finished must still find the report.
 static REDATE: std::sync::LazyLock<parking_lot::Mutex<RedateState>> =
    std::sync::LazyLock::new(|| parking_lot::Mutex::new(RedateState::default()));
 #[derive(Default)]
 struct RedateState {
    running: bool,
    cancel: Option<Arc<AtomicBool>>,
    last: Option<RedateSummary>,
 }
 /// Whether a re-date is running, and the last one's report.
 pub(crate) fn redate_status() -> (bool, Option<RedateSummary>) {
    let state = REDATE.lock();
    (state.running, state.last.clone())
 }
 /// Ask the running re-date to stop. False when none is running.
 pub(crate) fn cancel_redate() -> bool {
    match &REDATE.lock().cancel {
        Some(flag) => {
            flag.store(true, Ordering::Relaxed);
            true
        }
        None => false,
    }
 }
 /// One photo to repair.
 struct Candidate {
    uid: NodeUid,
    name: String,
    /// The capture time it carries now.
    stored: i64,
    /// The capture time its name implies.
    wanted: i64,
    favorite: bool,
    /// Album node uids the original is filed under.
    albums: Vec<String>,
 }
 impl Core {
    /// Re-date mis-dated photos. Blocking; run on its own thread.
    ///
    /// `cancel` stops the run at the next photo boundary. A photo is only ever
    /// trashed after its replacement has uploaded, so a cancel — or a crash —
    /// can leave a duplicate, never a hole.
    pub(crate) fn redate_photos(
        &self,
        dry_run: bool,
        limit: Option<usize>,
        range: Option<(i64, i64)>,
        cancel: Arc<AtomicBool>,
    ) -> CoreResult<RedateSummary> {
        let job = self.transfers.begin_job("Fixing photo dates");
        job.detail("looking for mis-dated photos");
        let stored = self
            .db
            .photos_all()
            .map_err(|e| CoreError::internal(format!("read timeline: {e}")))?;
        let mut summary = RedateSummary {
            examined: stored.len(),
            dry_run,
            ..Default::default()
        };
        let mut candidates = Vec::new();
        for photo in stored {
            if let Some((from, to)) = range
                && !(from..to).contains(&photo.capture_time)
            {
                continue;
            }
            let Some(name) = photo.name.filter(|n| !n.is_empty()) else {
                continue;
            };
            let Some(wanted) = capture_time_from_name(&name) else {
                continue;
            };
            if (wanted - photo.capture_time).abs() <= DRIFT {
                continue;
            }
            let Some(uid) = parse_node_uid(&photo.uid) else {
                continue;
            };
            candidates.push(Candidate {
                uid,
                name,
                stored: photo.capture_time,
                wanted,
                favorite: photo.favorite,
                albums: self.db.albums_of_photo(&photo.uid).unwrap_or_default(),
            });
        }
        if let Some(limit) = limit {
            candidates.truncate(limit);
        }
        summary.candidates = candidates.len();
        // Sampled after the limit, so the examples are of photos the run would
        // actually touch.
        summary.samples = candidates
            .iter()
            .take(SAMPLES)
            .map(|c| (c.name.clone(), c.stored, c.wanted))
            .collect();
        job.set_total(candidates.len() as u64);
        info!(
            examined = summary.examined,
            candidates = summary.candidates,
            dry_run,
            "photo re-date scan complete"
        );
        if dry_run || candidates.is_empty() {
            return Ok(summary);
        }
        for candidate in candidates {
            if cancel.load(Ordering::Relaxed) || self.shutdown.is_stopping() {
                break;
            }
            job.detail(candidate.name.clone());
            if let Err(e) = self.redate_one(&candidate, &mut summary) {
                summary.failed += 1;
                warn!(name = candidate.name, error = %e, "cannot re-date photo");
            }
            job.step();
        }
        self.spawn_timeline_refresh();
        summary.cancelled = cancel.load(Ordering::Relaxed);
        Ok(summary)
    }
    /// Rewrite one photo at the capture time its name implies.
    ///
    /// Order is load-bearing: upload first, file the new copy, and only then
    /// trash the original. Every earlier step failing leaves the account exactly
    /// as it was.
    fn redate_one(&self, candidate: &Candidate, summary: &mut RedateSummary) -> CoreResult<()> {
        let photos = self.photos();
        let path = self.open_photo(&candidate.uid)?;
        let size = std::fs::metadata(&path)
            .map_err(|e| CoreError::internal(format!("stat {}: {e}", path.display())))?
            .len();
        let media_type = media_type_of(&candidate.name).unwrap_or("application/octet-stream");
        let guard =
            self.transfers
                .begin(candidate.name.clone(), "", TransferDirection::Upload, size);
        let file = std::fs::File::open(&path)
            .map_err(|e| CoreError::internal(format!("open {}: {e}", path.display())))?;
        let reader = CountingReader::new(std::io::BufReader::new(file), &guard);
        let metadata = PhotoUploadMetadata {
            capture_time: Some(candidate.wanted),
            ..Default::default()
        };
        let uploaded = self.rt.block_on(photos.upload_photo_from(
            &candidate.name,
            media_type,
            reader,
            size as i64,
            Vec::new(),
            metadata,
            false,
        ));
        drop(guard);
        let new_uid = uploaded.map_err(|e| CoreError::from_api(&e, "re-upload photo"))?;
        // Favourite and albums before the trash: a failure here leaves both
        // copies on the account, which is recoverable by hand. Losing the
        // original first would not be.
        if candidate.favorite {
            let update = PhotoTagsUpdate {
                node_uid: new_uid.clone(),
                tags_to_add: vec![PhotoTag::Favorite],
                tags_to_remove: Vec::new(),
            };
            if let Err(e) = self.rt.block_on(photos.update_photos(&[update])) {
                warn!(name = candidate.name, error = %e, "cannot re-favourite re-dated photo");
            }
        }
        for album in &candidate.albums {
            let Some(album_uid) = parse_node_uid(album) else {
                continue;
            };
            match self
                .rt
                .block_on(photos.add_photos_to_album(&album_uid, std::slice::from_ref(&new_uid)))
            {
                Ok(_) => summary.album_links += 1,
                Err(e) => {
                    warn!(name = candidate.name, error = %e, "cannot re-file re-dated photo")
                }
            }
        }
        let outcomes = self
            .rt
            .block_on(
                self.client
                    .trash_nodes(std::slice::from_ref(&candidate.uid)),
            )
            .map_err(|e| CoreError::from_api(&e, "trash the mis-dated original"))?;
        if let Some((_, Err(e))) = outcomes.into_iter().next() {
            return Err(CoreError::from_api(&e, "trash the mis-dated original"));
        }
        summary.redated += 1;
        summary.bytes += size;
        info!(
            name = candidate.name,
            from = candidate.stored,
            to = candidate.wanted,
            "photo re-dated"
        );
        Ok(())
    }
    /// Start a re-date on its own thread. Errors when one is already running.
    pub(crate) fn spawn_redate(
        &self,
        dry_run: bool,
        limit: Option<usize>,
        range: Option<(i64, i64)>,
    ) -> CoreResult<()> {
        let cancel = Arc::new(AtomicBool::new(false));
        {
            let mut state = REDATE.lock();
            if state.running {
                return Err(CoreError::conflict(
                    "a photo re-date is already running; wait for it to finish or cancel it",
                ));
            }
            state.running = true;
            state.cancel = Some(cancel.clone());
            state.last = None;
        }
        let core = self.clone();
        std::thread::spawn(move || {
            let outcome = core.redate_photos(dry_run, limit, range, cancel);
            let mut state = REDATE.lock();
            state.running = false;
            state.cancel = None;
            state.last = outcome.as_ref().ok().cloned();
            match &outcome {
                Ok(summary) => info!(
                    candidates = summary.candidates,
                    redated = summary.redated,
                    failed = summary.failed,
                    "photo re-date finished"
                ),
                Err(e) => warn!(error = %e, "photo re-date failed"),
            }
        });
        Ok(())
    }
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn a_uid_without_both_halves_is_not_a_node() {
        assert!(parse_node_uid("vol~link").is_some());
        assert!(parse_node_uid("vol~").is_none());
        assert!(parse_node_uid("~link").is_none());
        assert!(parse_node_uid("nothing").is_none());
    }
    #[test]
    fn only_a_disagreement_larger_than_a_day_counts() {
        // The name says 2023-02-19; a stored time inside that day is fine.
        let wanted = capture_time_from_name("IMG-20230219-WA0001.jpg").unwrap();
        assert!((wanted - (wanted + 3_600)).abs() <= DRIFT);
        // An import three years later is not.
        assert!((wanted - (wanted + 3 * 365 * 86_400)).abs() > DRIFT);
    }
 }
@@ -15,6 +15,7 @@ use pdfs_core::{CoreError, CoreResult};
 use tracing::debug;
 use crate::QUOTA_TTL;
 use proton_drive_rs::proton_sdk::crypto::VerificationStatus;
 use proton_drive_rs::proton_sdk::ids::NodeUid;
 use proton_drive_rs::{MemberRole, NodeKind};
@@ -47,6 +48,18 @@ fn shared_entry_of(core: &Core, n: Node) -> DirEntry {
        .map(role_to_str)
        .unwrap_or_default()
        .to_string();
    let invitation = n.membership.as_ref();
    let shared_by = invitation
        .and_then(|m| m.inviter_email.clone())
        .unwrap_or_default();
    let shared_at = invitation.and_then(|m| m.invite_time).unwrap_or(0);
    // Only a signature that is present and wrong is a warning. An invitation
    // that could not be checked — unsigned, or no keys for the claimed inviter —
    // is not evidence of forgery, and flagging every such share would teach the
    // user to ignore the flag.
    let shared_by_unverified = invitation
        .and_then(|m| m.inviter_verification)
        .is_some_and(|status| status == VerificationStatus::Failed);
    DirEntry {
        name: n.name,
        is_dir,
@@ -57,6 +70,9 @@ fn shared_entry_of(core: &Core, n: Node) -> DirEntry {
        path: core.rel_path_for_uid(&n.uid).unwrap_or_default(),
        uid: n.uid.to_string(),
        role,
        shared_by,
        shared_at,
        shared_by_unverified,
    }
 }
@@ -609,6 +625,7 @@ impl Core {
            items.push(SharedItem {
                uid: uid.to_string(),
                is_dir: n.is_folder(),
                modified: n.modification_time,
                name: n.name,
                path: self.rel_path_for_uid(&uid).unwrap_or_default(),
                member_count: members,
@@ -1120,6 +1120,8 @@ mod tests {
            photo: None,
            album: None,
            verification: Default::default(),
            direct_role: None,
            share_id: None,
        }
    }
@@ -1128,6 +1130,9 @@ mod tests {
            share_id: ShareId::from("share"),
            membership_id: ShareMembershipId::from("membership"),
            permissions,
            invite_time: None,
            inviter_email: None,
            inviter_verification: None,
        }
    }
@@ -368,6 +368,8 @@ mod tests {
            photo: None,
            album: None,
            verification: Default::default(),
            direct_role: None,
            share_id: None,
        }
    }
@@ -51,6 +51,8 @@ pub(crate) fn virtual_node(parent_uid: NodeUid, name: String, timestamp: i64) ->
        photo: None,
        album: None,
        verification: Default::default(),
        direct_role: None,
        share_id: None,
    }
 }
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 authors.workspace = true
 rust-version.workspace = true
 repository.workspace = true
 homepage.workspace = true
 description = "GTK4 desktop app, tray, and search launcher for the Proton Drive Linux client"
 [[bin]]
 name = "pdfs-tray"
@@ -24,6 +27,7 @@ tracing.workspace = true
 tracing-subscriber.workspace = true
 anyhow.workspace = true
 tokio.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 ksni = "0.2"
 gtk4 = { version = "0.9", features = ["v4_12"] }
@@ -22,6 +22,9 @@ fn main() {
    }
    println!("cargo:rerun-if-changed=resources/pdfs.gresource.xml");
    println!(
        "cargo:rerun-if-changed=resources/icons/scalable/actions/pdfs-build-thumbnails-symbolic.svg"
    );
    println!(
        "cargo:rerun-if-changed=resources/icons/scalable/actions/pdfs-folder-upload-symbolic.svg"
    );
@@ -0,0 +1,5 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16">
  <!-- Generate-thumbnails action: a picture frame with a sparkle. A single
       symbolic fill lets GTK recolour it with the surrounding control. -->
  <path fill="#222222" d="M 2,3 C 1.45,3 1,3.45 1,4 V 14 C 1,14.55 1.45,15 2,15 H 14 C 14.55,15 15,14.55 15,14 V 7 H 13 V 13 H 3 V 5 H 9 V 3 Z M 5,6 C 4.45,6 4,6.45 4,7 C 4,7.55 4.45,8 5,8 C 5.55,8 6,7.55 6,7 C 6,6.45 5.55,6 5,6 Z M 10,7 L 7.5,10 L 6,9 L 4,11.5 V 12 H 12 V 9 Z M 13,0 L 12.4,2.4 L 10,3 L 12.4,3.6 L 13,6 L 13.6,3.6 L 16,3 L 13.6,2.4 Z"/>
 </svg>
@@ -4,6 +4,7 @@
       icon-theme resource path at startup, so they resolve by name (and recolour
       with the theme) exactly like a stock symbolic icon. -->
  <gresource prefix="/de/nils/protondrivelinux/icons">
    <file preprocess="xml-stripblanks">scalable/actions/pdfs-build-thumbnails-symbolic.svg</file>
    <file preprocess="xml-stripblanks">scalable/actions/pdfs-folder-upload-symbolic.svg</file>
  </gresource>
 </gresources>
@@ -19,11 +19,12 @@ use pages::trash::*;
 use pages::verify::*;
 use widgets::details::*;
 use widgets::share_dialog::*;
 use widgets::thumbnails::*;
 use widgets::versions_dialog::*;
 use std::cell::{Cell, RefCell};
-use std::collections::{HashMap, HashSet, VecDeque};
+use std::collections::{BTreeMap, HashMap, HashSet, VecDeque};
 use std::path::{Path, PathBuf};
@@ -49,8 +50,8 @@ use pdfs_core::control::{
    ActivityEntry, ActivityKind, AlbumInfo, BookmarkInfo, DeviceInfo, DirEntry, ErrorKind,
    ImportSummary, InvitationInfo, JobItem, PhotoItem, PhotoKind, PublicLinkInfo, RefreshScope,
    Request, Response, RestorableFolder, RestoreItem, SearchHit, ShareEntry, ShareEntryKind,
-    SharedItem, SyncFolderInfo, SyncPhase, SyncProgress, TransferDirection, TransferItem,
+    SharedItem, SyncFolderInfo, SyncPhase, SyncProgress, ThumbnailBuildStatus, TransferDirection,
-    pending_summary, send,
+    TransferItem, pending_summary, send,
 };
 use pdfs_core::mounts::{MountAccess, MountKind, MountMode, MountSpec};
@@ -107,6 +108,10 @@ struct Ui {
    /// The sidebar/content split. Collapsed while signed out, so the login page
    /// owns the whole window and no destination is reachable without a session.
    nav: adw::NavigationSplitView,
    /// Shared thumbnails for ordinary image files outside the Photos gallery.
    /// One cache and request queue serves Files, search, Shared and Trash, so
    /// the same image is downloaded and decoded only once.
    pub(crate) file_thumbs: FileThumbnailState,
    // Per-page state. Each page module owns its own struct; `Ui` keeps only
    // what more than one page genuinely shares.
@@ -207,10 +212,15 @@ fn load_proton_theme() {
         .file-grid {{ padding: 6px; }}\n\
         .file-tile {{ padding: 8px; border-radius: 10px; }}\n\
         .file-tile:hover {{ background: alpha({PROTON_PURPLE}, 0.10); }}\n\
         .file-thumbnail {{ border-radius: 7px; }}\n\
         .file-badge {{ -gtk-icon-shadow: 0 1px 2px rgba(0, 0, 0, 0.5); }}\n\
         .badge-pinned {{ color: #f5c211; }}\n\
         .badge-cached {{ color: #2ec27e; }}\n\
         .badge-cloud {{ color: #9aa0a6; }}\n\
         .browser-statusbar {{ background-color: alpha(currentColor, 0.025); }}\n\
         scale.browser-status-meter trough, progressbar.browser-status-meter trough {{ min-width: 104px; }}\n\
         scale.browser-status-meter trough {{ min-height: 6px; }}\n\
         progressbar.browser-status-meter trough, progressbar.browser-status-meter progress {{ min-height: 6px; }}\n\
         .photo-viewer-window {{ background-color: #111014; }}\n\
         .viewer-top-bar {{ background: linear-gradient(to bottom, rgba(0, 0, 0, 0.75), rgba(0, 0, 0, 0)); padding: 10px 16px 28px 20px; color: white; }}\n\
         .viewer-title {{ font-weight: 700; font-size: 1.05rem; text-shadow: 0 1px 3px rgba(0, 0, 0, 0.9); color: white; }}\n\
@@ -345,6 +355,7 @@ fn build_window(app: &adw::Application) {
        mounted: RefCell::new(false),
        sidebar: sidebar_list.clone(),
        nav: split.clone(),
        file_thumbs: FileThumbnailState::new(),
        login: LoginState {
            email: login_widgets.0,
            password: login_widgets.1,
@@ -390,7 +401,15 @@ fn build_window(app: &adw::Application) {
            new_folder: browser_widgets.new_folder.clone(),
            upload: browser_widgets.upload.clone(),
            upload_folder: browser_widgets.upload_folder.clone(),
            build_thumbnails: browser_widgets.build_thumbnails.clone(),
            thumbnail_build_row: browser_widgets.thumbnail_build_row.clone(),
            thumbnail_progress: browser_widgets.thumbnail_progress.clone(),
            thumbnail_status: browser_widgets.thumbnail_status.clone(),
            thumbnail_poll: RefCell::new(None),
            thumbnail_build_running: Cell::new(false),
            thumbnail_cancel_pending: Cell::new(false),
            search_source: RefCell::new(None),
            load_generation: Cell::new(0),
            views: browser_widgets.views.clone(),
            bulk: browser_widgets.bulk.clone(),
            bulk_label: browser_widgets.bulk_label.clone(),
@@ -398,6 +417,13 @@ fn build_window(app: &adw::Application) {
            bulk_pin: browser_widgets.bulk_pin.clone(),
            bulk_unpin: browser_widgets.bulk_unpin.clone(),
            empty_actions: browser_widgets.empty_actions.clone(),
            summary: browser_widgets.summary.clone(),
            zoom: browser_widgets.zoom.clone(),
            grid_thumbnail_size: Cell::new(GRID_THUMB_DEFAULT),
            grid_tiles: RefCell::new(Vec::new()),
            quota_box: browser_widgets.quota_box.clone(),
            quota: browser_widgets.quota.clone(),
            quota_text: browser_widgets.quota_text.clone(),
        },
        details: DetailsState {
            details: browser_widgets.details,
@@ -458,7 +484,8 @@ fn build_window(app: &adw::Application) {
            decode_idle: Cell::new(false),
            thumb_source: RefCell::new(None),
            relayout_source: RefCell::new(None),
-            bound: RefCell::new(HashMap::new()),
+            bound: RefCell::new(BTreeMap::new()),
            list: gallery_widgets.list.clone(),
        },
        shared: SharedState {
            content: shared_widgets.content.clone(),
@@ -552,6 +579,7 @@ fn build_window(app: &adw::Application) {
        &browser_widgets.new_folder,
        &browser_widgets.upload,
        &browser_widgets.upload_folder,
        &browser_widgets.build_thumbnails,
    );
    wire_details(&ui);
    wire_search(&ui);
@@ -588,6 +616,10 @@ fn build_window(app: &adw::Application) {
    // network round-trip only happens on demand rather than on every refresh.
    let ui_nav = ui.clone();
    stack.connect_visible_child_name_notify(move |st| {
        // Rows from the page being left must not keep full-size image downloads
        // alive in the daemon. The page being entered establishes a fresh
        // thumbnail generation as it paints.
        cancel_file_thumbnails(&ui_nav);
        sync_sidebar(&ui_nav);
        match st.visible_child_name().as_deref() {
            Some("browser") => load_browser(&ui_nav),
@@ -914,7 +946,7 @@ fn toast_failure(ui: &Rc<Ui>, what: &str, message: &str, kind: ErrorKind) {
 fn build_primary_menu() -> gtk4::MenuButton {
    let menu = gio::Menu::new();
    menu.append(Some("Keyboard Shortcuts"), Some("win.shortcuts"));
-    menu.append(Some("About Proton Drive"), Some("win.about"));
+    menu.append(Some("About Proton Drive for Linux"), Some("win.about"));
    gtk4::MenuButton::builder()
        .icon_name("open-menu-symbolic")
        .tooltip_text("Main menu")
@@ -933,11 +965,17 @@ fn install_window_actions(window: &adw::ApplicationWindow) {
    let win = window.clone();
    about.connect_activate(move |_, _| {
        let dialog = adw::AboutDialog::builder()
-            .application_name("Proton Drive")
+            .application_name("Proton Drive for Linux")
-            .application_icon("folder-remote-symbolic")
+            .application_icon("io.narl.proton-drive-linux")
            .version(pdfs_core::config::APP_VERSION)
-            .developer_name("proton-drive-linux")
+            .developer_name("Nils Pukropp")
-            .comments("On-demand Proton Drive sync for Linux.")
+            .website("https://github.com/narrrl/proton-drive-linux")
            .issue_url("https://github.com/narrrl/proton-drive-linux/issues")
            .license_type(gtk4::License::MitX11)
            .comments(
                "Files-on-demand Proton Drive for the Linux desktop.\n\n\
                 Unofficial client — not affiliated with, endorsed by, or supported by Proton AG.",
            )
            .build();
        dialog.present(Some(&win));
    });
@@ -28,9 +28,21 @@ pub(crate) struct BrowserState {
    pub(crate) new_folder: gtk4::Button,
    pub(crate) upload: gtk4::Button,
    pub(crate) upload_folder: gtk4::Button,
    /// Starts a daemon-side recursive local-thumbnail build for [`Self::path`].
    pub(crate) build_thumbnails: gtk4::Button,
    pub(crate) thumbnail_build_row: gtk4::Box,
    pub(crate) thumbnail_progress: gtk4::ProgressBar,
    pub(crate) thumbnail_status: gtk4::Label,
    pub(crate) thumbnail_poll: RefCell<Option<glib::SourceId>>,
    pub(crate) thumbnail_build_running: Cell<bool>,
    pub(crate) thumbnail_cancel_pending: Cell<bool>,
    /// Pending debounce timer for the search box; replaced on every keystroke so
    /// only the last pause actually fires a [`Request::Search`].
    pub(crate) search_source: RefCell<Option<glib::SourceId>>,
    /// Identity of the newest folder/search request. Paths and queries can be
    /// requested repeatedly, so comparing their text alone cannot reject an
    /// older response that finishes after a manual refresh.
    pub(crate) load_generation: Cell<u64>,
    /// The grid/list view stack, read to find out which of the two selections is
    /// the one the user is actually working in.
    pub(crate) views: gtk4::Stack,
@@ -46,6 +58,17 @@ pub(crate) struct BrowserState {
    /// state is a place to act rather than a dead end. Hidden on every other
    /// status (a load error is not the moment to offer an upload).
    pub(crate) empty_actions: gtk4::Box,
    /// Dolphin-style bottom status bar: current listing counts, the icon-grid
    /// zoom value, and Proton account storage usage.
    pub(crate) summary: gtk4::Label,
    pub(crate) zoom: gtk4::Scale,
    pub(crate) grid_thumbnail_size: Cell<i32>,
    /// Weak references to realised grid cells. Zoom resizes only these visible,
    /// recycled surfaces instead of invalidating the whole list model.
    pub(crate) grid_tiles: RefCell<Vec<(glib::WeakRef<gtk4::Overlay>, glib::WeakRef<gtk4::Label>)>>,
    pub(crate) quota_box: gtk4::Box,
    pub(crate) quota: gtk4::ProgressBar,
    pub(crate) quota_text: gtk4::Label,
 }
 /// Idle pause after the last keystroke before a search query is sent, so typing
@@ -55,6 +78,13 @@ pub(crate) const SEARCH_DEBOUNCE: Duration = Duration::from_millis(250);
 /// Cap on search hits requested from the daemon.
 pub(crate) const SEARCH_LIMIT: usize = 200;
 /// Browser grid thumbnail size controlled by the bottom zoom slider. The
 /// default preserves the former fixed 72 px presentation.
 pub(crate) const GRID_THUMB_MIN: i32 = 48;
 pub(crate) const GRID_THUMB_MAX: i32 = 144;
 pub(crate) const GRID_THUMB_DEFAULT: i32 = 72;
 pub(crate) const GRID_THUMB_STEP: i32 = 8;
 /// The Files page: a Nautilus-style file manager. A back/breadcrumb header with
 /// a grid/list view toggle sits over a [`gtk4::Stack`] that swaps between an
 /// **icon grid** ([`gtk4::GridView`]) and a **column list** ([`gtk4::ColumnView`]
@@ -86,6 +116,15 @@ pub(crate) struct BrowserWidgets {
    pub(crate) new_folder: gtk4::Button,
    pub(crate) upload: gtk4::Button,
    pub(crate) upload_folder: gtk4::Button,
    pub(crate) build_thumbnails: gtk4::Button,
    pub(crate) thumbnail_build_row: gtk4::Box,
    pub(crate) thumbnail_progress: gtk4::ProgressBar,
    pub(crate) thumbnail_status: gtk4::Label,
    pub(crate) summary: gtk4::Label,
    pub(crate) zoom: gtk4::Scale,
    pub(crate) quota_box: gtk4::Box,
    pub(crate) quota: gtk4::ProgressBar,
    pub(crate) quota_text: gtk4::Label,
    pub(crate) refresh: gtk4::Button,
    /// Wraps the views + the details pane; the pane slides in on selection.
    pub(crate) split: adw::OverlaySplitView,
@@ -149,6 +188,12 @@ pub(crate) fn build_browser_page() -> (gtk4::Widget, BrowserWidgets) {
        .valign(gtk4::Align::Center)
        .build();
    upload_folder.add_css_class("flat");
    let build_thumbnails = gtk4::Button::builder()
        .icon_name("pdfs-build-thumbnails-symbolic")
        .tooltip_text("Build thumbnails in this folder and its subfolders")
        .valign(gtk4::Align::Center)
        .build();
    build_thumbnails.add_css_class("flat");
    // Linked grid/list toggle, top-right, Nautilus-style.
    let grid_toggle = gtk4::ToggleButton::builder()
@@ -178,12 +223,24 @@ pub(crate) fn build_browser_page() -> (gtk4::Widget, BrowserWidgets) {
    header.append(&back);
    header.append(&crumb_scroll);
    header.append(&refresh);
    header.append(&build_thumbnails);
    header.append(&new_folder);
    header.append(&upload);
    header.append(&upload_folder);
    header.append(&search);
    header.append(&toggles);
    let thumbnail_status = gtk4::Label::builder()
        .halign(gtk4::Align::Start)
        .ellipsize(gtk4::pango::EllipsizeMode::End)
        .build();
    thumbnail_status.add_css_class("caption");
    let thumbnail_progress = gtk4::ProgressBar::builder().hexpand(true).build();
    let thumbnail_build_row = gtk4::Box::new(gtk4::Orientation::Horizontal, 10);
    thumbnail_build_row.append(&thumbnail_status);
    thumbnail_build_row.append(&thumbnail_progress);
    thumbnail_build_row.set_visible(false);
    // Empty / loading / error surface, shown in place of the views.
    let retry = gtk4::Button::builder()
        .label("Retry")
@@ -314,17 +371,94 @@ pub(crate) fn build_browser_page() -> (gtk4::Widget, BrowserWidgets) {
        .child(&bulk_box)
        .build();
-    let inner = gtk4::Box::new(gtk4::Orientation::Vertical, 12);
+    // Mirror DolphinStatusBar's full-width order: contextual text (stretch 1),
-    inner.set_margin_top(12);
+    // "Zoom:", its slider, then capacity information. Both visible troughs use
-    inner.set_margin_bottom(12);
+    // the same CSS dimensions.
-    inner.set_margin_start(12);
+    let summary = gtk4::Label::builder()
-    inner.set_margin_end(12);
+        .label("Loading…")
-    inner.append(&header);
+        .halign(gtk4::Align::Start)
-    inner.append(&bulk);
+        .valign(gtk4::Align::Center)
-    inner.append(&split);
+        .ellipsize(gtk4::pango::EllipsizeMode::End)
        .hexpand(true)
        .build();
    let zoom_label = gtk4::Label::new(Some("Zoom:"));
    zoom_label.set_valign(gtk4::Align::Center);
    let zoom = gtk4::Scale::with_range(
        gtk4::Orientation::Horizontal,
        f64::from(GRID_THUMB_MIN),
        f64::from(GRID_THUMB_MAX),
        f64::from(GRID_THUMB_STEP),
    );
    zoom.set_value(f64::from(GRID_THUMB_DEFAULT));
    zoom.set_draw_value(false);
    zoom.set_valign(gtk4::Align::Center);
    zoom.set_tooltip_text(Some("Size: 72 pixels"));
    zoom.add_css_class("browser-status-meter");
    let quota = gtk4::ProgressBar::new();
    quota.set_hexpand(false);
    quota.set_valign(gtk4::Align::Center);
    quota.set_tooltip_text(Some("Proton account storage"));
    quota.add_css_class("browser-status-meter");
    let quota_text = gtk4::Label::builder()
        .label("Loading…")
        .halign(gtk4::Align::Start)
        .valign(gtk4::Align::Center)
        .margin_end(6)
        .tooltip_text("Proton account storage")
        .build();
    let quota_box = gtk4::Box::new(gtk4::Orientation::Horizontal, 4);
    quota_box.set_valign(gtk4::Align::Center);
    quota_box.append(&quota);
    quota_box.append(&quota_text);
    quota_box.set_visible(false);
    let status_bar = gtk4::Box::new(gtk4::Orientation::Horizontal, 4);
    status_bar.add_css_class("browser-statusbar");
    status_bar.set_margin_start(6);
    status_bar.set_margin_end(2);
    status_bar.append(&summary);
    status_bar.append(&zoom_label);
    status_bar.append(&zoom);
    status_bar.append(&quota_box);
    let zoom_label_for_view = zoom_label.clone();
    let zoom_for_view = zoom.clone();
    let content_for_view = content.clone();
    view_stack.connect_visible_child_name_notify(move |stack| {
        let visible = content_for_view.visible_child_name().as_deref() == Some("views")
            && stack.visible_child_name().as_deref() == Some("grid");
        zoom_label_for_view.set_visible(visible);
        zoom_for_view.set_visible(visible);
    });
    let zoom_label_for_content = zoom_label.clone();
    let zoom_for_content = zoom.clone();
    let view_for_content = view_stack.clone();
    content.connect_visible_child_name_notify(move |stack| {
        let visible = stack.visible_child_name().as_deref() == Some("views")
            && view_for_content.visible_child_name().as_deref() == Some("grid");
        zoom_label_for_content.set_visible(visible);
        zoom_for_content.set_visible(visible);
    });
    let body = gtk4::Box::new(gtk4::Orientation::Vertical, 12);
    body.set_vexpand(true);
    body.set_margin_top(12);
    body.set_margin_bottom(6);
    body.set_margin_start(12);
    body.set_margin_end(12);
    body.append(&header);
    body.append(&thumbnail_build_row);
    body.append(&bulk);
    body.append(&split);
    let page = gtk4::Box::new(gtk4::Orientation::Vertical, 0);
    page.append(&body);
    page.append(&gtk4::Separator::new(gtk4::Orientation::Horizontal));
    page.append(&status_bar);
    (
-        inner.upcast(),
+        page.upcast(),
        BrowserWidgets {
            model,
            back,
@@ -338,6 +472,15 @@ pub(crate) fn build_browser_page() -> (gtk4::Widget, BrowserWidgets) {
            new_folder,
            upload,
            upload_folder,
            build_thumbnails,
            thumbnail_build_row,
            thumbnail_progress,
            thumbnail_status,
            summary,
            zoom,
            quota_box,
            quota,
            quota_text,
            refresh,
            split,
            details,
@@ -653,23 +796,51 @@ pub(crate) fn wire_browser(ui: &Rc<Ui>, grid: &gtk4::GridView, column_view: &gtk
        load_browser(&ui_back);
    });
-    // Grid tiles: a big icon over an ellipsized name, with a right-click menu.
+    // Resize only realised grid cells. Rebuilding the whole model for every
    // slider step would repeatedly tear down selection state while the pointer
    // is still moving.
    let zoom = ui.browser.zoom.clone();
    let ui_zoom = ui.clone();
    let grid_zoom = grid.clone();
    zoom.connect_value_changed(move |scale| {
        let size = (scale.value().round() as i32).clamp(GRID_THUMB_MIN, GRID_THUMB_MAX);
        scale.set_tooltip_text(Some(&format!("Size: {size} pixels")));
        if ui_zoom.browser.grid_thumbnail_size.replace(size) == size {
            return;
        }
        ui_zoom
            .browser
            .grid_tiles
            .borrow_mut()
            .retain(|(thumbnail_ref, label_ref)| {
                let (Some(thumbnail), Some(label)) = (thumbnail_ref.upgrade(), label_ref.upgrade())
                else {
                    return false;
                };
                resize_grid_tile(&thumbnail, &label, size);
                true
            });
        grid_zoom.queue_resize();
    });
    // Grid tiles: a thumbnail over an ellipsized name, with a right-click menu.
    let factory = gtk4::SignalListItemFactory::new();
    factory.connect_setup({
        let ui = ui.clone();
        move |_, item| {
            let item = item.downcast_ref::<gtk4::ListItem>().unwrap();
-            let icon = gtk4::Image::builder().pixel_size(64).build();
+            let size = ui.browser.grid_thumbnail_size.get();
-            // Corner sync-state badge, overlaid on the big icon.
+            let thumbnail = file_thumbnail_widget(size, grid_fallback_size(size));
            // Keep the sync-state badge inside the thumbnail surface.
            let badge = gtk4::Image::builder()
                .pixel_size(18)
                .halign(gtk4::Align::End)
-                .valign(gtk4::Align::End)
+                .valign(gtk4::Align::Start)
                .margin_top(2)
                .margin_end(2)
                .build();
            badge.add_css_class("file-badge");
-            let overlay = gtk4::Overlay::new();
+            thumbnail.add_overlay(&badge);
            overlay.set_child(Some(&icon));
            overlay.add_overlay(&badge);
            // `WordChar` rather than the default `Word`: a name with no spaces
            // offers no word-break opportunity, so word wrapping cannot break it
            // at all and the label asks for its full natural width instead —
@@ -686,9 +857,13 @@ pub(crate) fn wire_browser(ui: &Rc<Ui>, grid: &gtk4::GridView, column_view: &gtk
                .wrap_mode(gtk4::pango::WrapMode::WordChar)
                .lines(2)
                .build();
            ui.browser
                .grid_tiles
                .borrow_mut()
                .push((thumbnail.downgrade(), label.downgrade()));
            let tile = gtk4::Box::new(gtk4::Orientation::Vertical, 4);
            tile.add_css_class("file-tile");
-            tile.append(&overlay);
+            tile.append(&thumbnail);
            tile.append(&label);
            attach_context_menu(&ui, item, &tile);
            attach_drag(&ui, item, &tile);
@@ -696,21 +871,29 @@ pub(crate) fn wire_browser(ui: &Rc<Ui>, grid: &gtk4::GridView, column_view: &gtk
            item.set_child(Some(&tile));
        }
    });
-    factory.connect_bind(|_, item| {
+    factory.connect_bind({
-        let item = item.downcast_ref::<gtk4::ListItem>().unwrap();
+        let ui = ui.clone();
-        let tile = item.child().and_downcast::<gtk4::Box>().unwrap();
+        move |_, item| {
-        let overlay = tile.first_child().and_downcast::<gtk4::Overlay>().unwrap();
+            let item = item.downcast_ref::<gtk4::ListItem>().unwrap();
-        let icon = overlay.first_child().and_downcast::<gtk4::Image>().unwrap();
+            let tile = item.child().and_downcast::<gtk4::Box>().unwrap();
-        let badge = overlay.last_child().and_downcast::<gtk4::Image>().unwrap();
+            let thumbnail = tile.first_child().and_downcast::<gtk4::Overlay>().unwrap();
-        let label = tile.last_child().and_downcast::<gtk4::Label>().unwrap();
+            let badge = thumbnail
-        let obj = item.item().and_downcast::<BoxedAnyObject>().unwrap();
+                .last_child()
-        let entry = obj.borrow::<DirEntry>();
+                .and_downcast::<gtk4::Image>()
-        icon.set_icon_name(Some(icon_base_for(&entry)));
+                .unwrap();
-        label.set_label(&entry.name);
+            let label = thumbnail
-        // The tile shows at most two lines of it, so the full name has to be
+                .next_sibling()
-        // reachable somehow.
+                .and_downcast::<gtk4::Label>()
-        label.set_tooltip_text(Some(&entry.name));
+                .unwrap();
-        apply_badge(&badge, &entry);
+            let obj = item.item().and_downcast::<BoxedAnyObject>().unwrap();
            let entry = obj.borrow::<DirEntry>();
            let size = ui.browser.grid_thumbnail_size.get();
            resize_grid_tile(&thumbnail, &label, size);
            bind_file_thumbnail(&ui, &thumbnail, &entry, false);
            label.set_label(&entry.name);
            label.set_tooltip_text(Some(&entry.name));
            apply_badge(&badge, &entry);
        }
    });
    grid.set_factory(Some(&factory));
@@ -740,15 +923,33 @@ pub(crate) fn wire_browser(ui: &Rc<Ui>, grid: &gtk4::GridView, column_view: &gtk
    });
 }
-/// Build the Name column: a small icon plus the (star-prefixed when pinned) name,
+fn resize_grid_tile(thumbnail: &gtk4::Overlay, label: &gtk4::Label, size: i32) {
-/// with the same right-click menu the grid tiles carry.
+    resize_file_thumbnail(thumbnail, size, grid_fallback_size(size));
    let name_width = (size / 6 + 1).clamp(8, 24);
    label.set_width_chars(name_width);
    label.set_max_width_chars(name_width);
 }
 fn grid_fallback_size(thumbnail_size: i32) -> i32 {
    (thumbnail_size * 8 / 9).clamp(24, thumbnail_size)
 }
 /// Build the Name column: a small thumbnail with its local-state badge overlaid,
 /// followed by the name and the same right-click menu the grid tiles carry.
 pub(crate) fn name_column(ui: &Rc<Ui>) -> gtk4::ColumnViewColumn {
    let factory = gtk4::SignalListItemFactory::new();
    factory.connect_setup({
        let ui = ui.clone();
        move |_, item| {
            let item = item.downcast_ref::<gtk4::ListItem>().unwrap();
-            let icon = gtk4::Image::builder().pixel_size(16).build();
+            let thumbnail = file_thumbnail_widget(28, 16);
            let badge = gtk4::Image::builder()
                .pixel_size(14)
                .halign(gtk4::Align::End)
                .valign(gtk4::Align::Start)
                .build();
            badge.add_css_class("file-badge");
            thumbnail.add_overlay(&badge);
            // Ellipsized so the Name column can be *narrower* than its longest
            // name. Without it the label's minimum width is the whole string,
            // the column inherits that minimum, and one long name pushes Size
@@ -757,30 +958,36 @@ pub(crate) fn name_column(ui: &Rc<Ui>) -> gtk4::ColumnViewColumn {
                .halign(gtk4::Align::Start)
                .ellipsize(gtk4::pango::EllipsizeMode::End)
                .build();
            let badge = gtk4::Image::builder().pixel_size(14).build();
            badge.add_css_class("file-badge");
            let cell = gtk4::Box::new(gtk4::Orientation::Horizontal, 8);
-            cell.append(&icon);
+            cell.append(&thumbnail);
            cell.append(&label);
            cell.append(&badge);
            attach_context_menu(&ui, item, &cell);
            attach_drag(&ui, item, &cell);
            attach_drop(&ui, item, &cell);
            item.set_child(Some(&cell));
        }
    });
-    factory.connect_bind(|_, item| {
+    factory.connect_bind({
-        let item = item.downcast_ref::<gtk4::ListItem>().unwrap();
+        let ui = ui.clone();
-        let cell = item.child().and_downcast::<gtk4::Box>().unwrap();
+        move |_, item| {
-        let icon = cell.first_child().and_downcast::<gtk4::Image>().unwrap();
+            let item = item.downcast_ref::<gtk4::ListItem>().unwrap();
-        let badge = cell.last_child().and_downcast::<gtk4::Image>().unwrap();
+            let cell = item.child().and_downcast::<gtk4::Box>().unwrap();
-        let label = icon.next_sibling().and_downcast::<gtk4::Label>().unwrap();
+            let thumbnail = cell.first_child().and_downcast::<gtk4::Overlay>().unwrap();
-        let obj = item.item().and_downcast::<BoxedAnyObject>().unwrap();
+            let badge = thumbnail
-        let entry = obj.borrow::<DirEntry>();
+                .last_child()
-        icon.set_icon_name(Some(&format!("{}-symbolic", icon_base_for(&entry))));
+                .and_downcast::<gtk4::Image>()
-        label.set_label(&entry.name);
+                .unwrap();
-        label.set_tooltip_text(Some(&entry.name));
+            let label = thumbnail
-        apply_badge(&badge, &entry);
+                .next_sibling()
                .and_downcast::<gtk4::Label>()
                .unwrap();
            let obj = item.item().and_downcast::<BoxedAnyObject>().unwrap();
            let entry = obj.borrow::<DirEntry>();
            bind_file_thumbnail(&ui, &thumbnail, &entry, true);
            label.set_label(&entry.name);
            label.set_tooltip_text(Some(&entry.name));
            apply_badge(&badge, &entry);
        }
    });
    let column = gtk4::ColumnViewColumn::new(Some("Name"), Some(factory));
    column.set_expand(true);
@@ -1254,6 +1461,7 @@ pub(crate) fn wire_browser_actions(
    new_folder: &gtk4::Button,
    upload: &gtk4::Button,
    upload_folder: &gtk4::Button,
    build_thumbnails: &gtk4::Button,
 ) {
    let ui_nf = ui.clone();
    new_folder.connect_clicked(move |_| prompt_new_folder(&ui_nf));
@@ -1261,6 +1469,229 @@ pub(crate) fn wire_browser_actions(
    upload.connect_clicked(move |_| prompt_upload(&ui_up));
    let ui_uf = ui.clone();
    upload_folder.connect_clicked(move |_| prompt_upload_folder(&ui_uf));
    let ui_thumbs = ui.clone();
    build_thumbnails.connect_clicked(move |_| {
        if ui_thumbs.browser.thumbnail_build_running.get() {
            cancel_thumbnail_build(&ui_thumbs);
        } else {
            start_thumbnail_build(&ui_thumbs);
        }
    });
 }
 const THUMBNAIL_BUILD_POLL: Duration = Duration::from_millis(500);
 /// Start the daemon's deliberate recursive job. Opportunistic requests for
 /// visible rows are cancelled first; the explicit job has its own lifetime and
 /// continues if the user navigates while watching its progress.
 fn start_thumbnail_build(ui: &Rc<Ui>) {
    if !*ui.mounted.borrow() {
        toast_error(
            ui,
            "Couldn't build thumbnails",
            "Proton Drive isn't connected.",
        );
        return;
    }
    cancel_file_thumbnails(ui);
    ui.browser.thumbnail_build_running.set(true);
    // Do not expose Cancel until the daemon has acknowledged Start; the two
    // requests use separate control connections and could otherwise reorder.
    ui.browser.thumbnail_cancel_pending.set(true);
    repaint_thumbnail_build_action(ui, true);
    ui.browser.thumbnail_build_row.set_visible(true);
    ui.browser.thumbnail_progress.set_fraction(0.0);
    ui.browser
        .thumbnail_status
        .set_label("Starting thumbnail build…");
    let path = ui.browser.path.borrow().clone();
    let rx = spawn_request(
        ui.dirs.control_socket(),
        Request::StartThumbnailBuild { path },
    );
    let ui = ui.clone();
    glib::spawn_future_local(async move {
        match rx.recv().await {
            Ok(Ok(Response::ThumbnailBuild { status })) => {
                ui.browser.thumbnail_cancel_pending.set(false);
                repaint_thumbnail_build(&ui, &status);
            }
            Ok(Ok(Response::Error { message, kind })) => {
                thumbnail_build_failed(&ui);
                toast_failure(&ui, "Couldn't build thumbnails", &message, kind);
            }
            _ => {
                let message = "The mount service didn't respond.";
                thumbnail_build_failed(&ui);
                toast_error(&ui, "Couldn't build thumbnails", message);
            }
        }
    });
 }
 fn cancel_thumbnail_build(ui: &Rc<Ui>) {
    if ui.browser.thumbnail_cancel_pending.replace(true) {
        return;
    }
    ui.browser.build_thumbnails.set_sensitive(false);
    ui.browser
        .thumbnail_status
        .set_label("Stopping thumbnail build…");
    let rx = spawn_request(ui.dirs.control_socket(), Request::CancelThumbnailBuild);
    let ui = ui.clone();
    glib::spawn_future_local(async move {
        match rx.recv().await {
            Ok(Ok(Response::ThumbnailBuild { status })) if !status.running => {
                repaint_thumbnail_build(&ui, &status)
            }
            Ok(Ok(Response::ThumbnailBuild { .. })) => schedule_thumbnail_build_poll(&ui),
            Ok(Ok(Response::Error { message, kind })) => {
                thumbnail_cancel_failed(&ui);
                toast_failure(&ui, "Couldn't cancel thumbnail build", &message, kind);
            }
            _ => {
                thumbnail_cancel_failed(&ui);
                toast_error(
                    &ui,
                    "Couldn't cancel thumbnail build",
                    "The mount service didn't respond.",
                );
            }
        }
    });
 }
 fn thumbnail_cancel_failed(ui: &Rc<Ui>) {
    ui.browser.thumbnail_cancel_pending.set(false);
    ui.browser.thumbnail_build_running.set(true);
    repaint_thumbnail_build_action(ui, true);
    schedule_thumbnail_build_poll(ui);
 }
 fn schedule_thumbnail_build_poll(ui: &Rc<Ui>) {
    if let Some(source) = ui.browser.thumbnail_poll.borrow_mut().take() {
        source.remove();
    }
    let ui_poll = ui.clone();
    let source = glib::timeout_add_local_once(THUMBNAIL_BUILD_POLL, move || {
        ui_poll.browser.thumbnail_poll.borrow_mut().take();
        let rx = spawn_request(ui_poll.dirs.control_socket(), Request::ThumbnailBuildStatus);
        let ui_result = ui_poll.clone();
        glib::spawn_future_local(async move {
            match rx.recv().await {
                Ok(Ok(Response::ThumbnailBuild { status })) => {
                    repaint_thumbnail_build(&ui_result, &status)
                }
                Ok(Ok(Response::Error { message, .. })) => {
                    thumbnail_build_failed(&ui_result);
                    toast_error(&ui_result, "Thumbnail build stopped", &message);
                }
                _ => {
                    thumbnail_build_failed(&ui_result);
                    toast_error(
                        &ui_result,
                        "Thumbnail build stopped",
                        "The mount service stopped reporting thumbnail progress.",
                    );
                }
            }
        });
    });
    *ui.browser.thumbnail_poll.borrow_mut() = Some(source);
 }
 fn repaint_thumbnail_build(ui: &Rc<Ui>, status: &ThumbnailBuildStatus) {
    ui.browser
        .thumbnail_build_row
        .set_visible(show_thumbnail_build_progress(status));
    let root = if status.path.is_empty() {
        "Proton Drive"
    } else {
        &status.path
    };
    let text = if status.scanning {
        ui.browser.thumbnail_progress.pulse();
        format!(
            "Scanning {root}… {} folders, {} images",
            status.folders_scanned, status.images_found
        )
    } else if status.running {
        let fraction = if status.images_found == 0 {
            0.0
        } else {
            status.completed as f64 / status.images_found as f64
        };
        ui.browser
            .thumbnail_progress
            .set_fraction(fraction.clamp(0.0, 1.0));
        format!(
            "Building thumbnails in {root}… {} of {}",
            status.completed, status.images_found
        )
    } else {
        ui.browser.thumbnail_progress.set_fraction(1.0);
        let available = status.completed.saturating_sub(status.failed);
        match status.failed {
            0 => format!("Thumbnails ready for {available} images in {root}"),
            failed => {
                format!("Thumbnails ready for {available} images in {root}; {failed} unavailable")
            }
        }
    };
    let text = match status.message.as_deref() {
        Some(message) => format!("{text}. {message}"),
        None => text,
    };
    ui.browser.thumbnail_status.set_label(&text);
    ui.browser.thumbnail_status.set_tooltip_text(Some(&text));
    if status.running {
        ui.browser.thumbnail_build_running.set(true);
        repaint_thumbnail_build_action(ui, true);
        schedule_thumbnail_build_poll(ui);
    } else {
        ui.browser.thumbnail_build_running.set(false);
        ui.browser.thumbnail_cancel_pending.set(false);
        repaint_thumbnail_build_action(ui, false);
        if ui.stack.visible_child_name().as_deref() == Some("browser") {
            reload_listing(ui);
        }
    }
 }
 /// The progress row is transient: once the daemon reports completion, both its
 /// label and bar leave the browser instead of retaining a stale success state.
 fn show_thumbnail_build_progress(status: &ThumbnailBuildStatus) -> bool {
    status.running
 }
 fn repaint_thumbnail_build_action(ui: &Rc<Ui>, running: bool) {
    ui.browser.build_thumbnails.set_icon_name(if running {
        "process-stop-symbolic"
    } else {
        "pdfs-build-thumbnails-symbolic"
    });
    ui.browser
        .build_thumbnails
        .set_tooltip_text(Some(if running {
            "Cancel thumbnail build"
        } else {
            "Build thumbnails in this folder and its subfolders"
        }));
    ui.browser.build_thumbnails.set_sensitive(
        *ui.mounted.borrow() && (!running || !ui.browser.thumbnail_cancel_pending.get()),
    );
 }
 fn thumbnail_build_failed(ui: &Rc<Ui>) {
    ui.browser.thumbnail_build_running.set(false);
    ui.browser.thumbnail_cancel_pending.set(false);
    repaint_thumbnail_build_action(ui, false);
    ui.browser.thumbnail_build_row.set_visible(false);
    ui.browser.thumbnail_progress.set_fraction(0.0);
    ui.browser.thumbnail_status.set_label("");
    ui.browser.thumbnail_status.set_tooltip_text(None);
 }
 /// Send a mutating request (rename / move / delete / mkdir / upload, or a trash
@@ -1666,9 +2097,13 @@ pub(crate) fn format_modified(secs: i64) -> String {
 /// Request the current browser directory from the daemon and repaint both views.
 pub(crate) fn load_browser(ui: &Rc<Ui>) {
    cancel_file_thumbnails(ui);
    let generation = ui.browser.load_generation.get().wrapping_add(1);
    ui.browser.load_generation.set(generation);
    let path = ui.browser.path.borrow().clone();
    repaint_crumb(ui, &path);
    ui.browser.back.set_sensitive(!path.is_empty());
    ui.browser.summary.set_label("Loading…");
    // Drop the previous folder's rows up front: a slow reply must not leave stale
    // entries visible, where clicking one would open with a wrong relative path.
@@ -1693,7 +2128,7 @@ pub(crate) fn load_browser(ui: &Rc<Ui>) {
        // The user may have navigated on while this folder was loading. A stale
        // out-of-order reply must not repaint rows for a folder we've left, or
        // the breadcrumb and the grid would disagree.
-        if *ui.browser.path.borrow() != path {
+        if ui.browser.load_generation.get() != generation || *ui.browser.path.borrow() != path {
            return;
        }
        match result {
@@ -1714,6 +2149,7 @@ pub(crate) fn load_browser(ui: &Rc<Ui>) {
 /// (which restarts the service) wouldn't help and isn't offered.
 pub(crate) fn browser_failed(ui: &Rc<Ui>, message: &str, kind: ErrorKind) {
    ui.browser.model.remove_all();
    ui.browser.summary.set_label("Folder unavailable");
    browser_status(
        ui,
        "dialog-warning-symbolic",
@@ -1730,6 +2166,7 @@ pub(crate) fn browser_failed(ui: &Rc<Ui>, message: &str, kind: ErrorKind) {
 /// once the systemd mount comes up but a real failure stays visible.
 pub(crate) fn browser_unreachable(ui: &Rc<Ui>) {
    if service::is_failed() || !service::is_active() {
        ui.browser.summary.set_label("Not connected");
        browser_status(
            ui,
            "network-offline-symbolic",
@@ -1739,6 +2176,7 @@ pub(crate) fn browser_unreachable(ui: &Rc<Ui>) {
        );
        return;
    }
    ui.browser.summary.set_label("Connecting…");
    browser_status(
        ui,
        "folder-remote-symbolic",
@@ -1759,6 +2197,15 @@ pub(crate) fn browser_unreachable(ui: &Rc<Ui>) {
 /// which refreshes both the grid and the column list.
 pub(crate) fn repaint_browser(ui: &Rc<Ui>, entries: &[DirEntry]) {
    ui.browser.model.remove_all();
    ui.browser.summary.set_label(&listing_summary(
        entries.iter().filter(|entry| !entry.is_dir).count(),
        entries.iter().filter(|entry| entry.is_dir).count(),
        entries
            .iter()
            .filter(|entry| !entry.is_dir)
            .map(|entry| entry.size)
            .sum(),
    ));
    if entries.is_empty() {
        browser_status(
            ui,
@@ -1810,7 +2257,11 @@ pub(crate) fn wire_search(ui: &Rc<Ui>) {
 /// views, reusing the same row model so click-to-open and pin work unchanged
 /// (each hit carries its full path; see [`entry_rel`]).
 pub(crate) fn run_search(ui: &Rc<Ui>, query: &str) {
    cancel_file_thumbnails(ui);
    let generation = ui.browser.load_generation.get().wrapping_add(1);
    ui.browser.load_generation.set(generation);
    ui.browser.model.remove_all();
    ui.browser.summary.set_label("Searching…");
    browser_status(
        ui,
        "system-search-symbolic",
@@ -1835,7 +2286,9 @@ pub(crate) fn run_search(ui: &Rc<Ui>, query: &str) {
        // The box may have been cleared or typed past while the reply was in
        // flight; if the query no longer matches, a fresher load/search already
        // owns the model — drop this stale, possibly out-of-order result.
-        if ui.browser.search.text().trim() != query {
+        if ui.browser.load_generation.get() != generation
            || ui.browser.search.text().trim() != query
        {
            return;
        }
        match result {
@@ -1856,6 +2309,17 @@ pub(crate) fn run_search(ui: &Rc<Ui>, query: &str) {
 /// handlers already understand.
 pub(crate) fn repaint_search(ui: &Rc<Ui>, hits: &[SearchHit]) {
    ui.browser.model.remove_all();
    let counts = listing_summary(
        hits.iter().filter(|hit| !hit.is_dir).count(),
        hits.iter().filter(|hit| hit.is_dir).count(),
        hits.iter()
            .filter(|hit| !hit.is_dir)
            .map(|hit| hit.size)
            .sum(),
    );
    ui.browser
        .summary
        .set_label(&format!("{counts} — search results"));
    if hits.is_empty() {
        browser_status(
            ui,
@@ -1881,6 +2345,9 @@ pub(crate) fn repaint_search(ui: &Rc<Ui>, hits: &[SearchHit]) {
            uid: h.uid.clone(),
            path: h.path.clone(),
            role: String::new(),
            shared_by: String::new(),
            shared_at: 0,
            shared_by_unverified: false,
        })
        .collect();
    entries.sort_by(|a, b| {
@@ -1892,3 +2359,47 @@ pub(crate) fn repaint_search(ui: &Rc<Ui>, hits: &[SearchHit]) {
        ui.browser.model.append(&BoxedAnyObject::new(entry));
    }
 }
 fn listing_summary(files: usize, folders: usize, file_bytes: u64) -> String {
    let file_word = if files == 1 { "file" } else { "files" };
    let folder_word = if folders == 1 { "folder" } else { "folders" };
    match (folders, files) {
        (0, 0) => "0 folders, 0 files".to_string(),
        (_, 0) => format!("{folders} {folder_word}"),
        (0, _) => format!("{files} {file_word} ({})", human_bytes(file_bytes)),
        _ => format!(
            "{folders} {folder_word}, {files} {file_word} ({})",
            human_bytes(file_bytes)
        ),
    }
 }
 #[cfg(test)]
 mod tests {
    use super::{listing_summary, show_thumbnail_build_progress};
    use pdfs_core::control::ThumbnailBuildStatus;
    #[test]
    fn listing_summary_matches_dolphin_order_and_wording() {
        assert_eq!(listing_summary(0, 0, 0), "0 folders, 0 files");
        assert_eq!(listing_summary(0, 2, 0), "2 folders");
        assert_eq!(listing_summary(1, 0, 1024), "1 file (1.0 KiB)");
        assert_eq!(listing_summary(3, 1, 3072), "1 folder, 3 files (3.0 KiB)");
    }
    #[test]
    fn thumbnail_progress_disappears_when_build_finishes() {
        let mut status = ThumbnailBuildStatus {
            running: true,
            scanning: true,
            ..Default::default()
        };
        assert!(show_thumbnail_build_progress(&status));
        status.scanning = false;
        assert!(show_thumbnail_build_progress(&status));
        status.running = false;
        assert!(!show_thumbnail_build_progress(&status));
    }
 }
@@ -5,8 +5,12 @@ pub(crate) struct GalleryState {
    /// Every photo loaded so far, newest first — the order the lightbox's
    /// prev/next walks. The visible day sections are derived from this.
    pub(crate) model: gio::ListStore,
-    /// The day sections rendered by the Photos ListView, rebuilt from
+    /// The Photos ListView's own model: one item per *rendered row* — a day
-    /// [`Self::model`] by [`repaint_gallery`].
+    /// heading, or one row of that day's tile grid — rebuilt from
    /// [`Self::model`] by [`repaint_gallery`]. Rows rather than whole days
    /// because the ListView only realises what is on screen, and a day holding
    /// 1,600 photos (a Takeout import lands one) would otherwise be 1,600
    /// widgets built in a single bind.
    pub(crate) groups: gio::ListStore,
    /// Target tile edge in px, retuned by Ctrl+scroll / Ctrl+± (see
    /// [`zoom_gallery`]). The grid fits as many square tiles of about this size
@@ -110,11 +114,14 @@ pub(crate) struct GalleryState {
    /// re-flow, replaced on each new trigger so only the last one fires.
    pub(crate) thumb_source: RefCell<Option<glib::SourceId>>,
    pub(crate) relayout_source: RefCell<Option<glib::SourceId>>,
-    /// The day sections currently realised by the ListView, by their index in
+    /// The rows currently realised by the ListView, as row index -> the uid of
-    /// [`Self::groups`]. A resize or a zoom step re-flows these in place —
+    /// its first photo (absent for a heading row). A resize or a zoom step
-    /// rebuilding the ListStore instead would reset the scroll position out from
+    /// changes how many tiles fit per row, so the row model has to be rebuilt —
-    /// under the user.
+    /// this is what lets the rebuild put the user back where they were.
-    pub(crate) bound: RefCell<HashMap<u32, gtk4::Box>>,
+    pub(crate) bound: RefCell<BTreeMap<u32, Option<String>>>,
    /// The ListView itself, so a rebuild can scroll back to the row the user was
    /// looking at.
    pub(crate) list: gtk4::ListView,
 }
 /// How many photos to pull per [`Request::PhotosTimeline`] page.
@@ -158,13 +165,71 @@ pub(crate) const RELAYOUT_DEBOUNCE: Duration = Duration::from_millis(80);
 /// One day-section of the photos timeline: a heading plus the photos captured
 /// that day, in timeline order. Built from the flat [`Ui::gallery_model`] by
-/// [`group_photos`] and rendered as one [`gtk4::ListView`] row.
+/// [`group_photos`], then flattened into [`GalleryRow`]s for rendering.
 pub(crate) struct PhotoGroup {
    /// "Today", "Yesterday", or e.g. "3 June 2026".
    pub(crate) heading: String,
    pub(crate) photos: Vec<PhotoItem>,
 }
 /// One item of the ListView's model — the unit the gallery virtualises at.
 ///
 /// A whole day is *not* one item: a Google Photos Takeout drops thousands of
 /// photos onto a single date, and one ListView item per day means GTK builds
 /// every one of those tiles in one bind, on the main thread, before the row can
 /// be shown. Splitting the day into its grid rows keeps a bind to a handful of
 /// widgets no matter how big the day is.
 pub(crate) enum GalleryRow {
    /// A day heading: "Today", "3 June 2026".
    Heading(String),
    /// One row of a day's grid, already laid out to the current width and zoom.
    Tiles {
        photos: Vec<PhotoItem>,
        edge: i32,
        /// True for the last row of its day, which carries the section's bottom
        /// margin so days stay visually separated.
        last: bool,
    },
 }
 impl GalleryRow {
    /// The uid of the row's first photo, or `None` for a heading — the anchor a
    /// relayout scrolls back to.
    fn anchor(&self) -> Option<String> {
        match self {
            GalleryRow::Heading(_) => None,
            GalleryRow::Tiles { photos, .. } => photos.first().map(|p| p.uid.clone()),
        }
    }
    /// Whether re-rendering `self` would produce exactly what `other` shows —
    /// the test [`repaint_gallery`] diffs on, so appending a page only touches
    /// the rows that actually changed.
    fn same_as(&self, other: &GalleryRow) -> bool {
        match (self, other) {
            (GalleryRow::Heading(a), GalleryRow::Heading(b)) => a == b,
            (
                GalleryRow::Tiles {
                    photos: a,
                    edge: ae,
                    last: al,
                },
                GalleryRow::Tiles {
                    photos: b,
                    edge: be,
                    last: bl,
                },
            ) => {
                ae == be
                    && al == bl
                    && a.len() == b.len()
                    && a.iter().zip(b).all(|(x, y)| x.uid == y.uid)
            }
            _ => false,
        }
    }
 }
 /// The widgets [`build_gallery_page`] hands back to [`build_window`].
 pub(crate) struct GalleryWidgets {
    /// Flat, newest-first list of every loaded photo. Backs the lightbox's
@@ -611,40 +676,64 @@ pub(crate) fn wire_gallery(ui: &Rc<Ui>, list: &gtk4::ListView, scroll: &gtk4::Sc
    let factory = gtk4::SignalListItemFactory::new();
    factory.connect_setup(|_, item| {
        let item = item.downcast_ref::<gtk4::ListItem>().unwrap();
-        let section = gtk4::Box::new(gtk4::Orientation::Vertical, 8);
+        // One container for both row kinds: the bind fills it with either a
-        section.set_margin_bottom(16);
+        // heading label or a strip of tiles. The alternative — two factories, or
-        let heading = gtk4::Label::builder().halign(gtk4::Align::Start).build();
+        // a Stack per row — buys nothing, since a row's children are rebuilt on
-        heading.add_css_class("heading");
+        // bind either way.
-        heading.add_css_class("gallery-day");
+        let row = gtk4::Box::new(gtk4::Orientation::Horizontal, TILE_GAP);
-        section.append(&heading);
+        row.set_halign(gtk4::Align::Start);
-        item.set_child(Some(&section));
+        item.set_child(Some(&row));
        item.set_activatable(false);
    });
    let ui_bind = ui.clone();
    factory.connect_bind(move |_, item| {
        let item = item.downcast_ref::<gtk4::ListItem>().unwrap();
-        let section = item.child().and_downcast::<gtk4::Box>().unwrap();
+        let row_box = item.child().and_downcast::<gtk4::Box>().unwrap();
        let obj = item.item().and_downcast::<BoxedAnyObject>().unwrap();
-        let group = obj.borrow::<PhotoGroup>();
+        let row = obj.borrow::<GalleryRow>();
-        let heading = section.first_child().and_downcast::<gtk4::Label>().unwrap();
+        while let Some(child) = row_box.first_child() {
-        heading.set_label(&group.heading);
+            row_box.remove(&child);
-
+        }
-        fill_section(&ui_bind, &section, &group.photos);
+        match &*row {
-        // Remember the realised section so a learned aspect ratio or a resize can
+            GalleryRow::Heading(heading) => {
-        // re-justify it in place, without rebuilding the ListStore (which would
+                row_box.set_margin_top(16);
-        // yank the scroll position back to the top).
+                row_box.set_margin_bottom(8);
                let label = gtk4::Label::builder()
                    .label(heading)
                    .halign(gtk4::Align::Start)
                    .build();
                label.add_css_class("heading");
                label.add_css_class("gallery-day");
                row_box.append(&label);
            }
            GalleryRow::Tiles { photos, edge, last } => {
                row_box.set_margin_top(0);
                // The last row of a day carries the gap to the next heading.
                row_box.set_margin_bottom(if *last { 8 } else { TILE_GAP });
                for photo in photos {
                    row_box.append(&photo_tile(
                        &ui_bind,
                        Tile {
                            photo: photo.clone(),
                            edge: *edge,
                        },
                    ));
                }
                schedule_thumbs(&ui_bind);
            }
        }
        ui_bind
            .gallery
            .bound
            .borrow_mut()
-            .insert(item.position(), section);
+            .insert(item.position(), row.anchor());
    });
-    // ListView recycles section widgets, so a scrolled-away day must give up its
+    // ListView recycles row widgets, so a scrolled-away row must give up its
-    // claim on the widgets — otherwise a thumbnail landing late would paint into
+    // claim on them — otherwise a thumbnail landing late would paint into a tile
-    // a tile that now shows a different day.
+    // that now shows a different photo.
    let ui_unbind = ui.clone();
    factory.connect_unbind(move |_, item| {
        let item = item.downcast_ref::<gtk4::ListItem>().unwrap();
@@ -653,10 +742,11 @@ pub(crate) fn wire_gallery(ui: &Rc<Ui>, list: &gtk4::ListView, scroll: &gtk4::Sc
            .bound
            .borrow_mut()
            .remove(&item.position());
-        if let Some(obj) = item.item().and_downcast::<BoxedAnyObject>() {
+        if let Some(obj) = item.item().and_downcast::<BoxedAnyObject>()
-            let group = obj.borrow::<PhotoGroup>();
+            && let GalleryRow::Tiles { photos, .. } = &*obj.borrow::<GalleryRow>()
        {
            let mut wanted = ui_unbind.gallery.thumb_wanted.borrow_mut();
-            for photo in &group.photos {
+            for photo in photos {
                wanted.remove(&photo.uid);
            }
        }
@@ -917,34 +1007,6 @@ pub(crate) fn plan_grid(target: i32, width: i32) -> (usize, i32) {
    (columns, edge)
 }
 /// (Re)build a bound day-section's tiles: lay this day's photos out to the
 /// current content width and hand each tile whatever thumbnail is already in
 /// memory, queueing the rest. Replaces the section's rows in place, leaving the
 /// heading — so a re-flow never touches the ListView's model or scroll.
 pub(crate) fn fill_section(ui: &Rc<Ui>, section: &gtk4::Box, photos: &[PhotoItem]) {
    let Some(heading) = section.first_child() else {
        return;
    };
    while let Some(old) = heading.next_sibling() {
        section.remove(&old);
    }
    let width = gallery_width(ui);
    let rows = gtk4::Box::new(gtk4::Orientation::Vertical, TILE_GAP);
    for row in grid_rows(ui, photos, width) {
        let row_box = gtk4::Box::new(gtk4::Orientation::Horizontal, TILE_GAP);
        // A short last row stays left-aligned at the same tile size rather than
        // stretching: an even grid is the whole point of the square layout.
        row_box.set_halign(gtk4::Align::Start);
        for tile in row {
            row_box.append(&photo_tile(ui, tile));
        }
        rows.append(&row_box);
    }
    section.append(&rows);
    schedule_thumbs(ui);
 }
 /// The width the grid is laid out to: the ListView's own width, less a couple of
 /// px so a rounding error can't push a row into a horizontal overflow.
 /// Falls back to a sane guess before the first allocation.
@@ -1238,27 +1300,35 @@ pub(crate) fn schedule_relayout(ui: &Rc<Ui>) {
    *ui.gallery.relayout_source.borrow_mut() = Some(source);
 }
-/// Rebuild the tiles of the day sections currently on screen, at the current
+/// Re-flow the timeline at the current width and zoom.
-/// width and zoom. Sections that are *not* realised need no work: they lay
+///
-/// themselves out against the current state when the ListView binds them.
+/// A different column count means different rows, so unlike the old
 /// section-per-day model there is nothing to patch in place — the row model is
 /// rebuilt. What that would cost the user is their scroll position, so the
 /// topmost realised row's first photo is remembered and scrolled back to.
 pub(crate) fn relayout_gallery(ui: &Rc<Ui>) {
-    let bound: Vec<(u32, gtk4::Box)> = ui
+    let anchor: Option<String> = ui.gallery.bound.borrow().values().flatten().next().cloned();
-        .gallery
+    repaint_gallery(ui);
-        .bound
+    let Some(anchor) = anchor else { return };
-        .borrow()
+    let Some(row) = row_of_photo(&ui.gallery.groups, &anchor) else {
-        .iter()
+        return;
-        .map(|(pos, section)| (*pos, section.clone()))
+    };
-        .collect();
+    ui.gallery
-    for (pos, section) in bound {
+        .list
-        let Some(obj) = ui.gallery.groups.item(pos) else {
+        .scroll_to(row, gtk4::ListScrollFlags::empty(), None);
-            continue;
+}
-        };
+
-        let Some(boxed) = obj.downcast_ref::<BoxedAnyObject>() else {
+/// Which row of the rendered model holds `uid`, if any.
-            continue;
+fn row_of_photo(store: &gio::ListStore, uid: &str) -> Option<u32> {
-        };
+    (0..store.n_items()).find(|i| {
-        let photos = boxed.borrow::<PhotoGroup>().photos.clone();
+        store
-        fill_section(ui, &section, &photos);
+            .item(*i)
-    }
+            .and_downcast::<BoxedAnyObject>()
            .is_some_and(|obj| match &*obj.borrow::<GalleryRow>() {
                GalleryRow::Heading(_) => false,
                GalleryRow::Tiles { photos, .. } => photos.iter().any(|p| p.uid == uid),
            })
    })
 }
 /// Step the tile size by `delta` px and re-flow, clamped to the zoom range.
@@ -1276,46 +1346,75 @@ pub(crate) fn set_gallery_tile(ui: &Rc<Ui>, tile: i32) {
    schedule_relayout(ui);
 }
-/// Rebuild the day sections from the flat photo model. The timeline arrives
+/// Rebuild the ListView's row model from the flat photo model: each day becomes
-/// newest-first, so photos of the same day are already contiguous — one pass
+/// a heading row followed by its grid rows, laid out to the current width and
-/// splits them.
+/// zoom.
 ///
-/// The groups are diffed into the existing store rather than replacing it: a
+/// The rows are diffed into the existing store rather than replacing it: a "load
-/// "load more" only really changes the last day (the one the new page continues)
+/// more" only really changes the last day (the one the new page continues) and
-/// and appends after it, and clearing the store instead would scroll the user
+/// appends after it, and clearing the store instead would scroll the user back
-/// back to the top of the timeline at the exact moment they asked for more.
+/// to the top of the timeline at the exact moment they asked for more.
 pub(crate) fn repaint_gallery(ui: &Rc<Ui>) {
-    let groups = group_photos(&ui.gallery.model);
+    let rows = build_rows(ui);
    let store = &ui.gallery.groups;
-    for (i, group) in groups.iter().enumerate() {
+    for (i, row) in rows.iter().enumerate() {
        let i = i as u32;
        let unchanged = store
            .item(i)
            .and_downcast::<BoxedAnyObject>()
-            .is_some_and(|old| {
+            .is_some_and(|old| row.same_as(&old.borrow::<GalleryRow>()));
                let old = old.borrow::<PhotoGroup>();
                old.heading == group.heading && old.photos.len() == group.photos.len()
            });
        if unchanged {
            continue;
        }
-        let boxed = BoxedAnyObject::new(PhotoGroup {
+        let boxed = BoxedAnyObject::new(clone_row(row));
            heading: group.heading.clone(),
            photos: group.photos.clone(),
        });
        if i < store.n_items() {
            store.splice(i, 1, &[boxed]);
        } else {
            store.append(&boxed);
        }
    }
-    // Photos only ever get appended, so a shorter model means a fresh load.
+    if store.n_items() > rows.len() as u32 {
-    if store.n_items() > groups.len() as u32 {
+        let len = rows.len() as u32;
        let len = groups.len() as u32;
        store.splice(len, store.n_items() - len, &[] as &[BoxedAnyObject]);
    }
    update_gallery_subtitle(ui);
 }
 /// Flatten the loaded photos into the rows the ListView renders.
 fn build_rows(ui: &Rc<Ui>) -> Vec<GalleryRow> {
    let width = gallery_width(ui);
    let mut rows = Vec::new();
    for group in group_photos(&ui.gallery.model) {
        rows.push(GalleryRow::Heading(group.heading));
        let grid = grid_rows(ui, &group.photos, width);
        let last_index = grid.len().saturating_sub(1);
        for (index, tiles) in grid.into_iter().enumerate() {
            let edge = tiles.first().map(|t| t.edge).unwrap_or(TILE_DEFAULT);
            rows.push(GalleryRow::Tiles {
                photos: tiles.into_iter().map(|t| t.photo).collect(),
                edge,
                last: index == last_index,
            });
        }
    }
    rows
 }
 fn clone_row(row: &GalleryRow) -> GalleryRow {
    match row {
        GalleryRow::Heading(heading) => GalleryRow::Heading(heading.clone()),
        GalleryRow::Tiles { photos, edge, last } => GalleryRow::Tiles {
            photos: photos.clone(),
            edge: *edge,
            last: *last,
        },
    }
 }
 /// "1,204 photos" under the page title.
 fn update_gallery_subtitle(ui: &Rc<Ui>) {
    let loaded = ui.gallery.model.n_items() as usize;
    ui.gallery.subtitle.set_visible(loaded > 0);
    // An album counts what the server says it holds, not how much of it has been
@@ -151,6 +151,7 @@ pub(crate) fn load_shared(ui: &Rc<Ui>) {
    if ui.shared.inflight.get() {
        return;
    }
    cancel_file_thumbnails(ui);
    let current = ui.shared.nav.borrow().last().cloned();
    if let Some((uid, _)) = current {
        load_shared_folder(ui, uid);
@@ -308,11 +309,18 @@ fn shared_entry_row(ui: &Rc<Ui>, entry: &DirEntry) -> adw::ActionRow {
    if let Some(badge) = role_badge(&entry.role) {
        row.add_suffix(&badge);
    }
-    row.add_prefix(&gtk4::Image::from_icon_name(if entry.is_dir {
+    // The "shared by" in the subtitle is what the invitation claims. When its
-        "folder-symbolic"
+    // signature does not check out against that person's keys, the claim must
-    } else {
+    // not read as fact — someone may be impersonating a contact to get a file
-        "text-x-generic-symbolic"
+    // opened.
-    }));
+    if entry.shared_by_unverified {
        let warning = gtk4::Image::from_icon_name("dialog-warning-symbolic");
        warning.add_css_class("warning");
        warning.set_valign(gtk4::Align::Center);
        warning.set_tooltip_text(Some(UNVERIFIED_INVITER_TOOLTIP));
        row.add_suffix(&warning);
    }
    row.add_prefix(&file_thumbnail(ui, entry, 40, 24, true));
    let ui_act = ui.clone();
    let uid = entry.uid.clone();
    let name = entry.name.clone();
@@ -332,12 +340,29 @@ fn shared_entry_row(ui: &Rc<Ui>, entry: &DirEntry) -> adw::ActionRow {
    row
 }
-/// A shared row's subtitle: its size (files only), and where it can be reached
+/// Tooltip on the warning shown next to a share whose invitation did not verify.
-/// in the local mount once the synthetic `Shared with me/` directory has interned
+const UNVERIFIED_INVITER_TOOLTIP: &str = "The invitation's signature doesn't match the sender's keys. \
-/// it. An unlisted share has no local path yet, and says nothing rather than
+     It may not really be from them.";
-/// pointing at a directory that is not there.
+
 /// A shared row's subtitle: who shared it and when (share roots only — that is
 /// where the invitation lives), its size (files only), and where it can be
 /// reached in the local mount once the synthetic `Shared with me/` directory has
 /// interned it. An unlisted share has no local path yet, and says nothing rather
 /// than pointing at a directory that is not there.
 pub(crate) fn shared_row_subtitle(entry: &DirEntry) -> String {
    let mut parts: Vec<String> = Vec::new();
    if !entry.shared_by.is_empty() {
        let date = if entry.shared_at > 0 {
            format_modified(entry.shared_at)
        } else {
            String::new()
        };
        parts.push(if date.is_empty() {
            format!("Shared by {}", entry.shared_by)
        } else {
            format!("Shared by {} on {date}", entry.shared_by)
        });
    }
    if !entry.is_dir {
        parts.push(human_bytes(entry.size));
    }
@@ -726,9 +751,25 @@ mod tests {
            uid: "vol~link".into(),
            path: path.into(),
            role: role.into(),
            shared_by: String::new(),
            shared_at: 0,
            shared_by_unverified: false,
        }
    }
    #[test]
    fn a_share_root_says_who_shared_it() {
        let mut root = entry(true, "", "viewer");
        root.shared_by = "alice@proton.me".into();
        assert_eq!(shared_row_subtitle(&root), "Shared by alice@proton.me");
        root.shared_at = 1_700_000_000;
        let subtitle = shared_row_subtitle(&root);
        assert!(
            subtitle.starts_with("Shared by alice@proton.me on "),
            "{subtitle}"
        );
    }
    #[test]
    fn a_share_with_no_local_path_says_nothing_about_one() {
        // Before the synthetic directory has been listed, the daemon cannot
@@ -113,6 +113,7 @@ pub(crate) fn load_shared_by_me(ui: &Rc<Ui>) {
    if ui.shared_by_me.inflight.get() {
        return;
    }
    cancel_file_thumbnails(ui);
    ui.shared_by_me.inflight.set(true);
    shared_by_me_status(
        ui,
@@ -200,15 +201,12 @@ pub(crate) fn repaint_shared_by_me(ui: &Rc<Ui>, items: &[SharedItem]) {
    ui.shared_by_me.content.set_visible_child_name("list");
    let mut rows: Vec<gtk4::Widget> = Vec::new();
    for item in items {
        let entry = shared_item_as_entry(item);
        let row = adw::ActionRow::builder()
            .title(&item.name)
            .subtitle(shared_item_summary(item))
            .build();
-        row.add_prefix(&gtk4::Image::from_icon_name(if item.is_dir {
+        row.add_prefix(&file_thumbnail(ui, &entry, 40, 24, true));
            "folder-symbolic"
        } else {
            "text-x-generic-symbolic"
        }));
        // Copy / open the public link, when there is one with a recovered URL.
        if let Some(url) = item.link.as_ref().and_then(|l| l.url.clone()) {
@@ -245,7 +243,6 @@ pub(crate) fn repaint_shared_by_me(ui: &Rc<Ui>, items: &[SharedItem]) {
            .build();
        manage.add_css_class("flat");
        let ui_manage = ui.clone();
        let entry = shared_item_as_entry(item);
        manage.connect_clicked(move |_| open_share_dialog(&ui_manage, &entry));
        row.add_suffix(&manage);
@@ -289,12 +286,15 @@ pub(crate) fn shared_item_as_entry(item: &SharedItem) -> DirEntry {
        name: item.name.clone(),
        is_dir: item.is_dir,
        size: 0,
-        modified: 0,
+        modified: item.modified,
        pinned: false,
        cached: false,
        uid: item.uid.clone(),
        path: item.path.clone(),
        // Shared *by* me: I own it, so there is no role of mine to report.
        role: String::new(),
        shared_by: String::new(),
        shared_at: 0,
        shared_by_unverified: false,
    }
 }
@@ -572,7 +572,7 @@ pub(crate) fn refresh(ui: &Rc<Ui>) {
        refresh_takeout(ui);
    }
    match ui.stack.visible_child_name().as_deref() {
-        Some("main") => refresh_quota(ui),
+        Some("main" | "browser") => refresh_quota(ui),
        Some("locations") => refresh_locations(ui),
        Some("activity") => refresh_activity(ui),
        _ => {}
@@ -580,13 +580,11 @@ pub(crate) fn refresh(ui: &Rc<Ui>) {
 }
 /// How long a quota reading stays fresh. Account storage barely moves, so the
-/// Settings tick refetches it only this often rather than every 2s.
+/// active-page tick refetches it only this often rather than every 2s.
 const QUOTA_TTL: Duration = Duration::from_secs(60);
-/// Fetch the account quota (if the last reading is stale) and paint the Account
+/// Fetch the account quota (if the last reading is stale) and paint both the
-/// storage group. Runs only while Settings is on screen. The group stays hidden
+/// Settings storage group and Files status bar. A failed fetch leaves the last
 /// until a reading lands, so an account the API can't report — or a still-starting
 /// daemon — shows nothing rather than an empty bar. A failed fetch leaves the last
 /// good reading in place.
 pub(crate) fn refresh_quota(ui: &Rc<Ui>) {
    if ui.status.quota_inflight.get() {
@@ -609,28 +607,71 @@ pub(crate) fn refresh_quota(ui: &Rc<Ui>) {
        })) = result
        {
            ui.status.quota_checked_at.set(Some(Instant::now()));
-            let used = used_space.max(0) as u64;
+            paint_account_quota(&ui, max_space, used_space);
            if max_space > 0 {
                let total = max_space as u64;
                let fraction = (used as f64 / total as f64).min(1.0);
                ui.status.quota_bar.set_fraction(fraction);
                let pct = (fraction * 100.0).round() as u64;
                ui.status.quota_label.set_text(&format!(
                    "{} of {} used ({pct}%)",
                    human_bytes(used),
                    human_bytes(total)
                ));
            } else {
                ui.status.quota_bar.set_fraction(0.0);
                ui.status
                    .quota_label
                    .set_text(&format!("{} used", human_bytes(used)));
            }
            ui.status.quota_group.set_visible(true);
        } else if ui.status.quota_checked_at.get().is_none() {
            // Match Dolphin: capacity information does not occupy the bar until
            // the backing observer has real figures.
            ui.browser.quota_box.set_visible(false);
        }
    });
 }
 fn paint_account_quota(ui: &Rc<Ui>, max_space: i64, used_space: i64) {
    let (fraction, text) = quota_display(max_space, used_space);
    ui.status.quota_bar.set_fraction(fraction);
    ui.status.quota_label.set_text(&text);
    if let Some((fraction, free_text, tooltip)) = quota_status_display(max_space, used_space) {
        ui.browser.quota.set_fraction(fraction);
        ui.browser.quota.set_tooltip_text(Some(&tooltip));
        ui.browser.quota_text.set_label(&free_text);
        ui.browser.quota_text.set_tooltip_text(Some(&tooltip));
        ui.browser.quota_box.set_visible(true);
    } else {
        ui.browser.quota_box.set_visible(false);
    }
 }
 fn quota_display(max_space: i64, used_space: i64) -> (f64, String) {
    let used = used_space.max(0) as u64;
    if max_space <= 0 {
        return (0.0, format!("{} used", human_bytes(used)));
    }
    let total = max_space as u64;
    let fraction = (used as f64 / total as f64).clamp(0.0, 1.0);
    let pct = (fraction * 100.0).round() as u64;
    (
        fraction,
        format!(
            "{} of {} used ({pct}%)",
            human_bytes(used),
            human_bytes(total)
        ),
    )
 }
 /// Dolphin's status bar shows a bare capacity bar followed by “X free”; the
 /// full free/total/percentage sentence is a tooltip rather than inline bar text.
 fn quota_status_display(max_space: i64, used_space: i64) -> Option<(f64, String, String)> {
    if max_space <= 0 {
        return None;
    }
    let total = max_space as u64;
    let used = (used_space.max(0) as u64).min(total);
    let free = total.saturating_sub(used);
    let fraction = used as f64 / total as f64;
    let pct = (fraction * 100.0).round() as u64;
    Some((
        fraction,
        format!("{} free", human_bytes(free)),
        format!(
            "{} free out of {} ({pct}% used)",
            human_bytes(free),
            human_bytes(total)
        ),
    ))
 }
 /// Record the mount state seen by the last status poll: gate every control that
 /// needs a live daemon, and notify the desktop when the state actually flips.
 ///
@@ -642,6 +683,11 @@ pub(crate) fn set_mounted(ui: &Rc<Ui>, mounted: bool) {
    ui.browser.new_folder.set_sensitive(mounted);
    ui.browser.upload.set_sensitive(mounted);
    ui.browser.upload_folder.set_sensitive(mounted);
    ui.browser.build_thumbnails.set_sensitive(
        mounted
            && (!ui.browser.thumbnail_build_running.get()
                || !ui.browser.thumbnail_cancel_pending.get()),
    );
    ui.gallery.upload.set_sensitive(mounted);
    ui.details.details.pin_row.set_sensitive(mounted);
    ui.details.details.rename_button.set_sensitive(mounted);
@@ -1010,3 +1056,36 @@ pub(crate) fn repaint_pins(ui: &Rc<Ui>, pins: &[pdfs_core::cache::Pin], mounted:
            .push(PinRow { row, unpin: None });
    }
 }
 #[cfg(test)]
 mod tests {
    use super::{quota_display, quota_status_display};
    #[test]
    fn quota_display_reports_used_total_and_percentage() {
        let gib = 1024_i64.pow(3);
        let (fraction, text) = quota_display(4 * gib, gib);
        assert!((fraction - 0.25).abs() < f64::EPSILON);
        assert_eq!(text, "1.0 GiB of 4.0 GiB used (25%)");
    }
    #[test]
    fn quota_display_clamps_bad_api_values() {
        assert_eq!(quota_display(0, -1), (0.0, "0 B used".to_string()));
        assert_eq!(quota_display(100, 150).0, 1.0);
    }
    #[test]
    fn quota_status_display_matches_dolphin_wording() {
        let gib = 1024_i64.pow(3);
        assert_eq!(
            quota_status_display(4 * gib, gib),
            Some((
                0.25,
                "3.0 GiB free".to_string(),
                "3.0 GiB free out of 4.0 GiB (25% used)".to_string()
            ))
        );
        assert_eq!(quota_status_display(0, 0), None);
    }
 }
@@ -122,7 +122,7 @@ pub(crate) fn wire_trash(ui: &Rc<Ui>, list: &gtk4::ListView, empty: &gtk4::Butto
    factory.connect_setup(move |_, item| {
        let item = item.downcast_ref::<gtk4::ListItem>().unwrap();
-        let icon = gtk4::Image::builder().pixel_size(32).build();
+        let thumbnail = file_thumbnail_widget(40, 32);
        let name = gtk4::Label::builder()
            .halign(gtk4::Align::Start)
            .ellipsize(gtk4::pango::EllipsizeMode::Middle)
@@ -169,35 +169,38 @@ pub(crate) fn wire_trash(ui: &Rc<Ui>, list: &gtk4::ListView, empty: &gtk4::Butto
        row.set_margin_bottom(6);
        row.set_margin_start(6);
        row.set_margin_end(6);
-        row.append(&icon);
+        row.append(&thumbnail);
        row.append(&text);
        row.append(&restore);
        row.append(&purge);
        item.set_child(Some(&row));
    });
-    factory.connect_bind(|_, item| {
+    factory.connect_bind({
-        let item = item.downcast_ref::<gtk4::ListItem>().unwrap();
+        let ui = ui.clone();
-        let Some(entry) = bound_entry(item) else {
+        move |_, item| {
-            return;
+            let item = item.downcast_ref::<gtk4::ListItem>().unwrap();
-        };
+            let Some(entry) = bound_entry(item) else {
-        let row = item.child().and_downcast::<gtk4::Box>().unwrap();
+                return;
        let Some(icon) = row.first_child().and_downcast::<gtk4::Image>() else {
            return;
        };
        icon.set_icon_name(Some(&format!("{}-symbolic", icon_base_for(&entry))));
        let Some(text) = icon.next_sibling().and_downcast::<gtk4::Box>() else {
            return;
        };
        if let Some(name) = text.first_child().and_downcast::<gtk4::Label>() {
            name.set_label(&entry.name);
        }
        if let Some(meta) = text.last_child().and_downcast::<gtk4::Label>() {
            let kind = if entry.is_dir {
                "Folder".to_string()
            } else {
                human_bytes(entry.size)
            };
-            meta.set_label(&format!("{kind} · {}", format_modified(entry.modified)));
+            let row = item.child().and_downcast::<gtk4::Box>().unwrap();
            let Some(thumbnail) = row.first_child().and_downcast::<gtk4::Overlay>() else {
                return;
            };
            bind_file_thumbnail(&ui, &thumbnail, &entry, true);
            let Some(text) = thumbnail.next_sibling().and_downcast::<gtk4::Box>() else {
                return;
            };
            if let Some(name) = text.first_child().and_downcast::<gtk4::Label>() {
                name.set_label(&entry.name);
            }
            if let Some(meta) = text.last_child().and_downcast::<gtk4::Label>() {
                let kind = if entry.is_dir {
                    "Folder".to_string()
                } else {
                    human_bytes(entry.size)
                };
                meta.set_label(&format!("{kind} · {}", format_modified(entry.modified)));
            }
        }
    });
    list.set_factory(Some(&factory));
@@ -216,6 +219,7 @@ pub(crate) fn bound_entry(item: &gtk4::ListItem) -> Option<DirEntry> {
 /// Fetch the trash listing and repaint the page.
 pub(crate) fn load_trash(ui: &Rc<Ui>) {
    cancel_file_thumbnails(ui);
    // Drop the old rows first: a stale row here would offer Restore on something
    // that may already be gone.
    ui.trash.model.remove_all();
@@ -1,3 +1,4 @@
 pub(crate) mod details;
 pub(crate) mod share_dialog;
 pub(crate) mod thumbnails;
 pub(crate) mod versions_dialog;
@@ -0,0 +1,469 @@
 //! Shared thumbnails for ordinary Drive image files.
 //!
 //! The Photos gallery has timeline-specific batching and aspect-ratio state.
 //! File listings need a smaller, reusable surface: one loader backs My files,
 //! search, Shared and Trash, with modification-time cache keys
 //! so a replaced image never flashes its previous contents.
 use crate::*;
 use pdfs_core::control::{FileThumbRequest, is_thumbnail_image_name};
 const THUMB_BATCH: usize = 32;
 const THUMB_CACHE_MAX: usize = 256;
 const THUMB_MISSING_MAX: usize = 2048;
 const THUMB_DEBOUNCE: Duration = Duration::from_millis(40);
 const THUMB_RETRY: Duration = Duration::from_secs(2);
 pub(crate) struct FileThumbnailState {
    textures: RefCell<HashMap<String, gtk4::gdk::Texture>>,
    texture_order: RefCell<VecDeque<String>>,
    missing: RefCell<HashSet<String>>,
    missing_order: RefCell<VecDeque<String>>,
    wanted: RefCell<HashMap<String, Vec<gtk4::Picture>>>,
    queue: RefCell<VecDeque<FileThumbRequest>>,
    inflight: Cell<bool>,
    source: RefCell<Option<glib::SourceId>>,
    generation: Cell<u64>,
    generation_loading: Cell<bool>,
 }
 #[derive(Debug, PartialEq, Eq)]
 enum ReplyDisposition {
    Ignore,
    Load,
    Retry,
    Missing,
 }
 fn reply_disposition(wanted: bool, has_path: bool, pending: bool) -> ReplyDisposition {
    if !wanted {
        ReplyDisposition::Ignore
    } else if has_path {
        ReplyDisposition::Load
    } else if pending {
        ReplyDisposition::Retry
    } else {
        ReplyDisposition::Missing
    }
 }
 impl FileThumbnailState {
    pub(crate) fn new() -> Self {
        Self {
            textures: RefCell::new(HashMap::new()),
            texture_order: RefCell::new(VecDeque::new()),
            missing: RefCell::new(HashSet::new()),
            missing_order: RefCell::new(VecDeque::new()),
            wanted: RefCell::new(HashMap::new()),
            queue: RefCell::new(VecDeque::new()),
            inflight: Cell::new(false),
            source: RefCell::new(None),
            generation: Cell::new(0),
            generation_loading: Cell::new(false),
        }
    }
    fn store_texture(&self, key: &str, texture: gtk4::gdk::Texture) {
        let mut textures = self.textures.borrow_mut();
        let mut order = self.texture_order.borrow_mut();
        if textures.insert(key.to_string(), texture).is_none() {
            order.push_back(key.to_string());
        }
        while order.len() > THUMB_CACHE_MAX {
            if let Some(old) = order.pop_front() {
                textures.remove(&old);
            }
        }
    }
    fn store_missing(&self, key: String) {
        let mut missing = self.missing.borrow_mut();
        let mut order = self.missing_order.borrow_mut();
        if missing.insert(key.clone()) {
            order.push_back(key);
        }
        while order.len() > THUMB_MISSING_MAX {
            if let Some(old) = order.pop_front() {
                missing.remove(&old);
            }
        }
    }
 }
 /// Abandon every opportunistic ordinary-file thumbnail associated with the
 /// listing being left. Advancing a wire generation lets the daemon cancel work
 /// even when an older request reaches it after this one.
 pub(crate) fn cancel_file_thumbnails(ui: &Rc<Ui>) {
    if let Some(source) = ui.file_thumbs.source.borrow_mut().take() {
        source.remove();
    }
    ui.file_thumbs.queue.borrow_mut().clear();
    ui.file_thumbs.wanted.borrow_mut().clear();
    let generation = ui.file_thumbs.generation.replace(0);
    // The request is useful even when its reply is not. `spawn_request` owns the
    // socket round-trip on a worker thread, so dropping the receiver is safe.
    if generation != 0 {
        drop(spawn_request(
            ui.dirs.control_socket(),
            Request::CancelFileThumbs {
                generation: generation.saturating_add(1),
            },
        ));
    }
 }
 /// A square thumbnail surface with a generic file icon underneath the picture.
 /// Call [`bind_file_thumbnail`] whenever a recycled row is bound to an entry.
 pub(crate) fn file_thumbnail_widget(size: i32, fallback_size: i32) -> gtk4::Overlay {
    let fallback = gtk4::Image::builder().pixel_size(fallback_size).build();
    let picture = gtk4::Picture::builder()
        .width_request(size)
        .height_request(size)
        .content_fit(gtk4::ContentFit::Cover)
        .can_shrink(true)
        .visible(false)
        .build();
    picture.add_css_class("file-thumbnail");
    let overlay = gtk4::Overlay::new();
    overlay.set_width_request(size);
    overlay.set_height_request(size);
    overlay.set_halign(gtk4::Align::Center);
    overlay.set_valign(gtk4::Align::Center);
    overlay.set_overflow(gtk4::Overflow::Hidden);
    overlay.set_child(Some(&fallback));
    overlay.add_overlay(&picture);
    overlay
 }
 /// Resize an existing thumbnail surface. Grid rows are recycled, so changing
 /// these requests in place and rebinding the model is enough to implement the
 /// status-bar zoom without downloading or decoding an image again.
 pub(crate) fn resize_file_thumbnail(widget: &gtk4::Overlay, size: i32, fallback_size: i32) {
    widget.set_width_request(size);
    widget.set_height_request(size);
    let Some(fallback) = widget.child().and_downcast::<gtk4::Image>() else {
        return;
    };
    fallback.set_pixel_size(fallback_size);
    if let Some(picture) = fallback.next_sibling().and_downcast::<gtk4::Picture>() {
        picture.set_width_request(size);
        picture.set_height_request(size);
    }
 }
 /// Bind a thumbnail surface to one entry, painting a cached texture immediately
 /// or queueing an on-demand daemon request. Non-images retain the generic icon.
 pub(crate) fn bind_file_thumbnail(
    ui: &Rc<Ui>,
    widget: &gtk4::Overlay,
    entry: &DirEntry,
    symbolic_fallback: bool,
 ) {
    let Some(fallback) = widget.child().and_downcast::<gtk4::Image>() else {
        return;
    };
    // The browser may add a status badge after the picture. Locate the picture
    // immediately after the base fallback instead of assuming it is the last
    // overlay child.
    let Some(picture) = fallback.next_sibling().and_downcast::<gtk4::Picture>() else {
        return;
    };
    let fallback_name = if symbolic_fallback {
        format!("{}-symbolic", icon_base_for(entry))
    } else {
        icon_base_for(entry).to_string()
    };
    fallback.set_icon_name(Some(&fallback_name));
    fallback.set_visible(true);
    picture.set_visible(false);
    picture.set_paintable(gtk4::gdk::Paintable::NONE);
    // The widget name is a cheap binding token. List factories recycle their
    // children; a reply for the previous entry must not paint into the new one.
    let key = thumbnail_key(&entry.uid, entry.modified);
    picture.set_widget_name(&key);
    remove_waiter(ui, &picture);
    if entry.is_dir || !is_image_name(&entry.name) || entry.uid.is_empty() {
        return;
    }
    if let Some(texture) = ui.file_thumbs.textures.borrow().get(&key) {
        paint(&picture, &key, texture);
        return;
    }
    if ui.file_thumbs.missing.borrow().contains(&key) {
        return;
    }
    ui.file_thumbs
        .wanted
        .borrow_mut()
        .entry(key)
        .or_default()
        .push(picture);
    let mut queue = ui.file_thumbs.queue.borrow_mut();
    queue.retain(|item| item.uid != entry.uid);
    queue.push_back(FileThumbRequest {
        uid: entry.uid.clone(),
        modified: entry.modified,
        name: entry.name.clone(),
    });
    drop(queue);
    schedule_file_thumbs(ui);
 }
 /// Create and immediately bind a thumbnail for a non-recycled row.
 pub(crate) fn file_thumbnail(
    ui: &Rc<Ui>,
    entry: &DirEntry,
    size: i32,
    fallback_size: i32,
    symbolic_fallback: bool,
 ) -> gtk4::Overlay {
    let widget = file_thumbnail_widget(size, fallback_size);
    bind_file_thumbnail(ui, &widget, entry, symbolic_fallback);
    widget
 }
 /// Whether the file name denotes an image format for which Proton or the local
 /// decoder can reasonably provide a thumbnail.
 pub(crate) fn is_image_name(name: &str) -> bool {
    is_thumbnail_image_name(name)
 }
 fn thumbnail_key(uid: &str, modified: i64) -> String {
    format!("{uid}:{modified}")
 }
 fn remove_waiter(ui: &Rc<Ui>, picture: &gtk4::Picture) {
    let mut wanted = ui.file_thumbs.wanted.borrow_mut();
    wanted.retain(|_, pictures| {
        pictures.retain(|candidate| candidate != picture);
        !pictures.is_empty()
    });
 }
 fn paint(picture: &gtk4::Picture, key: &str, texture: &gtk4::gdk::Texture) {
    if picture.widget_name() != key {
        return;
    }
    picture.set_paintable(Some(texture));
    picture.set_visible(true);
    if let Some(overlay) = picture.parent().and_downcast::<gtk4::Overlay>()
        && let Some(fallback) = overlay.child().and_downcast::<gtk4::Image>()
    {
        fallback.set_visible(false);
    }
 }
 fn schedule_file_thumbs(ui: &Rc<Ui>) {
    if ui.file_thumbs.queue.borrow().is_empty() || ui.file_thumbs.inflight.get() {
        return;
    }
    if ui.file_thumbs.generation.get() == 0 {
        reserve_file_thumb_generation(ui);
        return;
    }
    if let Some(source) = ui.file_thumbs.source.borrow_mut().take() {
        source.remove();
    }
    let ui_flush = ui.clone();
    let source = glib::timeout_add_local_once(THUMB_DEBOUNCE, move || {
        ui_flush.file_thumbs.source.borrow_mut().take();
        flush_file_thumbs(&ui_flush);
    });
    *ui.file_thumbs.source.borrow_mut() = Some(source);
 }
 fn reserve_file_thumb_generation(ui: &Rc<Ui>) {
    if ui.file_thumbs.generation_loading.replace(true) {
        return;
    }
    let rx = spawn_request(
        ui.dirs.control_socket(),
        Request::ReserveFileThumbGeneration,
    );
    let ui = ui.clone();
    glib::spawn_future_local(async move {
        let result = rx.recv().await;
        ui.file_thumbs.generation_loading.set(false);
        match result {
            Ok(Ok(Response::FileThumbGeneration { generation })) if generation != 0 => {
                ui.file_thumbs.generation.set(generation);
                schedule_file_thumbs(&ui);
            }
            _ => retry_file_thumb_generation(&ui),
        }
    });
 }
 fn retry_file_thumb_generation(ui: &Rc<Ui>) {
    if let Some(source) = ui.file_thumbs.source.borrow_mut().take() {
        source.remove();
    }
    let ui_retry = ui.clone();
    let source = glib::timeout_add_local_once(THUMB_RETRY, move || {
        ui_retry.file_thumbs.source.borrow_mut().take();
        schedule_file_thumbs(&ui_retry);
    });
    *ui.file_thumbs.source.borrow_mut() = Some(source);
 }
 fn flush_file_thumbs(ui: &Rc<Ui>) {
    if ui.file_thumbs.inflight.get() {
        return;
    }
    let items: Vec<FileThumbRequest> = {
        let mut queue = ui.file_thumbs.queue.borrow_mut();
        let wanted = ui.file_thumbs.wanted.borrow();
        let mut batch = Vec::new();
        while batch.len() < THUMB_BATCH {
            let Some(item) = queue.pop_front() else {
                break;
            };
            if wanted.contains_key(&thumbnail_key(&item.uid, item.modified)) {
                batch.push(item);
            }
        }
        batch
    };
    if items.is_empty() {
        return;
    }
    ui.file_thumbs.inflight.set(true);
    let rx = spawn_request(
        ui.dirs.control_socket(),
        Request::FileThumbs {
            items: items.clone(),
            generation: ui.file_thumbs.generation.get(),
        },
    );
    let ui = ui.clone();
    glib::spawn_future_local(async move {
        let result = rx.recv().await;
        ui.file_thumbs.inflight.set(false);
        match result {
            Ok(Ok(Response::Thumbs { items: replies })) => {
                let mut requested: HashMap<String, FileThumbRequest> = items
                    .iter()
                    .cloned()
                    .map(|item| (item.uid.clone(), item))
                    .collect();
                let mut pending = Vec::new();
                for reply in replies {
                    let Some(request) = requested.remove(&reply.uid) else {
                        continue;
                    };
                    let key = thumbnail_key(&request.uid, request.modified);
                    let wanted = ui.file_thumbs.wanted.borrow().contains_key(&key);
                    match reply_disposition(wanted, reply.path.is_some(), reply.pending) {
                        ReplyDisposition::Ignore => continue,
                        ReplyDisposition::Load => {
                            let Some(path) = reply.path else { continue };
                            match gtk4::gdk::Texture::from_filename(&path) {
                                Ok(texture) => {
                                    ui.file_thumbs.store_texture(&key, texture.clone());
                                    if let Some(pictures) =
                                        ui.file_thumbs.wanted.borrow_mut().remove(&key)
                                    {
                                        for picture in pictures {
                                            paint(&picture, &key, &texture);
                                        }
                                    }
                                }
                                Err(e) => {
                                    tracing::debug!("cannot decode file thumbnail {path}: {e}");
                                    ui.file_thumbs.store_missing(key.clone());
                                    ui.file_thumbs.wanted.borrow_mut().remove(&key);
                                }
                            }
                        }
                        ReplyDisposition::Retry => pending.push(request),
                        ReplyDisposition::Missing => {
                            ui.file_thumbs.store_missing(key.clone());
                            ui.file_thumbs.wanted.borrow_mut().remove(&key);
                        }
                    }
                }
                pending.extend(requested.into_values());
                if !pending.is_empty() {
                    retry_file_thumbs(&ui, pending);
                }
            }
            Ok(Ok(Response::FileThumbsStale)) => {
                ui.file_thumbs.generation.set(0);
                retry_file_thumbs(&ui, items);
            }
            Ok(Ok(Response::Error { message, .. })) => {
                tracing::debug!("file thumbnails failed: {message}");
                retry_file_thumbs(&ui, items);
            }
            Ok(Ok(_)) | Ok(Err(_)) | Err(_) => {
                tracing::debug!("file thumbnails: no reply");
                retry_file_thumbs(&ui, items);
            }
        }
        schedule_file_thumbs(&ui);
    });
 }
 fn retry_file_thumbs(ui: &Rc<Ui>, items: Vec<FileThumbRequest>) {
    let ui = ui.clone();
    glib::timeout_add_local_once(THUMB_RETRY, move || {
        let wanted = ui.file_thumbs.wanted.borrow();
        let retry: Vec<FileThumbRequest> = items
            .into_iter()
            .filter(|item| wanted.contains_key(&thumbnail_key(&item.uid, item.modified)))
            .collect();
        drop(wanted);
        ui.file_thumbs.queue.borrow_mut().extend(retry);
        schedule_file_thumbs(&ui);
    });
 }
 #[cfg(test)]
 mod tests {
    use super::{ReplyDisposition, is_image_name, reply_disposition};
    #[test]
    fn image_extensions_are_case_insensitive_and_specific() {
        for name in [
            "photo.jpg",
            "SCAN.PNG",
            "animation.Gif",
            "archive.tiff",
            "camera.nef",
            "negative.CR3",
            "camera.RAW",
        ] {
            assert!(is_image_name(name), "{name}");
        }
        for name in [
            "notes.txt",
            "movie.mp4",
            "image.jpg.zip",
            "jpg",
            "camera.heic",
            "frame.avif",
            "graphic.svg",
            "camera.rw",
        ] {
            assert!(!is_image_name(name), "{name}");
        }
    }
    #[test]
    fn cancelled_listing_replies_cannot_become_permanent_misses() {
        assert_eq!(
            reply_disposition(false, false, false),
            ReplyDisposition::Ignore
        );
        assert_eq!(
            reply_disposition(true, false, false),
            ReplyDisposition::Missing
        );
    }
 }
@@ -1,26 +1,23 @@
 //! `pdfs-prompt --dmenu`: the same search, presented in the user's own launcher.
 //!
 //! Everything here is blocking and GTK-free — the process exists for one
-//! round-trip and then exits, so there is no main loop to keep off. It reuses
+//! round-trip and then exits, so there is no main loop to keep off. Talking to
-//! the GTK prompt's [`Hit`](crate::Hit) model and ranking, and its Drive
+//! the daemon and opening a chosen file are [`crate::query`]'s, shared with the
-//! activation policy, so the two front ends cannot drift on what "open" means.
+//! fzf front end and built on the GTK prompt's own [`Hit`](crate::Hit) model
 //! and activation policy; this module is only presentation.
 //!
 //! Launchers filter a static list; they cannot call back for a new one per
 //! keystroke. So the interaction is a loop: the first menu shows pinned files
 //! and accepts free text, and any text that matches no entry becomes the next
-//! search. Escape (an empty selection) ends it.
+//! search. Escape (an empty selection) ends it. `--fzf` ([`crate::fzf`]) is the
-
+//! front end for users who want results to appear while they type instead.
 use std::path::{Path, PathBuf};
 use pdfs_core::config::AppDirs;
 use pdfs_core::control::{
    Request, Response, SearchFilters, SearchHit, SearchKind, SearchSource, send,
 };
 use pdfs_core::menu::{self, MenuChoice, MenuItem, PromptConfig};
-use pdfs_core::opener::{self, OpenWith};
+use pdfs_core::opener::OpenWith;
-use crate::activation::{DriveActivation, drive_activation, mounted_or_relative, mounted_target};
+use crate::Hit;
-use crate::{Hit, file_name, is_document, is_image, is_media, rank_hits};
+use crate::query;
 /// Guard against a launcher that keeps handing back text we cannot satisfy —
 /// without it a scripted (non-interactive) menu could spin forever.
@@ -48,10 +45,7 @@ pub(crate) fn run(options: Options) -> Result<(), String> {
                .to_string()
        })?;
-    let mountpoint = match request(&socket, Request::Status)? {
+    let mountpoint = query::mountpoint(&socket, &dirs);
        Response::Status { mountpoint, .. } => PathBuf::from(mountpoint),
        _ => dirs.default_mountpoint(),
    };
    let mut query = options
        .query
@@ -59,8 +53,8 @@ pub(crate) fn run(options: Options) -> Result<(), String> {
        .filter(|q| !q.is_empty());
    for _ in 0..MAX_ROUNDS {
        let hits = match &query {
-            Some(text) => search(&socket, text, prompt.resolved_menu_limit())?,
+            Some(text) => query::search(&socket, text, prompt.resolved_menu_limit())?,
-            None => pins(&socket)?,
+            None => query::pins(&socket)?,
        };
        let items: Vec<MenuItem> = if hits.is_empty() {
            vec![MenuItem::new(placeholder(query.as_deref()), None)]
@@ -77,7 +71,7 @@ pub(crate) fn run(options: Options) -> Result<(), String> {
                    query = None;
                    continue;
                };
-                return open(&socket, &mountpoint, &policy, hit, query.is_none());
+                return query::open(&socket, &mountpoint, &policy, hit, query.is_none());
            }
            // No entry matched what was typed: treat it as the next query.
            MenuChoice::Custom(text) => query = Some(text),
@@ -118,57 +112,6 @@ fn placeholder(query: Option<&str>) -> String {
    }
 }
 /// Pinned files — the same "you asked to keep these" set the GTK prompt opens
 /// with, and the only listing the daemon offers without a query.
 fn pins(socket: &Path) -> Result<Vec<Hit>, String> {
    let Response::Pins { pins } = request(socket, Request::ListPins)? else {
        return Ok(Vec::new());
    };
    Ok(pins
        .into_iter()
        .map(|pin| {
            Hit::Drive(SearchHit {
                name: file_name(&pin.path),
                path: pin.path,
                is_dir: pin.is_dir.unwrap_or(pin.recursive),
                size: 0,
                modified: 0,
                pinned: true,
                uid: pin.uid,
                mounted_path: None,
                score: 0,
            })
        })
        .collect())
 }
 fn search(socket: &Path, query: &str, limit: usize) -> Result<Vec<Hit>, String> {
    let reply = request(
        socket,
        Request::SearchV2 {
            query: query.to_string(),
            limit,
            filters: SearchFilters {
                sources: vec![SearchSource::Drive, SearchSource::Local],
                kind: SearchKind::All,
            },
        },
    )?;
    let Response::SearchResultsV2 {
        drive_hits,
        local_hits,
        ..
    } = reply
    else {
        return Ok(Vec::new());
    };
    let mut hits: Vec<Hit> = drive_hits.into_iter().map(Hit::Drive).collect();
    hits.extend(local_hits.into_iter().map(Hit::Local));
    rank_hits(&mut hits);
    hits.truncate(limit);
    Ok(hits)
 }
 /// One launcher line per hit. Labels must be unique: they are how the selection
 /// is matched back, and two files of the same name in the same folder listing
 /// would otherwise be indistinguishable.
@@ -181,101 +124,15 @@ fn label_all(hits: &[Hit]) -> Vec<MenuItem> {
            label = format!("{}   ·   {} ({suffix})", hit.name(), hit.location());
            suffix += 1;
        }
-        items.push(MenuItem::new(label, Some(icon_name(hit))));
+        items.push(MenuItem::new(label, Some(query::icon_name(hit))));
    }
    items
 }
 /// Icon theme name for a hit.
 ///
 /// Coarse on purpose: `content_type_guess` would give an exact MIME name, but
 /// only with file *contents* to sniff — a Drive hit is metadata, and passing it
 /// an empty buffer answers `application-x-zerosize` for everything. The generic
 /// names below exist in every icon theme.
 fn icon_name(hit: &Hit) -> String {
    if hit.is_dir() {
        return "folder".to_string();
    }
    let name = hit.name();
    if is_image(name) {
        "image-x-generic"
    } else if is_media(name) {
        "video-x-generic"
    } else if is_document(name) {
        "text-x-generic"
    } else {
        "application-x-generic"
    }
    .to_string()
 }
 /// Open a chosen hit, mirroring the GTK prompt: local files are already on
 /// disk, a Drive folder or streamable file goes through the mount, and anything
 /// else is materialised by the daemon first.
 fn open(
    socket: &Path,
    mountpoint: &Path,
    policy: &OpenWith,
    hit: &Hit,
    from_pins: bool,
 ) -> Result<(), String> {
    match hit {
        Hit::Local(local) => {
            opener::open(policy, Path::new(&local.path), local.is_dir);
            Ok(())
        }
        Hit::Drive(drive) => {
            // A folder has no materialised form, and a pin row's `is_dir` is pin
            // policy rather than node kind, so both go to the mount unchecked.
            let unconditional = from_pins
                || matches!(
                    drive_activation(&drive.name, drive.is_dir),
                    DriveActivation::Folder | DriveActivation::MountedMedia
                );
            if unconditional {
                opener::open(
                    policy,
                    &mounted_or_relative(mountpoint, drive),
                    drive.is_dir,
                );
                return Ok(());
            }
            // Anything else the mount exposes opens there too, so an editor
            // saves back into Drive instead of into a cache blob.
            if let Some(path) = mounted_target(mountpoint, drive) {
                opener::open(policy, &path, false);
                return Ok(());
            }
            match request(
                socket,
                Request::OpenFile {
                    path: drive.path.clone(),
                    uid: Some(drive.uid.clone()),
                },
            )? {
                Response::FilePath { path } => {
                    // The reply is a content-hash blob; the rules key off the
                    // Drive name, which is what the user actually opened.
                    opener::open_named(policy, Path::new(&path), &drive.name, false);
                    Ok(())
                }
                Response::Error { message, .. } => Err(format!("could not open: {message}")),
                _ => Err("unexpected reply from the daemon".to_string()),
            }
        }
    }
 }
 /// One control-socket round-trip, with the daemon-is-down case phrased for a
 /// terminal rather than a status page.
 fn request(socket: &Path, request: Request) -> Result<Response, String> {
    send(socket, &request).map_err(|e| format!("cannot reach the Proton Drive daemon: {e}"))
 }
 #[cfg(test)]
 mod tests {
    use super::*;
-    use pdfs_core::control::LocalHit;
+    use pdfs_core::control::{LocalHit, SearchHit};
    fn drive(name: &str, path: &str, is_dir: bool) -> Hit {
        Hit::Drive(SearchHit {
@@ -331,18 +188,4 @@ mod tests {
        assert!(placeholder(None).contains("type to search"));
        assert!(placeholder(Some("md")).contains("md"));
    }
    #[test]
    fn icons_are_theme_names_the_launcher_can_look_up() {
        assert_eq!(icon_name(&drive("Photos", "Photos", true)), "folder");
        assert_eq!(
            icon_name(&drive("a.png", "a.png", false)),
            "image-x-generic"
        );
        assert_eq!(icon_name(&drive("a.md", "a.md", false)), "text-x-generic");
        assert_eq!(
            icon_name(&drive("a.bin", "a.bin", false)),
            "application-x-generic"
        );
    }
 }
@@ -0,0 +1,372 @@
 //! `pdfs-prompt --fzf`: launcher search that queries the daemon per keystroke.
 //!
 //! A dmenu-protocol launcher (fuzzel, rofi, wofi, …) is handed one static list
 //! and filters it itself; it cannot ask for a new one as the user types, which
 //! is why [`crate::dmenu`] has to make the search a two-step. `fzf` can:
 //! `--bind change:reload(…)` re-runs a command on every keystroke. So this
 //! front end re-executes *this binary* in `--feed` mode, and the daemon's own
 //! ranking ([`pdfs_core::control::Request::SearchV2`]) decides the order —
 //! `--disabled` turns fzf's matcher off so it does not re-sort what came back.
 //!
 //! Three roles, all the same binary:
 //!
 //! * **outer** — `--fzf` with no tty (a WM keybinding): spawn a terminal that
 //!   runs the inner role, and exit.
 //! * **inner** — `--fzf` with a tty: run fzf, open what was chosen.
 //! * **feed** — `--feed <TEXT>`: print one line per hit and exit. fzf spawns
 //!   this per keystroke and kills the one it superseded.
 //!
 //! A line is `display\tpayload`, shown through `--with-nth=1` so only the left
 //! half is visible. The payload is the JSON [`Hit`], which is what makes the
 //! selection unambiguous: unlike the dmenu path, identity does not have to be
 //! recovered from the label, so [`crate::dmenu::label_all`]'s uniquifying
 //! suffix has no counterpart here. JSON escapes tabs and newlines, so no file
 //! name can split a line.
 use std::io::{BufRead, BufReader, IsTerminal, Write};
 use std::path::PathBuf;
 use std::process::{Command, Stdio};
 use pdfs_core::config::AppDirs;
 use pdfs_core::menu::{self, PromptConfig};
 use pdfs_core::opener::OpenWith;
 use crate::query;
 use crate::{Hit, SEARCH_DEBOUNCE};
 /// Separates the visible half of a feed line from its payload.
 const FIELD: char = '\t';
 /// What the launcher prompt reads, matching the dmenu front end's wording.
 const PROMPT: &str = "Search Drive › ";
 pub(crate) struct Options {
    /// Search for this immediately instead of opening on the pinned files.
    pub query: Option<String>,
    /// Set by the terminal we spawned: run fzf here even without a tty rather
    /// than spawning a second terminal, which would recurse forever if the
    /// terminal does not give its child one.
    pub inner: bool,
 }
 /// Run the fzf flow. Returns an error only for conditions the user must act on
 /// (no fzf, no terminal, no daemon); a plain cancel is `Ok`.
 pub(crate) fn run(options: Options) -> Result<(), String> {
    if options.inner || std::io::stdin().is_terminal() {
        return interactive(options.query);
    }
    spawn_terminal(options.query)
 }
 /// Re-launch this binary's inner role inside a terminal.
 ///
 /// Not waited on: a keybinding should return immediately, and the terminal
 /// owns the rest of the interaction — including opening the chosen file, which
 /// `opener` detaches anyway.
 fn spawn_terminal(query: Option<String>) -> Result<(), String> {
    let dirs = AppDirs::new().map_err(|e| format!("cannot resolve app dirs: {e}"))?;
    let prompt: PromptConfig = dirs.load_config().resolved_prompt();
    let terminal = menu::resolve_terminal(prompt.terminal.as_ref()).ok_or_else(|| {
        "no terminal found — install foot/kitty/alacritty, or set prompt.terminal in config.json"
            .to_string()
    })?;
    let argv = menu::with_command(&terminal, &inner_command(self_exe()?, query.as_deref()));
    let (program, args) = argv
        .split_first()
        .ok_or_else(|| "no terminal command configured".to_string())?;
    Command::new(program)
        .args(args)
        .spawn()
        .map_err(|e| format!("cannot run terminal {program}: {e}"))?;
    Ok(())
 }
 /// The argv the spawned terminal runs.
 fn inner_command(exe: PathBuf, query: Option<&str>) -> Vec<String> {
    let mut argv = vec![
        exe.display().to_string(),
        "--fzf".to_string(),
        "--inner".to_string(),
    ];
    if let Some(text) = query.filter(|text| !text.trim().is_empty()) {
        argv.push("--query".to_string());
        argv.push(text.to_string());
    }
    argv
 }
 /// Run fzf here and act on the choice.
 fn interactive(query: Option<String>) -> Result<(), String> {
    if !menu::on_path("fzf") {
        return Err("fzf is not installed — install it, or use --dmenu".to_string());
    }
    let dirs = AppDirs::new().map_err(|e| format!("cannot resolve app dirs: {e}"))?;
    let config = dirs.load_config();
    let prompt: PromptConfig = config.resolved_prompt();
    let policy: OpenWith = config.resolved_open_with();
    let socket = dirs.control_socket();
    let query = query
        .map(|q| q.trim().to_string())
        .filter(|q| !q.is_empty());
    // fzf only fires `change` for a *keystroke*, so the first screen — pins, or
    // the results for an initial --query — has to arrive on stdin.
    let initial = hits(&socket, query.as_deref(), prompt.resolved_menu_limit());
    let argv = fzf_argv(&self_exe()?, query.as_deref());
    let (program, args) = argv.split_first().expect("fzf_argv is never empty");
    let mut child = Command::new(program)
        .args(args)
        .stdin(Stdio::piped())
        .stdout(Stdio::piped())
        .spawn()
        .map_err(|e| format!("cannot run fzf: {e}"))?;
    // Written on a worker for the same reason the dmenu path does it: fzf reads
    // stdin only once its UI is up, and a full pipe buffer would deadlock us.
    let payload: String = initial.iter().map(encode_line).collect();
    let mut stdin = child
        .stdin
        .take()
        .ok_or_else(|| "fzf stdin unavailable".to_string())?;
    let writer = std::thread::spawn(move || {
        let _ = stdin.write_all(payload.as_bytes());
        let _ = stdin.flush();
    });
    let mut selected = String::new();
    if let Some(stdout) = child.stdout.take() {
        let mut reader = BufReader::new(stdout);
        let mut line = String::new();
        while reader.read_line(&mut line).unwrap_or(0) > 0 {
            if selected.is_empty() {
                selected = line.trim_end_matches('\n').to_string();
            }
            line.clear();
        }
    }
    let _ = child.wait();
    let _ = writer.join();
    // Escape, or Enter on the "cannot reach the daemon" row, which carries no
    // payload — neither is an error.
    let Some(hit) = decode_line(&selected) else {
        return Ok(());
    };
    let mountpoint = query::mountpoint(&socket, &dirs);
    // Only the no-query screen is the pin list, and only there does a row's
    // `is_dir` mean pin policy rather than node kind.
    query::open(&socket, &mountpoint, &policy, &hit, query.is_none())
 }
 /// `--feed`: one round-trip, printed for fzf to swallow.
 ///
 /// Always succeeds. A reload command that exits non-zero leaves fzf showing an
 /// empty list with no explanation, so a failure becomes a visible row instead.
 pub(crate) fn feed(query: Option<&str>) {
    let Ok(dirs) = AppDirs::new() else {
        println!("(cannot resolve app dirs)");
        return;
    };
    let limit = dirs.load_config().resolved_prompt().resolved_menu_limit();
    let socket = dirs.control_socket();
    let query = query.map(str::trim).filter(|text| !text.is_empty());
    let stdout = std::io::stdout();
    let mut out = stdout.lock();
    for line in hits(&socket, query, limit).iter().map(encode_line) {
        let _ = out.write_all(line.as_bytes());
    }
 }
 /// The rows for one screen: pins when there is nothing typed, search results
 /// otherwise — the same split the GTK prompt makes on an empty entry.
 fn hits(socket: &std::path::Path, query: Option<&str>, limit: usize) -> Vec<Hit> {
    let result = match query {
        Some(text) => query::search(socket, text, limit),
        None => query::pins(socket),
    };
    match result {
        Ok(hits) => hits,
        Err(message) => {
            // Printed as a row rather than to stderr: fzf's alternate screen
            // hides stderr, so this is the only place the user would see it.
            println!("({message})");
            Vec::new()
        }
    }
 }
 fn fzf_argv(exe: &std::path::Path, query: Option<&str>) -> Vec<String> {
    let feed = format!("{} --feed {{q}}", shell_quote(&exe.display().to_string()));
    // The sleep is the debounce: fzf kills a reload child that a later keystroke
    // superseded, so a burst of typing costs one daemon round-trip, exactly as
    // the GTK prompt's timeout does.
    let debounce = SEARCH_DEBOUNCE.as_secs_f32();
    let mut argv: Vec<String> = [
        "fzf",
        // fzf's own fuzzy matcher would re-order and re-filter what the daemon
        // already ranked, and would hide rows it does not think match.
        "--disabled",
        "--no-sort",
        "--no-multi",
        "--layout=reverse",
        "--info=inline",
        "--delimiter=\t",
        "--with-nth=1",
    ]
    .iter()
    .map(|arg| (*arg).to_string())
    .collect();
    argv.push(format!("--prompt={PROMPT}"));
    // `reload:` rather than `reload(…)`: the unparenthesised form runs to the
    // end of the argument, so an install path containing a bracket cannot
    // truncate the command fzf parses out of it.
    argv.push(format!("--bind=change:reload:sleep {debounce}; {feed}"));
    if let Some(text) = query {
        argv.push(format!("--query={text}"));
    }
    argv
 }
 /// `display\tpayload\n`. The display half is scrubbed of the delimiter and of
 /// newlines; the payload is JSON, which escapes both.
 fn encode_line(hit: &Hit) -> String {
    let display =
        format!("{}   ·   {}", hit.name(), hit.location()).replace(['\n', '\r', FIELD], " ");
    let payload = serde_json::to_string(hit).unwrap_or_default();
    format!("{display}{FIELD}{payload}\n")
 }
 /// The hit a selected line stands for, or `None` for a line that carries no
 /// payload — the error/empty row, or an empty selection (Escape).
 fn decode_line(line: &str) -> Option<Hit> {
    let (_, payload) = line.trim_end_matches('\n').rsplit_once(FIELD)?;
    serde_json::from_str(payload).ok()
 }
 fn self_exe() -> Result<PathBuf, String> {
    std::env::current_exe().map_err(|e| format!("cannot locate pdfs-prompt: {e}"))
 }
 /// POSIX single-quoting, for the one string that goes through fzf's `sh -c`.
 fn shell_quote(text: &str) -> String {
    format!("'{}'", text.replace('\'', r"'\''"))
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use pdfs_core::control::{LocalHit, SearchHit};
    fn drive(name: &str, path: &str) -> Hit {
        Hit::Drive(SearchHit {
            name: name.into(),
            path: path.into(),
            is_dir: false,
            size: 7,
            modified: 9,
            pinned: false,
            uid: "uid~1".into(),
            mounted_path: None,
            score: 42,
        })
    }
    #[test]
    fn a_line_round_trips_through_the_payload() {
        let hit = drive("notes.md", "Docs/notes.md");
        let line = encode_line(&hit);
        assert!(line.ends_with('\n'));
        let back = decode_line(&line).expect("payload decodes");
        assert_eq!(back.name(), "notes.md");
        assert_eq!(back.key(), hit.key());
        assert_eq!(back.score(), 42);
    }
    #[test]
    fn a_local_hit_round_trips_as_itself() {
        let hit = Hit::Local(LocalHit {
            name: "notes.md".into(),
            path: "/home/me/Docs/notes.md".into(),
            is_dir: false,
            size: 1,
            modified: 2,
            score: 3,
        });
        let back = decode_line(&encode_line(&hit)).expect("payload decodes");
        assert!(matches!(back, Hit::Local(_)));
        assert_eq!(back.key(), hit.key());
    }
    #[test]
    fn a_name_with_a_tab_or_newline_stays_one_line() {
        let hit = drive("two\tparts\nfile.md", "Docs/two\tparts\nfile.md");
        let line = encode_line(&hit);
        assert_eq!(line.matches('\n').count(), 1, "{line:?}");
        assert_eq!(line.matches(FIELD).count(), 1, "{line:?}");
        assert_eq!(
            decode_line(&line).expect("payload decodes").name(),
            "two\tparts\nfile.md"
        );
    }
    #[test]
    fn a_row_without_a_payload_is_not_a_hit() {
        assert!(decode_line("").is_none());
        assert!(decode_line("(cannot reach the Proton Drive daemon)").is_none());
        assert!(decode_line("bogus\tnot json").is_none());
    }
    #[test]
    fn fzf_is_told_not_to_do_its_own_matching() {
        let argv = fzf_argv(std::path::Path::new("/usr/bin/pdfs-prompt"), None);
        assert!(argv.contains(&"--disabled".to_string()), "{argv:?}");
        assert!(argv.contains(&"--no-sort".to_string()), "{argv:?}");
        assert!(
            argv.iter().any(|arg| arg.starts_with("--with-nth=")),
            "the payload field must stay hidden: {argv:?}"
        );
    }
    #[test]
    fn every_keystroke_re_runs_the_feed_after_the_debounce() {
        let argv = fzf_argv(std::path::Path::new("/usr/bin/pdfs-prompt"), Some("md"));
        let bind = argv
            .iter()
            .find(|arg| arg.starts_with("--bind=change:"))
            .expect("a change binding");
        assert!(bind.contains("reload"), "{bind}");
        assert!(bind.contains("--feed {q}"), "{bind}");
        assert!(bind.contains(&format!("sleep {}", SEARCH_DEBOUNCE.as_secs_f32())));
        assert!(argv.contains(&"--query=md".to_string()), "{argv:?}");
    }
    #[test]
    fn a_path_with_a_quote_cannot_break_out_of_the_reload_command() {
        let argv = fzf_argv(std::path::Path::new("/home/o'brien/my prompt"), None);
        let bind = argv
            .iter()
            .find(|arg| arg.starts_with("--bind=change:"))
            .expect("a change binding");
        assert!(bind.contains(r"'/home/o'\''brien/my prompt'"), "{bind}");
        // The unparenthesised reload form: a bracket in the path must not end
        // the command as far as fzf's own parser is concerned.
        assert!(bind.starts_with("--bind=change:reload:"), "{bind}");
    }
    #[test]
    fn the_terminal_runs_the_inner_role_so_it_cannot_recurse() {
        let argv = inner_command(PathBuf::from("/usr/bin/pdfs-prompt"), Some("md"));
        assert_eq!(
            argv,
            vec!["/usr/bin/pdfs-prompt", "--fzf", "--inner", "--query", "md"]
        );
        assert_eq!(
            inner_command(PathBuf::from("/usr/bin/pdfs-prompt"), Some("  ")),
            vec!["/usr/bin/pdfs-prompt", "--fzf", "--inner"],
            "a blank query is no query"
        );
    }
 }
@@ -24,6 +24,8 @@ use pdfs_core::opener::{self, OpenWith};
 mod activation;
 mod dmenu;
 mod fzf;
 mod query;
 use activation::{DriveActivation, drive_activation, mounted_or_relative, mounted_target};
 const APP_ID: &str = "io.narl.proton-drive-linux-prompt";
@@ -125,7 +127,7 @@ fn is_media(name: &str) -> bool {
 /// One row in the unified result list. The two sections hold different payloads
 /// — a Drive hit must be hydrated through the daemon before it can be opened, a
 /// local file is already on disk — but they share one keyboard cursor.
-#[derive(Clone)]
+#[derive(Clone, serde::Serialize, serde::Deserialize)]
 enum Hit {
    Drive(SearchHit),
    Local(LocalHit),
@@ -341,12 +343,20 @@ Options:
                        rofi, …) instead of the built-in GTK window. Also
                        settable permanently as \"prompt\": { \"mode\": \"dmenu\" }
                        in config.json.
  --fzf                 Search in fzf, in a terminal, re-querying the daemon on
                        every keystroke — results appear as you type, unlike
                        --dmenu. Also settable as \"prompt\": { \"mode\": \"fzf\" }.
  --gtk                 Force the built-in window, overriding that setting.
  --menu <COMMAND>      Launcher command line for --dmenu, e.g.
                        --menu 'fuzzel --dmenu --width 60'. Overrides
                        \"prompt\": { \"menu\": [...] }.
  --query <TEXT>        Search for TEXT immediately instead of opening on the
-                        pinned-files list (--dmenu only).
+                        pinned-files list (--dmenu and --fzf only).
  --feed <TEXT>         Print the hits for TEXT, one per line, and exit. This is
                        what --fzf re-runs on each keystroke; it is not meant to
                        be typed.
  --inner               Run fzf here rather than spawning a terminal. Set by the
                        terminal --fzf spawns; not meant to be typed.
  -h, --help            Show this help.
 ";
@@ -356,6 +366,12 @@ struct Args {
    mode: Option<PromptMode>,
    menu: Option<Vec<String>>,
    query: Option<String>,
    /// `--feed`: print hits for this text and exit. `Some(None)` is `--feed`
    /// with an empty argument, which fzf sends for an empty input — a real
    /// request for the pinned list, not an absent flag.
    feed: Option<Option<String>>,
    /// `--inner`: we are the process a spawned terminal is running.
    inner: bool,
 }
 fn parse_args(argv: impl Iterator<Item = String>) -> Result<Args, String> {
@@ -363,12 +379,19 @@ fn parse_args(argv: impl Iterator<Item = String>) -> Result<Args, String> {
        mode: None,
        menu: None,
        query: None,
        feed: None,
        inner: false,
    };
    let mut argv = argv.peekable();
    while let Some(arg) = argv.next() {
        match arg.as_str() {
            "--dmenu" => args.mode = Some(PromptMode::Dmenu),
            "--fzf" => args.mode = Some(PromptMode::Fzf),
            "--gtk" => args.mode = Some(PromptMode::Gtk),
            "--inner" => args.inner = true,
            // fzf passes an empty argument for an empty input, so a missing
            // value here is that case rather than a user error.
            "--feed" => args.feed = Some(argv.next().filter(|text| !text.trim().is_empty())),
            // A launcher command is one shell-ish string so it can live in a
            // keybinding; splitting on whitespace is enough for flags, and a
            // launcher argument needing spaces belongs in config.json.
@@ -416,16 +439,31 @@ fn main() -> glib::ExitCode {
        }
    };
    // A feed is fzf's own reload child, not a front end: it must print hits and
    // nothing else, so it is answered before the stored mode is even read.
    if let Some(query) = args.feed {
        fzf::feed(query.as_deref());
        return glib::ExitCode::SUCCESS;
    }
    // The stored mode makes an existing keybinding switch front ends without
    // being re-bound; an explicit flag still wins.
    let stored = AppDirs::new()
        .map(|dirs| dirs.load_config().resolved_prompt().resolved_mode())
        .unwrap_or_default();
-    if args.mode.unwrap_or(stored) == PromptMode::Dmenu {
+    let launcher = match args.mode.unwrap_or(stored) {
-        return match dmenu::run(dmenu::Options {
+        PromptMode::Dmenu => Some(dmenu::run(dmenu::Options {
            menu: args.menu,
            query: args.query,
-        }) {
+        })),
        PromptMode::Fzf => Some(fzf::run(fzf::Options {
            query: args.query,
            inner: args.inner,
        })),
        PromptMode::Gtk => None,
    };
    if let Some(result) = launcher {
        return match result {
            Ok(()) => glib::ExitCode::SUCCESS,
            Err(message) => {
                eprintln!("pdfs-prompt: {message}");
@@ -0,0 +1,194 @@
 //! The daemon side of both launcher front ends: ask for hits, open a chosen one.
 //!
 //! `--dmenu` and `--fzf` differ only in how they present a list and collect a
 //! choice. Everything between the control socket and the chosen file lives here
 //! so the two cannot drift on what a result set is or what "open" means — the
 //! same reason both already share [`Hit`] and [`rank_hits`] with the GTK prompt.
 //!
 //! Everything here is blocking and GTK-free: the callers are one-shot processes
 //! with no main loop to keep free.
 use std::path::{Path, PathBuf};
 use pdfs_core::config::AppDirs;
 use pdfs_core::control::{
    Request, Response, SearchFilters, SearchHit, SearchKind, SearchSource, send,
 };
 use pdfs_core::opener::{self, OpenWith};
 use crate::activation::{DriveActivation, drive_activation, mounted_or_relative, mounted_target};
 use crate::{Hit, file_name, is_document, is_image, is_media, rank_hits};
 /// Where the mount lives, for turning a Drive path into something an
 /// application can open. Falls back to the configured default so a momentarily
 /// unreachable daemon still produces a plausible path rather than an error.
 pub(crate) fn mountpoint(socket: &Path, dirs: &AppDirs) -> PathBuf {
    match request(socket, Request::Status) {
        Ok(Response::Status { mountpoint, .. }) => PathBuf::from(mountpoint),
        _ => dirs.default_mountpoint(),
    }
 }
 /// Pinned files — the same "you asked to keep these" set the GTK prompt opens
 /// with, and the only listing the daemon offers without a query.
 pub(crate) fn pins(socket: &Path) -> Result<Vec<Hit>, String> {
    let Response::Pins { pins } = request(socket, Request::ListPins)? else {
        return Ok(Vec::new());
    };
    Ok(pins
        .into_iter()
        .map(|pin| {
            Hit::Drive(SearchHit {
                name: file_name(&pin.path),
                path: pin.path,
                is_dir: pin.is_dir.unwrap_or(pin.recursive),
                size: 0,
                modified: 0,
                pinned: true,
                uid: pin.uid,
                mounted_path: None,
                score: 0,
            })
        })
        .collect())
 }
 pub(crate) fn search(socket: &Path, query: &str, limit: usize) -> Result<Vec<Hit>, String> {
    let reply = request(
        socket,
        Request::SearchV2 {
            query: query.to_string(),
            limit,
            filters: SearchFilters {
                sources: vec![SearchSource::Drive, SearchSource::Local],
                kind: SearchKind::All,
            },
        },
    )?;
    let Response::SearchResultsV2 {
        drive_hits,
        local_hits,
        ..
    } = reply
    else {
        return Ok(Vec::new());
    };
    let mut hits: Vec<Hit> = drive_hits.into_iter().map(Hit::Drive).collect();
    hits.extend(local_hits.into_iter().map(Hit::Local));
    rank_hits(&mut hits);
    hits.truncate(limit);
    Ok(hits)
 }
 /// Icon theme name for a hit.
 ///
 /// Coarse on purpose: `content_type_guess` would give an exact MIME name, but
 /// only with file *contents* to sniff — a Drive hit is metadata, and passing it
 /// an empty buffer answers `application-x-zerosize` for everything. The generic
 /// names below exist in every icon theme.
 pub(crate) fn icon_name(hit: &Hit) -> String {
    if hit.is_dir() {
        return "folder".to_string();
    }
    let name = hit.name();
    if is_image(name) {
        "image-x-generic"
    } else if is_media(name) {
        "video-x-generic"
    } else if is_document(name) {
        "text-x-generic"
    } else {
        "application-x-generic"
    }
    .to_string()
 }
 /// Open a chosen hit, mirroring the GTK prompt: local files are already on
 /// disk, a Drive folder or streamable file goes through the mount, and anything
 /// else is materialised by the daemon first.
 pub(crate) fn open(
    socket: &Path,
    mountpoint: &Path,
    policy: &OpenWith,
    hit: &Hit,
    from_pins: bool,
 ) -> Result<(), String> {
    match hit {
        Hit::Local(local) => {
            opener::open(policy, Path::new(&local.path), local.is_dir);
            Ok(())
        }
        Hit::Drive(drive) => {
            // A folder has no materialised form, and a pin row's `is_dir` is pin
            // policy rather than node kind, so both go to the mount unchecked.
            let unconditional = from_pins
                || matches!(
                    drive_activation(&drive.name, drive.is_dir),
                    DriveActivation::Folder | DriveActivation::MountedMedia
                );
            if unconditional {
                opener::open(
                    policy,
                    &mounted_or_relative(mountpoint, drive),
                    drive.is_dir,
                );
                return Ok(());
            }
            // Anything else the mount exposes opens there too, so an editor
            // saves back into Drive instead of into a cache blob.
            if let Some(path) = mounted_target(mountpoint, drive) {
                opener::open(policy, &path, false);
                return Ok(());
            }
            match request(
                socket,
                Request::OpenFile {
                    path: drive.path.clone(),
                    uid: Some(drive.uid.clone()),
                },
            )? {
                Response::FilePath { path } => {
                    // The reply is a content-hash blob; the rules key off the
                    // Drive name, which is what the user actually opened.
                    opener::open_named(policy, Path::new(&path), &drive.name, false);
                    Ok(())
                }
                Response::Error { message, .. } => Err(format!("could not open: {message}")),
                _ => Err("unexpected reply from the daemon".to_string()),
            }
        }
    }
 }
 /// One control-socket round-trip, with the daemon-is-down case phrased for a
 /// terminal rather than a status page.
 pub(crate) fn request(socket: &Path, request: Request) -> Result<Response, String> {
    send(socket, &request).map_err(|e| format!("cannot reach the Proton Drive daemon: {e}"))
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    fn drive(name: &str, is_dir: bool) -> Hit {
        Hit::Drive(SearchHit {
            name: name.into(),
            path: name.into(),
            is_dir,
            size: 0,
            modified: 0,
            pinned: false,
            uid: "uid".into(),
            mounted_path: None,
            score: 0,
        })
    }
    #[test]
    fn icons_are_theme_names_the_launcher_can_look_up() {
        assert_eq!(icon_name(&drive("Photos", true)), "folder");
        assert_eq!(icon_name(&drive("a.png", false)), "image-x-generic");
        assert_eq!(icon_name(&drive("a.md", false)), "text-x-generic");
        assert_eq!(icon_name(&drive("a.bin", false)), "application-x-generic");
    }
 }
@@ -2650,6 +2650,16 @@ collisions without losing the source. Simple rename-only and move-only calls
 remain synchronous. The managed live suite subsequently passed the replacement
 and combined move/rename cases.
 **Follow-up (2026-09-15, unverified):** With SDK 0.6.3 the drain sends the
 move and the rename as one `move-multiple` request carrying the target name,
 instead of renaming in the source folder and then moving. That removes the
 second call the stale requirements could hit, and the SDK retries a remaining
 `InvalidRequirements` once with the server's current name hash. A destination
 name collision now moves under a conflict name in one step. Same-folder renames
 are unchanged. The synchronous FUSE `rename` path (`serve_rename`) still renames
 then moves with its bounded retry and has not been converted. Needs a managed
 live run of the combined move/rename cases.
 ---
 ## B47 — FUSE Accepts Path Components Longer Than NAME_MAX
@@ -9,6 +9,183 @@ release ships. Migrations are forward-only — a database written by a newer cli
 refuse-to-open, not a downgrade, so rolling back a release means restoring the cache from
 scratch (user data in `staging/` and `recovery/` is never touched by this).
 ## [Unreleased]
 Nothing yet.
 ## [1.10.0] — 2026-09-15
 One-request move-and-rename in the drain, and who shared an item with you. No schema change.
 Schema: **28**; SDK bumped to `proton-sdk` / `proton-drive-rs` **0.6.3**.
 ### Added
 - **Shared with me says who shared an item, and when.** The GUI row subtitle and `pdfs
  shared-with-me` show the inviter and invite date for a share root. The invitation's signature is
  checked against the claimed inviter's keys; when it does not verify, the GUI shows a warning
  and the CLI prints one, since the sender may be forged. `DirEntry` gains `shared_by`,
  `shared_at` and `shared_by_unverified` (defaulted, so older front-ends and daemons interoperate).
 ### Changed
 - **A queued move-and-rename lands as one request.** `drain_rename` used to rename in the source
  folder and then move, with a rename-out-of-the-way step when the destination held the name. It
  now calls `move-multiple` with a target name, so there is no half-applied state between the two
  halves and no second call for the encrypted-name requirements to go stale against (B46). A
  rename that stays in the same folder still uses the rename endpoint.
 ### Fixed
 - **Moving a node with no signature email no longer fails.** Such nodes (created anonymously, e.g.
  through a public link) need the passphrase signed by the mover; SDK 0.6.3 sends that signature.
 - **A node trashed through the newer API field is recognised as trashed.** The SDK now reads
  `TrashTime` as well as the legacy `Trashed` field, so the drain no longer tries to rename a node
  that is already in the trash.
 ## [1.9.3] — 2026-09-01
 The daemon's wait-for-login loop, and the latency that fixing it introduced. No schema change.
 Schema: **28**; SDK unchanged at `proton-sdk` / `proton-drive-rs` **0.6.2**.
 ### Fixed
 - **An enabled service with no saved session no longer polls the keyring 28,800 times a day.**
  `wait_for_session` slept a flat 3 s between checks, and a check is not just a sleep — `auth::load`
  builds a fresh `keyring::Entry`, so every iteration opened a new D-Bus connection to the Secret
  Service and negotiated a session on it. The wait now backs off, and "not logged in" is said once
  at `info` instead of on every pass, which also stops the journal filling with tens of thousands
  of identical lines (`#21`).
 - **Signing in wakes the parked daemon instead of leaving the mount up to an interval late.** The
  backoff had no wake-up path: a unit started at boot reaches the ceiling within ~90 s, and
  `enable --now` is a no-op on an already-active unit, so the GUI login and the tray's Connect left
  it sleeping. `service::enable_start` now runs `enable` + `restart`, which interrupts the sleep and
  still starts a unit that is down, and `pdfs login` restarts the unit when it is already active —
  deliberately without touching `enable`, so a headless setup driving `pdfs daemon` by hand is left
  alone. The ceiling also drops from 60 s to 15 s, still an 80% cut in keyring/D-Bus wakeups
  (28,800/day → 5,760/day), bounding the worst case for paths that never reach systemd.
 ### Changed
 - The wait is extracted into `wait_for_session()`, taking the load and sleep calls as parameters,
  so the schedule is testable without a keyring and without real time passing.
 ## [1.9.2] — 2026-08-28
 Repair for photos a Takeout import filed under the day they were imported, an `fzf` launcher front
 end, and a gallery that survives 1,600 photos on one date. No schema change. Schema: **28**; SDK
 `proton-sdk` / `proton-drive-rs` **0.6.2**.
 ### Added
 - **`pdfs redate-photos`: repair photos filed under the day they were imported.** A Takeout whose
  metadata sidecars did not match imports with no capture time at all, and the SDK then seals
  "now" into every revision — a decade of photos lands on one date. The date is still in the file
  name, so this finds photos whose name disagrees with their stored capture time by more than a
  day and rewrites them: download, re-upload at the right time, carry favourites and album
  memberships across, then **trash** (never delete) the original — Proton has no API for editing a
  sealed capture time. `--dry-run` reports without touching anything, `--from`/`--to` aim the run
  at the days an import landed on, and `--limit` caps it. Followed with `pdfs redate-status`,
  stopped with `pdfs cancel-redate`.
 - **`pdfs-prompt --fzf`: launcher search that updates as you type.** A dmenu-style launcher
  (fuzzel, rofi, wofi, …) is handed one static list and filters it itself, which is why `--dmenu`
  has to make searching two steps — type, Enter, *then* results. `fzf` can re-run a command on
  every keystroke, so the new mode re-queries the daemon per keystroke (debounced to match the GTK
  prompt) and keeps `--disabled` on so the daemon's ranking, not fzf's matcher, decides the order.
  Abbreviation and typo tolerance therefore work here exactly as they do in the built-in window.
 - Started without a tty — from a WM keybinding — `--fzf` spawns a terminal for itself (foot,
  ghostty, kitty, alacritty, wezterm or xterm, whichever is installed), each with the app-id/class
  `pdfs-prompt` so a single window rule floats it. Override with `"prompt": { "terminal": [...] }`,
  where a `{cmd}` token places the command and its absence appends it. `"prompt": { "mode": "fzf" }`
  makes it the default front end for an existing keybinding.
 ### Fixed
 - **Google Photos Takeout: sidecars with a localized suffix are matched again.** Google localizes
  the `.supplemental-metadata` it appends to a photo's JSON sidecar — a German export writes
  `.ergänzende-Metadaten` — and the scanner only knew the English spelling. No sidecar matched, so
  no photo had a capture time, so every photo in the export was stamped with the moment it was
  uploaded. Matching now hangs on the photo name in front of the suffix rather than on the suffix
  itself, which is locale-agnostic, and covers the misspelt variants Google has also shipped.
 - **A photo with no usable sidecar now takes its date from its file name.** `PXL_20260818_171030868.jpg`,
  `IMG_20230219_171030.jpg`, `Screenshot_20230101-102950.png`, `IMG-20230219-WA0001.jpg` and
  `Screenshot from 2023-01-01 10-29-50.png` all carry the date the photo was taken. Read as UTC, so
  it can be hours out — but never the years out that "the moment it was imported" is. A sidecar
  still wins.
 - **An opened file or folder no longer dies with the window that opened it.** Everything launched
  through `open_with` was started in the caller's process group with the caller's stdio, which was
  invisible from a resident GUI but fatal from `--fzf`: the prompt exits the moment you choose
  something, its terminal closes, and the pty hangup killed the application it had just started —
  so an `@dir` rule like `alacritty --working-directory {}` opened nothing at all. Opened children
  now get their own process group and no inherited stdio. Affects every front end; only `--fzf`
  could observe the bug.
 ### Changed
 - **The gallery virtualises at the row, not the day.** The Photos ListView had one item per day,
  and a bind built every one of that day's tiles — fine for a normal day, ruinous for the ~1,600
  photos a Takeout import drops onto a single date, which was 1,600 widgets constructed on the main
  thread before the section could be shown. Days are now flattened into heading rows and grid rows,
  so a bind is a handful of widgets whatever the day holds. A resize or a zoom step rebuilds the row
  model (the column count decides which photos share a row) and scrolls back to the photo that was
  at the top.
 - Updated to `proton-sdk` / `proton-drive-rs` 0.6.2 (photos save-to-timeline, `enumerate_events`).
 - The daemon side of both launcher front ends — search, pins, mountpoint lookup and the
  open-a-result policy — moved out of `pdfs-gui/src/dmenu.rs` into a shared `pdfs-gui/src/query.rs`,
  so `--dmenu` and `--fzf` cannot drift on what a result set is or what "open" means. No behaviour
  change to `--dmenu`.
 ## [1.9.1] — 2026-08-21
 Thumbnails everywhere the GUI lists files, a status bar under the Files browser, and the
 repository's contribution/branding files. No schema change. Schema: **28**; SDK unchanged at
 `proton-sdk` / `proton-drive-rs` **0.6.1**.
 `exiftool` (`libimage-exiftool-perl` / `perl-image-exiftool` / `perl-Image-ExifTool`) is a new
 runtime dependency, declared in the `.deb`, `.rpm` and `PKGBUILD` packaging. It is only used to
 pull the embedded preview out of a camera RAW; without it every other image format still gets a
 thumbnail.
 ### Added
 - **Thumbnails for ordinary Drive files**, not just the Photos timeline — painted in Files (both
  the grid and the Name column of the list), Shared, Shared by me, and Trash. Standard raster
  formats (`bmp`, `gif`, `jpeg`, `png`, `tiff`, `webp`) are decoded in the daemon; camera RAWs
  (`arw`, `cr2`, `cr3`, `dng`, `nef`, `orf`, `raf`, `rw2`, and the rest of the concrete list) are
  served from their embedded preview via `exiftool`. Previews are cached beside the existing photo
  thumbnails, outside the cache-budget scan, and tagged with the node's modification time — so a
  new revision of an image can never be shown with its predecessor's thumbnail.
 - Thumbnails for visible rows are requested opportunistically as tiles scroll in, and the daemon
  drops work for listings the user has already navigated away from. The listing generation is
  issued by the daemon (`ReserveFileThumbGeneration`), not seeded from the front-end's clock.
 - **Build a whole folder tree ahead of time** from the Files toolbar: one recursive local-thumbnail
  job per daemon, with live scan/found/completed/failed progress and a Cancel that appears only
  once the daemon has acknowledged the start. The job outlives navigation — it is deliberate work,
  separate from the opportunistic per-tile requests.
 - **A Dolphin-style status bar under the Files browser**: the current listing's counts, a Zoom
  slider for the icon grid, and account storage usage. Zoom resizes the realised grid cells rather
  than rebuilding the model, so dragging the slider does not tear down the selection; the default
  size reproduces the previous fixed 72 px tiles. Capacity stays out of the bar until a real
  reading lands, and the quota fetch (60 s TTL) now also runs while Files is on screen instead of
  only in Settings.
 - Repository housekeeping: `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, `SECURITY.md`, issue and pull
  request templates, a project logo, and workspace crate metadata (`repository`, `homepage`,
  `readme`, `keywords`, `categories`).
 ### Fixed
 - A remote thumbnail miss no longer suppresses local generation. The two negative results are now
  held in separate bounded caches: "Proton has no thumbnail for this node" and "this exact revision
  was decoded locally and could not be read" mean different things, and only the second is a
  permanent verdict for that revision.
 - A RAW whose preview could not be extracted because of the *environment* — `exiftool` missing, a
  failed download — is retried instead of being remembered as undecodable. Only bytes conclusively
  outside the supported formats are cached as a negative.
 - A recursive build that finds a uid an opportunistic tile job already owns waits briefly for it
  rather than either duplicating the work or blocking on it forever, and a cancellation racing a
  waiter's registration is caught by a backstop instead of leaving the waiter parked.
 - Starting a build for a root that is already building attaches to that job; starting one for a
  *different* root is refused explicitly rather than silently reporting the running job's progress
  as the caller's.
 - Decrypted camera RAWs are staged for `exiftool` in an owner-only (`0700`) directory of their own,
  removed as soon as the preview is out and swept at cache open after an unclean shutdown.
 - The RAW extension list had `rw` (not a format) and was missing `raw`; both classification helpers
  now read from one shared table instead of two hand-maintained `matches!` arms.
 - The tray and desktop-entry icons were wrong/missing; `.desktop` files and the packaged SVG were
  corrected.
 ## [1.9.0] — 2026-08-18
 Google Photos import, and a pass over the desktop app's interaction gaps. No schema change.
@@ -501,6 +678,10 @@ First stable release: FUSE files-on-demand mount, sync daemon under `proton-driv
 - The outstanding FUSE defects tracked in `docs/BUGS.md`, plus a truncate defect, validated
  by a new POSIX compliance suite for the filesystem.
 [1.9.3]: https://github.com/narrrl/proton-drive-linux/releases/tag/v1.9.3
 [1.9.2]: https://github.com/narrrl/proton-drive-linux/releases/tag/v1.9.2
 [1.9.1]: https://github.com/narrrl/proton-drive-linux/releases/tag/v1.9.1
 [1.9.0]: https://github.com/narrrl/proton-drive-linux/releases/tag/v1.9.0
 [1.8.2]: https://github.com/narrrl/proton-drive-linux/releases/tag/v1.8.2
 [1.8.1]: https://github.com/narrrl/proton-drive-linux/releases/tag/v1.8.1
 [1.8.0]: https://github.com/narrrl/proton-drive-linux/releases/tag/v1.8.0
@@ -0,0 +1,26 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <svg width="128" height="128" viewBox="0 0 128 128" fill="none" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="Proton Drive for Linux">
  <defs>
    <linearGradient id="pdl-bg" x1="0" y1="0" x2="0" y2="128" gradientUnits="userSpaceOnUse">
      <stop offset="0" stop-color="#8B72FF"/>
      <stop offset="1" stop-color="#5A38E8"/>
    </linearGradient>
  </defs>
  <rect width="128" height="128" rx="29" fill="url(#pdl-bg)"/>
  <!-- cloud: the remote drive (symmetric about x=64) -->
  <g fill="#FFFFFF">
    <circle cx="64" cy="42" r="20"/>
    <circle cx="44" cy="52" r="14"/>
    <circle cx="84" cy="52" r="14"/>
    <rect x="32" y="50" width="64" height="16" rx="8"/>
  </g>
  <!-- pull: files arrive only when opened -->
  <g stroke="#FFFFFF" stroke-width="8" stroke-linecap="round" stroke-linejoin="round">
    <path d="M64 75v17"/>
    <path d="M53 84l11 11 11-11"/>
    <path d="M45 108h38" stroke-opacity="0.55"/>
  </g>
 </svg>
@@ -9,18 +9,20 @@
 # Build + install:   cd packaging && makepkg -fi
 pkgname=proton-drive-linux
-pkgver=1.9.0
+pkgver=1.10.0
 pkgrel=1
-pkgdesc="Proton Drive client for Linux: FUSE files-on-demand mount, CLI, GTK4 app + tray"
+pkgdesc="Unofficial Proton Drive client for Linux: files-on-demand FUSE mount, CLI, GTK4 app + tray"
 arch=('x86_64')
-url="https://github.com/narl/proton-drive-linux"
+url="https://github.com/narrrl/proton-drive-linux"
 license=('MIT')
-depends=('fuse3' 'gtk4' 'libadwaita' 'webkitgtk-6.0')
+depends=('fuse3' 'gtk4' 'libadwaita' 'webkitgtk-6.0' 'perl-image-exiftool')
 makedepends=('cargo' 'git')
 provides=('pdfs')
 # Files-on-demand mount + keyring need these at runtime.
 optdepends=('gnome-keyring: credential storage via Secret Service'
-            'xdg-utils: "Open folder" action from the tray')
+            'xdg-utils: "Open folder" action from the tray'
            'fzf: live search-as-you-type launcher (pdfs-prompt --fzf)'
            'foot: terminal for pdfs-prompt --fzf started from a keybinding')
 options=('!lto' '!debug')
 # Built in place from the checkout; nothing to fetch or checksum.
@@ -1,11 +1,11 @@
 [Desktop Entry]
 Type=Application
-Name=Proton Drive (Tray)
+Name=Proton Drive for Linux (Tray)
 GenericName=Cloud Drive Tray
-Comment=Proton Drive system tray icon
+Comment=Proton Drive status and quick actions (unofficial client)
 Exec=pdfs-tray
 Icon=io.narl.proton-drive-linux
 Terminal=false
 Categories=Network;FileTransfer;GTK;
-Keywords=proton;drive;cloud;sync;storage;
+Keywords=proton;drive;cloud;sync;storage;files;backup;
 NoDisplay=true
@@ -1,12 +1,12 @@
 [Desktop Entry]
 Type=Application
-Name=Proton Drive
+Name=Proton Drive for Linux
 GenericName=Cloud Drive
-Comment=Proton Drive files-on-demand for Linux
+Comment=Files-on-demand Proton Drive (unofficial client)
 Exec=pdfs-app
 Icon=io.narl.proton-drive-linux
 Terminal=false
 Categories=Network;FileTransfer;GTK;
-Keywords=proton;drive;cloud;sync;storage;
+Keywords=proton;drive;cloud;sync;storage;files;backup;
 StartupNotify=true
 SingleMainWindow=true
@@ -1,14 +1,26 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<svg width="128" height="128" viewBox="0 0 128 128" xmlns="http://www.w3.org/2000/svg">
+<svg width="128" height="128" viewBox="0 0 128 128" fill="none" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="Proton Drive for Linux">
  <defs>
-    <linearGradient id="g" x1="0" y1="0" x2="0" y2="1">
+    <linearGradient id="pdl-bg" x1="0" y1="0" x2="0" y2="128" gradientUnits="userSpaceOnUse">
-      <stop offset="0" stop-color="#8b6dff"/>
+      <stop offset="0" stop-color="#8B72FF"/>
-      <stop offset="1" stop-color="#6d4aff"/>
+      <stop offset="1" stop-color="#5A38E8"/>
    </linearGradient>
  </defs>
-  <rect x="8" y="8" width="112" height="112" rx="26" fill="url(#g)"/>
+
-  <!-- cloud -->
+  <rect width="128" height="128" rx="29" fill="url(#pdl-bg)"/>
-  <path fill="#ffffff" d="M44 84c-11 0-20-9-20-20 0-10 7-18 17-20 3-11 13-19 25-19 13 0 24 10 26 23 9 1 16 9 16 18 0 10-8 18-18 18z"/>
+
-  <!-- down arrow (on-demand pull) -->
+  <!-- cloud: the remote drive (symmetric about x=64) -->
-  <path d="M64 50v22m0 0l-9-9m9 9l9-9" stroke="#6d4aff" stroke-width="7" stroke-linecap="round" stroke-linejoin="round" fill="none"/>
+  <g fill="#FFFFFF">
    <circle cx="64" cy="42" r="20"/>
    <circle cx="44" cy="52" r="14"/>
    <circle cx="84" cy="52" r="14"/>
    <rect x="32" y="50" width="64" height="16" rx="8"/>
  </g>
  <!-- pull: files arrive only when opened -->
  <g stroke="#FFFFFF" stroke-width="8" stroke-linecap="round" stroke-linejoin="round">
    <path d="M64 75v17"/>
    <path d="M53 84l11 11 11-11"/>
    <path d="M45 108h38" stroke-opacity="0.55"/>
  </g>
 </svg>
@@ -12,9 +12,9 @@
 Name:           proton-drive-linux
 Version:        %{version}
 Release:        1%{?dist}
-Summary:        Proton Drive client for Linux (FUSE, CLI, GTK4 app + tray)
+Summary:        Unofficial Proton Drive client for Linux (FUSE, CLI, GTK4 app + tray)
 License:        MIT
-URL:            https://github.com/narl/proton-drive-linux
+URL:            https://github.com/narrrl/proton-drive-linux
 ExclusiveArch:  x86_64
 BuildRequires:  cargo
@@ -33,6 +33,7 @@ Requires:       gtk4
 Requires:       libadwaita
 Requires:       libsecret
 Requires:       webkitgtk6.0
 Requires:       perl-Image-ExifTool
 Requires:       xdg-utils
 # DE-specific; do not Require a single desktop environment.
@@ -40,11 +41,16 @@ Recommends:     gnome-keyring
 Recommends:     gnome-shell-extension-appindicator
 Recommends:     kwallet
 # Only for `pdfs-prompt --fzf`; every other front end works without them.
 Suggests:       fzf
 Suggests:       foot
 Provides:       pdfs = %{version}-%{release}
 %description
-Unofficial Proton Drive client featuring a FUSE files-on-demand mount,
+Files-on-demand Proton Drive for the Linux desktop: a FUSE virtual mount with
-CLI, GTK4/Libadwaita GUI, system tray, and search launcher.
+block-level caching, a scriptable CLI, and a GTK4/Libadwaita desktop app with
 system tray and search launcher. Unofficial and not affiliated with Proton AG.
 %prep
 # In-tree build: no Source tarball. Pass --define "git_dir /path/to/checkout".
@@ -1,6 +1,6 @@
 [Unit]
 Description=Proton Drive Files-On-Demand mount
-Documentation=https://github.com/narl/proton-drive-linux
+Documentation=https://github.com/narrrl/proton-drive-linux
 # Tie the mount to the desktop session: start after it is up and stop with it.
 After=graphical-session.target
 PartOf=graphical-session.target
Author	SHA1	Message	Date
nvrl	dcb2ab7fac	chore(version) bumped to 1.10.0	2026-09-15 13:59:24 +02:00
nvrl	eb56f4a1e0	feat(fuse,core,gui,cli): one-request move+rename drain, show who shared an item - A queued rename that also changes folder now lands as one `move-multiple` request carrying the target name instead of rename-then-move, so there is no half-applied state and no second call for stale name requirements to hit (B46 follow-up). A destination name collision moves under a conflict name in one step; same-folder renames still use the rename endpoint. - Shared with me shows the inviter and invite date (GUI subtitle, `pdfs shared-with-me`), with a warning when the invitation signature does not verify against the claimed inviter's keys. `DirEntry` gains `shared_by`, `shared_at` and `shared_by_unverified`, all serde-defaulted. - Bump `proton-sdk` / `proton-drive-rs` to 0.6.3 (anonymous-node moves, `TrashTime` trashed detection).	2026-09-15 13:59:13 +02:00
nvrl	c28803b037	chore(changelog) updated changelog for 1.9.2 and 1.9.3	2026-09-08 14:58:48 +02:00
nvrl	cd8474954b	chore(version) bumped to 1.9.3	2026-09-01 17:00:43 +02:00
nvrl	d7e07d042d	Merge pull request #22 from kacperpaczos/fix/login-poll-backoff fix(cli): back off while waiting for a stored session	2026-09-01 16:38:29 +02:00
nvrl	45852082c0	fix(cli,core): wake the parked login-wait daemon on sign-in The login backoff had no wake-up path. A unit started at boot sits in wait_for_session and reaches the ceiling within ~90s; the user then signs in and `enable --now` is a no-op on an already-active unit, so the daemon kept sleeping and the mount appeared up to a full interval late. - service::enable_start now runs `enable` + `restart` instead of `enable --now`, so the GUI login and the tray's Connect interrupt the sleep immediately and still start a unit that is down. - `pdfs login` restarts the unit when it is already active. It stays out of `enable` on purpose, so a headless setup driving `pdfs daemon` by hand is left alone. - Lower the backoff ceiling from 60s to 15s. It is still an 80% cut in keyring/D-Bus wakeups (28,800/day -> 5,760/day) and it bounds the worst-case latency for paths that never touch systemd. Also corrects the flat-3s-poll figure in the doc comment: 86400/3 is 28,800 checks a day, not 48,000.	2026-09-01 16:28:25 +02:00
nvrl	99ad3838e1	fix(GALLERY) fixed takeout date conversion + repair command	2026-08-28 13:06:50 +02:00
Kacper Paczos	637b512f6a	fix(cli): back off while waiting for a stored session The daemon's wait-for-login loop slept a flat 3 seconds between checks and never gave up, so an enabled service with no saved session polled the keyring 28,800 times a day. Each check is more than a sleep: auth::load() builds a fresh keyring::Entry, so every iteration opens a new D-Bus connection to the Secret Service and negotiates a session on it. Back off from 3s to a 60s ceiling and say "not logged in" once at INFO rather than on every iteration, which also stops the journal filling with tens of thousands of identical lines. The wait is extracted into wait_for_session() taking the load and sleep calls as parameters, so the schedule is testable without a keyring and without real time passing. Refs #21	2026-08-25 13:24:46 +02:00
nvrl	16ad6548c8	chore(DOCS) updated changelog	2026-08-21 23:32:06 +02:00
nvrl	847ece17d7	version bumped to 1.9.1	2026-08-21 22:48:28 +02:00
nvrl	50d2acdaba	Merge pull request #20 from emptyname-org/feature/files-thumbnails-statusbar feat(gui): add file thumbnails and a browser status bar	2026-08-21 22:44:58 +02:00
emptyname	53caf63ad4	Fix thumbnail lifecycle failures	2026-08-21 12:32:31 +01:00
nvrl	5176dd91e1	fixed icon	2026-08-21 04:13:11 +02:00
nvrl	e88903d5ff	chore(branding) added branding, best practice to repo	2026-08-21 04:09:58 +02:00
emptyname	b3e6af1ae5	docs: document thumbnail runtime support	2026-08-18 13:06:40 +01:00
emptyname	b0f9513915	feat(gui): show file thumbnails and browser status bar	2026-08-18 13:06:36 +01:00
emptyname	91b0864fce	feat(thumbnails): generate cached previews for Drive files	2026-08-18 13:06:27 +01:00