fix(fuse): fill an incomplete queued revision's gaps on a write open

A partial write whose base was not in the content cache queued an
incomplete revision, and every write open over it was refused with EIO
until the drain uploaded it. CI's one-client-lan simulation hit this on
seed 1: a create over a file whose partial edit had not drained yet.

The write open now copies the blob and fills its gaps from the remote
base with Core::fill_gaps, as the drain does, and fails only when that
fill fails (B204).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EuyxByBpK3fSWtyPkugeHz

.github/workflows/aur.yml

@@ -67,7 +67,13 @@ jobs:
             User aur
           EOF
           # Pin the host key to the fingerprint published on aur.archlinux.org.
-          ssh-keyscan -t ed25519 aur.archlinux.org > "$HOME/.ssh/known_hosts"
+          # The scan sometimes returns nothing from the runner, so retry it.
+          for attempt in 1 2 3 4 5; do
+            ssh-keyscan -T 15 -t ed25519 aur.archlinux.org > "$HOME/.ssh/known_hosts" &&
+              [ -s "$HOME/.ssh/known_hosts" ] && break
+            echo "ssh-keyscan attempt $attempt returned no key; retrying"
+            sleep 10
+          done
           ssh-keygen -lf "$HOME/.ssh/known_hosts" | grep -q 'SHA256:RFzBCUItH9LZS0cKB5UE6ceAYhBD5C8GeOBip8Z11+4'
           chown -R builder: "$HOME/.ssh"
           chmod 600 "$HOME/.ssh/aur"

.github/workflows/ci.yml

@@ -32,8 +32,14 @@ jobs:
         with:
           toolchain: '1.96'
           components: rustfmt, clippy
+          cache: false
 
+      # Tags can only restore caches saved on main, so only main saves one. The
+      # release workflow restores this key for its quality gates.
       - uses: swatinem/rust-cache@v2
+        with:
+          shared-key: debug
+          save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Formatting
         run: cargo fmt --all -- --check
@@ -57,3 +63,84 @@ jobs:
 
   # Real Proton credentials and /dev/fuse deliberately do not run on pull
   # requests. Follow docs/TESTING.md on a dedicated test-account runner.
+
+  # The seeded simulation runs (docs/TESTING.md): real FUSE
+  # daemons against an in-memory Drive, so they need /dev/fuse but no account.
+  simulation:
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install native dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            pkg-config \
+            fuse3 \
+            libfuse3-dev \
+            libgtk-4-dev \
+            libadwaita-1-dev \
+            libwebkitgtk-6.0-dev \
+            libsecret-1-dev \
+            libdbus-1-dev
+
+      - name: Install minimum supported Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: '1.96'
+          cache: false
+
+      - uses: swatinem/rust-cache@v2
+        with:
+          shared-key: debug
+          save-if: false
+
+      - name: Simulation runs
+        run: 'cargo test -p pdfs-fuse --lib --locked sim:: -- --ignored --test-threads=1'
+
+      # A hung step writes every daemon thread's stack next to the run's
+      # state; without them a hang that does not replay cannot be told apart.
+      - name: Keep the stacks of a hung run
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: simulation-stacks
+          path: /tmp/pdfs-sim-*/stacks.txt
+          if-no-files-found: ignore
+
+  # Keeps the release-profile dependencies cached on main, where the release
+  # workflow can restore them; a tag cannot reuse the caches of earlier tags.
+  release-cache:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-24.04
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install native dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            pkg-config \
+            libfuse3-dev \
+            libgtk-4-dev \
+            libadwaita-1-dev \
+            libwebkitgtk-6.0-dev \
+            libsecret-1-dev \
+            libdbus-1-dev
+
+      - name: Install minimum supported Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: '1.96'
+          cache: false
+
+      - uses: swatinem/rust-cache@v2
+        with:
+          shared-key: release
+
+      - name: Release build
+        run: cargo build --release --locked

.github/workflows/release.yml

@@ -10,8 +10,60 @@ permissions:
   contents: write
 
 jobs:
+  checks:
+    name: Release quality gates
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            pkg-config \
+            libfuse3-dev \
+            libgtk-4-dev \
+            libadwaita-1-dev \
+            libwebkitgtk-6.0-dev \
+            libsecret-1-dev \
+            libdbus-1-dev
+
+      - name: Set up Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: '1.96'
+          components: rustfmt, clippy
+          cache: false
+
+      # A tag can read the caches of main but its own caches are useless to the next
+      # tag, so this only restores what CI saved on main.
+      - name: Cache Cargo target
+        uses: swatinem/rust-cache@v2
+        with:
+          shared-key: debug
+          save-if: false
+
+      - name: Verify tag and manifest versions
+        if: startsWith(github.ref, 'refs/tags/')
+        shell: bash
+        run: |
+          tag_version="${GITHUB_REF_NAME#v}"
+          manifest_version="$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -n1)"
+          pkgbuild_version="$(sed -n 's/^pkgver=//p' packaging/PKGBUILD | head -n1)"
+          test "$tag_version" = "$manifest_version"
+          test "$tag_version" = "$pkgbuild_version"
+
+      - name: Release quality gates
+        run: |
+          cargo fmt --all -- --check
+          cargo clippy --workspace --all-targets -- -D warnings
+          cargo test --workspace --locked
+          scripts/fuse-acceptance.sh --offline-only
+
   build-release:
-    name: Build and Release
+    name: Build packages
     runs-on: ubuntu-24.04
     environment: 'rpm signing'
 
@@ -38,27 +90,14 @@ jobs:
         uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
           toolchain: '1.96'
-          components: rustfmt, clippy
+          cache: false
 
+      # Restores the release-profile dependencies that CI builds on main.
       - name: Cache Cargo target
         uses: swatinem/rust-cache@v2
-
-      - name: Verify tag and manifest versions
-        if: startsWith(github.ref, 'refs/tags/')
-        shell: bash
-        run: |
-          tag_version="${GITHUB_REF_NAME#v}"
-          manifest_version="$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -n1)"
-          pkgbuild_version="$(sed -n 's/^pkgver=//p' packaging/PKGBUILD | head -n1)"
-          test "$tag_version" = "$manifest_version"
-          test "$tag_version" = "$pkgbuild_version"
-
-      - name: Release quality gates
-        run: |
-          cargo fmt --all -- --check
-          cargo clippy --workspace --all-targets -- -D warnings
-          cargo test --workspace --locked
-          scripts/fuse-acceptance.sh --offline-only
+        with:
+          shared-key: release
+          save-if: false
 
       - name: Build release binaries
         run: |
@@ -127,7 +166,7 @@ jobs:
           Maintainer: Nils Pukropp <contact@narl.io>
           Depends: fuse3, libgtk-4-1 (>= 4.12.0), libadwaita-1-0 (>= 1.5.0), libsecret-1-0, libwebkitgtk-6.0-4, libimage-exiftool-perl
           Installed-Size: ${INSTALLED_SIZE}
-          Homepage: https://github.com/narrrl/proton-drive-linux
+          Homepage: https://proton-drive.narl.io
           Description: Unofficial Proton Drive client for Linux
            Files-on-demand Proton Drive for the Linux desktop, unaffiliated with Proton AG:
            - FUSE virtual mount with block-level caching
@@ -152,6 +191,7 @@ jobs:
             --define "_topdir $PWD/rpmbuild" \
             --define "_sourcedir $PWD" \
             --define "git_dir $PWD" \
+            --define "prebuilt 1" \
             --define "version ${RPM_VERSION}" \
             --define "_dbpath $PWD/rpmbuild/db" \
             packaging/proton-drive-linux.spec
@@ -190,8 +230,19 @@ jobs:
             *.rpm
           if-no-files-found: error
 
+  publish:
+    name: Create GitHub Release
+    needs: [checks, build-release]
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Download packages
+        uses: actions/download-artifact@v8
+        with:
+          name: proton-drive-linux-builds
+
       - name: Create GitHub Release
-        if: startsWith(github.ref, 'refs/tags/')
         uses: softprops/action-gh-release@v3
         with:
           files: |
@@ -205,7 +256,7 @@ jobs:
 
   aur:
     name: Publish AUR packages
-    needs: build-release
+    needs: publish
     if: startsWith(github.ref, 'refs/tags/')
     uses: ./.github/workflows/aur.yml
     with:

.github/workflows/test-build.yml

@@ -0,0 +1,121 @@
+name: Test build
+
+# On-demand Fedora RPM of any branch, for someone to try a fix before it ships.
+# Run it from the Actions tab ("Run workflow", pick the branch). Built inside a
+# Fedora container so the binaries link against Fedora's own GTK, libadwaita and
+# WebKitGTK, not the Ubuntu ones the release RPM is built against.
+#
+# The RPM is unsigned and versioned `<Cargo version>-1.test.<sha>`, so it sorts
+# below the release it precedes and `dnf` replaces it when that ships.
+on:
+  workflow_dispatch:
+    inputs:
+      fedora:
+        description: 'Fedora release to build on'
+        required: false
+        default: '44'
+        type: string
+      prerelease:
+        description: 'Also publish a pre-release anyone can download without a GitHub login'
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+concurrency:
+  group: test-build-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  rpm:
+    name: Fedora ${{ inputs.fedora }} RPM
+    runs-on: ubuntu-24.04
+    container: fedora:${{ inputs.fedora }}
+    steps:
+      - name: Install build dependencies
+        run: |
+          dnf install -y --setopt=install_weak_deps=False \
+            git rpm-build gcc gcc-c++ make gettext curl \
+            pkgconf-pkg-config fuse3-devel gtk4-devel libadwaita-devel \
+            libsecret-devel dbus-devel glib2-devel webkitgtk6.0-devel
+
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      # Fedora's packaged Rust can trail the workspace's minimum (1.96).
+      - name: Set up Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: '1.96'
+          cache: false
+
+      - name: Cache Cargo target
+        uses: swatinem/rust-cache@v2
+        with:
+          shared-key: fedora-test-build
+          save-if: false
+
+      - name: Build release binaries
+        run: cargo build --release --locked
+
+      - name: Package RPM
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          VERSION=$(grep -m1 '^version' Cargo.toml | cut -d'"' -f2)
+          SHORT=${GITHUB_SHA::7}
+          mkdir -p rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS,BUILDROOT,db}
+          rpmbuild -bb \
+            --nodeps \
+            --define "_topdir $PWD/rpmbuild" \
+            --define "_sourcedir $PWD" \
+            --define "git_dir $PWD" \
+            --define "prebuilt 1" \
+            --define "version ${VERSION}" \
+            --define "dist .test.${SHORT}" \
+            --define "_dbpath $PWD/rpmbuild/db" \
+            packaging/proton-drive-linux.spec
+          mkdir -p out
+          cp rpmbuild/RPMS/x86_64/*.rpm out/
+          # The bare binaries, for trying one without installing anything.
+          tar -czf "out/proton-drive-linux-${VERSION}-${SHORT}-fedora${{ inputs.fedora }}-x86_64.tar.gz" \
+            -C target/release pdfs pdfs-tray pdfs-app pdfs-prompt
+          ls -l out
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: proton-drive-linux-fedora${{ inputs.fedora }}-${{ github.sha }}
+          path: out/*
+          retention-days: 14
+          if-no-files-found: error
+
+  prerelease:
+    name: Publish pre-release
+    needs: rpm
+    if: inputs.prerelease
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - name: Download build
+        uses: actions/download-artifact@v8
+        with:
+          path: out
+          merge-multiple: true
+
+      # One rolling pre-release per branch: a new run replaces the last one, so
+      # the link a tester was given keeps pointing at the newest build.
+      - name: Publish
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          TAG="test-$(echo "${GITHUB_REF_NAME}" | tr -c 'A-Za-z0-9._\n' '-')"
+          gh release delete "$TAG" --cleanup-tag --yes 2>/dev/null || true
+          gh release create "$TAG" out/* \
+            --target "$GITHUB_SHA" \
+            --prerelease \
+            --title "Test build of ${GITHUB_REF_NAME} (${GITHUB_SHA::7})" \
+            --notes "Unsigned test build of branch \`${GITHUB_REF_NAME}\` at ${GITHUB_SHA}. Not a release; replaced by the next test build of this branch."

CONTRIBUTING.md

@@ -6,9 +6,10 @@ deliberately high — everything else is ordinary Rust review.
 
 ## Before you start
 
-- Read [`AGENTS.md`](AGENTS.md) for repository conventions and
-  [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for how the daemon, front ends, and SDK fit
-  together.
+- Read [`AGENTS.md`](AGENTS.md) for repository conventions,
+  [`docs/DEVELOPMENT.md`](docs/DEVELOPMENT.md) for building, running and debugging from source,
+  and [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for how the daemon, front ends, and SDK fit
+  together. [`docs/README.md`](docs/README.md) indexes the rest.
 - Check [`docs/BUGS.md`](docs/BUGS.md) — it is the authoritative issue ledger, and your problem may
   already be tracked there with context.
 - For anything larger than a fix, open an issue first so the design can be discussed before you
@@ -23,8 +24,9 @@ cargo build --workspace
 ```
 
 GUI and FUSE targets need the GTK4, libadwaita, WebKitGTK 6, libsecret, D-Bus, and FUSE3
-development packages listed in the [README](README.md#prerequisites). Minimum supported Rust
-version is 1.96.
+development packages listed in [`docs/INSTALL.md`](docs/INSTALL.md#build-dependencies). Minimum
+supported Rust version is 1.96. [`docs/DEVELOPMENT.md`](docs/DEVELOPMENT.md#running-from-source)
+explains how to run your build next to, or instead of, the installed service.
 
 ## Quality gates
 
@@ -37,9 +39,9 @@ cargo test --workspace --locked
 scripts/fuse-acceptance.sh --offline-only
 ```
 
-Changes to the FUSE layer, sync, or the pending-operation queue should also be exercised against a
-real mount before review — see [`docs/TESTING.md`](docs/TESTING.md). Live runs are destructive:
-use a dedicated test account, never one holding data you cannot lose.
+Changes to the FUSE layer, sync, or the queue should also pass the simulation runs and be
+exercised against a real mount before review — see [`docs/TESTING.md`](docs/TESTING.md). Live
+runs are destructive: use a dedicated test account, never one holding data you cannot lose.
 
 ## Making changes
 
@@ -51,6 +53,13 @@ use a dedicated test account, never one holding data you cannot lose.
   control-socket work stays off GTK's main thread.
 - **`staging/` and `recovery/` may hold the only copy of user data.** Nothing may clear or purge
   them opportunistically.
+- **The GUI is fully translated.** Wrap every user-visible string in the helpers from
+  `crates/pdfs-gui/src/i18n.rs`, run `po/update.sh`, and translate the new entries in every
+  catalog in `po/LINGUAS` in the same change. See [`docs/TRANSLATING.md`](docs/TRANSLATING.md).
+  The CLI and daemon messages stay in English.
+- **Document what users see.** A new command, setting or behaviour belongs in the matching page
+  under `docs/` (user guide, CLI reference or configuration) and in the `[Unreleased]` section of
+  [`docs/CHANGELOG.md`](docs/CHANGELOG.md).
 
 ## Commits and pull requests
 

Cargo.lock

@@ -3474,7 +3474,7 @@ checksum = "2ee67f1008b1ba2321834326597b8e186293b049a023cdef258527550b9935b4"
 
 [[package]]
 name = "pdfs-cli"
-version = "2.5.0"
+version = "3.2.0"
 dependencies = [
  "anyhow",
  "clap",
@@ -3485,13 +3485,15 @@ dependencies = [
  "tokio",
  "tracing",
  "tracing-subscriber",
+ "zeroize",
 ]
 
 [[package]]
 name = "pdfs-core"
-version = "2.5.0"
+version = "3.2.0"
 dependencies = [
  "async-trait",
+ "base64 0.23.1",
  "dbus-secret-service-keyring-store",
  "directories",
  "ignore",
@@ -3508,13 +3510,15 @@ dependencies = [
  "thiserror 2.0.20",
  "tokio",
  "tracing",
+ "zeroize",
  "zip",
 ]
 
 [[package]]
 name = "pdfs-fuse"
-version = "2.5.0"
+version = "3.2.0"
 dependencies = [
+ "async-trait",
  "base64 0.23.1",
  "fuser",
  "futures",
@@ -3528,12 +3532,13 @@ dependencies = [
  "sha1 0.11.0",
  "tokio",
  "tracing",
+ "tracing-subscriber",
  "zip",
 ]
 
 [[package]]
 name = "pdfs-gui"
-version = "2.5.0"
+version = "3.2.0"
 dependencies = [
  "anyhow",
  "async-channel",
@@ -3570,9 +3575,9 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pgp"
-version = "0.20.0"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1cfa4743b28656065ff4c0ba09e46b357a65e8c00fc2341e89084b82f87cbdf1"
+checksum = "ae70f4d9325a391db30d115d6191a7bb67cec856aa0bba131290f0c4e09a532a"
 dependencies = [
  "aead 0.5.2",
  "aes 0.8.4",
@@ -3773,9 +3778,9 @@ dependencies = [
 
 [[package]]
 name = "proton-drive-rs"
-version = "0.7.0"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0f6996724e51e99f03d2843828de9477afc39baa764403cb69490cabc1c4d93"
+checksum = "1e789cab811c5e73e47fd97810b78a513cb254f4dd763b4eb3cad680d6dd31da"
 dependencies = [
  "async-trait",
  "base64 0.23.1",
@@ -3800,9 +3805,9 @@ dependencies = [
 
 [[package]]
 name = "proton-sdk"
-version = "0.7.0"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91cc25654133bd5714407a1df0996eaf214a6e8e0bb95d8139bc42e7cee31c34"
+checksum = "ace260acbf88c26f5bd4aef8c8c9898c322163c56620bdef3b6dd7742bec7619"
 dependencies = [
  "aes-gcm 0.11.1",
  "async-trait",
@@ -3829,6 +3834,7 @@ dependencies = [
  "thiserror 2.0.20",
  "tokio",
  "tracing",
+ "zeroize",
 ]
 
 [[package]]

Cargo.toml

@@ -3,20 +3,20 @@ resolver = "2"
 members = ["crates/pdfs-core", "crates/pdfs-fuse", "crates/pdfs-cli", "crates/pdfs-gui"]
 
 [workspace.package]
-version = "2.5.0"
+version = "3.2.0"
 edition = "2024"
 license = "MIT"
 authors = ["Nils Pukropp <contact@narl.io>"]
 rust-version = "1.96"
 repository = "https://github.com/narrrl/proton-drive-linux"
-homepage = "https://github.com/narrrl/proton-drive-linux"
+homepage = "https://proton-drive.narl.io"
 readme = "README.md"
 keywords = ["proton", "drive", "fuse", "sync", "linux"]
 categories = ["filesystem", "command-line-utilities"]
 
 [workspace.dependencies]
-proton-sdk = { version = "0.7.0" }
-proton-drive-rs = { version = "0.7.0" }
+proton-sdk = { version = "0.8.2" }
+proton-drive-rs = { version = "0.8.2" }
 
 # Internal crates.
 pdfs-core = { path = "crates/pdfs-core" }
@@ -26,6 +26,7 @@ tokio = { version = "1", features = ["rt-multi-thread", "macros", "sync", "fs",
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 base64 = "0.23"
+zeroize = "1"
 thiserror = "2"
 anyhow = "1"
 # Non-poisoning mutexes. A handler that panics while holding a lock must not

README.md

@@ -4,513 +4,174 @@
 
 # Proton Drive for Linux
 
-**Files-on-demand Proton Drive for the Linux desktop** — a FUSE virtual mount with block-level
-caching, a scriptable CLI, and a native GTK4 app with tray and search launcher.
+**Proton Drive on the Linux desktop.** Your files as a folder that downloads on demand, synced
+local folders, Photos, sharing, and a native GTK4 app with tray and search launcher, plus a
+scriptable CLI.
+
+**[proton-drive.narl.io](https://proton-drive.narl.io)**
 
 [![CI](https://github.com/narrrl/proton-drive-linux/actions/workflows/ci.yml/badge.svg)](https://github.com/narrrl/proton-drive-linux/actions/workflows/ci.yml)
 [![Release](https://img.shields.io/github/v/release/narrrl/proton-drive-linux?sort=semver)](https://github.com/narrrl/proton-drive-linux/releases/latest)
+[![AUR](https://img.shields.io/aur/version/proton-drive-for-linux)](https://aur.archlinux.org/packages/proton-drive-for-linux)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Rust 1.96+](https://img.shields.io/badge/rust-1.96%2B-orange.svg)](https://www.rust-lang.org)
-[![Platform: Linux](https://img.shields.io/badge/platform-linux-lightgrey.svg)](#prerequisites)
+[![Buy me a coffee](https://img.shields.io/badge/Buy%20me%20a%20coffee-FFDD00?logo=buymeacoffee&logoColor=black)](https://buymeacoffee.com/narl)
 
-<img src="images/files.png" alt="The GTK4 file browser" width="820">
+<img src="images/files.png" alt="My files in the Proton Drive app" width="820">
 
 </div>
 
 > [!IMPORTANT]
 > This is an **unofficial**, community-built client. It is not affiliated with, endorsed by, or
 > supported by Proton AG. "Proton" and "Proton Drive" are trademarks of Proton AG, used here only
-> to describe what the software talks to. Use a test account first, and read
-> [`docs/RECOVERY.md`](docs/RECOVERY.md) before trusting it with data you cannot lose.
-
-## Install
-
-```bash
-# Debian / Ubuntu
-sudo apt install ./proton-drive-linux_*.deb
-
-# Fedora
-sudo dnf install ./proton-drive-linux-*.rpm
-
-# Arch Linux (AUR)
-paru -S proton-drive-for-linux        # or -git / -bin
-```
-
-Packages for each release are attached to the [latest
-release](https://github.com/narrrl/proton-drive-linux/releases/latest); see
-[Installation & Packages](#installation--packages) for details and
-[Building from Source](#building-from-source) to compile it yourself.
-
-```bash
-pdfs login          # sign in (SRP + 2FA, credentials go to the system keyring)
-pdfs status         # mount state, queued writes, cache usage
-pdfs-app            # the desktop app
-```
-
-## Contents
-
-- [Features](#features) · [Quick search](#quick-search-and-media-opening) · [Opening files](#choosing-how-files-open)
-- [Selective sync](#selective-sync-pdfsignore) · [Diagnostics](#diagnostics--maintenance) · [Scripting](#scripting---json)
-- [Performance](#performance--caching) · [Filesystem safety](#filesystem-safety) · [Screenshots](#screenshots)
-- [Prerequisites](#prerequisites) · [Building](#building-from-source) · [Packages](#installation--packages) · [Releases](#automated-releases-cicd)
-
-**Documentation:** [Architecture](docs/ARCHITECTURE.md) · [Testing](docs/TESTING.md) ·
-[Recovery](docs/RECOVERY.md) · [Development](docs/DEVELOPMENT.md) · [Translating](docs/TRANSLATING.md) ·
-[Known issues](docs/BUGS.md) · [Changelog](docs/CHANGELOG.md) ·
-[Contributing](CONTRIBUTING.md) · [Security policy](SECURITY.md)
+> to describe what the software talks to. Try it with data you have another copy of first, and
+> read [what survives a lost machine](docs/RECOVERY.md) before you rely on it.
 
 ## Features
 
-- **Files-on-Demand (FUSE)**: Mount your Proton Drive as a virtual filesystem where files are downloaded only when opened, utilizing smart block-level caching and disk-backed writes.
-- **Command-Line Interface (CLI)**: Manage your drive, authenticate, and monitor sync status directly from the terminal.
-- **Non-Blocking GTK4 Desktop App**: Browse files, manage pins, configure options, and monitor active transfers through a modern, native GUI with a fully non-blocking asynchronous main loop.
-- **File Thumbnails**: Browse locally cached image previews in Files, Shared, and Trash, including embedded previews from camera RAW files. Build a whole folder tree from the Files toolbar and resize the grid from the status bar.
-- **Shared Links & Invites**: Browse files shared with you by other users, and view/manage your own public shared links directly in the GUI.
-- **Local Backup (Computers)**: Sync and back up local directories (like Downloads, Documents, Pictures, etc.) directly to your Proton Drive account.
-- **Locations**: One page (and `pdfs locations`) listing every place Proton Drive occupies on this machine — the main mount plus each backed-up folder — with its mode, sync state, and whether it is read-only. Switching a folder between a full local copy and on-demand happens here.
-- **System Tray Integration**: Background indicator for status monitoring, quick actions, and fast sync controls.
-- **Unified Search Launcher (HUD)**: A resident Google Drive-style launcher (`pdfs-prompt`) that searches Proton Drive and local files together, ranks the best matches, tolerates abbreviations and typos, and is ideal for a system-wide hotkey. It can also present the same search in your own launcher (`--dmenu`) or, searching live as you type, in `fzf` (`--fzf`).
-- **Secure Credential Storage**: Integrates with the system Secret Service (GNOME Keyring, KWallet, etc.) with smart in-memory credential caching to avoid UI thread blockages.
-- **Proton Photos Support**: Access your Proton Photos timeline, view thumbnails, and download backed-up media natively (available in the GUI as a navigation tab and via the CLI).
-- **File Version History**: Every revision Proton Drive still holds for a file, from the browser's details pane (**Versions**) or `pdfs versions list|restore|save|rm`. Restoring is server-side — no re-upload — and an old version can be written out to a local file without touching the live one.
-- **Photo Favourites**: Star a photo in the lightbox, filter the gallery to favourites, or use `pdfs favorite <uid>` / `pdfs photos --favorites`.
-- **Photo Albums**: Browse your albums — including the ones shared with you — from the Albums view of the Photos page, or with `pdfs albums` / `pdfs album <uid>`. Album contents open in the same gallery as the timeline.
-- **Places**: The Places view of the Photos page groups photos by the town they were taken in, using the location stored with each photo, as cards or on a world map. Towns are looked up offline in [GeoNames](https://www.geonames.org/) data (CC BY 4.0), and the map is drawn offline from [Natural Earth](https://www.naturalearthdata.com/) land outlines and country borders (public domain). Each town is marked with one of its photos, and zoomed in, every photo sits where it was taken. A street map from [OpenFreeMap](https://openfreemap.org/) (© [OpenStreetMap](https://www.openstreetmap.org/copyright) contributors) can be turned on under Appearance; it is off by default because the tile server learns which parts of the world you look at. Install `iso-codes` for country names in your language.
-- **Human Verification (CAPTCHA) Recovery**: Detects sign-in gates (VPN/new IP challenges) and launches an embedded `WebKitWebView` dialog to safely complete the challenge, transparently retrying authentication with the earned token.
-- **Selective Sync (`.pdfsignore`)**: Keep build trees, dependency directories, and editor leftovers out of synced folders using gitignore-style rules.
-- **Data-Safe Offline Writes**: Durable scratch/staging files and a transactional pending queue preserve acknowledged writes across network failures and restarts.
+**Files**
 
-## Quick Search and Media Opening
+- **Your Drive as a folder.** `~/ProtonDrive` works with every program. Files download when they
+  are opened, a block at a time, so a video starts playing and a large archive can be read
+  without fetching all of it.
+- **Available offline.** Keep chosen files and folders fully downloaded; everything else is
+  cached within a size limit you set.
+- **Synced folders.** Back up folders such as `~/Documents` under your computer in Proton Drive,
+  as a full two-way copy or online only. Gitignore-style `.pdfsignore` rules, conflict copies
+  instead of overwrites, pause and bandwidth limits.
+- **Works at local speed.** Making, renaming and deleting files and folders returns at once, online
+  or offline. Changes are staged on disk and queued before they are acknowledged, so they survive
+  a lost connection, a crash or a reboot and reach Drive when they can.
 
-`pdfs-prompt` searches Drive metadata and the local home-directory index in one request. Results are ranked together rather than split by source. Matching is case-insensitive and supports exact names, prefixes, parent paths, multiple terms, punctuation-separated words, ordered abbreviations, common typos, and adjacent transpositions.
+**Desktop app**
 
-The prompt stays resident after its first launch, so invoking the shortcut again reuses and resets the existing window. Drive folders open from the mount. Audio and video results also open through FUSE, allowing media players to seek and request ranges without downloading the entire file first; ordinary Drive files are materialized into the local cache before opening.
+- **Browse** My files, Shared with me, Shared by me, Computers and Trash, with thumbnails
+  (including camera RAW), drag and drop, details and **version history**.
+- **Photos.** Timeline with favorites, albums, and Places on a map; RAW+JPEG pairs shown as one
+  photo; duplicate finder; slideshow; **import from Google Photos** (Takeout).
+- **Sharing.** Invite people as viewer, editor or admin, create public links with password and
+  expiry, accept invitations.
+- **Sync overview.** What is uploading, what is waiting, what failed and why, and a history of
+  what happened. A change Drive refuses (storage full, access taken away) shows at once, on the
+  file too, and can be exported or discarded.
+- **Tray icon** with status, pause and quick actions, and a **search launcher** (`pdfs-prompt`)
+  that searches Proton Drive and your home folder together, as its own window, through fuzzel,
+  rofi or wofi, or live in `fzf`.
+- **Restore a computer.** Continue a backup on a new machine and bring its folders back in one
+  step.
+- **Sign-in** with two-factor authentication and CAPTCHA; the session is kept in the system
+  keyring.
+- Available in English, German, Spanish, French, Italian, Dutch, Polish and Brazilian
+  Portuguese.
 
-### Using your own launcher (fuzzel, rofi, wofi, …)
+**Command line**
 
-`pdfs-prompt --dmenu` runs the same search through an external dmenu-style
-launcher instead of the built-in window, so the HUD matches the rest of a
-tiling-WM desktop:
+- About 55 `pdfs` commands cover files, sync, sharing, Photos, Trash, versions and diagnostics.
+  Query commands print JSON with `--json`.
 
-```bash
-pdfs-prompt --dmenu                                   # fuzzel/rofi/wofi/tofi/bemenu/dmenu, whichever is installed
-pdfs-prompt --dmenu --menu 'fuzzel --dmenu --width 60'
-pdfs-prompt --dmenu --query invoice                   # skip straight to a search
-```
+## Install
 
-A launcher filters a fixed list — it cannot ask for a new one per keystroke — so
-searching takes two steps, and the prompt says which step you are on:
-
-- `Search Drive ›` lists your pinned files. Type anything that isn't one of them
-  and press Enter to search for it.
-- `Drive: invoice ›` lists the results. Enter opens one; typing something else
-  and pressing Enter searches again. Escape closes.
-
-`--query` skips the first step. fuzzel and rofi also get file-type icons.
-
-To make an existing keybinding use it without re-binding, and to pin the
-launcher command, set them in `config.json`:
-
-```json
-{
-  "prompt": {
-    "mode": "dmenu",
-    "menu": ["fuzzel", "--dmenu", "--width", "60"],
-    "menu_limit": 50
-  }
-}
-```
-
-`--gtk` overrides `"mode": "dmenu"` for one invocation. A `{prompt}` token
-anywhere in `menu` is replaced by the prompt text; without one, the launcher's
-own prompt flag is appended.
-
-### Live launcher search (fzf)
-
-The two-step above exists because no dmenu-style launcher can call back for new
-results per keystroke. `fzf` can, so `pdfs-prompt --fzf` searches as you type,
-exactly like the built-in window:
-
-```bash
-pdfs-prompt --fzf                    # pinned files, then live results as you type
-pdfs-prompt --fzf --query invoice    # start on a search
-```
-
-Every keystroke re-queries the daemon (debounced, like the GTK prompt) and fzf's
-own matcher is switched off, so the ordering you see is the daemon's ranking —
-abbreviations and typos included, which a launcher filtering a fixed list cannot
-do. Enter opens; Escape closes.
-
-fzf is a terminal program, so when it is started without one — from a WM
-keybinding — it spawns a terminal for itself: foot, ghostty, kitty, alacritty,
-wezterm or xterm, whichever is installed. Each is launched with the app-id/class
-`pdfs-prompt`, so one window rule floats it whichever terminal you have. In
-Hyprland:
-
-```
-windowrulev2 = float, class:^(pdfs-prompt)$
-windowrulev2 = size 900 500, class:^(pdfs-prompt)$
-windowrulev2 = center, class:^(pdfs-prompt)$
-bind = SUPER, space, exec, pdfs-prompt --fzf
-```
-
-Set it as the default front end, and pick the terminal explicitly, in
-`config.json`:
-
-```json
-{
-  "prompt": {
-    "mode": "fzf",
-    "terminal": ["foot", "--app-id=pdfs-prompt", "--"],
-    "menu_limit": 50
-  }
-}
-```
-
-A `{cmd}` token anywhere in `terminal` is replaced by the command to run;
-without one it is appended, which is what every detected terminal expects.
-
-## Choosing How Files Open
-
-By default every result is handed to `xdg-open`. An `open_with` block in
-`config.json` overrides that per file type — for instance opening text in
-Neovim inside Alacritty, while everything else still goes to the desktop:
-
-```json
-{
-  "open_with": {
-    "terminal": ["alacritty", "-e"],
-    "rules": [
-      { "match": ["@text"], "command": ["nvim"], "terminal": true },
-      { "match": ["*.png", "*.jpg"], "command": ["imv"] }
-    ]
-  }
-}
-```
-
-- `match` takes file-name globs (`*.md`, `notes-*.txt`) or the classes `@dir`,
-  `@text`, `@document`, `@image`, `@media`, `@any`. First matching rule wins.
-- `command` is argv, not a shell line. A `{}` token is replaced by the path;
-  without one the path is appended. `$VAR` tokens expand from the environment,
-  so `["$EDITOR"]` follows your editor.
-- `"terminal": true` wraps the command in `terminal`. When that is unset, the
-  terminal comes from `$PDFS_TERMINAL`, then `$TERMINAL`, then the first known
-  emulator on `PATH`; a bare name like `TERMINAL=alacritty` gains the right
-  "run this" flag automatically.
-- `"default": [...]` replaces `xdg-open` for everything unmatched.
-
-The rules apply to the prompt (both front ends) and to the GTK browser, so a
-file opens the same way wherever it was picked. Patterns are matched against the
-Drive name — a downloaded file is stored in the cache under its content hash,
-which says nothing about its type, so matching that would send everything to
-`xdg-open`.
-
-## Selective Sync (`.pdfsignore`)
-
-Two-way synced folders skip paths matched by ignore rules, so syncing a project
-directory does not upload `node_modules/`, `target/`, or `.git/`.
-
-Rules come from two places, and both apply:
-
-1. **Per folder** — a `.pdfsignore` file at the root of the synced folder
-   (`.protonignore` also works). Gitignore syntax, including negation:
-
-   ```gitignore
-   # everything build-related
-   build/
-   *.log
-
-   # ...except this one
-   !important.log
-   ```
-
-2. **Globally** — an `ignore_patterns` list in `config.json`, applied to every
-   synced folder. When unset, sensible defaults apply: `.git/`, `.hg/`, `.svn/`,
-   `node_modules/`, `target/`, `.venv/`, `__pycache__/`, `*~`, `*.swp`, `*.tmp`,
-   `.DS_Store`, and `Thumbs.db`.
-
-   ```json
-   {
-     "ignore_patterns": ["node_modules/", "target/", "*.iso"]
-   }
-   ```
-
-   Set it to `[]` to opt out of the defaults entirely.
-
-Rules are re-read at the start of every sync pass, so edits take effect on the
-next pass without restarting the daemon.
-
-**Ignoring is never destructive.** If a rule starts matching a file that was
-already synced, its copy on Drive is left untouched — the file simply stops
-being tracked. Removing the rule later picks the existing remote file back up
-rather than re-uploading it.
-
-## Diagnostics & Maintenance
-
-When something looks wrong, `pdfs diagnose` checks the installation and prints a
-report. It runs without a daemon on purpose — the state worth diagnosing is
-usually the state where the daemon will not start:
-
-```console
-$ pdfs diagnose
-Paths
-[ok  ]   state dir: /home/you/.local/state/proton-drive-linux
-[ok  ]   database: /home/you/.local/state/proton-drive-linux/cache.db (170.3 MiB)
-
-Account
-[ok  ]   keyring session: you@proton.me
-
-Daemon
-[ok  ]   daemon responding
-[ok  ]   mounted at: /home/you/ProtonDrive
-[ok  ]   queued writes: none
-
-No problems found.
-```
-
-It exits non-zero if any check fails, so it works in a health-check script.
-
-For the local metadata database and content cache:
-
-| Command | What it does |
+| Distribution | Package |
 |---|---|
-| `pdfs cache inspect` | Database size, reclaimable space, per-table row counts, cache usage against budget |
-| `pdfs cache inspect --deep` | Also runs SQLite's integrity check — reads every page, so it is slow on a large database |
-| `pdfs cache vacuum` | Checkpoints the write-ahead log and compacts the database |
-| `pdfs cache clear` | Deletes cached file content, keeping pinned files |
+| Debian, Ubuntu 24.04 or newer | `.deb` from the [latest release](https://github.com/narrrl/proton-drive-linux/releases/latest) |
+| Fedora 44 or newer | `.rpm` from the [latest release](https://github.com/narrrl/proton-drive-linux/releases/latest) |
+| Arch Linux | [`proton-drive-for-linux`](https://aur.archlinux.org/packages/proton-drive-for-linux) (also `-bin` and `-git`) in the AUR |
+| Anything else | [Build from source](docs/INSTALL.md#build-from-source) |
 
-`vacuum` takes a write lock for its duration and needs room for a second copy of
-the database while it runs, so it is a deliberate operation rather than
-something the daemon does on a timer.
-
-Before a release, run the real-kernel acceptance suite against a dedicated test
-account and mount. See [`docs/TESTING.md`](docs/TESTING.md); it includes optional
-two-mount convergence checks and confines destructive operations to a fresh
-test directory.
-
-## Scripting (`--json`)
-
-Query commands accept a global `--json` flag and emit machine-readable output:
-
-```console
-$ pdfs --json sync list | jq '.items[] | select(.state != "idle") | .local_path'
-$ pdfs --json cache inspect | jq '.db_reclaimable_bytes'
-$ pdfs --json status | jq -r '.mount.mountpoint'
+```bash
+sudo apt install ./proton-drive-linux_*.deb        # Debian, Ubuntu
+sudo dnf install ./proton-drive-linux-*.rpm        # Fedora
+paru -S proton-drive-for-linux                     # Arch
 ```
 
-Supported on `status`, `ls`, `pins`, `sync list`, `devices list`, `transfers`,
-`activity`, and `cache inspect`. Commands that perform an action keep their
-human output — a script that needs to know whether one worked has the exit code.
+Then open **Proton Drive** from your applications menu and sign in. The app starts the background
+service, and your files appear in `~/ProtonDrive`.
 
-Two things worth relying on:
+Signing in from a terminal instead? `pdfs login` stores the session but does not start the
+service. Enable it once:
 
-- **The payload is unwrapped.** Output is `{"items": […]}`, not the daemon's
-  internal `{"SyncFolders": {"items": […]}}`, so scripts never name an internal
-  variant.
-- **Errors still fail.** A daemon-side error prints its JSON body (with a
-  machine-readable `kind`) on stdout *and* exits non-zero, so `set -e` and
-  `if pdfs …` behave as expected rather than treating a failed lookup as
-  success.
+```bash
+pdfs login
+systemctl --user enable --now proton-drive.service
+pdfs status
+```
 
-## Performance & Caching
+[docs/INSTALL.md](docs/INSTALL.md) has the requirements, optional extras (tray on GNOME, RAW and
+video thumbnails), headless use and uninstalling.
 
-The client includes several optimizations designed for high efficiency, a low memory footprint, and a responsive user experience:
+## Documentation
 
-- **On-Demand Block Cache**: Files are read in fixed 4 MiB blocks. For unpinned files, the client fetches and caches only the blocks containing the requested byte ranges. This enables fast sequential and sparse reads (e.g. media streaming or metadata scanning) without downloading entire files.
-- **Disk-Backed Writes**: Large file writes are staged on disk in temporary scratch files (rather than fully buffered in RAM) and track modified byte intervals. Only the unedited remote segments are fetched at commit time, keeping memory usage minimal.
-- **Non-Blocking GTK4 Loop**: To prevent UI freezes, all synchronous D-Bus credential checks, control socket requests, and cache usage calculations are offloaded to background worker threads or fetched asynchronously.
-- **Flicker-Free UI Rendering**: The GTK4 application performs differential rendering of the pins list, only modifying list rows when the list content changes, preserving the user's scroll position and widget focus.
-- **Durable Staging**: Scratch metadata and staged writes are synced and atomically published before an upload is acknowledged locally. Rapid revisions supersede pending work transactionally.
-
-## Filesystem Safety
-
-Version 1.0 strengthens the boundaries around local-only data and destructive reconciliation:
-
-- Truncate composes with queued revisions, preserving the authoritative prefix and correct zero-filled growth.
-- Combined move-and-rename operations are queued durably and tolerate partially completed remote state.
-- Session tombstones prevent successfully unlinked entries from reappearing through eventually consistent listings.
-- Names are valid UTF-8 and no longer than Linux's 255-byte component limit.
-- Incomplete mirror scans are non-destructive, and total-wipe protection covers every non-empty baseline.
-- Failed conflict preservation, local deletion, or staging publication does not settle a new baseline or discard the only local copy.
-- State, cache, and config directories must be real, current-user-owned `0700` directories; control sockets are `0600`.
+| | |
+|---|---|
+| [User guide](docs/USER_GUIDE.md) | Everything the app, tray and launcher do |
+| [Command-line reference](docs/CLI.md) | Every `pdfs` command and scripting with `--json` |
+| [Configuration](docs/CONFIGURATION.md) | `config.json`, file locations, environment variables, the service |
+| [Troubleshooting](docs/TROUBLESHOOTING.md) | Diagnosing problems and fixing common ones |
+| [Recovering on a new computer](docs/RECOVERY.md) | Getting your synced folders back after a reinstall or a lost machine |
+| [Changelog](docs/CHANGELOG.md) | What changed in each release |
 
+For contributors: [development guide](docs/DEVELOPMENT.md), [architecture](docs/ARCHITECTURE.md),
+[testing](docs/TESTING.md), [translating](docs/TRANSLATING.md), [roadmap](docs/ROADMAP.md) and the
+[bug ledger](docs/BUGS.md). The [documentation index](docs/README.md) lists everything.
 
 ## Screenshots
 
-### GUI Application & Launcher
-
 <table>
   <tr>
-    <td align="center" width="50%"><img src="images/login.png" alt="Login Screen" width="100%"><br><sub><b>Login Screen</b></sub></td>
-    <td align="center" width="50%"><img src="images/files.png" alt="Files Browser" width="100%"><br><sub><b>Files Browser</b></sub></td>
+    <td align="center" width="50%"><img src="images/files.png" alt="My files" width="100%"><br><sub><b>My files</b></sub></td>
+    <td align="center" width="50%"><img src="images/photos.png" alt="Photos timeline" width="100%"><br><sub><b>Photos</b></sub></td>
   </tr>
   <tr>
-    <td align="center" width="50%"><img src="images/shared.png" alt="Shared Links" width="100%"><br><sub><b>Shared Links</b></sub></td>
-    <td align="center" width="50%"><img src="images/shared_with_me.png" alt="Shared with me" width="100%"><br><sub><b>Shared with me</b></sub></td>
+    <td align="center" width="50%"><img src="images/photos_map.png" alt="Photos places map" width="100%"><br><sub><b>Places</b></sub></td>
+    <td align="center" width="50%"><img src="images/computers.png" alt="Computers" width="100%"><br><sub><b>Computers</b></sub></td>
   </tr>
   <tr>
-    <td align="center" width="50%"><img src="images/restore_devices.png" alt="Local Backups (Computers)" width="100%"><br><sub><b>Local Backups (Computers)</b></sub></td>
-    <td align="center" width="50%"><img src="images/photos.png" alt="Photos Timeline" width="100%"><br><sub><b>Photos Timeline</b></sub></td>
+    <td align="center" width="50%"><img src="images/sync.png" alt="Sync folders" width="100%"><br><sub><b>Sync</b></sub></td>
+    <td align="center" width="50%"><img src="images/conflicts.png" alt="Sync history showing resolved conflicts" width="100%"><br><sub><b>Sync history</b></sub></td>
   </tr>
   <tr>
-    <td align="center" width="50%"><img src="images/prompt_gtk.png" alt="Search Launcher Prompt (GTK)" width="100%"><br><sub><b>Search Launcher Prompt (GTK)</b></sub></td>
-    <td align="center" width="50%"><img src="images/prompt_fzf.png" alt="Search Launcher Prompt (fzf)" width="100%"><br><sub><b>Search Launcher Prompt (fzf)</b></sub></td>
+    <td align="center" width="50%"><img src="images/prompt_gtk.png" alt="Search launcher" width="100%"><br><sub><b>Search launcher</b></sub></td>
+    <td align="center" width="50%"><img src="images/prompt_fzf.png" alt="Search launcher in fzf" width="100%"><br><sub><b>Search launcher in fzf</b></sub></td>
   </tr>
   <tr>
-    <td align="center" width="50%"><img src="images/activity.png" alt="Activity" width="100%"><br><sub><b>Activity</b></sub></td>
-    <td align="center" width="50%"><img src="images/settings.png" alt="Settings" width="100%"><br><sub><b>Settings</b></sub></td>
+    <td align="center" width="50%"><img src="images/login.png" alt="Sign in" width="100%"><br><sub><b>Sign in</b></sub></td>
+    <td></td>
   </tr>
 </table>
 
----
+## How it works
 
-## Prerequisites
+A background service (`proton-drive.service`, the `pdfs daemon` command) holds your session,
+mounts `~/ProtonDrive` through FUSE, runs the upload queue and the sync engine, and follows
+Proton's event stream for changes made elsewhere. The app, the tray, the launcher and the CLI are
+clients of that service over a local socket. Everything is end-to-end encrypted with your Proton
+keys before it leaves the machine, through a Rust implementation of Proton's Drive SDK.
 
-To compile the application from source or run the built binaries, ensure you have the following system libraries installed on your distribution:
-
-### Ubuntu / Debian (24.04+)
-```bash
-sudo apt-get update
-sudo apt-get install -y \
-  pkg-config \
-  libfuse3-dev \
-  libgtk-4-dev \
-  libadwaita-1-dev \
-  libwebkitgtk-6.0-dev \
-  libsecret-1-dev \
-  libdbus-1-dev \
-  libimage-exiftool-perl
-```
-
-### Arch Linux
-```bash
-sudo pacman -S --needed pkgconf fuse3 gtk4 libadwaita libsecret dbus webkitgtk-6.0 perl-image-exiftool
-```
-
-### Fedora (44+)
-```bash
-sudo dnf install -y \
-  pkgconf-pkg-config fuse3-devel gtk4-devel libadwaita-devel \
-  webkitgtk6.0-devel libsecret-devel dbus-devel glib2-devel \
-  perl-Image-ExifTool cargo rust
-```
-
-Runtime extras (pick your desktop):
-```bash
-# GNOME — keyring + tray (AppIndicator)
-sudo dnf install -y gnome-keyring gnome-shell-extension-appindicator xdg-utils
-
-# KDE Plasma — KWallet (Secret Service); tray works via built-in SNI
-sudo dnf install -y kwallet xdg-utils
-```
-
----
-
-## Building from Source
-
-Ensure you have Rust and Cargo installed (minimum supported Rust version is 1.96).
-
-1. Clone the repository and navigate into the project directory:
-   ```bash
-   git clone https://github.com/narrrl/proton-drive-linux.git
-   cd proton-drive-linux
-   ```
-2. Build the workspace in release mode:
-   ```bash
-   cargo build --release --locked
-   ```
-
-The compiled binaries will be available under `target/release/`:
-- `pdfs`: The CLI utility.
-- `pdfs-app`: The GTK4 application.
-- `pdfs-tray`: The tray status notifier.
-- `pdfs-prompt`: The launcher prompt for quick HUD search.
-
----
-
-## Installation & Packages
-
-### 1. Debian / Ubuntu (.deb)
-Install the debian package via `dpkg` or `apt`:
-```bash
-sudo apt install ./proton-drive-linux_*.deb
-```
-
-### 2. Arch Linux (AUR)
-Three AUR packages cover the usual choices; they conflict with each other, so
-install one:
-
-| Package | Contents |
-| --- | --- |
-| [`proton-drive-for-linux`](https://aur.archlinux.org/packages/proton-drive-for-linux) | builds the latest tagged release from source |
-| [`proton-drive-for-linux-git`](https://aur.archlinux.org/packages/proton-drive-for-linux-git) | builds `main` from git |
-| [`proton-drive-for-linux-bin`](https://aur.archlinux.org/packages/proton-drive-for-linux-bin) | installs the release binaries, no compile |
-
-```bash
-paru -S proton-drive-for-linux        # or any AUR helper
-```
-
-The package sources live in `packaging/aur/`; see
-[`packaging/aur/README.md`](packaging/aur/README.md) for how they are updated and
-published. A local `PKGBUILD` that compiles the working tree in place is still
-available for development builds:
-```bash
-cd packaging && makepkg -fi
-```
-
-### 3. Fedora (local RPM)
-A local `.spec` is available under `packaging/`. From the repository root:
-```bash
-sudo dnf install -y rpm-build
-rpmbuild -bb packaging/proton-drive-linux.spec \
-  --define "git_dir $PWD" \
-  --define "_rpmdir $PWD/packaging/out" \
-  --define "_builddir $PWD/packaging/build" \
-  --define "_sourcedir $PWD" \
-  --define "_specdir $PWD/packaging" \
-  --define "_srcrpmdir $PWD/packaging/out"
-sudo dnf install packaging/out/x86_64/proton-drive-linux-*.rpm
-```
-
----
-
-## Automated Releases (CI/CD)
-
-This project has a GitHub Actions CI workflow configured under `.github/workflows/release.yml`.
-
-### How it works:
-1. **Triggers**: 
-   - Pushing a git tag matching `v*` (e.g. `git tag v0.1.0 && git push origin v0.1.0`).
-   - Manual runs via the **Actions** tab in GitHub (**workflow_dispatch**).
-2. **Quality Gates and Build Process**:
-   - For tagged builds, verifies that the tag, workspace version, and `packaging/PKGBUILD` version agree.
-   - Runs `cargo fmt`, Clippy with warnings denied, the locked workspace test suite, and the account-free FUSE acceptance contract.
-   - Spawns an Ubuntu runner and installs GTK4, Libadwaita, FUSE3, and Secret Service packages.
-   - Sets up the Rust compiler and caches build targets to speed up runs.
-   - Compiles the workspace members in release mode.
-3. **Artifact Packaging**:
-   - Generates a `.tar.gz` containing the raw binaries (`pdfs`, `pdfs-app`, `pdfs-tray`, `pdfs-prompt`).
-   - Packs them into Debian (`.deb`) and Fedora (`.rpm`) packages.
-   - Includes the systemd user service and tray autostart entry in the Debian package.
-4. **Publishing**:
-   - Creates a GitHub Release matching the pushed tag and uploads the `.deb`, `.rpm`, and `.tar.gz` packages as release assets.
-   - For manual runs, compiles and exposes the packages as workflow run artifacts for testing.
-
----
+Files you open are decrypted into a local cache so programs can read them. What that means for
+the security of the machine is spelled out in the
+[threat model](docs/ARCHITECTURE.md#10-threat-model-what-this-client-writes-to-disk-in-plaintext).
 
 ## Contributing
 
-Bug reports, packaging fixes, and patches are welcome — see [CONTRIBUTING.md](CONTRIBUTING.md) for
-the workflow and the quality gates CI enforces, and [SECURITY.md](SECURITY.md) for reporting a
-vulnerability privately.
+Bug reports, translations and patches are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for the
+workflow and the checks CI runs, and [SECURITY.md](SECURITY.md) to report a vulnerability
+privately.
 
-The app, tray and search prompt are available in English, German, Spanish, French, Italian, Dutch,
-Polish and Brazilian Portuguese. [docs/TRANSLATING.md](docs/TRANSLATING.md) explains how to improve
-a translation or add a language.
+## Support
+
+Proton Drive Linux is free and built in spare time. If it saves you a few headaches, you can
+[buy me a coffee](https://buymeacoffee.com/narl).
+
+<a href="https://buymeacoffee.com/narl"><img src="https://img.shields.io/badge/Buy%20me%20a%20coffee-FFDD00?logo=buymeacoffee&logoColor=black" alt="Buy me a coffee"></a>
 
 ## License
 
 Released under the [MIT License](LICENSE).
 
+The Places map uses [GeoNames](https://www.geonames.org/) data (CC BY 4.0) and
+[Natural Earth](https://www.naturalearthdata.com/) outlines (public domain). The optional street
+map comes from [OpenFreeMap](https://openfreemap.org/), © [OpenStreetMap](https://www.openstreetmap.org/copyright)
+contributors.
+
 Proton Drive is a service of Proton AG. This project is an independent client and carries no
 affiliation with or endorsement from Proton AG.

SECURITY.md

@@ -30,5 +30,10 @@ the interesting boundaries are:
 - **Cryptography.** Key derivation, signature handling, and anything that could publish plaintext
   or the wrong key material to Proton.
 
+What the client deliberately keeps in plaintext on disk, and why, is documented in the
+[threat model](docs/ARCHITECTURE.md#10-threat-model-what-this-client-writes-to-disk-in-plaintext).
+Behaviour described there is known and not a vulnerability by itself; a way to make it worse
+than described is.
+
 Out of scope: vulnerabilities in Proton's own service (report those to Proton AG), and issues that
 require an attacker who already has your user account on the machine.

crates/pdfs-cli/Cargo.toml

@@ -23,3 +23,4 @@ tracing-subscriber.workspace = true
 clap.workspace = true
 rpassword.workspace = true
 serde_json.workspace = true
+zeroize.workspace = true

crates/pdfs-cli/src/main.rs

@@ -14,12 +14,45 @@ use pdfs_core::cache::ContentCache;
 use pdfs_core::config::AppDirs;
 use pdfs_core::control::{
     ConflictKeep, ErrorKind, MountKind, RefreshScope, Request as CtlRequest,
-    Response as CtlResponse, RestoreItem as CtlRestoreItem, ShareEntryKind, SyncPhase,
+    Response as CtlResponse, RestoreItem as CtlRestoreItem, ShareEntryKind, SyncIssue, SyncPhase,
     pending_summary,
 };
 use pdfs_core::db::Db;
 use pdfs_core::service;
 
+/// `println!` for this binary, shadowing std's, which panics when stdout is
+/// closed: `pdfs ls | head` ended in a "Broken pipe" panic once `head` had its
+/// lines. This one hands the failure to [`stdout_written`] instead.
+///
+/// Restoring the default `SIGPIPE` would also stop the panic, but the same
+/// binary runs the daemon, which must not die when a socket's peer goes away.
+macro_rules! println {
+    ($($arg:tt)*) => {{
+        use std::io::Write as _;
+        $crate::stdout_written(writeln!(std::io::stdout(), $($arg)*))
+    }};
+}
+
+/// [`println!`] without the newline.
+macro_rules! print {
+    ($($arg:tt)*) => {{
+        use std::io::Write as _;
+        $crate::stdout_written(write!(std::io::stdout(), $($arg)*))
+    }};
+}
+
+/// Exit on a failed write to stdout. A closed pipe means the reader has all it
+/// wanted, so that exit is a success.
+fn stdout_written(result: std::io::Result<()>) {
+    if let Err(error) = result {
+        if error.kind() == std::io::ErrorKind::BrokenPipe {
+            std::process::exit(0);
+        }
+        eprintln!("Error: writing to stdout: {error}");
+        std::process::exit(1);
+    }
+}
+
 #[derive(Parser)]
 #[command(
     name = "pdfs",
@@ -30,7 +63,7 @@ struct Cli {
     /// Emit machine-readable JSON instead of formatted text.
     ///
     /// Applies to the query commands (`status`, `ls`, `pins`, `sync list`,
-    /// `devices list`, `locations`, `transfers`, `activity`, `cache inspect`). Commands that
+    /// `devices list`, `locations`, `transfers`, `activity`, `trash`, `cache inspect`). Commands that
     /// perform an action keep their human output — a script that needs to know
     /// whether one succeeded has the exit code.
     #[arg(long, global = true)]
@@ -102,6 +135,24 @@ enum Command {
         /// Account email; prompted if omitted.
         #[arg(short, long)]
         username: Option<String>,
+        /// For a two-password account, keep the mailbox password's unlock in the
+        /// system keyring so the daemon starts without asking after every login.
+        /// Without it the unlock lives in kernel memory for this session only.
+        #[arg(long)]
+        remember: bool,
+    },
+    /// Enter the mailbox password of a two-password account so the daemon can
+    /// unlock your files. Needed once per login session.
+    Unlock {
+        /// Keep the unlock in the system keyring instead of kernel memory only.
+        #[arg(long)]
+        remember: bool,
+    },
+    /// Forget the unlock held in kernel memory; the account is locked again.
+    Lock {
+        /// Also remove an unlock kept in the keyring with `--remember`.
+        #[arg(long)]
+        forget: bool,
     },
     /// Forget the stored session.
     Logout,
@@ -285,26 +336,34 @@ enum Command {
     },
     /// Rename a file or folder via the running daemon.
     Rename {
-        /// File/folder path, inside the mountpoint or relative to it.
+        /// File/folder path, inside My files or an on-demand synced folder, or
+        /// relative to the mountpoint.
         path: PathBuf,
         /// New name (a single path component).
         new_name: String,
     },
-    /// Move a file or folder into another folder via the running daemon.
+    /// Move files or folders into another folder via the running daemon.
+    ///
+    /// The paths may be in different locations: My files and any synced
+    /// folder, on-demand or mirrored. The move happens on Proton Drive, so
+    /// nothing is downloaded or uploaded again, unlike `mv` between two
+    /// locations. The last path is the destination folder.
     Move {
-        /// File/folder path, inside the mountpoint or relative to it.
-        path: PathBuf,
-        /// Destination folder path, inside the mountpoint or relative to it.
-        new_parent: PathBuf,
+        /// Files/folders to move, then the destination folder: each inside a
+        /// location, or relative to the mountpoint.
+        #[arg(required = true, num_args = 2.., value_name = "PATH")]
+        paths: Vec<PathBuf>,
     },
     /// Trash a file or folder via the running daemon.
     Rm {
-        /// File/folder path, inside the mountpoint or relative to it.
+        /// File/folder path, inside My files or an on-demand synced folder, or
+        /// relative to the mountpoint.
         path: PathBuf,
     },
     /// Create a folder via the running daemon.
     Mkdir {
-        /// Parent folder path, inside the mountpoint or relative to it.
+        /// Parent folder path, inside My files or an on-demand synced folder,
+        /// or relative to the mountpoint.
         parent: PathBuf,
         /// New folder name (a single path component).
         name: String,
@@ -569,6 +628,15 @@ enum DeviceCmd {
         #[arg(long, conflicts_with = "uid")]
         clear: bool,
     },
+    /// Move another computer's folders into this computer's backup and sync
+    /// them here. The other computer stays registered, without those folders.
+    Migrate {
+        /// Device uid (from `devices list`).
+        uid: String,
+        /// Skip the confirmation and accept every proposed local path.
+        #[arg(long)]
+        yes: bool,
+    },
 }
 
 #[derive(Subcommand)]
@@ -636,6 +704,25 @@ enum SyncCmd {
     },
     /// List uploads and changes not yet on Proton Drive.
     Queue,
+    /// List queued changes Proton Drive refused or that keep failing, and what to do.
+    Issues,
+    /// Save the content of a queued upload (by id from `sync queue`) to a file.
+    Export {
+        /// Queue id.
+        id: i64,
+        /// Where to save it: a new file, or an existing folder to save it in.
+        dest: PathBuf,
+    },
+    /// Drop a queued change (by id from `sync queue`) and undo it here: a new file
+    /// or folder goes, anything else goes back to what Proton Drive has. Its
+    /// content is lost unless saved with `sync export` first.
+    Discard {
+        /// Queue id.
+        id: i64,
+        /// Do not ask first.
+        #[arg(long)]
+        yes: bool,
+    },
     /// Retry a queued operation now (by id from `sync queue`), or every failed one.
     Retry {
         /// Queue id; omit to retry every failed operation.
@@ -743,7 +830,9 @@ fn main() -> Result<()> {
     let cli = Cli::parse();
     JSON_OUTPUT.store(cli.json, std::sync::atomic::Ordering::Relaxed);
     match cli.command {
-        Command::Login { username } => cmd_login(username),
+        Command::Login { username, remember } => cmd_login(username, remember),
+        Command::Unlock { remember } => cmd_unlock(remember),
+        Command::Lock { forget } => cmd_lock(forget),
         Command::Logout => cmd_logout(),
         Command::Status => cmd_status(),
         Command::Locations => cmd_locations(),
@@ -800,7 +889,10 @@ fn main() -> Result<()> {
             scope,
         } => cmd_search(query, limit, scope),
         Command::Rename { path, new_name } => cmd_rename(path, new_name),
-        Command::Move { path, new_parent } => cmd_move(path, new_parent),
+        Command::Move { mut paths } => {
+            let new_parent = paths.pop().expect("clap requires at least two paths");
+            cmd_move(paths, new_parent)
+        }
         Command::Rm { path } => cmd_rm(path),
         Command::Mkdir { parent, name } => cmd_mkdir(parent, name),
         Command::Upload { sources, parent } => cmd_upload(sources, parent),
@@ -884,6 +976,24 @@ fn cmd_devices(action: DeviceCmd) -> Result<()> {
             let uid = if clear { None } else { uid };
             ok_or_bail(control_request(CtlRequest::AdoptDevice { uid })?)?
         }
+        DeviceCmd::Migrate { uid, yes } => {
+            if !yes {
+                println!(
+                    "Every folder that device backs up moves into this computer's backup.\n\
+                     The device stays registered, without those folders. Stop Proton Drive\n\
+                     on that computer first, or it sees its folders disappear."
+                );
+                confirm("Move them here?")?;
+            }
+            let response = control_request(CtlRequest::MigrateDevice { uid })?;
+            // A script gets the one reply and runs `sync restore` itself.
+            if emit_json(&response)? {
+                return Ok(());
+            }
+            ok_or_bail(response)?;
+            // The folders are this device's now, so the plain restore offers them.
+            cmd_sync_restore(yes, None)?
+        }
     }
     Ok(())
 }
@@ -984,7 +1094,17 @@ fn cmd_sync(action: SyncCmd) -> Result<()> {
             })?)?
         }
         SyncCmd::Queue => return cmd_sync_queue(),
+        SyncCmd::Issues => return cmd_sync_issues(),
+        SyncCmd::Export { id, dest } => return cmd_sync_export(id, &dest),
         SyncCmd::Limit { up, down } => return cmd_sync_limit(up, down),
+        SyncCmd::Discard { id, yes } => {
+            if !yes {
+                confirm(&format!(
+                    "Discard queued change {id} and undo it here? Content not exported is lost."
+                ))?;
+            }
+            ok_or_bail(control_request(CtlRequest::DiscardPendingOp { id })?)?
+        }
         SyncCmd::Retry { id } => ok_or_bail(control_request(CtlRequest::RetryPendingOp { id })?)?,
         SyncCmd::Resume { folder: None } => {
             ok_or_bail(control_request(CtlRequest::SetSyncPaused {
@@ -1062,6 +1182,9 @@ fn cmd_sync_queue() -> Result<()> {
                     (false, _) => "due now".to_string(),
                 };
                 println!("[{}]  {}  {}  ({state})", op.id, op.kind, op.path);
+                if let Some(issue) = op.issue {
+                    println!("      needs attention: {}", issue_text(issue));
+                }
                 if let Some(error) = &op.last_error {
                     println!("      failed {} time(s): {error}", op.attempts);
                 }
@@ -1073,6 +1196,91 @@ fn cmd_sync_queue() -> Result<()> {
     Ok(())
 }
 
+/// `pdfs sync issues`: the queued changes that need the user, and what to do.
+fn cmd_sync_issues() -> Result<()> {
+    let response = control_request(CtlRequest::ListPendingOps)?;
+    let items = match response {
+        CtlResponse::PendingOps { items } => items,
+        CtlResponse::Error { message, kind } => bail!("{}", cli_error(kind, &message)),
+        other => bail!("unexpected response: {other:?}"),
+    };
+    let issues: Vec<_> = items.into_iter().filter(|op| op.failing).collect();
+    if json_enabled() {
+        println!("{}", serde_json::to_string_pretty(&issues)?);
+        return Ok(());
+    }
+    if issues.is_empty() {
+        println!("No sync issues.");
+        return Ok(());
+    }
+    for op in issues {
+        println!("[{}]  {}  {}", op.id, op.kind, op.path);
+        match op.issue {
+            Some(issue) => println!("      {}", issue_text(issue)),
+            None => println!("      keeps failing; it is retried."),
+        }
+        if let Some(error) = &op.last_error {
+            println!("      last error: {error}");
+        }
+        if op.exportable {
+            println!(
+                "      save a copy: pdfs sync export {} <file or folder>",
+                op.id
+            );
+        }
+    }
+    Ok(())
+}
+
+/// What a sync issue means, and what the user can do about it.
+fn issue_text(issue: SyncIssue) -> &'static str {
+    match issue {
+        SyncIssue::Quota => {
+            "Proton Drive storage is full. Free up space or upgrade; the change is retried."
+        }
+        SyncIssue::Access => {
+            "you can no longer change this on Proton Drive, for example because a share was \
+             revoked. Save a copy to keep the content."
+        }
+        SyncIssue::Missing => {
+            "the file or its folder is gone from Proton Drive. Save a copy to keep the content."
+        }
+        SyncIssue::Limit => {
+            "the folder holds too many items or is nested too deep. Move the file to another \
+             folder."
+        }
+        SyncIssue::Rejected => {
+            "Proton Drive rejected the change, for example the name. Rename the file."
+        }
+        SyncIssue::Unknown => "Proton Drive refused the change.",
+    }
+}
+
+/// `pdfs sync export`: save a queued upload's content. A folder as `dest`
+/// gets the file under its own name.
+fn cmd_sync_export(id: i64, dest: &Path) -> Result<()> {
+    let mut dest =
+        std::path::absolute(dest).with_context(|| format!("resolving {}", dest.display()))?;
+    if dest.is_dir() {
+        let items = match control_request(CtlRequest::ListPendingOps)? {
+            CtlResponse::PendingOps { items } => items,
+            CtlResponse::Error { message, kind } => bail!("{}", cli_error(kind, &message)),
+            other => bail!("unexpected response: {other:?}"),
+        };
+        let Some(op) = items.iter().find(|op| op.id == id) else {
+            bail!("no queued change {id}; see `pdfs sync queue`");
+        };
+        let name = Path::new(&op.path)
+            .file_name()
+            .with_context(|| format!("{} has no file name", op.path))?;
+        dest.push(name);
+    }
+    ok_or_bail(control_request(CtlRequest::ExportPendingOp {
+        id,
+        dest: dest.display().to_string(),
+    })?)
+}
+
 /// `pdfs sync restore`: list what this machine's device holds, confirm where
 /// each folder should land, then hand the mapping to the daemon.
 ///
@@ -1620,7 +1828,7 @@ fn prompt_line(label: &str) -> Result<String> {
     Ok(line.trim().to_owned())
 }
 
-fn cmd_login(username: Option<String>) -> Result<()> {
+fn cmd_login(username: Option<String>, remember: bool) -> Result<()> {
     let username = match username {
         Some(u) => u,
         None => prompt_line("Proton email")?,
@@ -1632,20 +1840,32 @@ fn cmd_login(username: Option<String>) -> Result<()> {
         prompt_line("2FA code").map_err(|e| pdfs_core::Error::Other(format!("read 2FA code: {e}")))
     };
 
+    // Only a two-password account is ever asked for this.
+    let get_mailbox = |attempt: u32| prompt_mailbox(attempt, remember);
+
+    // Proton may ask for a CAPTCHA first, usually on a VPN. The CLI has no
+    // browser engine, so the user solves the page in their own browser and says
+    // when they are done; the retry then carries the challenge token.
+    let get_hv = |hv: pdfs_core::proton_sdk::api::HumanVerification| {
+        println!(
+            "Proton is asking for a CAPTCHA before it will accept this sign-in.\n\
+             Open this page in your browser and complete it:\n\n  {}\n",
+            auth::browser_verification_url(&hv)
+        );
+        prompt_line("Press Enter once the page says you are verified")
+            .map_err(|e| pdfs_core::Error::Other(format!("read verification answer: {e}")))?;
+        Ok(auth::browser_verified(&hv))
+    };
+
     let rt = tokio::runtime::Runtime::new()?;
-    // Solving a CAPTCHA needs a browser engine, which the CLI has no business
-    // carrying. Point at the app that does rather than failing with the raw API
-    // message, which reads as "your login is broken".
-    rt.block_on(auth::login(&username, &password, get_totp))
-        .map_err(|e| match e {
-            pdfs_core::Error::HumanVerificationRequired(_) => anyhow::anyhow!(
-                "Proton is asking for a CAPTCHA before it will accept this sign-in.\n\
-                 Run `pdfs-app` and sign in there — it can show the verification page.\n\
-                 (This is usually triggered by a VPN or an unfamiliar IP; signing in from \
-                 your usual network often avoids it.)"
-            ),
-            other => anyhow::Error::new(other).context("login failed"),
-        })?;
+    rt.block_on(auth::login_interactive(
+        &username,
+        &password,
+        get_totp,
+        get_mailbox,
+        get_hv,
+    ))
+    .context("login failed")?;
 
     // A daemon that is already up is parked in `wait_for_session`, sleeping
     // between keyring checks; restart it so the mount appears now instead of
@@ -1657,9 +1877,88 @@ fn cmd_login(username: Option<String>) -> Result<()> {
     }
 
     println!("Logged in as {username}. Session stored in the system keyring.");
+    report_key_state();
     Ok(())
 }
 
+/// Ask for the mailbox password of a two-password account, without echo.
+fn prompt_mailbox(attempt: u32, remember: bool) -> pdfs_core::Result<auth::Mailbox> {
+    if attempt == 0 {
+        eprintln!("This account has a separate mailbox password.");
+    } else {
+        eprintln!("That mailbox password did not unlock the account. Try again.");
+    }
+    let password = rpassword::prompt_password("Mailbox password: ")
+        .map_err(|e| pdfs_core::Error::Other(format!("read mailbox password: {e}")))?;
+    Ok(auth::Mailbox {
+        password: zeroize::Zeroizing::new(password),
+        remember,
+    })
+}
+
+/// Say where the account's keys are held, and what that means for the next login.
+fn report_key_state() {
+    match auth::key_state() {
+        Ok(auth::KeyState::Session) => println!(
+            "Unlocked for this login session only. After you log out or reboot, run `pdfs unlock`."
+        ),
+        Ok(auth::KeyState::Locked) => println!("The account is locked. Run `pdfs unlock`."),
+        _ => {}
+    }
+}
+
+fn cmd_unlock(remember: bool) -> Result<()> {
+    auth::load().context("not logged in (run `pdfs login` first)")?;
+    let rt = tokio::runtime::Runtime::new()?;
+    // Bounded like the login prompt: three wrong answers end the command.
+    let mut attempt = 0;
+    loop {
+        let mailbox = prompt_mailbox(attempt, remember)?;
+        match rt.block_on(auth::unlock(&mailbox.password, remember)) {
+            Ok(()) => break,
+            Err(pdfs_core::Error::WrongMailboxPassword) if attempt < 2 => attempt += 1,
+            Err(e) => return Err(anyhow::Error::new(e).context("unlock failed")),
+        }
+    }
+    // A daemon parked on the locked account would otherwise notice on its next
+    // poll; restarting it makes the mount appear now, as after `pdfs login`.
+    if service::is_active() {
+        service::restart();
+    }
+    println!("Unlocked.");
+    report_key_state();
+    Ok(())
+}
+
+fn cmd_lock(forget: bool) -> Result<()> {
+    auth::lock(forget)?;
+    println!(
+        "Locked. {}",
+        if forget {
+            "Unlock removed from memory and keyring."
+        } else {
+            "Run `pdfs unlock` to unlock again."
+        }
+    );
+    // The running daemon keeps its keys until it restarts; say so, since
+    // "locked" would otherwise suggest the mount stopped.
+    if service::is_active() {
+        println!(
+            "The running daemon keeps its keys until it restarts: `systemctl --user restart proton-drive`."
+        );
+    }
+    Ok(())
+}
+
+/// `stored`, `session` or `locked`: where the account's keys are held.
+fn key_state_name() -> &'static str {
+    match auth::key_state() {
+        Ok(auth::KeyState::Stored) => "stored",
+        Ok(auth::KeyState::Session) => "session",
+        _ => "locked",
+    }
+}
+
 fn cmd_logout() -> Result<()> {
     auth::logout()?;
     println!("Stored session cleared.");
@@ -1687,6 +1986,7 @@ fn cmd_status() -> Result<()> {
             "username": session.as_ref().map(|s| s.username.clone()),
             "user_id": session.as_ref().map(|s| s.user_id.clone()),
             "scopes": session.as_ref().map(|s| s.scopes.clone()),
+            "keys": session.as_ref().map(|_| key_state_name()),
             "mount": mount,
         });
         println!("{}", serde_json::to_string_pretty(&out)?);
@@ -1697,6 +1997,11 @@ fn cmd_status() -> Result<()> {
         Ok(s) => {
             println!("Logged in as {} (user {})", s.username, s.user_id);
             println!("Scopes: {}", s.scopes.join(", "));
+            match key_state_name() {
+                "locked" => println!("Keys: locked — run `pdfs unlock`"),
+                "session" => println!("Keys: unlocked for this login session"),
+                _ => {}
+            }
         }
         Err(pdfs_core::Error::NotLoggedIn) => {
             println!("Not logged in. Run `pdfs login`.");
@@ -1719,9 +2024,12 @@ fn cmd_status() -> Result<()> {
             staged_oldest_secs,
             paused,
             paused_until,
+            session_expired,
+            tokens_unsaved,
             ..
         }) => {
             let state = match (online, paused) {
+                _ if session_expired => ", session expired: run `pdfs login`",
                 (_, true) => ", sync paused",
                 (false, false) => ", offline",
                 (true, false) => "",
@@ -1754,6 +2062,11 @@ fn cmd_status() -> Result<()> {
                     failing_error.as_deref().unwrap_or("no error recorded"),
                 );
             }
+            if tokens_unsaved {
+                println!(
+                    "Keyring    refuses the refreshed sign-in; unlock it, or a reboot needs `pdfs login`"
+                );
+            }
         }
         Ok(other) => println!("Mount: unexpected response {other:?}"),
         Err(_) => println!("Mount: not running."),
@@ -1828,7 +2141,7 @@ fn login_poll_delay(attempts: u32) -> std::time::Duration {
     std::time::Duration::from_secs(BASE_SECS.saturating_mul(factor).min(MAX_SECS))
 }
 
-/// Block until a session is stored, backing off between checks.
+/// Block until a session is stored and unlocked, backing off between checks.
 ///
 /// `load` and `sleep` are parameters rather than direct calls so the backoff
 /// schedule can be tested without a keyring and without real time passing.
@@ -1853,6 +2166,16 @@ where
                 sleep(delay);
                 attempts = attempts.saturating_add(1);
             }
+            Err(pdfs_core::Error::Locked) => {
+                let delay = login_poll_delay(attempts);
+                if attempts == 0 {
+                    tracing::info!("account is locked; waiting for `pdfs unlock`…");
+                } else {
+                    tracing::debug!(delay_secs = delay.as_secs(), "account still locked");
+                }
+                sleep(delay);
+                attempts = attempts.saturating_add(1);
+            }
             Err(e) => return Err(e.into()),
         }
     }
@@ -1863,25 +2186,31 @@ where
 /// an external unmount triggers a remount; errors back off and retry. This is
 /// the entry point for the systemd user service.
 fn cmd_daemon(mountpoint: Option<PathBuf>) -> Result<()> {
+    // The daemon holds the account's key passphrases in memory; keep them out
+    // of core dumps and away from same-user ptrace.
+    pdfs_core::kernelkey::forbid_dumps();
     loop {
         // Wait until a session is stored. The GUI enables this service on login,
         // but the service may also start at boot before the user has logged in.
-        wait_for_session(|| auth::load().map(|_| ()), std::thread::sleep)?;
+        wait_for_session(auth::ready, pdfs_fuse::idle_sleep)?;
 
         match mount_once(mountpoint.clone()) {
             Ok(pdfs_fuse::MountOutcome::Shutdown) => {
                 tracing::info!("daemon stopping");
                 return Ok(());
             }
+            Ok(pdfs_fuse::MountOutcome::ResumeStored) => {
+                tracing::info!("resuming the session stored in the keyring");
+            }
             Ok(pdfs_fuse::MountOutcome::Unmounted) => {
                 tracing::warn!("mount ended externally; remounting in 2s");
-                std::thread::sleep(std::time::Duration::from_secs(2));
+                pdfs_fuse::idle_sleep(std::time::Duration::from_secs(2));
             }
             Err(e) => {
                 // `{:#}` so the whole anyhow chain lands in the log — the top
                 // context alone ("mount failed") never says *why*.
                 tracing::error!(error = format!("{e:#}"), "mount failed; retrying in 5s");
-                std::thread::sleep(std::time::Duration::from_secs(5));
+                pdfs_fuse::idle_sleep(std::time::Duration::from_secs(5));
             }
         }
     }
@@ -1939,13 +2268,22 @@ fn mount_once(mountpoint: Option<PathBuf>) -> Result<pdfs_fuse::MountOutcome> {
             sweep_mode: config.resolved_conflict_sweep(),
             upload_limit: config.upload_limit.unwrap_or(0),
             download_limit: config.download_limit.unwrap_or(0),
+            local_first: config.local_first.unwrap_or(true),
         },
     );
 
-    // Clean unmount check (as a best-effort final backup).
-    if let Err(e) = rt.block_on(auth::persist(&session)) {
-        tracing::debug!(error = %e, "no new tokens to persist on shutdown");
+    // Last chance for a rotation the keyring refused when it happened. Only
+    // that: by now the keyring may hold a newer login, the one this stop was
+    // restarted for, and the tokens of this session would overwrite it.
+    if let Err(e) = auth::persist(&session) {
+        tracing::error!(
+            error = %e,
+            "could not save the refreshed session tokens; the next start may need `pdfs login`"
+        );
     }
+    // Dropping the runtime waits for every blocking task, however long; a call
+    // still stuck on Drive would hold the stop until systemd kills it (B165).
+    rt.shutdown_timeout(std::time::Duration::from_secs(2));
 
     let outcome = result.context("mount failed")?;
     Ok(outcome)
@@ -2439,14 +2777,33 @@ fn cmd_rename(path: PathBuf, new_name: String) -> Result<()> {
     Ok(())
 }
 
-fn cmd_move(path: PathBuf, new_parent: PathBuf) -> Result<()> {
-    match control_request(CtlRequest::Move {
-        path: path_arg(&path)?,
-        new_parent: path_arg(&new_parent)?,
-    })? {
-        CtlResponse::Ok { message } => println!("{message}"),
-        CtlResponse::Error { message, kind } => bail!("{}", cli_error(kind, &message)),
-        other => bail!("unexpected response: {other:?}"),
+/// Move each of `sources` into `new_parent`, one request each. A refusal names
+/// its source and the rest still move; the command fails if any did not.
+fn cmd_move(sources: Vec<PathBuf>, new_parent: PathBuf) -> Result<()> {
+    let new_parent = path_arg(&new_parent)?;
+    let mut failed = 0;
+    for source in &sources {
+        let outcome = path_arg(source).and_then(|path| {
+            match control_request(CtlRequest::Move {
+                path,
+                new_parent: new_parent.clone(),
+            })? {
+                CtlResponse::Ok { message } => Ok(message),
+                CtlResponse::Error { message, kind } => bail!("{}", cli_error(kind, &message)),
+                other => bail!("unexpected response: {other:?}"),
+            }
+        });
+        match outcome {
+            Ok(message) => println!("{message}"),
+            Err(e) if sources.len() == 1 => return Err(e),
+            Err(e) => {
+                eprintln!("{}: {e:#}", source.display());
+                failed += 1;
+            }
+        }
+    }
+    if failed > 0 {
+        bail!("{failed} of {} could not be moved", sources.len());
     }
     Ok(())
 }
@@ -2524,7 +2881,11 @@ fn cmd_diagnostics() -> Result<()> {
 }
 
 fn cmd_trash() -> Result<()> {
-    match control_request(CtlRequest::ListTrash)? {
+    let response = control_request(CtlRequest::ListTrash)?;
+    if emit_json(&response)? {
+        return Ok(());
+    }
+    match response {
         CtlResponse::Entries { entries } if entries.is_empty() => println!("(trash is empty)"),
         CtlResponse::Entries { entries } => {
             for e in entries {
@@ -3036,6 +3397,19 @@ fn cmd_diagnose() -> Result<()> {
     match pdfs_core::auth::load() {
         Ok(session) => {
             report.finding(DiagnoseLevel::Ok, "  keyring session", session.username);
+            match key_state_name() {
+                "locked" => report.finding(
+                    DiagnoseLevel::Fail,
+                    "  account keys",
+                    "locked — run `pdfs unlock` (the daemon waits for it)",
+                ),
+                "session" => report.finding(
+                    DiagnoseLevel::Ok,
+                    "  account keys",
+                    "unlocked for this login session",
+                ),
+                _ => report.finding(DiagnoseLevel::Ok, "  account keys", "stored in the keyring"),
+            }
         }
         Err(e) => {
             // A locked keyring and an absent login look the same from here, so
@@ -3066,6 +3440,8 @@ fn cmd_diagnose() -> Result<()> {
         Ok(CtlResponse::Status {
             mountpoint,
             online,
+            session_expired,
+            tokens_unsaved,
             pending_uploads,
             pending_changes,
             ..
@@ -3087,19 +3463,38 @@ fn cmd_diagnose() -> Result<()> {
                     |kind| format!("{mountpoint} ({kind})"),
                 ),
             );
-            report.finding(
-                if online {
-                    DiagnoseLevel::Ok
-                } else {
-                    DiagnoseLevel::Warn
-                },
-                "  network",
-                if online {
-                    "online"
-                } else {
-                    "offline; cached data remains available"
-                },
-            );
+            // The keyring check above read the blob, which still holds the
+            // tokens the daemon could not replace.
+            if tokens_unsaved {
+                report.finding(
+                    DiagnoseLevel::Warn,
+                    "  session tokens",
+                    "the keyring refuses the refreshed ones; unlock it, or a reboot needs `pdfs login`",
+                );
+            }
+            // A refused session reads as offline too, but no connection will
+            // bring it back, and the keyring check above cannot tell.
+            if session_expired {
+                report.finding(
+                    DiagnoseLevel::Fail,
+                    "  session",
+                    "Proton refused it (expired or revoked) — run `pdfs login`",
+                );
+            } else {
+                report.finding(
+                    if online {
+                        DiagnoseLevel::Ok
+                    } else {
+                        DiagnoseLevel::Warn
+                    },
+                    "  network",
+                    if online {
+                        "online"
+                    } else {
+                        "offline; cached data remains available"
+                    },
+                );
+            }
             let pending = pending_uploads + pending_changes;
             report.finding(
                 if pending == 0 {
@@ -3334,6 +3729,21 @@ mod login_wait_tests {
         );
     }
 
+    #[test]
+    fn a_locked_account_is_waited_on_until_it_is_unlocked() {
+        let mut checks = vec![
+            Ok(()),
+            Err(pdfs_core::Error::Locked),
+            Err(pdfs_core::Error::NotLoggedIn),
+            Err(pdfs_core::Error::Locked),
+        ];
+        let mut slept = 0;
+
+        wait_for_session(|| checks.pop().unwrap(), |_| slept += 1).unwrap();
+
+        assert_eq!(slept, 3, "locked and signed-out are both waited out");
+    }
+
     #[test]
     fn a_stored_session_is_not_waited_for_at_all() {
         let mut slept = 0;
@@ -3366,6 +3776,7 @@ mod login_wait_tests {
             shared_by_unverified: false,
             trashed_at: 0,
             trashed_from: None,
+            issue: None,
         };
         assert_eq!(shared_by_line(&entry), None, "no invitation, no line");
         entry.shared_by = "alice@proton.me".into();

crates/pdfs-core/Cargo.toml

@@ -28,3 +28,5 @@ dbus-secret-service-keyring-store.workspace = true
 parking_lot.workspace = true
 async-trait.workspace = true
 libc.workspace = true
+zeroize.workspace = true
+base64.workspace = true

crates/pdfs-core/src/cache.rs

@@ -91,7 +91,7 @@ const TOUCH_FLUSH_AT: usize = 256;
 ///
 /// Public because it is the *contract* a block has to satisfy, not a detail of
 /// this cache: the network read path validates against it too, so a block that
-/// comes back short is refused before it can truncate a file (bugs.md B84).
+/// comes back short is refused before it can truncate a file (`docs/BUGS.md` B84).
 pub fn block_len(size: u64, idx: u64) -> u64 {
     let start = idx.saturating_mul(BLOCK_SIZE);
     size.saturating_sub(start).min(BLOCK_SIZE)
@@ -311,8 +311,7 @@ struct PinFile {
     pins: BTreeMap<String, Pin>,
 }
 
-/// What a staged file actually contains, written beside it as `<name>.json`
-/// (offline.md Phase 2).
+/// What a staged file actually contains, written beside it as `<name>.json`.
 ///
 /// A staged file is **not** necessarily valid whole-file content, and that is
 /// the whole reason this exists. A partial overwrite commits by filling the
@@ -365,6 +364,14 @@ pub struct StagedWrite {
     pub based_on: Option<Baseline>,
 }
 
+impl StagedWrite {
+    /// Whether `authored` ranges cover a file of `len` bytes, so the staged
+    /// bytes are its complete new content. An empty file has nothing to cover.
+    pub fn covers(authored: &[(u64, u64)], len: u64) -> bool {
+        len == 0 || authored == [(0, len)]
+    }
+}
+
 /// The identity of a remote revision, as far as we can observe it.
 ///
 /// `revision_id` is the authoritative identity when present: the server assigns a
@@ -431,9 +438,9 @@ pub struct ContentCache {
     /// Subdirectory for write-handle scratch files (disk-backed write buffers).
     /// Emptied on open so a crashed run leaves no orphans.
     scratch_dir: PathBuf,
-    /// Subdirectory holding the bytes of writes that have not been uploaded yet
-    /// (offline.md Phase 2/3) — every released write passes through here, since
-    /// the upload is a queued op performed later. Unlike `scratch_dir` this is
+    /// Subdirectory holding the bytes of writes that have not been uploaded yet.
+    /// Every released write passes through here, since the upload is a queued
+    /// op performed later. Unlike `scratch_dir` this is
     /// **never** emptied on open: these are the only copy of content the user
     /// authored, and the whole point is that they outlive the daemon.
     staging_dir: PathBuf,
@@ -468,7 +475,7 @@ pub struct ContentCache {
     thumb_bytes: AtomicU64,
     /// Unified metadata DB. Its `cache_entries` table is the LRU index: every
     /// store/read/evict updates it, and the budget enforcers query it instead of
-    /// scanning the cache directories (plan.md P4).
+    /// scanning the cache directories.
     db: Arc<Db>,
     /// LRU touches not yet written to `cache_entries`, keyed by cache key.
     ///
@@ -730,6 +737,60 @@ impl ContentCache {
         Some(buf)
     }
 
+    /// Write the whole content of `uid` at `(mtime, size)` to `dst` from the
+    /// cache alone, and report whether that worked.
+    ///
+    /// A whole-file blob is cloned. Otherwise every block of the revision has to
+    /// be cached, under its recorded geometry or, failing that, the uniform one
+    /// the read path would use. Anything short of the full content leaves
+    /// nothing at `dst`, so a caller falls back to a download with a clean slate.
+    ///
+    /// This is what lets a mirror folder take a file an on-demand mount has
+    /// already read, after a move between them, without fetching it again. The
+    /// trust is the read path's: the same `(mtime, size)` key, and blocks that
+    /// were validated when they were fetched.
+    pub fn copy_cached_to(&self, uid: &NodeUid, mtime: i64, size: u64, dst: &Path) -> bool {
+        if size == 0 {
+            return false;
+        }
+        if let Some(blob) = self.valid_blob(uid, mtime, size) {
+            if Self::clone_or_copy(&blob, dst).is_ok_and(|len| len == size) {
+                self.touch(Self::key(uid));
+                return true;
+            }
+            let _ = std::fs::remove_file(dst);
+            return false;
+        }
+        let geometry = self
+            .block_geometry(uid, mtime, size)
+            .unwrap_or_else(|| BlockGeometry::uniform(size));
+        if geometry.size() != size {
+            return false;
+        }
+        let spans = geometry.spans(0, size);
+        // Checked up front so a file with one block missing costs stats, not a
+        // copy of every block before it.
+        if !spans
+            .iter()
+            .all(|&span| self.has_block(uid, mtime, size, span))
+        {
+            return false;
+        }
+        let written = (|| -> Option<()> {
+            use std::io::Write;
+            let mut out = std::fs::File::create(dst).ok()?;
+            for span in spans {
+                out.write_all(&self.cached_block(uid, mtime, size, span)?)
+                    .ok()?;
+            }
+            (out.metadata().ok()?.len() == size).then_some(())
+        })();
+        if written.is_none() {
+            let _ = std::fs::remove_file(dst);
+        }
+        written.is_some()
+    }
+
     /// Store `bytes` as the cached content for `uid`, tagged with `(mtime,
     /// size)`. The blob is written to a temp file then renamed so a concurrent
     /// reader never sees a partial blob; the meta tag is written last so a
@@ -783,6 +844,9 @@ impl ContentCache {
         }
         let bytes = std::fs::metadata(&tmp)?.len();
         std::fs::rename(&tmp, &blob)?;
+        // Linked from the blob already cached, the temp name was a second name
+        // of it, and the rename did nothing (`docs/BUGS.md` B187).
+        let _ = std::fs::remove_file(&tmp);
         let meta = serde_json::to_vec(&Meta { mtime, size })?;
         std::fs::write(self.meta_path(uid), meta)?;
         self.db
@@ -924,7 +988,7 @@ impl ContentCache {
     /// a miss ([`cached_block`](Self::cached_block) checks), so a bad block
     /// cannot escape this cache even though this does not check. Validating a
     /// block is the *reader's* job, at the point it is fetched — see
-    /// `Core::read_block` (bugs.md B84).
+    /// `Core::read_block` (`docs/BUGS.md` B84).
     pub fn store_block(
         &self,
         uid: &NodeUid,
@@ -1426,9 +1490,8 @@ impl ContentCache {
     /// This is what makes a write survive its upload: the caller is releasing a
     /// write handle and would otherwise delete the file, so until the bytes are
     /// on the remote, staging holds the only copy. Every dirty handle goes
-    /// through here — the upload is a queued op performed later (offline.md
-    /// Phase 3), and a staged file is also what a human can recover from if the
-    /// queue never drains.
+    /// through here — the upload is a queued op performed later, and a staged
+    /// file is also what a human can recover from if the queue never drains.
     ///
     /// Falls back to a copy when the rename crosses a filesystem boundary; a
     /// failure here means we could not save the bytes at all, so it is reported
@@ -2002,6 +2065,17 @@ mod tests {
         NodeUid::new(VolumeId::from("vol"), LinkId::from(link))
     }
 
+    #[test]
+    fn an_empty_write_covers_the_file_and_a_gap_does_not() {
+        assert!(
+            StagedWrite::covers(&[], 0),
+            "an empty file has nothing to cover"
+        );
+        assert!(StagedWrite::covers(&[(0, 7)], 7));
+        assert!(!StagedWrite::covers(&[(0, 3), (4, 7)], 7));
+        assert!(!StagedWrite::covers(&[], 7));
+    }
+
     /// A unique temp directory removed on drop; avoids a dev-dependency.
     struct TempDir(PathBuf);
     impl TempDir {
@@ -2124,6 +2198,24 @@ mod tests {
         assert_eq!(c.read_range(&u, 200, 5, 0, 5).unwrap(), b"newer");
     }
 
+    /// A landed create and the revision after it can adopt the same staged
+    /// blob. The link to the temp name is then a second name of the cached
+    /// blob, and a rename between two names of one file does nothing: the
+    /// temp name stayed until the next start swept it (`docs/BUGS.md` B187).
+    #[test]
+    fn store_file_twice_from_the_same_blob_leaves_no_temp_file() {
+        let (c, d) = cache();
+        let u = uid("a");
+        let src = d.path().join("staged-blob");
+        std::fs::write(&src, b"staged").unwrap();
+
+        c.store_file(&u, 100, 6, &src).unwrap();
+        c.store_file(&u, 100, 6, &src).unwrap();
+
+        assert!(!c.blob_path(&u).with_extension("tmp").exists());
+        assert_eq!(c.read_range(&u, 100, 6, 0, 6).unwrap(), b"staged");
+    }
+
     #[test]
     fn reconcile_rebuilds_index_from_disk() {
         let dir = TempDir::new();
@@ -2217,42 +2309,26 @@ mod tests {
     /// call also needs.
     #[test]
     fn budget_check_is_free_when_under_budget() {
-        use std::time::Instant;
-
         // Cap far above what we store, so every store stays under budget.
         let (c, _d) = cache_capped(1 << 30);
         let payload = vec![0u8; 4096];
-
-        // Cost of a store against a near-empty index...
-        let t = Instant::now();
-        for i in 0..500u64 {
+        for i in 0..8u64 {
             c.store_block(&uid("a"), 1, 1 << 30, blk(1 << 30, i), &payload)
                 .unwrap();
         }
-        let empty = t.elapsed() / 500;
 
-        // ...and against one with a few thousand entries in it.
-        for i in 500..2500u64 {
-            c.store_block(&uid("a"), 1, 1 << 30, blk(1 << 30, i), &payload)
-                .unwrap();
-        }
-        let t = Instant::now();
-        for i in 2500..3000u64 {
-            c.store_block(&uid("a"), 1, 1 << 30, blk(1 << 30, i), &payload)
-                .unwrap();
-        }
-        let full = t.elapsed() / 500;
+        // Plant an index row far over the cap behind the running total's back,
+        // and older than every real block. Any budget check that consults the
+        // index would see the pool over budget, evict, and reseed the total.
+        c.db.cache_touch("planted", KIND_BLOCK, 1 << 40, 0).unwrap();
 
-        println!("B4: store_block under budget — {empty:?} at ~0 entries, {full:?} at 2500");
-        // A ratio, not a wall-clock bound: the claim is that the under-budget
-        // path does not grow with the index, and only a ratio tests that. An
-        // absolute threshold measures the machine's load instead, and this test
-        // runs alongside the rest of the suite.
-        assert!(
-            full < empty * 3,
-            "under-budget store should not scale with the index: \
-             {empty:?} at ~0 entries vs {full:?} at 2500"
-        );
+        c.store_block(&uid("a"), 1, 1 << 30, blk(1 << 30, 8), &payload)
+            .unwrap();
+
+        // Not a timing ratio: that measured the CI runner's load and flaked.
+        assert_eq!(c.block_bytes.load(Ordering::Relaxed), 9 * 4096);
+        let entries = c.db.cache_entries_by_kind(KIND_BLOCK).unwrap();
+        assert_eq!(entries.len(), 10, "under-budget store evicted: {entries:?}");
     }
 
     /// The running totals are a fast path, not a second source of truth: after
@@ -2561,6 +2637,46 @@ mod tests {
         assert!(c.cached_block(&u, 100, 5000, blk(5000, 0)).is_none());
     }
 
+    #[test]
+    fn a_cached_blob_is_copied_out_whole() {
+        let (c, d) = cache();
+        let u = uid("blob");
+        c.store(&u, 7, 5, b"hello").unwrap();
+        let dst = d.path().join("out");
+        assert!(c.copy_cached_to(&u, 7, 5, &dst));
+        assert_eq!(std::fs::read(&dst).unwrap(), b"hello");
+        // Another revision is not this one.
+        assert!(!c.copy_cached_to(&u, 8, 5, &d.path().join("stale")));
+        assert!(!d.path().join("stale").exists());
+    }
+
+    #[test]
+    fn cached_blocks_are_copied_out_in_order() {
+        let (c, d) = cache();
+        let u = uid("blocks");
+        let size = BLOCK_SIZE + 3;
+        let first = vec![1_u8; BLOCK_SIZE as usize];
+        c.store_block(&u, 7, size, blk(size, 0), &first).unwrap();
+        c.store_block(&u, 7, size, blk(size, 1), b"end").unwrap();
+        let dst = d.path().join("out");
+        assert!(c.copy_cached_to(&u, 7, size, &dst));
+        let bytes = std::fs::read(&dst).unwrap();
+        assert_eq!(bytes.len() as u64, size);
+        assert_eq!(&bytes[..BLOCK_SIZE as usize], first.as_slice());
+        assert_eq!(&bytes[BLOCK_SIZE as usize..], b"end");
+    }
+
+    #[test]
+    fn a_file_with_a_block_missing_is_not_copied_out() {
+        let (c, d) = cache();
+        let u = uid("partial");
+        let size = BLOCK_SIZE + 3;
+        c.store_block(&u, 7, size, blk(size, 1), b"end").unwrap();
+        let dst = d.path().join("out");
+        assert!(!c.copy_cached_to(&u, 7, size, &dst));
+        assert!(!dst.exists(), "a partial copy must not be left behind");
+    }
+
     /// The [`BlockSpan`] the uniform geometry gives block `idx` of a file of
     /// `size` bytes — the shape these tests were written against, and the one
     /// this client's own uploads still have.
@@ -2573,7 +2689,7 @@ mod tests {
     }
 
     /// The geometry the whole read path validates against, here and over the
-    /// network (bugs.md B84): full blocks, then whatever is left.
+    /// network (`docs/BUGS.md` B84): full blocks, then whatever is left.
     #[test]
     fn block_len_is_full_blocks_then_the_remainder() {
         let size = BLOCK_SIZE * 2 + 17;
@@ -2653,7 +2769,7 @@ mod tests {
     /// A cached block is addressed by the range it covers, not by its index
     /// alone. Re-planning a file onto its real geometry must therefore miss the
     /// blocks the uniform fallback cached, rather than serve their bytes at the
-    /// wrong offset (bugs.md B85).
+    /// wrong offset (`docs/BUGS.md` B85).
     #[test]
     fn a_cached_block_is_not_served_to_a_different_geometry() {
         let (c, _d) = cache();
@@ -2720,7 +2836,7 @@ mod tests {
 
     /// A block of the wrong length cannot escape the cache even though the
     /// store does not check: the read validates it and reports a miss, so the
-    /// next read refetches rather than serving a hole (bugs.md B84).
+    /// next read refetches rather than serving a hole (`docs/BUGS.md` B84).
     #[test]
     fn a_block_of_the_wrong_length_reads_as_a_miss() {
         let (c, _d) = cache();
@@ -2785,7 +2901,7 @@ mod tests {
         );
     }
 
-    /// A failed upload must never cost the user their bytes (offline.md Phase 2):
+    /// A failed upload must never cost the user their bytes:
     /// the scratch file moves to staging intact, and staging survives a reopen
     /// the way scratch deliberately does not.
     #[test]

crates/pdfs-core/src/config.rs

@@ -3,7 +3,7 @@
 use std::path::{Path, PathBuf};
 
 use directories::ProjectDirs;
-use serde::{Deserialize, Serialize};
+use serde::{Deserialize, Deserializer, Serialize};
 
 use crate::error::{Error, Result};
 use crate::menu::PromptConfig;
@@ -12,8 +12,19 @@ use crate::syncignore::DEFAULT_IGNORE_PATTERNS;
 
 /// Proton requires `external-drive-{name}@{semver}-{channel}` (channel ∈
 /// stable/beta/alpha); a malformed value trips the 422 anti-abuse path.
-pub const APP_VERSION: &str = "external-drive-linux@0.1.0-alpha";
-pub const USER_AGENT: &str = "proton-drive-linux/0.1.0";
+/// Follows the release so Proton can tell releases apart and retire old ones
+/// without retiring every one.
+pub const APP_VERSION: &str = concat!(
+    "external-drive-linux@",
+    env!("CARGO_PKG_VERSION"),
+    "-stable"
+);
+pub const USER_AGENT: &str = concat!("proton-drive-linux/", env!("CARGO_PKG_VERSION"));
+
+/// The fixed identity every release up to 3.1.0 wrote into `config.json`. Read
+/// back as "unset" so those configs follow the release instead of pinning it.
+const LEGACY_APP_VERSION: &str = "external-drive-linux@0.1.0-alpha";
+const LEGACY_USER_AGENT: &str = "proton-drive-linux/0.1.0";
 
 /// Keyring service name; one entry per credential kind keyed by username.
 pub const KEYRING_SERVICE: &str = "proton-drive-linux";
@@ -76,10 +87,24 @@ fn resolve_sweep_mode(env: Option<&str>, stored: Option<SweepMode>) -> SweepMode
 }
 
 /// Configuration structure allowing the user to customize client identification headers.
-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, Default)]
 pub struct AppConfig {
-    pub app_version: String,
-    pub user_agent: String,
+    /// Override for [`APP_VERSION`]. `None` means "use the release's own";
+    /// the old fixed default reads as `None`, so it leaves the file on the
+    /// next save.
+    #[serde(
+        default,
+        deserialize_with = "identity_override",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub app_version: Option<String>,
+    /// Override for [`USER_AGENT`], handled like `app_version`.
+    #[serde(
+        default,
+        deserialize_with = "identity_override",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub user_agent: Option<String>,
     /// Soft cap on the on-disk content cache, in bytes (`0` = unlimited).
     /// `None` means "use [`DEFAULT_CACHE_BUDGET_BYTES`]"; the Settings page
     /// writes an explicit value here. Defaulted for configs predating the field.
@@ -154,6 +179,13 @@ pub struct AppConfig {
     /// configs predating the field.
     #[serde(default)]
     pub online_map: bool,
+    /// Record a new folder, a new file, a rename or a delete through the mount
+    /// locally and send it from the queue, instead of waiting for Drive in the
+    /// syscall. `None` means on. `false` brings back the old path for one
+    /// release (docs/ROADMAP.md). Defaulted for configs predating
+    /// the field.
+    #[serde(default)]
+    pub local_first: Option<bool>,
 }
 
 /// The My Files page's view choices, remembered between runs.
@@ -209,30 +241,28 @@ impl FileSort {
     }
 }
 
-impl Default for AppConfig {
-    fn default() -> Self {
-        Self {
-            app_version: APP_VERSION.to_string(),
-            user_agent: USER_AGENT.to_string(),
-            cache_budget: None,
-            upload_limit: None,
-            download_limit: None,
-            mountpoint: None,
-            ignore_patterns: None,
-            device_uid: None,
-            conflict_sweep: None,
-            open_with: None,
-            prompt: None,
-            proton_theme: None,
-            files_view: FilesView::default(),
-            tray_hidden: false,
-            language: None,
-            online_map: false,
-        }
-    }
+/// Reads an `app_version` or `user_agent` override, dropping the fixed
+/// identity older releases stored as the default.
+fn identity_override<'de, D: Deserializer<'de>>(
+    deserializer: D,
+) -> std::result::Result<Option<String>, D::Error> {
+    let value = Option::<String>::deserialize(deserializer)?;
+    Ok(value.filter(|v| v != LEGACY_APP_VERSION && v != LEGACY_USER_AGENT))
 }
 
 impl AppConfig {
+    /// The `x-pm-appversion` sent to Proton: the user's override, or
+    /// [`APP_VERSION`].
+    pub fn resolved_app_version(&self) -> &str {
+        self.app_version.as_deref().unwrap_or(APP_VERSION)
+    }
+
+    /// The `User-Agent` sent to Proton: the user's override, or
+    /// [`USER_AGENT`].
+    pub fn resolved_user_agent(&self) -> &str {
+        self.user_agent.as_deref().unwrap_or(USER_AGENT)
+    }
+
     /// The effective cache budget in bytes: the user's explicit choice, or
     /// [`DEFAULT_CACHE_BUDGET_BYTES`] when unset.
     pub fn resolved_cache_budget(&self) -> u64 {
@@ -424,7 +454,7 @@ impl AppDirs {
     /// typical umask makes them `0755`. Until this was fixed, the only thing
     /// keeping another local user out was `~/.cache` and `~/.local/state`
     /// happening to be `0700`, which is a convention of the user's system and
-    /// not something this client established (bugs.md B6).
+    /// not something this client established (`docs/BUGS.md` B6).
     ///
     /// Applied on every start, not just at creation: a directory that already
     /// exists with a permissive mode — restored from a backup that flattened
@@ -475,7 +505,7 @@ fn restrict_dir(dir: &Path) -> Result<()> {
 /// session — enumerate, read, upload, trash, share — without presenting any
 /// credential, since the daemon already holds one. It is an authority boundary,
 /// not merely private data, and `UnixListener::bind` applies the umask like any
-/// other file (bugs.md B6).
+/// other file (`docs/BUGS.md` B6).
 ///
 /// There is a window between `bind` and this call during which the socket
 /// carries the umask's mode. It is closed in practice by the containing
@@ -496,7 +526,7 @@ mod tests {
         std::fs::metadata(p).unwrap().permissions().mode() & 0o777
     }
 
-    /// bugs.md B6. A permissive mode here is not a cosmetic problem: these
+    /// `docs/BUGS.md` B6. A permissive mode here is not a cosmetic problem: these
     /// directories hold decrypted content, a plaintext index of every node name,
     /// and the control socket that commands the daemon's session.
     #[test]
@@ -563,8 +593,8 @@ mod tests {
     #[test]
     fn test_app_config_serialization() {
         let config = AppConfig {
-            app_version: "external-drive-test-client@1.0.0".to_string(),
-            user_agent: "test-agent/1.0".to_string(),
+            app_version: Some("external-drive-test-client@1.0.0".to_string()),
+            user_agent: Some("test-agent/1.0".to_string()),
             cache_budget: Some(1234),
             upload_limit: Some(500_000),
             download_limit: None,
@@ -584,11 +614,15 @@ mod tests {
             tray_hidden: true,
             language: Some("de".to_string()),
             online_map: true,
+            local_first: Some(false),
         };
         let json = serde_json::to_string(&config).unwrap();
         let decoded: AppConfig = serde_json::from_str(&json).unwrap();
-        assert_eq!(decoded.app_version, "external-drive-test-client@1.0.0");
-        assert_eq!(decoded.user_agent, "test-agent/1.0");
+        assert_eq!(
+            decoded.resolved_app_version(),
+            "external-drive-test-client@1.0.0"
+        );
+        assert_eq!(decoded.resolved_user_agent(), "test-agent/1.0");
         assert_eq!(decoded.proton_theme, Some(true));
         assert!(decoded.tray_hidden);
         assert!(decoded.online_map);
@@ -619,8 +653,55 @@ mod tests {
     #[test]
     fn test_default_app_config() {
         let default_config = AppConfig::default();
-        assert_eq!(default_config.app_version, APP_VERSION);
-        assert_eq!(default_config.user_agent, USER_AGENT);
+        assert_eq!(default_config.resolved_app_version(), APP_VERSION);
+        assert_eq!(default_config.resolved_user_agent(), USER_AGENT);
+    }
+
+    #[test]
+    fn the_client_identity_follows_the_release() {
+        let version = env!("CARGO_PKG_VERSION");
+        assert_eq!(
+            APP_VERSION,
+            format!("external-drive-linux@{version}-stable")
+        );
+        assert_eq!(USER_AGENT, format!("proton-drive-linux/{version}"));
+    }
+
+    #[test]
+    fn an_old_config_with_the_fixed_identity_follows_the_release() {
+        // Every config written up to 3.1.0 holds these two values, so they must
+        // not pin the identity once Proton retires 0.1.0.
+        let json = format!(
+            r#"{{"app_version":"{LEGACY_APP_VERSION}","user_agent":"{LEGACY_USER_AGENT}","tray_hidden":true}}"#
+        );
+        let decoded: AppConfig = serde_json::from_str(&json).unwrap();
+        assert_eq!(decoded.resolved_app_version(), APP_VERSION);
+        assert_eq!(decoded.resolved_user_agent(), USER_AGENT);
+        assert!(decoded.tray_hidden, "the rest of the config survives");
+
+        let saved = serde_json::to_string(&decoded).unwrap();
+        assert!(!saved.contains("app_version"), "{saved}");
+        assert!(!saved.contains("user_agent"), "{saved}");
+    }
+
+    #[test]
+    fn a_hand_set_client_identity_is_kept() {
+        let json = r#"{"app_version":"external-drive-linux@9.9.9-beta","user_agent":"custom/1"}"#;
+        let decoded: AppConfig = serde_json::from_str(json).unwrap();
+        assert_eq!(
+            decoded.resolved_app_version(),
+            "external-drive-linux@9.9.9-beta"
+        );
+        assert_eq!(decoded.resolved_user_agent(), "custom/1");
+        let saved = serde_json::to_string(&decoded).unwrap();
+        assert!(saved.contains("external-drive-linux@9.9.9-beta"), "{saved}");
+    }
+
+    #[test]
+    fn a_config_without_a_client_identity_loads() {
+        let decoded: AppConfig = serde_json::from_str("{}").unwrap();
+        assert_eq!(decoded.resolved_app_version(), APP_VERSION);
+        assert_eq!(decoded.resolved_user_agent(), USER_AGENT);
     }
 
     #[test]

crates/pdfs-core/src/control.rs

@@ -339,7 +339,10 @@ pub enum Request {
     /// single path component (no separators). Replies with [`Response::Ok`].
     Rename { path: String, new_name: String },
     /// Move a file or folder into a new parent folder. Both `path` and
-    /// `new_parent` are mountpoint-relative. Replies with [`Response::Ok`].
+    /// `new_parent` are mountpoint-relative, or both absolute local paths; two
+    /// absolute paths may lie in different locations (My files, an on-demand
+    /// or a mirror synced folder), and the move is still made on Proton Drive
+    /// without transferring content. Replies with [`Response::Ok`].
     Move { path: String, new_parent: String },
     /// Trash a file or folder. `path` is mountpoint-relative. Replies with
     /// [`Response::Ok`].
@@ -440,11 +443,18 @@ pub enum Request {
     DeleteDevice { uid: String },
     /// Adopt an existing device as this machine's, pinning its uid in
     /// `config.json` so a hostname change or reinstall re-attaches to it instead
-    /// of registering a duplicate (features.md 5.1). `uid: None` clears the pin.
+    /// of registering a duplicate. `uid: None` clears the pin.
     /// Replies with [`Response::Ok`].
     AdoptDevice { uid: Option<String> },
+    /// Move every folder another device backs up into this machine's own
+    /// device, as server-side moves on the main volume. The other device stays
+    /// registered, without those folders. Sync folders here that already track
+    /// one of them follow it to its new share. Nothing is downloaded: the moved
+    /// folders are then offered by [`Request::ListRestorableFolders`].
+    /// Replies with [`Response::Ok`].
+    MigrateDevice { uid: String },
 
-    // ---- device folder sync (devices.md) ----------------------------------
+    // ---- device folder sync ----------------------------------
     /// Add a local folder to this machine's device, uploading its tree and
     /// registering the device on first use. Replies with [`Response::Ok`].
     AddSyncFolder { local_path: String },
@@ -474,6 +484,15 @@ pub enum Request {
     /// Retry a backed-off queued op now instead of waiting out its backoff;
     /// every failed op when `id` is `None`. Replies with [`Response::Ok`].
     RetryPendingOp { id: Option<i64> },
+    /// Copy the content of a queued upload (`id` from
+    /// [`Request::ListPendingOps`]) to `dest`, an absolute path that must not
+    /// exist yet. The op stays queued. Replies with [`Response::Ok`].
+    ExportPendingOp { id: i64, dest: String },
+    /// Drop a queued change (`id` from [`Request::ListPendingOps`]) and undo
+    /// it locally: a node made here goes, a node Drive has goes back to what
+    /// Drive has, along with every other change queued on it. Its content is
+    /// lost unless it was exported first. Replies with [`Response::Ok`].
+    DiscardPendingOp { id: i64 },
     /// List the `(sync-conflict …)` copies under My Files and in synced
     /// folders. Replies with
     /// [`Response::Conflicts`].
@@ -484,7 +503,7 @@ pub enum Request {
     /// [`Response::Ok`].
     ResolveConflict { path: String, keep: ConflictKeep },
     /// List the folders under this machine's device that can be synced here,
-    /// each with a proposed local path (features.md 5.2). Replies with
+    /// each with a proposed local path. Replies with
     /// [`Response::RestorableFolders`].
     ListRestorableFolders,
     /// Attach the given remote device folders to local paths and sync them down.
@@ -877,6 +896,59 @@ pub struct PendingOpInfo {
     pub parked: bool,
     /// Failed often enough to count as stuck.
     pub failing: bool,
+    /// Why Drive refused it, when it did; such an op needs attention at once.
+    #[serde(default)]
+    pub issue: Option<SyncIssue>,
+    /// Carries file content that [`Request::ExportPendingOp`] can save.
+    #[serde(default)]
+    pub exportable: bool,
+}
+
+/// Why Drive refused a queued change (in [`PendingOpInfo`]). The change stays
+/// queued and keeps being retried; nothing is deleted.
+#[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum SyncIssue {
+    /// The account's storage is full.
+    Quota,
+    /// The account may no longer change the file or its folder, for example
+    /// because a share was revoked.
+    Access,
+    /// The file or the folder it goes into is gone from Drive.
+    Missing,
+    /// The folder holds too many items, or is nested too deep.
+    Limit,
+    /// Drive rejected the change, for example a name it does not accept.
+    Rejected,
+    /// An issue from a newer daemon.
+    #[serde(other)]
+    Unknown,
+}
+
+impl SyncIssue {
+    /// The name stored in the database and sent on the wire.
+    pub fn as_str(self) -> &'static str {
+        match self {
+            SyncIssue::Quota => "quota",
+            SyncIssue::Access => "access",
+            SyncIssue::Missing => "missing",
+            SyncIssue::Limit => "limit",
+            SyncIssue::Rejected => "rejected",
+            SyncIssue::Unknown => "unknown",
+        }
+    }
+
+    /// The issue stored as `name`.
+    pub fn parse(name: &str) -> Self {
+        match name {
+            "quota" => SyncIssue::Quota,
+            "access" => SyncIssue::Access,
+            "missing" => SyncIssue::Missing,
+            "limit" => SyncIssue::Limit,
+            "rejected" => SyncIssue::Rejected,
+            _ => SyncIssue::Unknown,
+        }
+    }
 }
 
 /// One synced local folder on this machine's device (in [`Response::SyncFolders`]).
@@ -1153,6 +1225,12 @@ pub struct JobItem {
     /// Steps known to need doing, or `0` when unknown (indeterminate progress).
     /// May *grow* mid-job as more work is discovered.
     pub total: u64,
+    /// Housekeeping that changes nothing in the user's files: a mirror folder
+    /// scan that finds nothing to do yet, an index rebuild, a cache check. Front
+    /// ends may show it, but should not report the drive as busy over it. Absent
+    /// from older daemons, which never set it.
+    #[serde(default)]
+    pub background: bool,
 }
 
 /// One in-flight transfer in a [`Response::Transfers`] snapshot.
@@ -1231,6 +1309,10 @@ pub struct DirEntry {
     /// not known, and for anything not in the trash.
     #[serde(default)]
     pub trashed_from: Option<String>,
+    /// Why Drive refused a change queued on the node, for a [`Request::ListDir`]
+    /// entry; `None` otherwise.
+    #[serde(default)]
+    pub issue: Option<SyncIssue>,
 }
 
 /// One hit in a [`Request::Search`] result. Like [`DirEntry`] but carries the
@@ -1834,17 +1916,17 @@ pub enum Response {
         /// The pin registry.
         pins: Vec<Pin>,
         /// False when the daemon is serving the cached tree because the API is
-        /// unreachable (offline.md Phase 1). Cached and pinned content still
+        /// unreachable. Cached and pinned content still
         /// reads; anything else fails until the network is back.
         #[serde(default = "default_online")]
         online: bool,
-        /// Writes accepted locally but not yet uploaded (offline.md Phase 3).
+        /// Writes accepted locally but not yet uploaded.
         /// Non-zero means the mount is ahead of the remote — either a copy is
         /// still draining, or it cannot drain because we are offline.
         #[serde(default)]
         pending_uploads: u64,
-        /// Queued mutations that carry no bytes: `mkdir`, `rename`, `trash`
-        /// (offline.md Phase 3b). Counted apart from `pending_uploads` because
+        /// Queued mutations that carry no bytes: `mkdir`, `rename`, `trash`.
+        /// Counted apart from `pending_uploads` because
         /// calling a queued `mkdir` an upload is a lie.
         #[serde(default)]
         pending_changes: u64,
@@ -1877,6 +1959,16 @@ pub enum Response {
         /// resumed, or not paused.
         #[serde(default)]
         paused_until: Option<i64>,
+        /// True when Proton refused the session itself (refresh token refused,
+        /// account deleted or disabled). `online` is false then too, but no
+        /// connection brings it back: only signing in again does.
+        #[serde(default)]
+        session_expired: bool,
+        /// True while the keyring refuses the session's refreshed tokens. The
+        /// daemon keeps retrying; until it succeeds, a reboot signs the user
+        /// out.
+        #[serde(default)]
+        tokens_unsaved: bool,
     },
     /// A human-readable success message.
     Ok { message: String },
@@ -3013,6 +3105,9 @@ mod tests {
                 uid: Some("dev-1".into()),
             },
             Request::AdoptDevice { uid: None },
+            Request::MigrateDevice {
+                uid: "dev-2".into(),
+            },
             Request::ListRestorableFolders,
             Request::RestoreSyncFolders {
                 items: vec![RestoreItem {
@@ -3287,6 +3382,17 @@ mod tests {
                 },
                 r#"{"SaveRevisionAsByUid":{"uid":"vol~link","revision_id":"rev-3","dest":"/tmp/out.bin"}}"#,
             ),
+            (
+                Request::ExportPendingOp {
+                    id: 7,
+                    dest: "/tmp/out.bin".into(),
+                },
+                r#"{"ExportPendingOp":{"id":7,"dest":"/tmp/out.bin"}}"#,
+            ),
+            (
+                Request::DiscardPendingOp { id: 7 },
+                r#"{"DiscardPendingOp":{"id":7}}"#,
+            ),
         ];
         for (request, wire) in cases {
             assert_eq!(serde_json::to_string(&request).unwrap(), wire);
@@ -3295,6 +3401,25 @@ mod tests {
         }
     }
 
+    /// A daemon that predates sync issues sends neither field, and a newer one
+    /// may send an issue this build does not know.
+    #[test]
+    fn a_queued_op_from_another_daemon_version_still_decodes() {
+        let old = r#"{"id":1,"kind":"create","path":"a.txt","attempts":0,"last_error":null,
+            "queued_at":5,"next_attempt_at":5,"parked":false,"failing":false}"#;
+        let op: PendingOpInfo = serde_json::from_str(old).unwrap();
+        assert_eq!(op.issue, None);
+        assert!(!op.exportable);
+
+        let newer = old.replace(r#""failing":false"#, r#""failing":true,"issue":"embargo""#);
+        let op: PendingOpInfo = serde_json::from_str(&newer).unwrap();
+        assert_eq!(op.issue, Some(SyncIssue::Unknown));
+        assert_eq!(
+            SyncIssue::parse(SyncIssue::Quota.as_str()),
+            SyncIssue::Quota
+        );
+    }
+
     /// A front-end that predates the favorites filter sends no `favorites`
     /// field, and must keep getting the whole timeline rather than an empty page.
     #[test]

crates/pdfs-core/src/db/fixtures/v2.8.2.sql

@@ -0,0 +1,249 @@
+/* WARNING: Script requires that SQLITE_DBCONFIG_DEFENSIVE be disabled */
+PRAGMA foreign_keys=OFF;
+BEGIN TRANSACTION;
+CREATE TABLE sync_state (key TEXT PRIMARY KEY, value TEXT);
+INSERT INTO sync_state VALUES('schema_version','35');
+CREATE TABLE nodes (
+  uid           TEXT PRIMARY KEY,
+  parent_uid    TEXT,
+  name          TEXT NOT NULL,
+  is_dir        INTEGER NOT NULL,
+  size          INTEGER,
+  mtime         INTEGER NOT NULL,
+  revision_hash TEXT,
+  trashed       INTEGER NOT NULL DEFAULT 0
+, node_json TEXT, listed INTEGER NOT NULL DEFAULT 0, path TEXT);
+INSERT INTO nodes VALUES('vol~root',NULL,'My Files',1,0,200,NULL,0,'{"uid":{"volume_id":"vol","link_id":"root"},"parent_uid":null,"kind":"Folder","name":"My Files","creation_time":100,"modification_time":200,"trashed":false,"is_shared":false,"is_shared_publicly":false,"signature_email":null,"membership":null,"direct_role":null,"share_id":null,"photo":null,"album":null,"verification":{"name":"NotSigned","passphrase":"NotSigned","content_key":null,"extended_attributes":null}}',0,'');
+INSERT INTO nodes VALUES('vol~docs','vol~root','Docs',1,0,200,NULL,0,'{"uid":{"volume_id":"vol","link_id":"docs"},"parent_uid":{"volume_id":"vol","link_id":"root"},"kind":"Folder","name":"Docs","creation_time":100,"modification_time":200,"trashed":false,"is_shared":false,"is_shared_publicly":false,"signature_email":null,"membership":null,"direct_role":null,"share_id":null,"photo":null,"album":null,"verification":{"name":"NotSigned","passphrase":"NotSigned","content_key":null,"extended_attributes":null}}',0,'Docs');
+INSERT INTO nodes VALUES('vol~report','vol~docs','report.txt',0,10,200,NULL,0,'{"uid":{"volume_id":"vol","link_id":"report"},"parent_uid":{"volume_id":"vol","link_id":"docs"},"kind":{"File":{"media_type":"text/plain","total_size_on_storage":20,"active_revision_state":null,"active_revision_id":null,"claimed_size":10,"claimed_modification_time":null,"content_sha1":null}},"name":"report.txt","creation_time":100,"modification_time":200,"trashed":false,"is_shared":false,"is_shared_publicly":false,"signature_email":null,"membership":null,"direct_role":null,"share_id":null,"photo":null,"album":null,"verification":{"name":"NotSigned","passphrase":"NotSigned","content_key":null,"extended_attributes":null}}',0,'Docs/report.txt');
+INSERT INTO nodes VALUES('vol~old','vol~docs','old.txt',0,3,200,NULL,0,'{"uid":{"volume_id":"vol","link_id":"old"},"parent_uid":{"volume_id":"vol","link_id":"docs"},"kind":{"File":{"media_type":"text/plain","total_size_on_storage":13,"active_revision_state":null,"active_revision_id":null,"claimed_size":3,"claimed_modification_time":null,"content_sha1":null}},"name":"old.txt","creation_time":100,"modification_time":200,"trashed":false,"is_shared":false,"is_shared_publicly":false,"signature_email":null,"membership":null,"direct_role":null,"share_id":null,"photo":null,"album":null,"verification":{"name":"NotSigned","passphrase":"NotSigned","content_key":null,"extended_attributes":null}}',0,'Docs/old.txt');
+INSERT INTO nodes VALUES('vol~shared','vol~docs','shared.txt',0,4,200,NULL,0,'{"uid":{"volume_id":"vol","link_id":"shared"},"parent_uid":{"volume_id":"vol","link_id":"docs"},"kind":{"File":{"media_type":"text/plain","total_size_on_storage":14,"active_revision_state":null,"active_revision_id":null,"claimed_size":4,"claimed_modification_time":null,"content_sha1":null}},"name":"shared.txt","creation_time":100,"modification_time":200,"trashed":false,"is_shared":false,"is_shared_publicly":false,"signature_email":null,"membership":null,"direct_role":null,"share_id":null,"photo":null,"album":null,"verification":{"name":"NotSigned","passphrase":"NotSigned","content_key":null,"extended_attributes":null}}',0,'Docs/shared.txt');
+INSERT INTO nodes VALUES('local~dir','vol~root','Offline folder',1,0,200,NULL,0,'{"uid":{"volume_id":"local","link_id":"dir"},"parent_uid":{"volume_id":"vol","link_id":"root"},"kind":"Folder","name":"Offline folder","creation_time":100,"modification_time":200,"trashed":false,"is_shared":false,"is_shared_publicly":false,"signature_email":null,"membership":null,"direct_role":null,"share_id":null,"photo":null,"album":null,"verification":{"name":"NotSigned","passphrase":"NotSigned","content_key":null,"extended_attributes":null}}',1,'Offline folder');
+INSERT INTO nodes VALUES('local~inner','local~dir','inner.txt',0,5,200,NULL,0,'{"uid":{"volume_id":"local","link_id":"inner"},"parent_uid":{"volume_id":"local","link_id":"dir"},"kind":{"File":{"media_type":"text/plain","total_size_on_storage":15,"active_revision_state":null,"active_revision_id":null,"claimed_size":5,"claimed_modification_time":null,"content_sha1":null}},"name":"inner.txt","creation_time":100,"modification_time":200,"trashed":false,"is_shared":false,"is_shared_publicly":false,"signature_email":null,"membership":null,"direct_role":null,"share_id":null,"photo":null,"album":null,"verification":{"name":"NotSigned","passphrase":"NotSigned","content_key":null,"extended_attributes":null}}',0,'Offline folder/inner.txt');
+INSERT INTO nodes VALUES('local~part','vol~root','movie.part',0,7,200,NULL,0,'{"uid":{"volume_id":"local","link_id":"part"},"parent_uid":{"volume_id":"vol","link_id":"root"},"kind":{"File":{"media_type":"text/plain","total_size_on_storage":17,"active_revision_state":null,"active_revision_id":null,"claimed_size":7,"claimed_modification_time":null,"content_sha1":null}},"name":"movie.part","creation_time":100,"modification_time":200,"trashed":false,"is_shared":false,"is_shared_publicly":false,"signature_email":null,"membership":null,"direct_role":null,"share_id":null,"photo":null,"album":null,"verification":{"name":"NotSigned","passphrase":"NotSigned","content_key":null,"extended_attributes":null}}',0,'movie.part');
+CREATE TABLE cache_entries (
+  cache_key     TEXT PRIMARY KEY,
+  size_bytes    INTEGER,
+  last_accessed INTEGER,
+  is_pinned     INTEGER NOT NULL DEFAULT 0
+, kind TEXT NOT NULL DEFAULT 'blob');
+CREATE TABLE pins (
+  uid       TEXT PRIMARY KEY,
+  path      TEXT NOT NULL,
+  recursive INTEGER NOT NULL DEFAULT 0
+);
+CREATE TABLE local_files (
+  id       INTEGER PRIMARY KEY,
+  path     TEXT NOT NULL UNIQUE,
+  name     TEXT NOT NULL,
+  is_dir   INTEGER NOT NULL,
+  size     INTEGER NOT NULL DEFAULT 0,
+  mtime    INTEGER NOT NULL DEFAULT 0,
+  scan_gen INTEGER NOT NULL DEFAULT 0
+);
+CREATE TABLE photos (
+  uid          TEXT PRIMARY KEY,
+  capture_time INTEGER NOT NULL,
+  name         TEXT,
+  ratio        REAL,
+  thumb_state  INTEGER NOT NULL DEFAULT 0,
+  seq          INTEGER NOT NULL
+, media_type TEXT, kind INTEGER NOT NULL DEFAULT 0, favorite INTEGER NOT NULL DEFAULT 0, content_hash TEXT, main_uid TEXT, group_key TEXT, resolved_at INTEGER, latitude REAL, longitude REAL, place_id INTEGER, similar_hash INTEGER);
+CREATE TABLE trash (
+  uid    TEXT PRIMARY KEY,
+  name   TEXT NOT NULL,
+  is_dir INTEGER NOT NULL,
+  size   INTEGER NOT NULL DEFAULT 0,
+  mtime  INTEGER NOT NULL DEFAULT 0
+, parent_uid TEXT, trashed_at INTEGER);
+CREATE TABLE device (
+  uid      TEXT PRIMARY KEY,
+  share_id TEXT NOT NULL,
+  root_uid TEXT NOT NULL,
+  name     TEXT NOT NULL,
+  created  INTEGER NOT NULL DEFAULT 0
+);
+CREATE TABLE sync_folder (
+  id              INTEGER PRIMARY KEY,
+  local_path      TEXT NOT NULL UNIQUE,
+  remote_uid      TEXT NOT NULL,
+  remote_share_id TEXT NOT NULL,
+  mode            TEXT NOT NULL DEFAULT 'mirror',
+  state           TEXT NOT NULL DEFAULT 'idle',
+  last_sync       INTEGER NOT NULL DEFAULT 0
+, pending_mode TEXT);
+CREATE TABLE sync_entry (
+  folder_id   INTEGER NOT NULL,
+  rel_path    TEXT NOT NULL,
+  remote_uid  TEXT,
+  local_mtime INTEGER NOT NULL DEFAULT 0,
+  local_size  INTEGER NOT NULL DEFAULT 0,
+  remote_hash TEXT,
+  remote_rev  TEXT, local_mtime_ns INTEGER,
+  PRIMARY KEY (folder_id, rel_path)
+);
+CREATE TABLE activity (
+  id     INTEGER PRIMARY KEY,
+  time   INTEGER NOT NULL,
+  kind   TEXT NOT NULL,
+  target TEXT NOT NULL,
+  detail TEXT NOT NULL DEFAULT '',
+  ok     INTEGER NOT NULL DEFAULT 1
+);
+CREATE TABLE pending_op (
+  id              INTEGER PRIMARY KEY,
+  kind            TEXT NOT NULL,
+  uid             TEXT NOT NULL,
+  blob_path       TEXT,
+  meta_json       TEXT,
+  created_at      INTEGER NOT NULL,
+  attempts        INTEGER NOT NULL DEFAULT 0,
+  last_error      TEXT,
+  next_attempt_at INTEGER NOT NULL DEFAULT 0
+, parent_uid TEXT, name TEXT, claimed_at INTEGER NOT NULL DEFAULT 0, access_deferred_since INTEGER NOT NULL DEFAULT 0);
+INSERT INTO pending_op VALUES(1,'mkdir','local~dir',NULL,NULL,1700000000000,0,NULL,0,'vol~root','Offline folder',4611686018427387903,0);
+INSERT INTO pending_op VALUES(2,'create','local~inner','/blobs/inner','{"len":5,"mtime":1700000000,"based_on":null}',1700000000000,0,NULL,0,'local~dir','inner.txt',0,0);
+INSERT INTO pending_op VALUES(3,'create','local~part','/blobs/part','{"len":5,"mtime":1700000000,"based_on":null}',1700000000000,0,NULL,8000000000000,'vol~root','movie.part',0,0);
+INSERT INTO pending_op VALUES(4,'revision','vol~report','/blobs/report','{"len":5,"mtime":1700000000,"based_on":null}',1700000000000,2,'network unreachable',1700000900000,NULL,NULL,0,0);
+INSERT INTO pending_op VALUES(5,'rename','vol~shared',NULL,'{"original_parent_uid":"vol~docs","original_name":"shared.txt"}',1700000000000,0,NULL,1700000700000,'vol~root','shared-moved.txt',0,1700000100000);
+INSERT INTO pending_op VALUES(6,'trash','vol~old',NULL,NULL,1700000000000,0,NULL,0,NULL,NULL,0,0);
+CREATE TABLE IF NOT EXISTS 'local_fts_data'(id INTEGER PRIMARY KEY, block BLOB);
+INSERT INTO local_fts_data VALUES(1,x'000000');
+INSERT INTO local_fts_data VALUES(10,x'00000000000000');
+CREATE TABLE IF NOT EXISTS 'local_fts_idx'(segid, term, pgno, PRIMARY KEY(segid, term)) WITHOUT ROWID;
+CREATE TABLE IF NOT EXISTS 'local_fts_docsize'(id INTEGER PRIMARY KEY, sz BLOB);
+CREATE TABLE IF NOT EXISTS 'local_fts_config'(k PRIMARY KEY, v) WITHOUT ROWID;
+INSERT INTO local_fts_config VALUES('version',4);
+CREATE TABLE share_access (
+  root_uid TEXT PRIMARY KEY,
+  access   TEXT NOT NULL
+           CHECK (access IN ('owner', 'editor', 'viewer', 'unknown'))
+);
+CREATE TABLE mount (
+  id              INTEGER PRIMARY KEY,
+  kind            TEXT NOT NULL
+                  CHECK (kind IN ('myfiles', 'device', 'shared')),
+  sync_folder_id  INTEGER REFERENCES sync_folder(id) ON DELETE CASCADE,
+  share_root_uid  TEXT,
+  local_path      TEXT NOT NULL DEFAULT '',
+  root_uid        TEXT NOT NULL DEFAULT '',
+  root_share_id   TEXT NOT NULL DEFAULT '',
+  mode            TEXT NOT NULL DEFAULT 'unknown',
+  access          TEXT NOT NULL DEFAULT 'rw'
+                  CHECK (access IN ('rw', 'ro')),
+  CHECK (
+    (kind = 'myfiles' AND sync_folder_id IS NULL AND share_root_uid IS NULL)
+    OR
+    (kind = 'device' AND sync_folder_id IS NOT NULL AND share_root_uid IS NULL)
+    OR
+    (kind = 'shared' AND sync_folder_id IS NULL AND share_root_uid IS NOT NULL)
+  )
+);
+CREATE TABLE albums (
+  uid           TEXT PRIMARY KEY,
+  name          TEXT NOT NULL,
+  photo_count   INTEGER NOT NULL DEFAULT 0,
+  cover_uid     TEXT,
+  last_activity INTEGER,
+  shared        INTEGER NOT NULL DEFAULT 0,
+  seq           INTEGER NOT NULL
+);
+CREATE TABLE album_photos (
+  album_uid    TEXT NOT NULL,
+  uid          TEXT NOT NULL,
+  capture_time INTEGER NOT NULL,
+  name         TEXT,
+  media_type   TEXT,
+  kind         INTEGER NOT NULL DEFAULT 0,
+  ratio        REAL,
+  thumb_state  INTEGER NOT NULL DEFAULT 0,
+  seq          INTEGER NOT NULL,
+  PRIMARY KEY (album_uid, uid)
+);
+CREATE TABLE IF NOT EXISTS 'nodes_fts_data'(id INTEGER PRIMARY KEY, block BLOB);
+INSERT INTO nodes_fts_data VALUES(1,x'083850');
+INSERT INTO nodes_fts_data VALUES(10,x'000000000108080008010101020101030101040101050101060101070101080101');
+INSERT INTO nodes_fts_data VALUES(137438953473,x'000000340430206669010204010366696c0102050103696c6501020601036c657301020701036d79200102020103792066010203040808080808');
+INSERT INTO nodes_fts_data VALUES(274877906945,x'0000001a0430646f6302080201010201036f6373020803010103040b');
+INSERT INTO nodes_fts_data VALUES(412316860417,x'0000008b04302e747803080801010d01032f72650306010106010363732f03060101040103646f630306010102010365706f03080301010801036f637303060101030202727403080501010a0103706f7203080401010901037265700308020101070202742e03080601010b0103732f7203060101050103742e7403080701010c0202787403080901010e040b0a0a0a0b0a0a0b0b0a0a0b');
+INSERT INTO nodes_fts_data VALUES(549755813889,x'0000006b04302e747804080501010a01032f6f6c0406010106010363732f04060101040103642e7404080401010902026f63040601010201036c642e04080301010801036f6373040601010302026c640408020101070103732f6f0406010105010374787404080601010b040b0a0a0b090b0a0a0a');
+INSERT INTO nodes_fts_data VALUES(687194767361,x'0000008c04302e747805080801010d01032f736805060101060103617265050804010109010363732f05060101040103642e7405080701010c02026f630506010102010365642e05080601010b010368617205080301010801036f63730506010103010372656405080501010a0103732f73050601010502026861050802010107010374787405080901010e040b0a0b0a0b090b0b0a0b0a0a');
+INSERT INTO nodes_fts_data VALUES(824633720833,x'00000084043020666f060809010109010364657206080d01010d0103652066060808010108010366666c06080301010302026c6906080401010402026f6c06080a01010a0103696e6506080601010601036c646506080c01010c0202696e06080501010501036e652006080701010701036f666606080201010202026c6406080b01010b040b0b0b0b0a0a0b0b0a0b0b');
+INSERT INTO nodes_fts_data VALUES(962072674305,x'000000da043020666f070601010901032e747807080701011601032f696e07060101100103646572070601010d010365206607060101080202722e07080501011403012f070601010e010366666c070601010302026c69070601010402026f6c070601010a0103696e65070601010603016e07080201011101036c6465070601010c0202696e070601010501036e6520070601010703017207080401011302026e6507080301011201036f6666070601010202026c64070601010b0103722e7407080601011502022f69070601010f0103747874070808010117040a0b0a0a0a0a080a09090a090a090a090a0a090b09');
+INSERT INTO nodes_fts_data VALUES(1099511627777,x'0000005c04302e706108080701010701036172740808090101090103652e70080806010106010369652e08080501010501036d6f7608080201010201036f766908080301010301037061720808080101080103766965080804010104040b0b0b0b0b0b0b');
+CREATE TABLE IF NOT EXISTS 'nodes_fts_idx'(segid, term, pgno, PRIMARY KEY(segid, term)) WITHOUT ROWID;
+INSERT INTO nodes_fts_idx VALUES(1,x'',2);
+INSERT INTO nodes_fts_idx VALUES(2,x'',2);
+INSERT INTO nodes_fts_idx VALUES(3,x'',2);
+INSERT INTO nodes_fts_idx VALUES(4,x'',2);
+INSERT INTO nodes_fts_idx VALUES(5,x'',2);
+INSERT INTO nodes_fts_idx VALUES(6,x'',2);
+INSERT INTO nodes_fts_idx VALUES(7,x'',2);
+INSERT INTO nodes_fts_idx VALUES(8,x'',2);
+CREATE TABLE IF NOT EXISTS 'nodes_fts_content'(id INTEGER PRIMARY KEY, c0, c1);
+INSERT INTO nodes_fts_content VALUES(1,'My Files','');
+INSERT INTO nodes_fts_content VALUES(2,'Docs','Docs');
+INSERT INTO nodes_fts_content VALUES(3,'report.txt','Docs/report.txt');
+INSERT INTO nodes_fts_content VALUES(4,'old.txt','Docs/old.txt');
+INSERT INTO nodes_fts_content VALUES(5,'shared.txt','Docs/shared.txt');
+INSERT INTO nodes_fts_content VALUES(6,'Offline folder','Offline folder');
+INSERT INTO nodes_fts_content VALUES(7,'inner.txt','Offline folder/inner.txt');
+INSERT INTO nodes_fts_content VALUES(8,'movie.part','movie.part');
+CREATE TABLE IF NOT EXISTS 'nodes_fts_docsize'(id INTEGER PRIMARY KEY, sz BLOB);
+INSERT INTO nodes_fts_docsize VALUES(1,x'0600');
+INSERT INTO nodes_fts_docsize VALUES(2,x'0202');
+INSERT INTO nodes_fts_docsize VALUES(3,x'080d');
+INSERT INTO nodes_fts_docsize VALUES(4,x'050a');
+INSERT INTO nodes_fts_docsize VALUES(5,x'080d');
+INSERT INTO nodes_fts_docsize VALUES(6,x'0c0c');
+INSERT INTO nodes_fts_docsize VALUES(7,x'0716');
+INSERT INTO nodes_fts_docsize VALUES(8,x'0808');
+CREATE TABLE IF NOT EXISTS 'nodes_fts_config'(k PRIMARY KEY, v) WITHOUT ROWID;
+INSERT INTO nodes_fts_config VALUES('version',4);
+CREATE TABLE own_sealed_rev (
+  uid         TEXT PRIMARY KEY,
+  revision_id TEXT NOT NULL,
+  sealed_at   INTEGER NOT NULL
+);
+INSERT INTO own_sealed_rev VALUES('vol~report','rev-1',1700000000000);
+PRAGMA writable_schema=ON;
+INSERT INTO sqlite_schema(type,name,tbl_name,rootpage,sql)VALUES('table','local_fts','local_fts',0,'CREATE VIRTUAL TABLE local_fts USING fts5(
+  name, path, content=''local_files'', content_rowid=''id'', tokenize=''trigram''
+)');
+INSERT INTO sqlite_schema(type,name,tbl_name,rootpage,sql)VALUES('table','nodes_fts','nodes_fts',0,'CREATE VIRTUAL TABLE nodes_fts USING fts5(
+  name, path, tokenize=''trigram''
+)');
+CREATE TRIGGER mount_sync_folder_insert
+AFTER INSERT ON sync_folder
+BEGIN
+  INSERT OR IGNORE INTO mount (kind, sync_folder_id)
+  VALUES ('device', NEW.id);
+END;
+CREATE INDEX idx_nodes_parent ON nodes(parent_uid);
+CREATE INDEX idx_photos_seq ON photos(seq);
+CREATE INDEX pending_op_uid ON pending_op(uid);
+CREATE INDEX pending_op_parent ON pending_op(parent_uid);
+CREATE INDEX cache_entries_lru ON cache_entries(kind, last_accessed);
+CREATE INDEX idx_nodes_name_nocase ON nodes(name COLLATE NOCASE);
+CREATE INDEX idx_local_files_name_nocase
+  ON local_files(name COLLATE NOCASE);
+CREATE UNIQUE INDEX mount_myfiles
+  ON mount(kind) WHERE kind = 'myfiles';
+CREATE UNIQUE INDEX mount_device
+  ON mount(sync_folder_id) WHERE kind = 'device';
+CREATE UNIQUE INDEX mount_shared
+  ON mount(share_root_uid) WHERE kind = 'shared';
+CREATE INDEX idx_album_photos_seq ON album_photos(album_uid, seq);
+CREATE INDEX idx_album_photos_uid ON album_photos(uid);
+CREATE INDEX idx_photos_favorite ON photos(favorite, seq);
+CREATE INDEX idx_sync_entry_remote_uid ON sync_entry(remote_uid);
+CREATE INDEX idx_local_files_scan_gen ON local_files(scan_gen);
+CREATE INDEX idx_nodes_parent_live ON nodes(parent_uid) WHERE trashed = 0;
+CREATE INDEX idx_pending_op_claimed
+    ON pending_op(uid) WHERE claimed_at <> 0;
+CREATE INDEX idx_trash_parent ON trash(parent_uid);
+CREATE INDEX idx_photos_group ON photos(group_key);
+CREATE INDEX idx_photos_unresolved ON photos(resolved_at);
+CREATE INDEX idx_photos_place ON photos(place_id);
+PRAGMA writable_schema=OFF;
+COMMIT;

crates/pdfs-core/src/db/maintenance.rs

@@ -1,4 +1,4 @@
-//! Database health reporting and repair (features.md 4.3).
+//! Database health reporting and repair.
 //!
 //! Everything here exists for the case where something has already gone wrong:
 //! a crash mid-write, a full disk, a cache that has grown out of proportion to

crates/pdfs-core/src/db/migrations.rs

@@ -5,11 +5,13 @@
 //! is already on disk somewhere, so a change here would silently diverge from
 //! what an existing install actually has. Add a new one instead.
 
+use rusqlite::OptionalExtension;
+
 use super::Db;
 use crate::Result;
 
 /// Current schema version. Bump on every forward migration added below.
-pub(super) const SCHEMA_VERSION: i64 = 35;
+pub(super) const SCHEMA_VERSION: i64 = 42;
 
 impl Db {
     pub(super) fn migrate(&self) -> Result<()> {
@@ -332,6 +334,112 @@ impl Db {
                 tx.execute_batch(MIGRATION_V35)?;
             }
         }
+        if current < 36 {
+            // Same guards as V26-V35.
+            let has_column: bool = tx.query_row(
+                "SELECT COUNT(*) FROM pragma_table_info('nodes') WHERE name = 'lid'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            let has_nodes: bool = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'nodes'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            if has_nodes && !has_column {
+                tx.execute_batch(MIGRATION_V36)?;
+            }
+        }
+        if current < 37 {
+            // Same guards as V26-V36.
+            let sql: Option<String> = tx
+                .query_row(
+                    "SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'pending_op'",
+                    [],
+                    |row| row.get(0),
+                )
+                .optional()?;
+            if sql.is_some_and(|sql| !sql.contains("AUTOINCREMENT")) {
+                tx.execute_batch(MIGRATION_V37)?;
+            }
+        }
+        if current < 38 {
+            // Same guards as V26-V37.
+            let has_column: bool = tx.query_row(
+                "SELECT COUNT(*) FROM pragma_table_info('pending_op') WHERE name = 'issue'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            let has_ops: bool = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'pending_op'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            if has_ops && !has_column {
+                tx.execute_batch(MIGRATION_V38)?;
+            }
+        }
+        if current < 39 {
+            // Same guards as V26-V38.
+            let has_column: bool = tx.query_row(
+                "SELECT COUNT(*) FROM pragma_table_info('pending_op') WHERE name = 'lid'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            let has_ops: bool = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'pending_op'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            if has_ops && !has_column {
+                tx.execute_batch(MIGRATION_V39)?;
+            }
+        }
+        if current < 40 {
+            // Same guards as V26-V39.
+            let has_column: bool = tx.query_row(
+                "SELECT COUNT(*) FROM pragma_table_info('nodes') WHERE name = 'parent_lid'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            let has_nodes: bool = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'nodes'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            if has_nodes && !has_column {
+                tx.execute_batch(MIGRATION_V40)?;
+            }
+        }
+        if current < 41 {
+            // Needs both tables; on a database that never had them there is
+            // nothing to rewrite.
+            let tables: i64 = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master
+                 WHERE type = 'table' AND name IN ('nodes', 'pending_op', 'pins')",
+                [],
+                |row| row.get(0),
+            )?;
+            if tables == 3 {
+                tx.execute_batch(MIGRATION_V41)?;
+            }
+        }
+        if current < 42 {
+            // Same guards as V26-V40.
+            let has_column: bool = tx.query_row(
+                "SELECT COUNT(*) FROM pragma_table_info('pending_op') WHERE name = 'sent_sha1'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            let has_ops: bool = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'pending_op'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            if has_ops && !has_column {
+                tx.execute_batch(MIGRATION_V42)?;
+            }
+        }
         tx.execute(
             "INSERT INTO sync_state (key, value) VALUES ('schema_version', ?1)
              ON CONFLICT(key) DO UPDATE SET value = excluded.value",
@@ -469,7 +577,7 @@ CREATE TABLE trash (
 );
 ";
 
-/// Schema v8: device sync (devices.md). This machine registers as one Proton Drive
+/// Schema v8: device sync. This machine registers as one Proton Drive
 /// **Device** (a share + root folder on the main volume); `device` is a singleton
 /// row cached so we reuse the same device across restarts instead of creating a
 /// new one each run. `sync_folder` is one row per local folder the user added,
@@ -530,8 +638,8 @@ ALTER TABLE sync_folder ADD COLUMN pending_mode TEXT;
 ";
 
 /// Schema v11: writes no longer upload inside the FUSE handler. `release` stages
-/// the bytes and records the intended upload here, and a drain worker performs it
-/// (offline.md Phase 3). The row outlives the process, so a write survives both a
+/// the bytes and records the intended upload here, and a drain worker performs it.
+/// The row outlives the process, so a write survives both a
 /// dead network and a restart.
 ///
 /// `blob_path` points into the content cache's `staging/` dir and `meta_json` is
@@ -558,7 +666,7 @@ CREATE INDEX pending_op_uid ON pending_op(uid);
 
 /// Schema v12: `pending_op` also carries mutations that *create* a node, which a
 /// revision op never had to describe — it always addressed a node the server had
-/// already minted a uid for (offline.md Phase 3b).
+/// already minted a uid for.
 ///
 /// An offline `create`/`mkdir` cannot get a real uid, so the node is invented
 /// locally under a `local~<uuid>` placeholder and the op records where it goes
@@ -948,7 +1056,7 @@ ALTER TABLE pending_op ADD COLUMN access_deferred_since INTEGER NOT NULL DEFAULT
 /// as the last sync and left the file the same length — a fixed-size record
 /// rewritten, an image re-exported, a database page updated in place — read as
 /// *unchanged* and was never uploaded. The remote copy silently stayed at the
-/// older content until something else about the file moved (bugs.md B25).
+/// older content until something else about the file moved (`docs/BUGS.md` B25).
 ///
 /// Nullable rather than a converted `local_mtime * 1_000_000_000`: the
 /// nanosecond part of an existing baseline is genuinely unknown, and inventing
@@ -1059,3 +1167,166 @@ ALTER TABLE photos ADD COLUMN similar_hash INTEGER;
 const MIGRATION_V35: &str = "
 ALTER TABLE trash ADD COLUMN trashed_at INTEGER;
 ";
+
+/// Schema v36: every node row has a local id (`lid`); see
+/// docs/ARCHITECTURE.md §2.
+///
+/// The `uid` was the row's key, so a node had no identity until Drive minted
+/// one, and a create that landed moved its row to a new key. The `lid` is given
+/// when the row is first written and never changes or comes back, which is what
+/// `AUTOINCREMENT` adds over a plain rowid. It takes the old rowid, so the
+/// search index, keyed by rowid since v15, stays valid. The `uid` becomes
+/// nullable for a node that is not on Drive yet.
+const MIGRATION_V36: &str = "
+CREATE TABLE nodes_v36 (
+  lid           INTEGER PRIMARY KEY AUTOINCREMENT,
+  uid           TEXT UNIQUE,
+  parent_uid    TEXT,
+  name          TEXT NOT NULL,
+  is_dir        INTEGER NOT NULL,
+  size          INTEGER,
+  mtime         INTEGER NOT NULL,
+  revision_hash TEXT,
+  trashed       INTEGER NOT NULL DEFAULT 0,
+  node_json     TEXT,
+  listed        INTEGER NOT NULL DEFAULT 0,
+  path          TEXT
+);
+INSERT INTO nodes_v36
+  (lid, uid, parent_uid, name, is_dir, size, mtime, revision_hash, trashed, node_json, listed,
+   path)
+  SELECT rowid, uid, parent_uid, name, is_dir, size, mtime, revision_hash, trashed, node_json,
+         listed, path
+    FROM nodes;
+DROP TABLE nodes;
+ALTER TABLE nodes_v36 RENAME TO nodes;
+CREATE INDEX idx_nodes_parent ON nodes(parent_uid);
+CREATE INDEX idx_nodes_name_nocase ON nodes(name COLLATE NOCASE);
+CREATE INDEX idx_nodes_parent_live ON nodes(parent_uid) WHERE trashed = 0;
+";
+
+/// Schema v37: a `pending_op` id is never given out twice.
+///
+/// A plain rowid is the largest one plus one, so an op queued right after the
+/// newest one was dropped took its id. The drain retires the op it is
+/// working on by id, and so deleted the new op: a trash queued over a rename
+/// on the wire was lost when the rename landed. `AUTOINCREMENT` never reuses
+/// an id. Ids are kept, as is every index.
+const MIGRATION_V37: &str = "
+CREATE TABLE pending_op_v37 (
+  id                    INTEGER PRIMARY KEY AUTOINCREMENT,
+  kind                  TEXT NOT NULL,
+  uid                   TEXT NOT NULL,
+  blob_path             TEXT,
+  meta_json             TEXT,
+  created_at            INTEGER NOT NULL,
+  attempts              INTEGER NOT NULL DEFAULT 0,
+  last_error            TEXT,
+  next_attempt_at       INTEGER NOT NULL DEFAULT 0,
+  parent_uid            TEXT,
+  name                  TEXT,
+  claimed_at            INTEGER NOT NULL DEFAULT 0,
+  access_deferred_since INTEGER NOT NULL DEFAULT 0
+);
+INSERT INTO pending_op_v37
+  (id, kind, uid, blob_path, meta_json, created_at, attempts, last_error, next_attempt_at,
+   parent_uid, name, claimed_at, access_deferred_since)
+  SELECT id, kind, uid, blob_path, meta_json, created_at, attempts, last_error,
+         next_attempt_at, parent_uid, name, claimed_at, access_deferred_since
+    FROM pending_op;
+DROP TABLE pending_op;
+ALTER TABLE pending_op_v37 RENAME TO pending_op;
+CREATE INDEX pending_op_uid ON pending_op(uid);
+CREATE INDEX pending_op_parent ON pending_op(parent_uid);
+CREATE INDEX idx_pending_op_claimed
+    ON pending_op(uid) WHERE claimed_at <> 0;
+";
+
+/// Schema v38: why Drive refused a queued op, when it did (a sync issue).
+/// `NULL` for an op that has not been refused, which is every op migrated.
+const MIGRATION_V38: &str = "
+ALTER TABLE pending_op ADD COLUMN issue TEXT;
+";
+
+/// Schema v39: a queued op names its node and its parent by local id too.
+///
+/// A create made inside a folder that had not landed named the folder by its
+/// placeholder uid, and every landing had to find and rewrite those strings.
+/// The local id stays the same when the folder lands. An op whose node has no
+/// row keeps `NULL` and is matched by uid, as before.
+const MIGRATION_V39: &str = "
+ALTER TABLE pending_op ADD COLUMN lid INTEGER;
+ALTER TABLE pending_op ADD COLUMN parent_lid INTEGER;
+UPDATE pending_op
+   SET lid = (SELECT lid FROM nodes WHERE nodes.uid = pending_op.uid),
+       parent_lid = (SELECT lid FROM nodes WHERE nodes.uid = pending_op.parent_uid);
+CREATE INDEX pending_op_lid ON pending_op(lid);
+CREATE INDEX pending_op_parent_lid ON pending_op(parent_lid);
+";
+
+/// Schema v40: a node row names its parent by local id too.
+///
+/// The local id stays when a folder made here lands and its row takes the uid
+/// Drive gave it, so a child linked by it needs no rewrite. `NULL` while the
+/// parent has no row, as `parent_uid` then names nothing either.
+const MIGRATION_V40: &str = "
+ALTER TABLE nodes ADD COLUMN parent_lid INTEGER;
+UPDATE nodes SET parent_lid = (SELECT p.lid FROM nodes p WHERE p.uid = nodes.parent_uid);
+CREATE INDEX idx_nodes_parent_lid ON nodes(parent_lid);
+";
+
+/// Schema v41: a node made on this machine goes by `local~<lid>` until it
+/// lands, a function of its row, where it used to get a `local~<ms>-<n>`
+/// placeholder. Every placeholder still stored is rewritten to its row's
+/// stand-in: the row itself and its `node_json`, its children, the ops on it
+/// or into it, and its pins. A placeholder op with no row keeps its uid and
+/// drains as before.
+const MIGRATION_V41: &str = "
+CREATE TEMP TABLE local_v41 AS
+  SELECT uid AS old, 'local~' || lid AS new, lid FROM nodes
+   WHERE uid LIKE 'local~%' AND uid <> 'local~' || lid;
+UPDATE pending_op SET uid = (SELECT new FROM local_v41 WHERE old = pending_op.uid)
+ WHERE uid IN (SELECT old FROM local_v41);
+UPDATE pending_op SET parent_uid = (SELECT new FROM local_v41 WHERE old = pending_op.parent_uid)
+ WHERE parent_uid IN (SELECT old FROM local_v41);
+UPDATE pending_op
+   SET meta_json = json_set(meta_json, '$.uid',
+         (SELECT new FROM local_v41 WHERE old = json_extract(pending_op.meta_json, '$.uid')))
+ WHERE json_valid(meta_json)
+   AND json_extract(meta_json, '$.uid') IN (SELECT old FROM local_v41);
+UPDATE pending_op
+   SET meta_json = json_set(meta_json, '$.original_parent_uid',
+         (SELECT new FROM local_v41
+           WHERE old = json_extract(pending_op.meta_json, '$.original_parent_uid')))
+ WHERE json_valid(meta_json)
+   AND json_extract(meta_json, '$.original_parent_uid') IN (SELECT old FROM local_v41);
+UPDATE pins SET uid = (SELECT new FROM local_v41 WHERE old = pins.uid)
+ WHERE uid IN (SELECT old FROM local_v41);
+UPDATE nodes
+   SET node_json = json_set(node_json, '$.parent_uid.link_id',
+         (SELECT CAST(lid AS TEXT) FROM local_v41 WHERE old = nodes.parent_uid))
+ WHERE parent_uid IN (SELECT old FROM local_v41)
+   AND json_valid(node_json)
+   AND json_extract(node_json, '$.parent_uid.volume_id') = 'local';
+UPDATE nodes SET parent_uid = (SELECT new FROM local_v41 WHERE old = nodes.parent_uid)
+ WHERE parent_uid IN (SELECT old FROM local_v41);
+UPDATE nodes
+   SET node_json = json_set(node_json, '$.uid.link_id', CAST(lid AS TEXT))
+ WHERE lid IN (SELECT lid FROM local_v41)
+   AND json_valid(node_json)
+   AND json_extract(node_json, '$.uid.volume_id') = 'local';
+UPDATE nodes SET uid = 'local~' || lid WHERE lid IN (SELECT lid FROM local_v41);
+DROP TABLE local_v41;
+";
+
+/// Schema v42: the SHA-1 of each blob a queued create sent, space-separated.
+/// A create whose answer was lost may have made its file with any of them,
+/// and the op that finds that file again may run after a restart. `NULL` for
+/// an op that has sent nothing, which is every op migrated: what the daemon
+/// that wrote it sent is not known. Likewise the parent and name each attempt
+/// was sent under, as a JSON list of pairs: a rename since then moves the op
+/// but not the file Drive may have made.
+const MIGRATION_V42: &str = "
+ALTER TABLE pending_op ADD COLUMN sent_sha1 TEXT;
+ALTER TABLE pending_op ADD COLUMN sent_to TEXT;
+";

crates/pdfs-core/src/db/mod.rs

@@ -56,8 +56,9 @@ pub use local::LocalFileHit;
 pub use maintenance::{DbStats, VacuumOutcome};
 pub use nodes::{PublishedSharedRoot, SearchHit, StoredNode};
 pub use ops::{
-    AttachedBlob, FAILING_ATTEMPTS, LOCAL_VOLUME, OP_CREATE, OP_MKDIR, OP_RENAME, OP_REVISION,
-    OP_TRASH, PARK_EXPIRY_MS, PARK_UNTIL, PendingCounts, PendingOp, RenameMeta, op_supersedes,
+    AttachedBlob, CreateLanding, CreateRetired, FAILING_ATTEMPTS, LOCAL_VOLUME, OP_CREATE,
+    OP_MKDIR, OP_RENAME, OP_REVISION, OP_TRASH, PARK_EXPIRY_MS, PARK_UNTIL, PendingCounts,
+    PendingOp, RenameMeta, local_lid, local_uid, op_supersedes,
 };
 pub use photos::{StoredPhoto, StoredPlace, THUMB_HAVE, THUMB_NONE, THUMB_UNKNOWN, TimelineRow};
 pub use pins::PinRow;

crates/pdfs-core/src/db/nodes.rs

@@ -3,9 +3,11 @@
 
 use std::collections::HashSet;
 
+use rusqlite::types::Value;
 use rusqlite::{OptionalExtension, Transaction, params};
 
 use super::Db;
+use super::ops::{OP_CREATE, OP_MKDIR, OP_RENAME, local_lid, local_uid, wake_ops_waiting_for_tx};
 use crate::{Access, Result};
 use proton_drive_rs::proton_sdk::ids::{LinkId, NodeUid, VolumeId};
 use proton_drive_rs::{Node, NodeKind};
@@ -17,6 +19,8 @@ use super::utils::{
 pub struct StoredNode {
     pub node: Node,
     pub listed: bool,
+    /// The row's local id ([`Db::lid_of`]).
+    pub lid: i64,
 }
 
 /// One full-text search match: the stored [`Node`] plus its mountpoint-relative
@@ -62,12 +66,13 @@ impl Db {
     /// snapshot while offline, including after a live event expired its TTL.
     pub fn visible_children(&self, parent: &NodeUid) -> Result<Vec<Node>> {
         let conn = self.read();
-        let mut stmt = conn.prepare(
-            "SELECT node_json FROM nodes
-              WHERE parent_uid = ?1 AND trashed = 0 AND node_json IS NOT NULL
-              ORDER BY name, uid",
-        )?;
-        let rows = stmt.query_map([parent.to_string()], |row| row.get::<_, String>(0))?;
+        let (key, parent) = parent_key(&conn, &parent.to_string())?;
+        let mut stmt = conn.prepare(&format!(
+            "SELECT {NODE_NOW} FROM nodes n LEFT JOIN nodes p ON p.lid = n.parent_lid
+              WHERE n.{key} = ?1 AND n.trashed = 0 AND n.node_json IS NOT NULL
+              ORDER BY n.name, n.uid"
+        ))?;
+        let rows = stmt.query_map([parent], |row| row.get::<_, String>(0))?;
         let mut nodes = Vec::new();
         for row in rows {
             nodes.push(serde_json::from_str(&row?)?);
@@ -264,10 +269,25 @@ impl Db {
     /// resolve its shared-tree access. Removing the op first could resurrect
     /// that row after a crash; removing the row first could strand a now
     /// unauthorizable op. One transaction closes both windows.
-    pub fn complete_trash_op(&self, op_id: i64, uid: &NodeUid) -> Result<()> {
+    ///
+    /// An op that found the name still held by this trash failed with a
+    /// backoff, and the name is free now. It is made due at once
+    /// ([`Db::wake_ops_waiting_for`]).
+    ///
+    /// Returns the staged blob of the create the trash withdrew, if it kept
+    /// one, for the caller to discard.
+    pub fn complete_trash_op(&self, op_id: i64, uid: &NodeUid) -> Result<Option<String>> {
         let uid = uid.to_string();
         let mut conn = self.conn.lock();
         let tx = conn.transaction()?;
+        let (name, blob): (Option<String>, Option<String>) = tx
+            .query_row(
+                "SELECT name, blob_path FROM pending_op WHERE id = ?1",
+                params![op_id],
+                |row| Ok((row.get(0)?, row.get(1)?)),
+            )
+            .optional()?
+            .unwrap_or_default();
         let rowid: Option<i64> = tx
             .query_row(
                 "SELECT rowid FROM nodes WHERE uid = ?1",
@@ -280,17 +300,23 @@ impl Db {
             tx.execute("DELETE FROM nodes_fts WHERE rowid = ?1", params![rowid])?;
         }
         tx.execute("DELETE FROM pending_op WHERE id = ?1", params![op_id])?;
+        if let Some(name) = name {
+            wake_ops_waiting_for_tx(&tx, &name)?;
+        }
         tx.commit()?;
-        Ok(())
+        Ok(blob)
     }
 
     /// Check if a folder node has any non-trashed children in the database.
     pub fn has_children(&self, parent_uid: &NodeUid) -> Result<bool> {
-        let uid_str = parent_uid.to_string();
         let conn = self.read();
+        let (key, parent) = parent_key(&conn, &parent_uid.to_string())?;
         let count: i64 = conn.query_row(
-            "SELECT COUNT(*) FROM nodes WHERE parent_uid = ?1 AND trashed = 0",
-            params![uid_str],
+            &format!(
+                "SELECT COUNT(*) FROM nodes
+                 WHERE {key} = ?1 AND trashed = 0 AND node_json IS NOT NULL"
+            ),
+            params![parent],
             |row| row.get(0),
         )?;
         Ok(count > 0)
@@ -305,9 +331,11 @@ impl Db {
     pub fn node_path(&self, uid: &str) -> Result<Option<String>> {
         let conn = self.read();
         let exists: Option<i64> = conn
-            .query_row("SELECT 1 FROM nodes WHERE uid = ?1", params![uid], |r| {
-                r.get(0)
-            })
+            .query_row(
+                "SELECT 1 FROM nodes WHERE uid = ?1 AND node_json IS NOT NULL",
+                params![uid],
+                |r| r.get(0),
+            )
             .optional()?;
         if exists.is_none() {
             return Ok(None);
@@ -325,11 +353,11 @@ impl Db {
     pub fn path_relative_to(&self, ancestor_uid: &str, uid: &str) -> Result<Option<String>> {
         let conn = self.read();
         let mut stmt = conn.prepare(
-            "WITH RECURSIVE anc(uid, parent_uid, name, depth) AS (
-               SELECT uid, parent_uid, name, 0 FROM nodes WHERE uid = ?1
+            "WITH RECURSIVE anc(uid, parent_lid, name, depth) AS (
+               SELECT uid, parent_lid, name, 0 FROM nodes WHERE uid = ?1
                UNION ALL
-               SELECT n.uid, n.parent_uid, n.name, anc.depth + 1
-               FROM nodes n JOIN anc ON n.uid = anc.parent_uid
+               SELECT n.uid, n.parent_lid, n.name, anc.depth + 1
+               FROM nodes n JOIN anc ON n.lid = anc.parent_lid
                WHERE anc.depth < 1024
              )
              SELECT uid, name FROM anc ORDER BY depth",
@@ -378,12 +406,13 @@ impl Db {
         let conn = self.read();
         let rows: Vec<HitRow> = if query.chars().count() < TRIGRAM_MIN {
             let pat = format!("%{}%", like_escape(query));
-            let mut stmt = conn.prepare(
-                "SELECT node_json, uid, path FROM nodes
-                 WHERE name LIKE ?1 ESCAPE '\\' AND trashed = 0 AND node_json IS NOT NULL
-                   AND (?3 IS NULL OR path IS NULL OR path LIKE ?3 ESCAPE '\\')
-                 ORDER BY name LIMIT ?2",
-            )?;
+            let mut stmt = conn.prepare(&format!(
+                "SELECT {NODE_NOW}, n.uid, n.path
+                 FROM nodes n LEFT JOIN nodes p ON p.lid = n.parent_lid
+                 WHERE n.name LIKE ?1 ESCAPE '\\' AND n.trashed = 0 AND n.node_json IS NOT NULL
+                   AND (?3 IS NULL OR n.path IS NULL OR n.path LIKE ?3 ESCAPE '\\')
+                 ORDER BY n.name LIMIT ?2"
+            ))?;
             collect_hits(stmt.query_map(params![pat, limit as i64, scope_pat], hit_row)?)?
         } else {
             // Escape double quotes and quote each term, then combine with AND so
@@ -393,13 +422,14 @@ impl Db {
                 .map(|word| format!("\"{}\"", word.replace('"', "\"\"")))
                 .collect::<Vec<_>>()
                 .join(" AND ");
-            let mut stmt = conn.prepare(
-                "SELECT n.node_json, n.uid, n.path
+            let mut stmt = conn.prepare(&format!(
+                "SELECT {NODE_NOW}, n.uid, n.path
                  FROM nodes_fts f JOIN nodes n ON n.rowid = f.rowid
+                 LEFT JOIN nodes p ON p.lid = n.parent_lid
                  WHERE f.name MATCH ?1 AND n.trashed = 0 AND n.node_json IS NOT NULL
                    AND (?3 IS NULL OR n.path IS NULL OR n.path LIKE ?3 ESCAPE '\\')
-                 ORDER BY f.rank LIMIT ?2",
-            )?;
+                 ORDER BY f.rank LIMIT ?2"
+            ))?;
             collect_hits(stmt.query_map(params![phrase, limit as i64, scope_pat], hit_row)?)?
         };
 
@@ -436,20 +466,22 @@ impl Db {
         let lane_limit = limit.div_ceil(2);
         let mut rows: Vec<HitRow> = if terms.is_empty() {
             let pat = format!("%{}%", like_escape(query));
-            let mut stmt = conn.prepare(
-                "SELECT node_json, uid, path FROM nodes
-                 WHERE name LIKE ?1 ESCAPE '\\' AND trashed = 0 AND node_json IS NOT NULL
-                 ORDER BY name LIMIT ?2",
-            )?;
+            let mut stmt = conn.prepare(&format!(
+                "SELECT {NODE_NOW}, n.uid, n.path
+                 FROM nodes n LEFT JOIN nodes p ON p.lid = n.parent_lid
+                 WHERE n.name LIKE ?1 ESCAPE '\\' AND n.trashed = 0 AND n.node_json IS NOT NULL
+                 ORDER BY n.name LIMIT ?2"
+            ))?;
             collect_hits(stmt.query_map(params![pat, limit as i64], hit_row)?)?
         } else {
             let expression = terms.join(" OR ");
-            let mut stmt = conn.prepare(
-                "SELECT n.node_json, n.uid, n.path
+            let mut stmt = conn.prepare(&format!(
+                "SELECT {NODE_NOW}, n.uid, n.path
                    FROM nodes_fts f JOIN nodes n ON n.rowid = f.rowid
+                   LEFT JOIN nodes p ON p.lid = n.parent_lid
                   WHERE nodes_fts MATCH ?1 AND n.trashed = 0 AND n.node_json IS NOT NULL
-                  ORDER BY f.rank LIMIT ?2",
-            )?;
+                  ORDER BY f.rank LIMIT ?2"
+            ))?;
             collect_hits(stmt.query_map(params![expression, lane_limit as i64], hit_row)?)?
         };
         // Trigram rank does not know that a name *starts* with the query, and a
@@ -459,12 +491,13 @@ impl Db {
         if !terms.is_empty()
             && let Some(first) = query.chars().next()
         {
-            let mut stmt = conn.prepare(
-                "SELECT node_json, uid, path FROM nodes
-                 WHERE name COLLATE NOCASE LIKE ?1 ESCAPE '\\'
-                   AND trashed = 0 AND node_json IS NOT NULL
-                 ORDER BY name COLLATE NOCASE LIMIT ?2",
-            )?;
+            let mut stmt = conn.prepare(&format!(
+                "SELECT {NODE_NOW}, n.uid, n.path
+                 FROM nodes n LEFT JOIN nodes p ON p.lid = n.parent_lid
+                 WHERE n.name COLLATE NOCASE LIKE ?1 ESCAPE '\\'
+                   AND n.trashed = 0 AND n.node_json IS NOT NULL
+                 ORDER BY n.name COLLATE NOCASE LIMIT ?2"
+            ))?;
             let mut extra = Vec::new();
             for pattern in [
                 format!("{}%", like_escape(query)),
@@ -500,40 +533,50 @@ impl Db {
     /// re-enumerates from the remote on next access.
     pub fn set_listed(&self, uid: &NodeUid, listed: bool) -> Result<()> {
         let conn = self.conn.lock();
+        let (key, uid) = row_key(&uid.to_string());
         conn.execute(
-            "UPDATE nodes SET listed = ?2 WHERE uid = ?1",
-            params![uid.to_string(), listed as i64],
+            &format!("UPDATE nodes SET listed = ?2 WHERE {key} = ?1"),
+            params![uid, listed as i64],
         )?;
         Ok(())
     }
 
     /// Load every persisted node for cold-start hydration of the `State` maps.
+    ///
+    /// Each node names its parent as the parent's row has it now, found by
+    /// local id: a folder that landed has its new uid there, while the node
+    /// stored below it may still hold the placeholder.
     pub fn load_all(&self) -> Result<Vec<StoredNode>> {
         let conn = self.read();
-        let mut stmt =
-            conn.prepare("SELECT node_json, listed FROM nodes WHERE node_json IS NOT NULL")?;
+        let mut stmt = conn.prepare(&format!(
+            "SELECT {NODE_NOW}, n.listed, n.lid
+             FROM nodes n LEFT JOIN nodes p ON p.lid = n.parent_lid
+             WHERE n.node_json IS NOT NULL"
+        ))?;
         let rows = stmt.query_map([], |row| {
             let json: String = row.get(0)?;
             let listed: i64 = row.get(1)?;
-            Ok((json, listed != 0))
+            Ok((json, listed != 0, row.get(2)?))
         })?;
         let mut out = Vec::new();
         for row in rows {
-            let (json, listed) = row?;
+            let (json, listed, lid) = row?;
             let node: Node = serde_json::from_str(&json)?;
-            out.push(StoredNode { node, listed });
+            out.push(StoredNode { node, listed, lid });
         }
         Ok(out)
     }
 
     /// Load one persisted node back by uid. Used to recover the My Files root
-    /// when the API is unreachable, so the mount can still serve the cached tree
-    /// (offline.md Phase 1).
+    /// when the API is unreachable, so the mount can still serve the cached tree.
     pub fn node_by_uid(&self, uid: &str) -> Result<Option<Node>> {
         let conn = self.read();
         let json: Option<String> = conn
             .query_row(
-                "SELECT node_json FROM nodes WHERE uid = ?1 AND node_json IS NOT NULL",
+                &format!(
+                    "SELECT {NODE_NOW} FROM nodes n LEFT JOIN nodes p ON p.lid = n.parent_lid
+                     WHERE n.uid = ?1 AND n.node_json IS NOT NULL"
+                ),
                 params![uid],
                 |r| r.get(0),
             )
@@ -544,31 +587,178 @@ impl Db {
         }
     }
 
+    /// The uid of the node with local id `lid`: `None` when it has no row, or
+    /// is not on Drive yet.
+    pub fn uid_of_lid(&self, lid: i64) -> Result<Option<String>> {
+        let conn = self.read();
+        Ok(conn
+            .query_row("SELECT uid FROM nodes WHERE lid = ?1", params![lid], |r| {
+                r.get(0)
+            })
+            .optional()?
+            .flatten())
+    }
+
+    /// The local id of the node stored under `uid`, or `None` when it has no
+    /// row. It stays the same for as long as the row exists, including when a
+    /// create lands and the row takes the uid Drive gave it: a node made on
+    /// this machine is found by its stand-in ([`local_uid`]) before and after.
+    pub fn lid_of(&self, uid: &str) -> Result<Option<i64>> {
+        node_lid(&self.read(), uid)
+    }
+
+    /// The local id of each node, in order, giving a row to each that has none.
+    ///
+    /// A new row is only a stub: it has no `node_json`, so no listing or search
+    /// returns it until the node is upserted, which the caller still owes. That
+    /// keeps this cheap enough to call with the inode lock held, which is
+    /// where an inode number is first needed.
+    pub fn lids_for(&self, nodes: &[&Node]) -> Result<Vec<i64>> {
+        let mut conn = self.conn.lock();
+        let tx = conn.transaction()?;
+        let mut lids = Vec::with_capacity(nodes.len());
+        {
+            let mut known = tx.prepare_cached("SELECT lid FROM nodes WHERE uid = ?1")?;
+            let mut stub = tx.prepare_cached(
+                "INSERT INTO nodes (uid, parent_uid, name, is_dir, mtime, trashed, parent_lid)
+                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)",
+            )?;
+            for node in nodes {
+                let uid = node.uid.to_string();
+                let lid = match known.query_row(params![uid], |r| r.get(0)).optional()? {
+                    Some(lid) => lid,
+                    None => {
+                        let parent = node.parent_uid.as_ref().map(ToString::to_string);
+                        let parent_lid = match &parent {
+                            Some(parent) => node_lid(&tx, parent)?,
+                            None => None,
+                        };
+                        stub.execute(params![
+                            uid,
+                            parent,
+                            node.name,
+                            node.is_folder() as i64,
+                            node.modification_time,
+                            node.trashed as i64,
+                            parent_lid,
+                        ])?;
+                        let lid = tx.last_insert_rowid();
+                        adopt_children_tx(&tx, &uid, lid)?;
+                        lid
+                    }
+                };
+                lids.push(lid);
+            }
+        }
+        tx.commit()?;
+        Ok(lids)
+    }
+
+    /// Give a node being made on this machine its row under `parent_uid`, and
+    /// return its local id. The row goes by [`local_uid`] of that id until
+    /// the node lands.
+    ///
+    /// Like [`Db::lids_for`], only a stub: the caller upserts the node.
+    pub fn add_local_row(
+        &self,
+        parent_uid: &str,
+        name: &str,
+        is_dir: bool,
+        mtime: i64,
+    ) -> Result<i64> {
+        let mut conn = self.conn.lock();
+        let tx = conn.transaction()?;
+        tx.execute(
+            "INSERT INTO nodes (uid, parent_uid, name, is_dir, mtime, trashed, parent_lid)
+             VALUES (NULL, ?1, ?2, ?3, ?4, 0,
+                     COALESCE(?5, (SELECT lid FROM nodes WHERE uid = ?1)))",
+            params![
+                parent_uid,
+                name,
+                is_dir as i64,
+                mtime,
+                local_lid(parent_uid)
+            ],
+        )?;
+        let lid = tx.last_insert_rowid();
+        tx.execute(
+            "UPDATE nodes SET uid = ?2 WHERE lid = ?1",
+            params![lid, local_uid(lid)],
+        )?;
+        tx.commit()?;
+        Ok(lid)
+    }
+
     /// Read the persisted incremental-sync cursor (a `DriveEventId`), if any.
     /// The daemon resumes from this on restart instead of reseeding to the
     /// server head, so changes made while unmounted are still applied (P2).
     pub fn children_if_listed(&self, parent: &NodeUid) -> Result<Option<Vec<Node>>> {
         let conn = self.read();
+        let (key, folder) = row_key(&parent.to_string());
         let listed: Option<i64> = conn
             .query_row(
-                "SELECT listed FROM nodes WHERE uid = ?1",
-                params![parent.to_string()],
+                &format!("SELECT listed FROM nodes WHERE {key} = ?1"),
+                params![folder],
                 |r| r.get(0),
             )
             .optional()?;
         if listed != Some(1) {
             return Ok(None);
         }
-        let mut stmt = conn.prepare(
-            "SELECT node_json FROM nodes
-             WHERE parent_uid = ?1 AND node_json IS NOT NULL AND trashed = 0",
-        )?;
-        let rows = stmt.query_map(params![parent.to_string()], |r| r.get::<_, String>(0))?;
+        drop(conn);
+        self.known_children(parent).map(Some)
+    }
+
+    /// The children the DB knows under `parent`, whether or not the folder's
+    /// listing is still marked complete. Only for when nothing better can be
+    /// had: a listing dropped as stale may miss or keep a child.
+    pub fn known_children(&self, parent: &NodeUid) -> Result<Vec<Node>> {
+        let conn = self.read();
+        let (key, parent) = parent_key(&conn, &parent.to_string())?;
+        let mut stmt = conn.prepare(&format!(
+            "SELECT {NODE_NOW} FROM nodes n LEFT JOIN nodes p ON p.lid = n.parent_lid
+             WHERE n.{key} = ?1 AND n.node_json IS NOT NULL AND n.trashed = 0"
+        ))?;
+        let rows = stmt.query_map(params![parent], |r| r.get::<_, String>(0))?;
         let mut out = Vec::new();
         for json in rows {
             out.push(serde_json::from_str(&json?)?);
         }
-        Ok(Some(out))
+        Ok(out)
+    }
+
+    /// What a queued change does to `parent`'s listing, which Drive does not
+    /// show until it lands: the children made or moved in by a queued create,
+    /// mkdir or rename, as the DB holds them, and the nodes a queued rename
+    /// moves elsewhere.
+    ///
+    /// A listing read from Drive is laid over with these, or a folder listed
+    /// while a create in it is queued, after a restart say, loses the file
+    /// until the create lands (`docs/BUGS.md` B132).
+    pub fn queued_children(&self, parent: &NodeUid) -> Result<(Vec<Node>, HashSet<String>)> {
+        let conn = self.read();
+        let (key, parent) = parent_key(&conn, &parent.to_string())?;
+        let mut stmt = conn.prepare(&format!(
+            "SELECT {NODE_NOW} FROM nodes n LEFT JOIN nodes p ON p.lid = n.parent_lid
+             WHERE n.{key} = ?1 AND n.node_json IS NOT NULL AND n.trashed = 0
+               AND EXISTS (SELECT 1 FROM pending_op o
+                           WHERE (o.lid = n.lid OR o.uid = n.uid) AND o.kind IN (?2, ?3, ?4))"
+        ))?;
+        let rows = stmt.query_map(params![parent, OP_CREATE, OP_MKDIR, OP_RENAME], |r| {
+            r.get::<_, String>(0)
+        })?;
+        let mut here = Vec::new();
+        for json in rows {
+            here.push(serde_json::from_str(&json?)?);
+        }
+        let mut stmt = conn.prepare(&format!(
+            "SELECT DISTINCT n.uid FROM pending_op p JOIN nodes n ON n.lid = p.lid OR n.uid = p.uid
+             WHERE p.kind = ?2 AND n.{key} IS NOT ?1"
+        ))?;
+        let gone = stmt
+            .query_map(params![parent, OP_RENAME], |r| r.get::<_, String>(0))?
+            .collect::<std::result::Result<HashSet<_>, _>>()?;
+        Ok((here, gone))
     }
 
     // --- Content-cache LRU index (P4) -------------------------------------
@@ -590,9 +780,157 @@ struct PriorRow {
     trashed: bool,
 }
 
+/// [`Db::lid_of`] on `conn`, which may be a transaction.
+pub(super) fn node_lid(conn: &rusqlite::Connection, uid: &str) -> Result<Option<i64>> {
+    let row = match local_lid(uid) {
+        Some(lid) => conn.query_row("SELECT lid FROM nodes WHERE lid = ?1", params![lid], |r| {
+            r.get(0)
+        }),
+        None => conn.query_row("SELECT lid FROM nodes WHERE uid = ?1", params![uid], |r| {
+            r.get(0)
+        }),
+    };
+    Ok(row.optional()?)
+}
+
+/// The column and value that find `uid`'s own row. A stand-in is found by its
+/// local id: a create that lands gives the row the uid Drive made before the
+/// tree has it, and the tree asks by the stand-in until then (`docs/BUGS.md`
+/// B177).
+fn row_key(uid: &str) -> (&'static str, Value) {
+    match local_lid(uid) {
+        Some(lid) => ("lid", Value::Integer(lid)),
+        None => ("uid", Value::Text(uid.to_owned())),
+    }
+}
+
+/// The column and value a row names `parent` by: its local id when it has a
+/// row, which the children keep when it lands, or its uid when it has none,
+/// as a device folder's root does.
+fn parent_key(conn: &rusqlite::Connection, parent: &str) -> Result<(&'static str, Value)> {
+    Ok(match node_lid(conn, parent)? {
+        Some(lid) => ("parent_lid", Value::Integer(lid)),
+        None => ("parent_uid", Value::Text(parent.to_owned())),
+    })
+}
+
+/// `n.node_json` naming its parent as the parent's row `p`, joined by
+/// `n.parent_lid`, has it now. A folder that lands takes its real uid in its
+/// own row only, so a node stored below it still names the stand-in.
+const NODE_NOW: &str = "CASE WHEN p.uid IS NULL OR p.uid = n.parent_uid THEN n.node_json
+     ELSE json_set(n.node_json, '$.parent_uid', json_object(
+            'volume_id', substr(p.uid, 1, instr(p.uid, '~') - 1),
+            'link_id', substr(p.uid, instr(p.uid, '~') + 1))) END";
+
+/// Hand a drained placeholder's row to the real uid it landed as.
+///
+/// Nothing else is rewritten. The rows below it and the ops made inside it
+/// name it by its local id, which stays; what reads them for a uid takes the
+/// one the row has now ([`NODE_NOW`], `PARENT_NOW` in `ops.rs`).
+///
+/// Dropping the placeholder row and waiting for the server's copy of the real
+/// node left a window with no row for either uid. A queued child drained in
+/// that window found no authority for its parent, re-read it over the network
+/// and was deferred five seconds behind a folder that had just landed
+/// (`docs/BUGS.md` B120). The placeholder's own node, readdressed, stands in
+/// until the server's copy is upserted over it. A row the real uid already
+/// has is newer than the placeholder, so its node is kept, under the
+/// placeholder's `lid`: the node was known by that one first.
+pub(super) fn adopt_placeholder_row_tx(
+    tx: &Transaction<'_>,
+    local: &str,
+    real: &str,
+) -> Result<()> {
+    // A folder pinned before it landed stays pinned: the pin keyed by the
+    // placeholder was dropped with it (`docs/BUGS.md` B148).
+    tx.execute(
+        "UPDATE OR IGNORE pins SET uid = ?2 WHERE uid = ?1",
+        params![local, real],
+    )?;
+    tx.execute("DELETE FROM pins WHERE uid = ?1", params![local])?;
+    let row: Option<(i64, Option<String>)> = tx
+        .query_row(
+            "SELECT lid, node_json FROM nodes WHERE uid = ?1",
+            params![local],
+            |row| Ok((row.get(0)?, row.get(1)?)),
+        )
+        .optional()?;
+    // Ops queued before schema 39 have no `parent_lid`, nor do ops made
+    // under a placeholder that never had a row.
+    tx.execute(
+        "UPDATE pending_op SET parent_uid = ?2 WHERE parent_lid IS NULL AND parent_uid = ?1",
+        params![local, real],
+    )?;
+    let Some((lid, json)) = row else {
+        return Ok(());
+    };
+    let known: Option<(i64, Option<String>)> = tx
+        .query_row(
+            "SELECT lid, node_json FROM nodes WHERE uid = ?1",
+            params![real],
+            |row| Ok((row.get(0)?, row.get(1)?)),
+        )
+        .optional()?;
+    if let Some((known_lid, _)) = known {
+        // Ops queued against the row Drive listed now name the landing one.
+        tx.execute(
+            "UPDATE pending_op SET lid = ?2 WHERE lid = ?1",
+            params![known_lid, lid],
+        )?;
+        tx.execute(
+            "UPDATE pending_op SET parent_lid = ?2 WHERE parent_lid = ?1",
+            params![known_lid, lid],
+        )?;
+        tx.execute(
+            "UPDATE nodes SET parent_lid = ?2 WHERE parent_lid = ?1",
+            params![known_lid, lid],
+        )?;
+        tx.execute("DELETE FROM nodes WHERE lid = ?1", params![known_lid])?;
+        tx.execute("DELETE FROM nodes_fts WHERE rowid = ?1", params![known_lid])?;
+    }
+    tx.execute(
+        "UPDATE nodes SET uid = ?2 WHERE lid = ?1",
+        params![lid, real],
+    )?;
+    let json = known.and_then(|(_, known_json)| known_json).or(json);
+    let (Some(json), Some(real)) = (json, parse_node_uid(real)) else {
+        return Ok(());
+    };
+    let mut node: Node = serde_json::from_str(&json)?;
+    node.uid = real;
+    upsert_node_tx(tx, &node)
+}
+
+/// Link the rows that name `uid` as their parent to its new row `lid`: they
+/// were stored before it, or under a row of the same uid since dropped.
+fn adopt_children_tx(tx: &Transaction<'_>, uid: &str, lid: i64) -> Result<()> {
+    tx.execute(
+        "UPDATE nodes SET parent_lid = ?2 WHERE parent_uid = ?1 AND parent_lid IS NOT ?2",
+        params![uid, lid],
+    )?;
+    Ok(())
+}
+
 fn upsert_node_tx(tx: &Transaction<'_>, node: &Node) -> Result<()> {
-    let json = serde_json::to_string(node)?;
     let uid = node.uid.to_string();
+    // A node written under its stand-in after it landed is its row, which has
+    // the uid Drive gave it by now: written under the stand-in, it would bring
+    // the placeholder row back beside it.
+    if let Some(lid) = local_lid(&uid) {
+        let landed: Option<String> = tx
+            .query_row(
+                "SELECT uid FROM nodes WHERE lid = ?1 AND uid IS NOT ?2",
+                params![lid, uid],
+                |row| row.get(0),
+            )
+            .optional()?;
+        if let Some(real) = landed.as_deref().and_then(parse_node_uid) {
+            let mut node = node.clone();
+            node.uid = real;
+            return upsert_node_tx(tx, &node);
+        }
+    }
+    let json = serde_json::to_string(node)?;
     let parent_uid = node.parent_uid.as_ref().map(|u| u.to_string());
 
     let prior: Option<PriorRow> = tx
@@ -614,26 +952,34 @@ fn upsert_node_tx(tx: &Transaction<'_>, node: &Node) -> Result<()> {
     // where resolving it from scratch is a recursive walk to the root. A node
     // whose parent is not cached (a device folder's root lives in `device`, never
     // in `nodes`) starts a path of its own, which is what the walk did too.
-    let path = match &parent_uid {
-        None => String::new(),
+    let (parent_lid, path) = match &parent_uid {
+        None => (None, String::new()),
         Some(parent) => {
-            let parent_path: Option<Option<String>> = tx
-                .query_row(
-                    "SELECT path FROM nodes WHERE uid = ?1",
-                    params![parent],
-                    |row| row.get(0),
-                )
-                .optional()?;
-            join_path(parent_path.flatten().as_deref().unwrap_or(""), &node.name)
+            let parent_row: Option<(i64, Option<String>)> = match node_lid(tx, parent)? {
+                Some(lid) => tx
+                    .query_row(
+                        "SELECT lid, path FROM nodes WHERE lid = ?1",
+                        params![lid],
+                        |row| Ok((row.get(0)?, row.get(1)?)),
+                    )
+                    .optional()?,
+                None => None,
+            };
+            let (lid, parent_path) = parent_row.unzip();
+            (
+                lid,
+                join_path(parent_path.flatten().as_deref().unwrap_or(""), &node.name),
+            )
         }
     };
 
     tx.execute(
         "INSERT INTO nodes
-           (uid, parent_uid, name, is_dir, size, mtime, trashed, node_json, path)
-         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)
+           (uid, parent_uid, name, is_dir, size, mtime, trashed, node_json, path, parent_lid)
+         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)
          ON CONFLICT(uid) DO UPDATE SET
            parent_uid = excluded.parent_uid,
+           parent_lid = excluded.parent_lid,
            name       = excluded.name,
            is_dir     = excluded.is_dir,
            size       = excluded.size,
@@ -651,6 +997,7 @@ fn upsert_node_tx(tx: &Transaction<'_>, node: &Node) -> Result<()> {
             node.trashed as i64,
             json,
             path,
+            parent_lid,
         ],
     )?;
     let rowid: i64 = tx.query_row(
@@ -658,6 +1005,9 @@ fn upsert_node_tx(tx: &Transaction<'_>, node: &Node) -> Result<()> {
         params![uid],
         |row| row.get(0),
     )?;
+    if prior.is_none() {
+        adopt_children_tx(tx, &uid, rowid)?;
+    }
 
     // FTS5 has no UPSERT, so the node's own row is always replaced.
     let indexable = node_is_indexable_tx(tx, &uid)?;
@@ -680,7 +1030,7 @@ fn upsert_node_tx(tx: &Transaction<'_>, node: &Node) -> Result<()> {
             || prior.trashed != node.trashed
     });
     if node.is_folder() && subtree_moved {
-        reindex_subtree_tx(tx, &uid, &path, indexable)?;
+        reindex_subtree_tx(tx, rowid, &path, indexable)?;
     }
     Ok(())
 }
@@ -701,22 +1051,22 @@ fn upsert_node_tx(tx: &Transaction<'_>, node: &Node) -> Result<()> {
 /// this deep.
 fn reindex_subtree_tx(
     tx: &Transaction<'_>,
-    folder: &str,
+    folder: i64,
     folder_path: &str,
     folder_indexable: bool,
 ) -> Result<()> {
     let descendants: Vec<(i64, String, bool)> = {
         let mut stmt = tx.prepare(
-            "WITH RECURSIVE sub(rowid, uid, name, path, blocked, depth) AS (
-               SELECT n.rowid, n.uid, n.name,
+            "WITH RECURSIVE sub(rowid, name, path, blocked, depth) AS (
+               SELECT n.rowid, n.name,
                       CASE WHEN ?2 = '' THEN n.name ELSE ?2 || '/' || n.name END,
                       n.trashed, 0
-                 FROM nodes n WHERE n.parent_uid = ?1
+                 FROM nodes n WHERE n.parent_lid = ?1
                UNION ALL
-               SELECT n.rowid, n.uid, n.name,
+               SELECT n.rowid, n.name,
                       sub.path || '/' || n.name,
                       MAX(sub.blocked, n.trashed), sub.depth + 1
-                 FROM nodes n JOIN sub ON n.parent_uid = sub.uid
+                 FROM nodes n JOIN sub ON n.parent_lid = sub.rowid
                 WHERE sub.depth < 256
              )
              SELECT rowid, path, blocked FROM sub",
@@ -741,8 +1091,10 @@ fn reindex_subtree_tx(
     let mut set_path = tx.prepare("UPDATE nodes SET path = ?2 WHERE rowid = ?1")?;
     let mut unindex = tx.prepare("DELETE FROM nodes_fts WHERE rowid = ?1")?;
     let mut index = tx.prepare(
+        // Not a stub row (`Db::lids_for`): it is indexed when its node is
+        // written.
         "INSERT INTO nodes_fts (rowid, name, path)
-         SELECT rowid, name, ?2 FROM nodes WHERE rowid = ?1",
+         SELECT rowid, name, ?2 FROM nodes WHERE rowid = ?1 AND node_json IS NOT NULL",
     )?;
     for (rowid, path, blocked) in descendants {
         set_path.execute(params![rowid, path])?;
@@ -755,7 +1107,8 @@ fn reindex_subtree_tx(
 }
 
 fn direct_child_uids_tx(tx: &Transaction<'_>, parent: &str) -> Result<Vec<String>> {
-    let mut stmt = tx.prepare("SELECT uid FROM nodes WHERE parent_uid = ?1")?;
+    let (key, parent) = parent_key(tx, parent)?;
+    let mut stmt = tx.prepare(&format!("SELECT uid FROM nodes WHERE {key} = ?1"))?;
     let rows = stmt.query_map([parent], |row| row.get::<_, String>(0))?;
     let mut uids = Vec::new();
     for row in rows {
@@ -780,14 +1133,14 @@ fn direct_child_uids_tx(tx: &Transaction<'_>, parent: &str) -> Result<Vec<String
 /// ends at one whose parent is a row we have already visited.
 fn node_is_indexable_tx(tx: &Transaction<'_>, uid: &str) -> Result<bool> {
     let indexable: i64 = tx.query_row(
-        "WITH RECURSIVE ancestors(uid, parent_uid, trashed, depth, path) AS (
-           SELECT uid, parent_uid, trashed, 0, char(31) || uid || char(31)
+        "WITH RECURSIVE ancestors(lid, parent_lid, trashed, depth, path) AS (
+           SELECT lid, parent_lid, trashed, 0, ',' || lid || ','
              FROM nodes WHERE uid = ?1
            UNION ALL
-           SELECT n.uid, n.parent_uid, n.trashed, a.depth + 1,
-                  a.path || n.uid || char(31)
-             FROM ancestors a JOIN nodes n ON n.uid = a.parent_uid
-            WHERE instr(a.path, char(31) || n.uid || char(31)) = 0
+           SELECT n.lid, n.parent_lid, n.trashed, a.depth + 1,
+                  a.path || n.lid || ','
+             FROM ancestors a JOIN nodes n ON n.lid = a.parent_lid
+            WHERE instr(a.path, ',' || n.lid || ',') = 0
          )
          SELECT CASE
            WHEN COUNT(*) = 0 THEN 0
@@ -795,8 +1148,7 @@ fn node_is_indexable_tx(tx: &Transaction<'_>, uid: &str) -> Result<bool> {
            WHEN EXISTS (
              SELECT 1 FROM ancestors a
               WHERE a.depth = (SELECT MAX(depth) FROM ancestors)
-                AND a.parent_uid IS NOT NULL
-                AND EXISTS (SELECT 1 FROM nodes p WHERE p.uid = a.parent_uid)
+                AND EXISTS (SELECT 1 FROM nodes p WHERE p.lid = a.parent_lid)
            ) THEN 0
            ELSE 1
          END
@@ -814,7 +1166,7 @@ fn tombstone_subtree_tx(tx: &Transaction<'_>, root_uid: &str) -> Result<()> {
                SELECT rowid, uid, node_json FROM nodes WHERE uid = ?1
                UNION
                SELECT n.rowid, n.uid, n.node_json FROM nodes n
-                 JOIN subtree s ON n.parent_uid = s.uid
+                 JOIN subtree s ON n.parent_lid = s.rowid
              )
              SELECT rowid, uid, node_json FROM subtree",
         )?;

crates/pdfs-core/src/db/pins.rs

@@ -64,11 +64,11 @@ impl Db {
     }
 
     /// Whether `uid` is pinned — directly, or because a strict ancestor folder
-    /// is pinned recursively. The ancestor check walks `parent_uid` to the root
+    /// is pinned recursively. The ancestor check walks `parent_lid` to the root
     /// via a CTE; a direct pin is honoured even when the node has no `nodes` row
     /// yet (e.g. a CLI that never hydrates the node cache).
     ///
-    /// The walk is depth-capped like [`super::utils::path_of`]: a `parent_uid`
+    /// The walk is depth-capped like [`super::utils::path_of`]: a parent
     /// cycle is corrupt data the API can hand us, and `UNION ALL` over one never
     /// terminates — while holding the daemon's only SQLite connection, on a path
     /// that runs per cached read.
@@ -85,11 +85,11 @@ impl Db {
         let anc: Option<i64> = conn
             .query_row(
                 &format!(
-                    "WITH RECURSIVE anc(uid, parent_uid, depth) AS (
-                       SELECT uid, parent_uid, 0 FROM nodes WHERE uid = ?1
+                    "WITH RECURSIVE anc(uid, parent_lid, depth) AS (
+                       SELECT uid, parent_lid, 0 FROM nodes WHERE uid = ?1
                        UNION ALL
-                       SELECT n.uid, n.parent_uid, anc.depth + 1
-                       FROM nodes n JOIN anc ON n.uid = anc.parent_uid
+                       SELECT n.uid, n.parent_lid, anc.depth + 1
+                       FROM nodes n JOIN anc ON n.lid = anc.parent_lid
                        WHERE anc.depth < {MAX_PATH_DEPTH}
                      )
                      SELECT 1 FROM anc a JOIN pins p ON p.uid = a.uid
@@ -109,10 +109,11 @@ impl Db {
     pub fn pinned_uids(&self) -> Result<Vec<String>> {
         let conn = self.read();
         let mut stmt = conn.prepare(
-            "WITH RECURSIVE sub(uid) AS (
-               SELECT uid FROM pins WHERE recursive = 1
+            "WITH RECURSIVE sub(uid, lid) AS (
+               SELECT p.uid, n.lid FROM pins p LEFT JOIN nodes n ON n.uid = p.uid
+                WHERE p.recursive = 1
                UNION
-               SELECT n.uid FROM nodes n JOIN sub ON n.parent_uid = sub.uid
+               SELECT n.uid, n.lid FROM nodes n JOIN sub ON n.parent_lid = sub.lid
              )
              SELECT uid FROM sub
              UNION
@@ -126,15 +127,16 @@ impl Db {
         Ok(out)
     }
 
-    /// Every descendant uid of `folder` (all depths), via a `parent_uid` CTE.
+    /// Every descendant uid of `folder` (all depths), via a `parent_lid` CTE.
     /// Used to evict a recursively-pinned subtree's cached blobs on unpin.
     pub fn descendants(&self, folder: &str) -> Result<Vec<String>> {
         let conn = self.read();
         let mut stmt = conn.prepare(
-            "WITH RECURSIVE sub(uid) AS (
-               SELECT uid FROM nodes WHERE parent_uid = ?1
+            "WITH RECURSIVE sub(uid, lid) AS (
+               SELECT c.uid, c.lid FROM nodes c JOIN nodes f ON c.parent_lid = f.lid
+                WHERE f.uid = ?1
                UNION
-               SELECT n.uid FROM nodes n JOIN sub ON n.parent_uid = sub.uid
+               SELECT n.uid, n.lid FROM nodes n JOIN sub ON n.parent_lid = sub.lid
              )
              SELECT uid FROM sub",
         )?;

crates/pdfs-core/src/db/share_access.rs

@@ -95,11 +95,27 @@ impl Db {
     /// Resolve a persisted node's effective access through its nearest recorded
     /// share root. `None` means the node itself is not persisted, which callers
     /// must not treat as owned: stale handles need to fail closed.
+    ///
+    /// A stand-in ([`local_uid`](super::local_uid)) finds its row by local id,
+    /// so it still does once its create has landed and the row has the uid
+    /// Drive gave it. The tree learns that uid a moment later, and a rename in
+    /// between was refused (`docs/BUGS.md` B174).
     pub fn effective_node_access(&self, uid: &NodeUid) -> Result<Option<Access>> {
         let conn = self.read();
+        let key = uid.to_string();
+        let key = match super::local_lid(&key) {
+            Some(lid) => conn
+                .query_row("SELECT uid FROM nodes WHERE lid = ?1", [lid], |row| {
+                    row.get::<_, Option<String>>(0)
+                })
+                .optional()?
+                .flatten()
+                .unwrap_or(key),
+            None => key,
+        };
         let exists: bool = conn.query_row(
-            "SELECT EXISTS(SELECT 1 FROM nodes WHERE uid = ?1)",
-            [uid.to_string()],
+            "SELECT EXISTS(SELECT 1 FROM nodes WHERE uid = ?1 AND node_json IS NOT NULL)",
+            [&key],
             |row| row.get(0),
         )?;
         if !exists {
@@ -107,25 +123,26 @@ impl Db {
         }
         let value = conn
             .query_row(
-                "WITH RECURSIVE ancestors(uid, parent_uid, depth, path) AS (
-                   SELECT uid, parent_uid, 0, char(31) || uid || char(31)
+                "WITH RECURSIVE ancestors(uid, parent_uid, parent_lid, depth, path) AS (
+                   SELECT uid, parent_uid, parent_lid, 0, char(31) || uid || char(31)
                      FROM nodes WHERE uid = ?1
                    UNION ALL
-                   SELECT a.parent_uid, n.parent_uid, a.depth + 1,
-                          a.path || a.parent_uid || char(31)
+                   SELECT COALESCE(n.uid, a.parent_uid), n.parent_uid, n.parent_lid,
+                          a.depth + 1,
+                          a.path || COALESCE(n.uid, a.parent_uid) || char(31)
                      FROM ancestors a
-                     LEFT JOIN nodes n ON n.uid = a.parent_uid
+                     LEFT JOIN nodes n ON n.lid = a.parent_lid
                     WHERE a.parent_uid IS NOT NULL
                       AND instr(
                             a.path,
-                            char(31) || a.parent_uid || char(31)
+                            char(31) || COALESCE(n.uid, a.parent_uid) || char(31)
                           ) = 0
                  )
                  SELECT sa.access
                    FROM ancestors a JOIN share_access sa ON sa.root_uid = a.uid
                   ORDER BY a.depth ASC
                   LIMIT 1",
-                [uid.to_string()],
+                [&key],
                 |row| row.get::<_, String>(0),
             )
             .optional()?;

crates/pdfs-core/src/db/sync.rs

@@ -25,8 +25,8 @@ pub struct StoredSyncFolder {
 }
 
 /// One per-file sync baseline row: what a path looked like on both sides at the
-/// last successful sync, so the next reconcile can tell which side changed
-/// (devices.md Phase 2). `remote_rev`/`remote_hash` hold the remote signature —
+/// last successful sync, so the next reconcile can tell which side changed.
+/// `remote_rev`/`remote_hash` hold the remote signature —
 /// its modification time and size as strings — since no cheap content hash is
 /// exposed; change detection is `(mtime, size)` on each side.
 #[derive(Clone, Debug, PartialEq)]
@@ -39,7 +39,7 @@ pub struct StoredSyncEntry {
     ///
     /// `local_mtime` alone cannot tell an edit that landed inside the same
     /// second as the last sync — and left the file the same length — from no
-    /// edit at all, so those never uploaded (bugs.md B25). `None` on a row
+    /// edit at all, so those never uploaded (`docs/BUGS.md` B25). `None` on a row
     /// written before schema 28, which the comparison reads as "compare whole
     /// seconds", so upgrading does not make an entire mirror look changed.
     pub local_mtime_ns: Option<i64>,
@@ -139,6 +139,17 @@ impl Db {
         Ok(())
     }
 
+    /// Re-point a synced folder at the share that now holds its remote folder,
+    /// after the folder moved to another device without changing its uid.
+    pub fn sync_folder_set_share(&self, id: i64, share_id: &str) -> Result<()> {
+        let conn = self.conn.lock();
+        conn.execute(
+            "UPDATE sync_folder SET remote_share_id = ?2 WHERE id = ?1",
+            params![id, share_id],
+        )?;
+        Ok(())
+    }
+
     /// Queue (or, with `None`, withdraw) a mode the folder should move to once it
     /// is safe to switch.
     pub fn sync_folder_set_pending_mode(&self, id: i64, mode: Option<&str>) -> Result<()> {
@@ -260,10 +271,92 @@ impl Db {
         Ok(())
     }
 
+    /// Drop the baseline rows of `rel_path` and everything under it.
+    ///
+    /// Used when a subtree leaves a mirror folder through a move on Drive: its
+    /// local copy is about to be removed, and rows left behind would read as
+    /// "deleted locally" and trash the moved nodes at their new place.
+    pub fn sync_entries_remove_subtree(&self, folder_id: i64, rel_path: &str) -> Result<()> {
+        let conn = self.conn.lock();
+        conn.execute(
+            "DELETE FROM sync_entry
+              WHERE folder_id = ?1
+                AND (rel_path = ?2 OR substr(rel_path, 1, length(?2) + 1) = ?2 || '/')",
+            params![folder_id, rel_path],
+        )?;
+        Ok(())
+    }
+
+    /// Move the baseline rows of `from_rel` and everything under it to `to_rel`
+    /// in folder `to_folder`, in one transaction.
+    ///
+    /// Used when a move on Drive took a mirror subtree along with its local
+    /// copy: the rows still describe both sides correctly, only under a new
+    /// path, so the next pass on either folder has nothing to do. The two
+    /// folders may be the same one.
+    pub fn sync_entries_move(
+        &self,
+        from_folder: i64,
+        from_rel: &str,
+        to_folder: i64,
+        to_rel: &str,
+    ) -> Result<()> {
+        let mut conn = self.conn.lock();
+        let tx = conn.transaction()?;
+        {
+            let mut select = tx.prepare(
+                "SELECT rel_path, remote_uid, local_mtime, local_size, remote_rev, remote_hash,
+                        local_mtime_ns
+                   FROM sync_entry
+                  WHERE folder_id = ?1
+                    AND (rel_path = ?2 OR substr(rel_path, 1, length(?2) + 1) = ?2 || '/')",
+            )?;
+            let rows = select
+                .query_map(params![from_folder, from_rel], |r| {
+                    Ok(StoredSyncEntry {
+                        rel_path: r.get(0)?,
+                        remote_uid: r.get(1)?,
+                        local_mtime: r.get(2)?,
+                        local_size: r.get(3)?,
+                        remote_rev: r.get(4)?,
+                        remote_hash: r.get(5)?,
+                        local_mtime_ns: r.get(6)?,
+                    })
+                })?
+                .collect::<rusqlite::Result<Vec<_>>>()?;
+            let mut delete =
+                tx.prepare("DELETE FROM sync_entry WHERE folder_id = ?1 AND rel_path = ?2")?;
+            for row in &rows {
+                delete.execute(params![from_folder, row.rel_path])?;
+            }
+            let mut insert = tx.prepare(
+                "INSERT OR REPLACE INTO sync_entry
+                   (folder_id, rel_path, remote_uid, local_mtime, local_size, remote_rev,
+                    remote_hash, local_mtime_ns)
+                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)",
+            )?;
+            for row in rows {
+                let rel = format!("{to_rel}{}", &row.rel_path[from_rel.len()..]);
+                insert.execute(params![
+                    to_folder,
+                    rel,
+                    row.remote_uid,
+                    row.local_mtime,
+                    row.local_size,
+                    row.remote_rev,
+                    row.remote_hash,
+                    row.local_mtime_ns,
+                ])?;
+            }
+        }
+        tx.commit()?;
+        Ok(())
+    }
+
     /// Drop the entire baseline for a folder. Used when flipping ondemand→mirror:
     /// the local tree was evicted, so the old baseline is stale and would make the
     /// next reconcile mistake "locally deleted" for "must re-download". Clearing it
-    /// leaves an empty baseline + full remote = pure download (devices.md P3).
+    /// leaves an empty baseline + full remote = pure download.
     pub fn sync_entries_clear(&self, folder_id: i64) -> Result<()> {
         let conn = self.conn.lock();
         conn.execute(

crates/pdfs-core/src/db/trash.rs

@@ -102,5 +102,5 @@ impl Db {
         Ok(seen)
     }
 
-    // ---- device sync (devices.md) -----------------------------------------
+    // ---- device sync -----------------------------------------
 }

crates/pdfs-core/src/db/utils.rs

@@ -72,18 +72,18 @@ pub(super) fn path_of(conn: &Connection, uid: &str) -> Result<String> {
     }
 }
 
-/// Resolve a path by walking `parent_uid` to the root via a recursive CTE.
+/// Resolve a path by walking `parent_lid` to the root via a recursive CTE.
 ///
-/// A cycle in `parent_uid` is corrupt data the API can still hand us, and
+/// A cycle in the parents is corrupt data the API can still hand us, and
 /// `UNION ALL` over one never terminates — the walk is therefore depth-capped
 /// and returns the truncated path rather than hanging the caller.
 pub(super) fn walk_path_of(conn: &Connection, uid: &str) -> Result<String> {
     let mut stmt = conn.prepare(&format!(
-        "WITH RECURSIVE anc(uid, parent_uid, name, depth) AS (
-           SELECT uid, parent_uid, name, 0 FROM nodes WHERE uid = ?1
+        "WITH RECURSIVE anc(parent_lid, parent_uid, name, depth) AS (
+           SELECT parent_lid, parent_uid, name, 0 FROM nodes WHERE uid = ?1
            UNION ALL
-           SELECT n.uid, n.parent_uid, n.name, anc.depth + 1
-           FROM nodes n JOIN anc ON n.uid = anc.parent_uid
+           SELECT n.parent_lid, n.parent_uid, n.name, anc.depth + 1
+           FROM nodes n JOIN anc ON n.lid = anc.parent_lid
            WHERE anc.depth < {MAX_PATH_DEPTH}
          )
          SELECT name, parent_uid FROM anc ORDER BY depth DESC"

crates/pdfs-core/src/error.rs

@@ -32,6 +32,16 @@ pub enum Error {
     #[error("saved session can no longer unlock your keys — run `pdfs login` again")]
     ReloginRequired,
 
+    /// The account has a separate mailbox password that has not been entered
+    /// since login, so its keys cannot be unlocked. The fix is
+    /// [`auth::unlock`](crate::auth::unlock), not a new login.
+    #[error("account is locked — enter the mailbox password with `pdfs unlock`")]
+    Locked,
+
+    /// The mailbox password was checked against the account and is wrong.
+    #[error("that mailbox password does not unlock your account")]
+    WrongMailboxPassword,
+
     /// The login was gated behind human verification. Not a failure the user can
     /// fix by retrying: the challenge has to be solved and the login restarted
     /// with the resulting token (see [`auth::login_verified`](crate::auth::login_verified)).
@@ -199,9 +209,11 @@ impl From<serde_json::Error> for CoreError {
 impl From<Error> for CoreError {
     fn from(e: Error) -> Self {
         let kind = match &e {
-            Error::NotLoggedIn | Error::ReloginRequired | Error::HumanVerificationRequired(_) => {
-                ErrorKind::Denied
-            }
+            Error::NotLoggedIn
+            | Error::ReloginRequired
+            | Error::Locked
+            | Error::WrongMailboxPassword
+            | Error::HumanVerificationRequired(_) => ErrorKind::Denied,
             Error::Proton(proton_sdk::ProtonError::Api(api)) => api_kind(api.code),
             // A `ProtonError` that never reached the API is a transport failure.
             Error::Proton(_) => ErrorKind::Offline,
@@ -266,6 +278,23 @@ fn api_kind(code: proton_sdk::api::ResponseCode) -> ErrorKind {
     }
 }
 
+/// Whether `e` says the session itself is gone: its refresh token was refused,
+/// or the account was deleted or disabled.
+///
+/// Nothing but a new login helps then, and no retry will ever succeed, so a
+/// caller must not take it for a lost connection and wait for it to come back
+/// (issue #35: a revoked session was shown as "offline" for good).
+pub fn session_revoked(e: &proton_sdk::ProtonError) -> bool {
+    use proton_sdk::api::ResponseCode as C;
+    match e {
+        proton_sdk::ProtonError::Api(api) => {
+            api.is_invalid_refresh_token()
+                || matches!(api.code, C::AccountDeleted | C::AccountDisabled)
+        }
+        _ => false,
+    }
+}
+
 /// The result every request-serving method in the daemon returns.
 pub type CoreResult<T> = std::result::Result<T, CoreError>;
 
@@ -297,6 +326,17 @@ mod tests {
         assert_eq!(api_kind(C::ProtonDriveUnknown), ErrorKind::Remote);
     }
 
+    #[test]
+    fn only_a_refused_refresh_or_a_closed_account_revokes_the_session() {
+        assert!(session_revoked(&api(C::InvalidRefreshToken)));
+        assert!(session_revoked(&api(C::AccountDeleted)));
+        assert!(session_revoked(&api(C::AccountDisabled)));
+        // One file the account may not touch says nothing about the session.
+        assert!(!session_revoked(&api(C::Forbidden)));
+        assert!(!session_revoked(&api(C::Timeout)));
+        assert!(!session_revoked(&ProtonError::KeysLocked));
+    }
+
     /// The regression this whole pass exists to prevent: before it, every SDK
     /// failure was hardcoded to `Remote`, so a 403 asked the user to retry a
     /// request that could never succeed.

crates/pdfs-core/src/kernelkey.rs

@@ -0,0 +1,233 @@
+//! A secret held in the Linux kernel keyring, for as long as the user is logged in.
+//!
+//! This is where the key passphrases of a two-password account live by default:
+//! the mailbox password is never stored, and the secrets derived from it are
+//! kept in kernel memory — not on disk, not in the Secret Service — and vanish
+//! when the user's last session ends or the machine reboots. Both the daemon and
+//! `pdfs unlock` reach the same entry because it hangs off the *user* keyring.
+//! It is also where session tokens wait while the Secret Service refuses them
+//! ([`UNSAVED_TOKENS`]), so they outlive the process that holds them.
+//!
+//! Kernel keys are not paged to swap, are invisible to other users, and are
+//! wiped by [`clear`] (`KEYCTL_REVOKE`), which makes them a better home than a
+//! process's heap. Processes of the same user can still read them, exactly as
+//! they could ptrace the daemon: this protects against disk, backup and other
+//! users, not against code already running as you.
+//!
+//! The keyring may be unavailable (a container, a kernel built without
+//! `CONFIG_KEYS`); every operation then reports it as an error and the caller
+//! falls back to asking again, never to storing the secret somewhere weaker.
+
+use std::io;
+
+use zeroize::Zeroizing;
+
+/// One secret in the user keyring, by its description. Descriptions are
+/// namespaced so they cannot collide with another program's keys.
+pub struct Key {
+    description: &'static [u8],
+}
+
+/// The account's key passphrases (see the module docs).
+#[cfg(not(test))]
+pub const PASSPHRASES: Key = Key {
+    description: b"pdfs:key-passphrases\0",
+};
+/// Tests must never touch a real unlock.
+#[cfg(test)]
+pub const PASSPHRASES: Key = Key {
+    description: b"pdfs:key-passphrases:test\0",
+};
+
+/// Session tokens the Secret Service refused to store, until it takes them.
+/// A refresh token held only in a process's memory dies with the process.
+#[cfg(not(test))]
+pub const UNSAVED_TOKENS: Key = Key {
+    description: b"pdfs:unsaved-tokens\0",
+};
+#[cfg(test)]
+pub const UNSAVED_TOKENS: Key = Key {
+    description: b"pdfs:unsaved-tokens:test\0",
+};
+
+const KEY_TYPE: &[u8] = b"user\0";
+
+const KEY_SPEC_USER_KEYRING: i32 = -4;
+const KEYCTL_REVOKE: libc::c_long = 3;
+const KEYCTL_SETPERM: libc::c_long = 5;
+const KEYCTL_SEARCH: libc::c_long = 10;
+const KEYCTL_READ: libc::c_long = 11;
+
+/// Possessor and owner may view, read, write, search, link and set attributes;
+/// group and others get nothing.
+///
+/// A new key's default grants the owner only *view*, and read access to the
+/// possessor. A process possesses the user keyring only when its session
+/// keyring links to it, which a systemd user service or a container does not
+/// guarantee — so with the default, the daemon could store a key it then
+/// cannot read back. The owner is the same user that could ptrace the daemon
+/// anyway, so granting it read access gives up nothing.
+const PERM_OWNER_AND_POSSESSOR: u32 = 0x3f3f_0000;
+
+fn last_error<T>() -> io::Result<T> {
+    Err(io::Error::last_os_error())
+}
+
+fn find(description: &[u8]) -> io::Result<Option<libc::c_long>> {
+    // SAFETY: both strings are NUL-terminated and outlive the call.
+    let id = unsafe {
+        libc::syscall(
+            libc::SYS_keyctl,
+            KEYCTL_SEARCH,
+            KEY_SPEC_USER_KEYRING,
+            KEY_TYPE.as_ptr(),
+            description.as_ptr(),
+            0,
+        )
+    };
+    if id >= 0 {
+        return Ok(Some(id));
+    }
+    let err = io::Error::last_os_error();
+    match err.raw_os_error() {
+        // ENOKEY: not stored. EKEYREVOKED/EKEYEXPIRED: stored once, now gone.
+        Some(libc::ENOKEY | libc::EKEYREVOKED | libc::EKEYEXPIRED) => Ok(None),
+        _ => Err(err),
+    }
+}
+
+/// Stop this process from being core-dumped or ptraced by an unprivileged
+/// process of the same user, so the secrets in its memory stay out of crash
+/// reports. Call once at start of a long-lived process that holds them.
+pub fn forbid_dumps() {
+    // SAFETY: `PR_SET_DUMPABLE` takes plain integers and only affects this process.
+    let rc = unsafe { libc::prctl(libc::PR_SET_DUMPABLE, 0, 0, 0, 0) };
+    if rc != 0 {
+        tracing::warn!(error = %io::Error::last_os_error(), "could not mark the process non-dumpable");
+    }
+}
+
+impl Key {
+    /// Store `secret`, replacing any earlier one.
+    pub fn store(&self, secret: &[u8]) -> io::Result<()> {
+        // SAFETY: strings are NUL-terminated; the payload pointer/length pair
+        // describes `secret`, which outlives the call.
+        let id = unsafe {
+            libc::syscall(
+                libc::SYS_add_key,
+                KEY_TYPE.as_ptr(),
+                self.description.as_ptr(),
+                secret.as_ptr(),
+                secret.len(),
+                KEY_SPEC_USER_KEYRING,
+            )
+        };
+        if id < 0 {
+            return last_error();
+        }
+        // SAFETY: plain integer arguments.
+        let rc = unsafe {
+            libc::syscall(
+                libc::SYS_keyctl,
+                KEYCTL_SETPERM,
+                id,
+                PERM_OWNER_AND_POSSESSOR,
+            )
+        };
+        if rc < 0 {
+            // A key whose permissions are unknown is not one to leave behind.
+            let err = io::Error::last_os_error();
+            let _ = self.clear();
+            return Err(err);
+        }
+        Ok(())
+    }
+
+    /// Read the stored secret, or `None` when there is none.
+    pub fn load(&self) -> io::Result<Option<Zeroizing<Vec<u8>>>> {
+        let Some(id) = find(self.description)? else {
+            return Ok(None);
+        };
+        // Size first, then read; retry if the key was replaced in between.
+        for _ in 0..3 {
+            // SAFETY: a null buffer asks the kernel only for the payload length.
+            let len = unsafe {
+                libc::syscall(
+                    libc::SYS_keyctl,
+                    KEYCTL_READ,
+                    id,
+                    std::ptr::null_mut::<u8>(),
+                    0usize,
+                )
+            };
+            if len < 0 {
+                return match io::Error::last_os_error().raw_os_error() {
+                    Some(libc::ENOKEY | libc::EKEYREVOKED | libc::EKEYEXPIRED) => Ok(None),
+                    _ => last_error(),
+                };
+            }
+            let mut buf = Zeroizing::new(vec![0u8; len as usize]);
+            // SAFETY: `buf` is `len` writable bytes.
+            let read = unsafe {
+                libc::syscall(
+                    libc::SYS_keyctl,
+                    KEYCTL_READ,
+                    id,
+                    buf.as_mut_ptr(),
+                    buf.len(),
+                )
+            };
+            if read < 0 {
+                return last_error();
+            }
+            if read as usize <= buf.len() {
+                buf.truncate(read as usize);
+                return Ok(Some(buf));
+            }
+        }
+        Err(io::Error::other("the key changed while it was being read"))
+    }
+
+    /// Remove the stored secret. Succeeds when there is none.
+    pub fn clear(&self) -> io::Result<()> {
+        let Some(id) = find(self.description)? else {
+            return Ok(());
+        };
+        // SAFETY: plain integer arguments.
+        let rc = unsafe { libc::syscall(libc::SYS_keyctl, KEYCTL_REVOKE, id) };
+        if rc < 0 {
+            return match io::Error::last_os_error().raw_os_error() {
+                Some(libc::ENOKEY | libc::EKEYREVOKED) => Ok(()),
+                _ => last_error(),
+            };
+        }
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // The kernel keyring is process-wide state and a sandbox may not offer it,
+    // so one test covers the whole round trip and skips when it is unavailable.
+    #[test]
+    fn stored_secret_round_trips_and_clears() {
+        if PASSPHRASES.store(b"probe").is_err() {
+            eprintln!("kernel keyring unavailable; skipping");
+            return;
+        }
+        let saved = PASSPHRASES
+            .load()
+            .unwrap()
+            .expect("stored secret is readable");
+        assert_eq!(saved.as_slice(), b"probe");
+
+        PASSPHRASES.store(b"replaced").unwrap();
+        assert_eq!(PASSPHRASES.load().unwrap().unwrap().as_slice(), b"replaced");
+
+        PASSPHRASES.clear().unwrap();
+        assert!(PASSPHRASES.load().unwrap().is_none());
+        PASSPHRASES.clear().unwrap();
+    }
+}

crates/pdfs-core/src/lib.rs

@@ -10,6 +10,7 @@ pub mod config;
 pub mod control;
 pub mod db;
 pub mod error;
+pub mod kernelkey;
 pub mod localindex;
 pub mod menu;
 pub mod mounts;

crates/pdfs-core/src/profile.rs

@@ -1,4 +1,4 @@
-//! The machine profile that travels with a device (features.md 5.3).
+//! The machine profile that travels with a device.
 //!
 //! Sync folder mappings, pins, and the settings that shape them live in
 //! `cache.db` and `config.json` — both on the local disk. When that disk dies,

crates/pdfs-core/src/service.rs

@@ -55,9 +55,10 @@ fn systemctl_query(args: &[&str]) -> bool {
 /// keyring checks). `--now` is a no-op on an active unit, so the daemon would
 /// keep sleeping and the mount would not appear until the next poll fired.
 /// Restarting makes the new session take effect immediately, and starts the
-/// unit when it is not running at all.
+/// unit when it is not running at all. `reenable` for the reason given on
+/// [`enable`].
 pub fn enable_start() -> bool {
-    let enabled = systemctl(&["enable"]);
+    let enabled = systemctl(&["reenable"]);
     systemctl(&["restart"]) && enabled
 }
 
@@ -97,8 +98,14 @@ pub fn is_enabled() -> bool {
 /// Enable the service so it auto-starts on future logins, without necessarily
 /// starting it now beyond what `enable` does. Used by the Settings "Start on
 /// login" switch; pairs with [`disable`](disable).
+///
+/// `reenable` rather than `enable`: older installs were enabled
+/// into `default.target.wants`, and a plain `enable` would add the new
+/// `graphical-session.target.wants` link while leaving the old one to start the
+/// unit too early. `reenable` drops every existing link and recreates them from
+/// the current `[Install]` section.
 pub fn enable() -> bool {
-    systemctl(&["enable"])
+    systemctl(&["reenable"])
 }
 
 /// Disable auto-start without stopping the running mount. Used by the Settings

crates/pdfs-core/src/syncignore.rs

@@ -1,4 +1,4 @@
-//! Selective-sync ignore rules for mirror folders (features.md 1.1).
+//! Selective-sync ignore rules for mirror folders.
 //!
 //! A mirror folder otherwise uploads every path beneath its root, which for a
 //! project directory means `node_modules/`, `.git/`, and `target/` — quota

crates/pdfs-fuse/Cargo.toml

@@ -15,6 +15,7 @@ zip.workspace = true
 sha1.workspace = true
 proton-drive-rs.workspace = true
 futures.workspace = true
+async-trait.workspace = true
 tokio.workspace = true
 tracing.workspace = true
 fuser.workspace = true
@@ -24,3 +25,6 @@ base64.workspace = true
 image.workspace = true
 notify = "8"
 parking_lot.workspace = true
+
+[dev-dependencies]
+tracing-subscriber.workspace = true

crates/pdfs-fuse/src/background.rs

@@ -2,6 +2,7 @@
 
 use super::*;
 use crate::shutdown::Shutdown;
+use pdfs_core::error::session_revoked;
 
 /// Drop `uid` from one mount's tree and tell that mount's kernel session the
 /// entry is gone. Shared by the trash and delete paths, which differ only in
@@ -9,7 +10,7 @@ use crate::shutdown::Shutdown;
 ///
 /// Returns whether this mount actually held the node, so the caller can evict
 /// its content blob once if *any* mount did.
-fn forget_and_notify(st: &mut State, notify: &mut NotifyBatch, uid: &NodeUid) -> bool {
+pub(crate) fn forget_and_notify(st: &mut State, notify: &mut NotifyBatch, uid: &NodeUid) -> bool {
     // Capture the inode before `forget` clears the uid mapping.
     let child = st.by_uid.get(uid).copied();
     let Some((parent, name)) = st.forget(uid) else {
@@ -97,15 +98,13 @@ fn event_serializes_shared_publication(event: &DriveEvent, own_volume: &VolumeId
 /// entry forces the next `lookup`/`readdir` to re-enumerate from the remote, so
 /// most events only need to invalidate listings rather than re-fetch eagerly.
 ///
-/// Applied to **every** mounted inode space, not just the primary one. This task
-/// is per-daemon while node state is per-mount, and a `DriveEvent` names a uid,
-/// not a mount — so a file trashed from another device has to be withdrawn from
-/// whichever of our sessions is showing it, which for anything under a sync
-/// folder is a [`Core::fork_state`] fork rather than `core.state`. Reaching for
-/// the primary state alone left forks serving a deleted file indefinitely, the
-/// read-side twin of `docs/BUGS.md` B74. Inode numbers are per-mount, so each
-/// mount must be notified through its **own** channel; that pairing is what
-/// [`Core::for_each_mount`] exists to preserve.
+/// Applied to the tree every mount shares, and told to **every** mounted
+/// session. A `DriveEvent` names a uid, not a mount, so a file trashed from
+/// another device has to be withdrawn from whichever of our sessions is showing
+/// it — which for anything under a sync folder is a [`Core::fork_state`] fork.
+/// Telling the primary session alone left forks serving a deleted file, the
+/// read-side twin of `docs/BUGS.md` B74. [`Core::for_each_mount`] sends what
+/// the kernel needs to hear to every session.
 fn apply_event(core: &Core, event: &DriveEvent, dirty: &mut DirtyParents) -> pdfs_core::Result<()> {
     let foreign_delete = is_foreign_node_delete(event, &core.primary_root_uid.volume_id);
     let serializes_shared_publication =
@@ -145,7 +144,7 @@ fn apply_event(core: &Core, event: &DriveEvent, dirty: &mut DirtyParents) -> pdf
             // create, and re-fetching would replace the size and mtime of the
             // write we just accepted with the stale revision's — making a file
             // that was copied in seconds ago read as empty until its upload
-            // lands (offline.md Phase 3).
+            // lands.
             //
             // A write that has already drained is the same story one step later:
             // the drain brought the tree level with the revision it sealed, so
@@ -233,6 +232,48 @@ fn acknowledge_applied_event(
     Ok(id)
 }
 
+/// How many applied node-update ids [`RecentEvents`] remembers. Far more than a
+/// replay can reach back: one comes from a batch whose last event was not its
+/// newest, so it repeats at most what that batch held.
+const RECENT_EVENTS: usize = 4096;
+
+/// The node updates applied lately, by event id, so one that comes round again
+/// is skipped rather than applied twice.
+///
+/// The feed can deliver the same event twice in a batch, and a batch whose
+/// events come out of order leaves the cursor short of its newest event, so the
+/// next poll replays what lay past it. An update applied twice is not harmless:
+/// the first copy of our own change claims the echo [`Core::note_self_change`]
+/// recorded, and the second, unclaimed, reads as someone else's edit and evicts
+/// the bytes a partial write is about to gap-fill from (docs/BUGS.md B123).
+///
+/// Only node updates: a delete is idempotent, and a continuity loss names the
+/// cursor it lost, which is an id already applied.
+#[derive(Default)]
+struct RecentEvents {
+    ids: HashSet<DriveEventId>,
+    order: VecDeque<DriveEventId>,
+}
+
+impl RecentEvents {
+    /// Record `event` as applied, reporting whether it was already.
+    fn repeat(&mut self, event: &DriveEvent) -> bool {
+        let DriveEvent::NodeUpdated { id, .. } = event else {
+            return false;
+        };
+        if !self.ids.insert(id.clone()) {
+            return true;
+        }
+        self.order.push_back(id.clone());
+        if self.order.len() > RECENT_EVENTS
+            && let Some(old) = self.order.pop_front()
+        {
+            self.ids.remove(&old);
+        }
+        false
+    }
+}
+
 /// The folders one batch of events changed, collected so the listings are
 /// dropped once at the end of the batch rather than once per event.
 ///
@@ -320,10 +361,10 @@ fn flush_dirty_parents(core: &Core, dirty: &DirtyParents) {
 /// only on fatal error.
 ///
 /// Takes the whole `Core` rather than the primary mount's pieces: an event has
-/// to be applied to every mounted inode space, and the registry that enumerates
-/// them lives on the `Core` (see [`apply_event`]).
+/// to reach every mounted session, and the registry that enumerates them lives
+/// on the `Core` (see [`apply_event`]).
 pub(super) async fn run_event_sync(
-    client: ProtonDriveClient,
+    client: Arc<dyn DriveApi>,
     scope: DriveEventScopeId,
     core: Core,
 ) {
@@ -335,7 +376,7 @@ pub(super) async fn run_event_sync(
         // server head; persist it so the next restart resumes instead of
         // reseeding (which would skip everything that changed offline).
         // Seeding needs the network, and this task also runs on mounts that
-        // started offline (offline.md Phase 1) — so retry rather than giving up,
+        // started offline — so retry rather than giving up,
         // which used to disable live sync for the life of the daemon.
         Ok(None) => {
             // Nothing says what changed before this cursor, so a persisted SDK
@@ -362,6 +403,12 @@ pub(super) async fn run_event_sync(
                         }
                         break Some(c.clone());
                     }
+                    // Refused for good: retrying would be refused the same way
+                    // for the life of the daemon. The next login restarts it.
+                    Err(e) if session_revoked(&e) => {
+                        core.mark_session_expired("seed event cursor", &e);
+                        return;
+                    }
                     Err(e) => {
                         warn!(error = %e, ?delay, "seed event cursor failed; retrying");
                         tokio::time::sleep(delay).await;
@@ -377,10 +424,12 @@ pub(super) async fn run_event_sync(
     };
     info!(?cursor, "event sync started");
 
+    let mut recent = RecentEvents::default();
     loop {
-        tokio::time::sleep(POLL_INTERVAL).await;
-        let events = match client.enumerate_events(&scope, cursor.as_ref()).await {
+        core.next_poll(POLL_INTERVAL).await;
+        let events = match link::bounded(client.enumerate_events(&scope, cursor.as_ref())).await {
             Ok(events) => events,
+            Err(e) if core.lost_link(&e, "poll events") => continue,
             Err(e) => {
                 warn!(error = %e, "event poll failed; retrying after interval");
                 continue;
@@ -396,6 +445,11 @@ pub(super) async fn run_event_sync(
         // did apply.
         let mut dirty = DirtyParents::default();
         for event in &events {
+            if recent.repeat(event) {
+                debug!(id = %event.id().as_str(), "skipping an event already applied");
+                cursor = Some(event.id().clone());
+                continue;
+            }
             // Converge the SDK's own caches (folder keys, entity cache) on the
             // server before applying the event to our tree. Without this, a node
             // re-keyed/moved by another client keeps a stale key in the SDK for
@@ -455,6 +509,10 @@ pub(super) async fn run_photos_event_sync(core: Core) {
                 debug!("no photos volume; photo event sync not started");
                 return;
             }
+            Err(error) if session_revoked(&error) => {
+                core.mark_session_expired("read the photos root", &error);
+                return;
+            }
             Err(error) => {
                 warn!(%error, "reading the photos root failed; retrying");
                 tokio::time::sleep(ONLINE_PROBE_MAX).await;
@@ -471,9 +529,10 @@ pub(super) async fn run_photos_event_sync(core: Core) {
     info!(?cursor, "photo event sync started");
 
     loop {
-        tokio::time::sleep(POLL_INTERVAL).await;
-        let events = match photos.enumerate_events(&scope, cursor.as_ref()).await {
+        core.next_poll(POLL_INTERVAL).await;
+        let events = match link::bounded(photos.enumerate_events(&scope, cursor.as_ref())).await {
             Ok(events) => events,
+            Err(error) if core.lost_link(&error, "poll photo events") => continue,
             Err(error) => {
                 warn!(%error, "photo event poll failed; retrying after interval");
                 continue;
@@ -612,7 +671,7 @@ pub(super) fn run_local_index(
             scan_local_once(&db, &indexing, &transfers, &mountpoint);
         }
         // Interruptible, so teardown joins this thread instead of leaving it to
-        // keep rewriting the index for a mount that is gone (bugs.md B44).
+        // keep rewriting the index for a mount that is gone (`docs/BUGS.md` B44).
         if !shutdown.sleep(LOCAL_INDEX_CHECK) {
             return;
         }
@@ -662,7 +721,7 @@ fn scan_local_once(
 
     // The walk has no idea how many files it will find, so the job counts what it
     // has seen and stays indeterminate.
-    let job = transfers.begin_job("Indexing this computer");
+    let job = transfers.begin_background_job("Indexing this computer");
     job.detail("Scanning your files");
     let walked = localindex::scan(&[home], &excludes, |batch| {
         if let Err(e) = db.local_upsert_batch(generation, &batch) {
@@ -715,6 +774,43 @@ mod tests {
         }
     }
 
+    #[test]
+    fn a_node_update_seen_again_is_skipped_but_other_events_are_not() {
+        let update = |id: &str| DriveEvent::NodeUpdated {
+            id: DriveEventId::from(id),
+            node_uid: uid("file"),
+            parent_node_uid: None,
+            is_trashed: false,
+            is_shared: false,
+        };
+        let mut recent = RecentEvents::default();
+        assert!(!recent.repeat(&update("e1")));
+        assert!(!recent.repeat(&update("e2")));
+        assert!(recent.repeat(&update("e1")), "a duplicate or replay");
+        let lost = DriveEvent::ContinuityLost {
+            id: DriveEventId::from("e2"),
+        };
+        assert!(!recent.repeat(&lost), "names the cursor, which was applied");
+    }
+
+    #[test]
+    fn recent_events_forget_the_oldest_past_their_bound() {
+        let update = |n: usize| DriveEvent::NodeUpdated {
+            id: DriveEventId::from(format!("e{n}")),
+            node_uid: uid("file"),
+            parent_node_uid: None,
+            is_trashed: false,
+            is_shared: false,
+        };
+        let mut recent = RecentEvents::default();
+        for n in 0..=RECENT_EVENTS {
+            assert!(!recent.repeat(&update(n)));
+        }
+        assert_eq!(recent.ids.len(), RECENT_EVENTS);
+        assert!(!recent.repeat(&update(0)), "the oldest was forgotten");
+        assert!(recent.repeat(&update(RECENT_EVENTS)));
+    }
+
     #[test]
     fn foreign_delete_invalidates_an_earlier_refresh_generation() {
         let own_volume = VolumeId::from("own");

crates/pdfs-fuse/src/control.rs

@@ -163,8 +163,8 @@ fn read_request_line(reader: &mut impl BufRead) -> std::io::Result<Option<String
 /// Turn a CLI-supplied path into the mount that owns it and the path relative
 /// to *that* mount's root.
 ///
-/// [`rel_to_mount`] is the older, primary-only reading, and it is what every
-/// mutating request still uses. It rejects anything outside the primary
+/// [`rel_to_mount`] is the older, primary-only reading, and it is what most
+/// requests still use. It rejects anything outside the primary
 /// mountpoint, which leaves a secondary on-demand mount — a synced folder
 /// switched out of mirror mode — with no way to be named at all: `pdfs ls` and
 /// `pdfs refresh` both answered "is not under the mountpoint", so a folder
@@ -185,11 +185,14 @@ fn route_to_mount(core: &Core, mountpoint: &Path, path: &str) -> CoreResult<(Cor
     rel_to_mount(mountpoint, path).map(|rel| (core.clone(), rel))
 }
 
-/// [`route_to_mount`] for a conflict copy. The listing names a copy inside a
-/// synced folder by its absolute local path (`docs/BUGS.md` B99), so the
-/// resolve has to run against the on-demand mount serving it. A mirror folder
-/// has no mount to run against: its copy is an ordinary local file.
-fn route_conflict(core: &Core, mountpoint: &Path, path: &str) -> CoreResult<(Core, PathBuf)> {
+/// [`route_to_mount`] for a request that changes what it names: trash, rename,
+/// create a folder, resolve a conflict. Each has to run against the on-demand
+/// mount serving the path, and `pdfs rm ~/Downloads/x` answered "is not under
+/// the mountpoint" while `pdfs move` took the same path. The conflict listing
+/// names a copy in a synced folder by its absolute local path (`docs/BUGS.md`
+/// B99), so resolving one needs this too. A mirror folder has no mount to run
+/// against: a file there is an ordinary local file.
+fn route_change(core: &Core, mountpoint: &Path, path: &str) -> CoreResult<(Core, PathBuf)> {
     let routed = route_to_mount(core, mountpoint, path).map_err(|e| {
         let p = Path::new(path);
         let mirrored = core
@@ -200,7 +203,7 @@ fn route_conflict(core: &Core, mountpoint: &Path, path: &str) -> CoreResult<(Cor
             .any(|folder| folder.mode == "mirror" && p.starts_with(&folder.local_path));
         if mirrored {
             CoreError::invalid(format!(
-                "{path} is in a mirrored folder; rename or delete the local file there"
+                "{path} is in a mirrored folder; change the local file there instead"
             ))
         } else {
             e
@@ -217,6 +220,27 @@ fn route_conflict(core: &Core, mountpoint: &Path, path: &str) -> CoreResult<(Cor
     }
 }
 
+/// [`route_change`] for a request that trashes or renames the node it names.
+/// A mount's root is My files or a whole synced folder. An on-demand folder's
+/// root has a parent on Drive, so nothing further down would stop `pdfs rm
+/// ~/Downloads` from trashing the folder out from under its own mount.
+fn route_node(core: &Core, mountpoint: &Path, path: &str) -> CoreResult<(Core, PathBuf)> {
+    let routed = route_change(core, mountpoint, path)?;
+    if below_root(&routed.1) {
+        Ok(routed)
+    } else {
+        Err(CoreError::invalid(format!(
+            "{path} is the root of a synced location and cannot be changed"
+        )))
+    }
+}
+
+/// Whether a mount-relative path names something below the mount's root.
+fn below_root(rel: &Path) -> bool {
+    rel.components()
+        .any(|component| matches!(component, Component::Normal(_)))
+}
+
 /// Turn a CLI-supplied path into a mountpoint-relative path. An absolute path
 /// must live under `mountpoint`; a relative path is taken as already relative to
 /// the mount root.
@@ -291,6 +315,9 @@ impl Drop for RefreshGuard {
 pub(crate) fn status_response(core: &Core, username: &str, mountpoint: &Path) -> CtlResponse {
     let pins = core.cache.list_pins();
     let queued = core.db.pending_op_counts().unwrap_or_default();
+    // Read after the queue: the drain counts an upload as landing before it
+    // retires the op, so one of the two always has it (B119).
+    let landing = core.landing_uploads.load(Ordering::SeqCst);
     let staging = core.cache.staging_usage();
     CtlResponse::Status {
         parked_uploads: queued.parked.max(0) as u64,
@@ -307,7 +334,9 @@ pub(crate) fn status_response(core: &Core, username: &str, mountpoint: &Path) ->
         budget: core.cache.budget(),
         pins,
         online: core.online.load(Ordering::Relaxed),
-        pending_uploads: queued.uploads.max(0) as u64,
+        session_expired: core.session_expired(),
+        tokens_unsaved: pdfs_core::auth::tokens_unsaved(),
+        pending_uploads: queued.uploads.max(0) as u64 + landing,
         pending_changes: queued.changes.max(0) as u64,
     }
 }
@@ -342,7 +371,7 @@ fn touched_topics(request: &CtlRequest) -> &'static [Topic] {
             RefreshScope::Photos { .. } => &[],
         },
         R::RenameDevice { .. } | R::DeleteDevice { .. } => &[Topic::Devices],
-        R::AdoptDevice { .. } => &[Topic::Devices, Topic::Locations],
+        R::AdoptDevice { .. } | R::MigrateDevice { .. } => &[Topic::Devices, Topic::Locations],
         R::AddSyncFolder { .. }
         | R::RemoveSyncFolder { .. }
         | R::SetSyncFolderMode { .. }
@@ -350,6 +379,7 @@ fn touched_topics(request: &CtlRequest) -> &'static [Topic] {
         | R::RestoreSyncFolders { .. }
         | R::RestoreDeviceFolders { .. } => &[Topic::Locations, Topic::Devices],
         R::RetryPendingOp { .. } => &[Topic::Queue],
+        R::DiscardPendingOp { .. } => &[Topic::Queue, Topic::Files],
         R::ResolveConflict { .. } => &[Topic::Files, Topic::Trash, Topic::Conflicts],
         R::ShareNode { .. }
         | R::ShareNodeByUid { .. }
@@ -959,8 +989,8 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
             },
             Err(e) => CtlResponse::error(e),
         },
-        Ok(CtlRequest::Rename { path, new_name }) => match rel_to_mount(mountpoint, &path) {
-            Ok(rel) => match core.rename(&rel, &new_name) {
+        Ok(CtlRequest::Rename { path, new_name }) => match route_node(core, mountpoint, &path) {
+            Ok((core, rel)) => match core.rename(&rel, &new_name) {
                 Ok(name) => {
                     core.log_activity(ActivityKind::Rename, &name, format!("was {path}"), true);
                     CtlResponse::Ok {
@@ -974,6 +1004,24 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
             },
             Err(e) => CtlResponse::error(e),
         },
+        // Two absolute paths may name two different locations, which only
+        // `move_between` can resolve; a relative pair keeps the old meaning.
+        Ok(CtlRequest::Move { path, new_parent })
+            if Path::new(&path).is_absolute() && Path::new(&new_parent).is_absolute() =>
+        {
+            match core.move_between(Path::new(&path), Path::new(&new_parent)) {
+                Ok(name) => {
+                    core.log_activity(ActivityKind::Move, &name, format!("to {new_parent}"), true);
+                    CtlResponse::Ok {
+                        message: format!("moved {name}"),
+                    }
+                }
+                Err(e) => {
+                    core.log_activity(ActivityKind::Move, &path, &e, false);
+                    CtlResponse::error(e)
+                }
+            }
+        }
         Ok(CtlRequest::Move { path, new_parent }) => {
             match (
                 rel_to_mount(mountpoint, &path),
@@ -999,8 +1047,8 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
                 (Err(e), _) | (_, Err(e)) => CtlResponse::error(e),
             }
         }
-        Ok(CtlRequest::Delete { path }) => match rel_to_mount(mountpoint, &path) {
-            Ok(rel) => match core.delete(&rel) {
+        Ok(CtlRequest::Delete { path }) => match route_node(core, mountpoint, &path) {
+            Ok((core, rel)) => match core.delete(&rel) {
                 Ok(name) => {
                     core.log_activity(ActivityKind::Trash, &name, "", true);
                     CtlResponse::Ok {
@@ -1014,21 +1062,23 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
             },
             Err(e) => CtlResponse::error(e),
         },
-        Ok(CtlRequest::CreateFolder { parent, name }) => match rel_to_mount(mountpoint, &parent) {
-            Ok(parent_rel) => match core.create_folder(&parent_rel, &name) {
-                Ok(name) => {
-                    core.log_activity(ActivityKind::CreateFolder, &name, "", true);
-                    CtlResponse::Ok {
-                        message: format!("created folder {name}"),
+        Ok(CtlRequest::CreateFolder { parent, name }) => {
+            match route_change(core, mountpoint, &parent) {
+                Ok((core, parent_rel)) => match core.create_folder(&parent_rel, &name) {
+                    Ok(name) => {
+                        core.log_activity(ActivityKind::CreateFolder, &name, "", true);
+                        CtlResponse::Ok {
+                            message: format!("created folder {name}"),
+                        }
                     }
-                }
-                Err(e) => {
-                    core.log_activity(ActivityKind::CreateFolder, &name, &e, false);
-                    CtlResponse::error(e)
-                }
-            },
-            Err(e) => CtlResponse::error(e),
-        },
+                    Err(e) => {
+                        core.log_activity(ActivityKind::CreateFolder, &name, &e, false);
+                        CtlResponse::error(e)
+                    }
+                },
+                Err(e) => CtlResponse::error(e),
+            }
+        }
         Ok(CtlRequest::UploadPaths { parent, sources }) => {
             match rel_to_mount(mountpoint, &parent) {
                 // Ack immediately and upload on a background thread: a directory tree
@@ -1249,6 +1299,10 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
             Ok(message) => CtlResponse::Ok { message },
             Err(e) => CtlResponse::error(e),
         },
+        Ok(CtlRequest::MigrateDevice { uid }) => match core.migrate_device(&uid) {
+            Ok(message) => CtlResponse::Ok { message },
+            Err(e) => CtlResponse::error(e),
+        },
         Ok(CtlRequest::AddSyncFolder { local_path }) => {
             // Registering the device and uploading a folder tree far outlasts the
             // socket read timeout, so ack immediately and work on a background
@@ -1345,7 +1399,7 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
             Err(e) => CtlResponse::error(e),
         },
         Ok(CtlRequest::ResolveConflict { path, keep }) => {
-            match route_conflict(core, mountpoint, &path) {
+            match route_change(core, mountpoint, &path) {
                 Ok((core, rel)) => match core.resolve_conflict(&rel, &keep) {
                     Ok(message) => CtlResponse::Ok { message },
                     Err(e) => CtlResponse::error(e),
@@ -1357,6 +1411,20 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
             Ok(items) => CtlResponse::PendingOps { items },
             Err(e) => CtlResponse::error(e),
         },
+        Ok(CtlRequest::ExportPendingOp { id, dest }) => {
+            match core.export_pending_op(id, Path::new(&dest)) {
+                Ok(written) => CtlResponse::Ok {
+                    message: format!("wrote {} to {dest}", human_bytes(written)),
+                },
+                Err(e) => CtlResponse::error(e),
+            }
+        }
+        Ok(CtlRequest::DiscardPendingOp { id }) => match core.discard_pending_op(id) {
+            Ok(path) => CtlResponse::Ok {
+                message: format!("discarded the queued change to {path}"),
+            },
+            Err(e) => CtlResponse::error(e),
+        },
         Ok(CtlRequest::RetryPendingOp { id }) => match core.retry_pending_ops(id) {
             Ok(0) if id.is_some() => CtlResponse::Ok {
                 message: "nothing to retry: the operation is already due or waiting for a rename"
@@ -1754,7 +1822,7 @@ pub(crate) fn run_control_socket(
     info!("control socket listening");
     for conn in listener.incoming() {
         // Checked on every accept, including the deliberate poke teardown sends
-        // to wake this thread out of a blocking accept (bugs.md B44).
+        // to wake this thread out of a blocking accept (`docs/BUGS.md` B44).
         if core.shutdown.is_stopping() {
             info!("control socket closing");
             return;
@@ -1846,6 +1914,18 @@ mod request_limit_tests {
         assert!(rel_to_mount(mountpoint, "Photos/../../escape").is_err());
         assert!(rel_to_mount(mountpoint, "/mnt/elsewhere").is_err());
     }
+
+    /// `pdfs rm` and `pdfs rename` reach on-demand mounts, whose root is a whole
+    /// synced folder with a parent on Drive. Only a path below a root may get
+    /// through to the trash or rename call.
+    #[test]
+    fn only_a_path_below_a_mount_root_names_a_node() {
+        assert!(below_root(Path::new("Photos")));
+        assert!(below_root(Path::new("./Photos/2026")));
+        assert!(!below_root(Path::new("")));
+        assert!(!below_root(Path::new(".")));
+        assert!(!below_root(Path::new("./.")));
+    }
 }
 
 #[cfg(test)]

crates/pdfs-fuse/src/devices.rs

@@ -1,5 +1,5 @@
 //! This machine as a Proton Drive Device, and the local folders it keeps in
-//! step with the remote (devices.md).
+//! step with the remote.
 //!
 //! A sync folder runs in one of two modes. `mirror` keeps a real local tree that
 //! the engine in [`super::sync`] reconciles both ways; `ondemand` evicts that
@@ -19,6 +19,7 @@ use pdfs_core::control::{
 };
 use pdfs_core::db::{StoredDevice, StoredSyncFolder};
 use pdfs_core::mounts::MountMode;
+use pdfs_core::profile::PROFILE_DIR_NAME;
 use pdfs_core::{CoreError, CoreResult};
 use proton_drive_rs::proton_sdk::ids::{DeviceUid, NodeUid};
 use proton_drive_rs::{DeviceType, Node};
@@ -27,7 +28,7 @@ use tracing::{info, warn};
 
 use super::sync::{self, base_name};
 use super::{
-    Core, SecondaryInsertRejection, SecondaryMount, State, SwitchBlocked, clear_stale_mount,
+    Core, SecondaryInsertRejection, SecondaryMount, SwitchBlocked, clear_stale_mount,
     device_type_str, dir_is_empty, evict_dir_contents, fuse_connection_id, is_stale_mount,
     now_secs, parse_uid, spawn_session, sync_folder_info, this_hostname,
 };
@@ -114,6 +115,22 @@ pub(crate) fn set_adopted_device_uid(uid: Option<&str>) -> CoreResult<()> {
         .map_err(|e| CoreError::internal(format!("write config: {e}")))
 }
 
+/// The name a folder moved in from `device` takes when `name` is already
+/// taken under this device's root, or `None` when it can keep its own.
+fn migrated_name(name: &str, device: &str, taken: &[String]) -> Option<String> {
+    let free = |candidate: &str| !taken.iter().any(|t| t == candidate);
+    if free(name) {
+        return None;
+    }
+    let base = format!("{name} ({device})");
+    if free(&base) {
+        return Some(base);
+    }
+    (2..)
+        .map(|n| format!("{base} {n}"))
+        .find(|candidate| free(candidate))
+}
+
 impl Core {
     // ---- devices ----------------------------------------------------------
 
@@ -184,8 +201,8 @@ impl Core {
     }
 
     /// Adopt an existing device as *this* machine's, pinning it in `config.json`
-    /// so hostname changes and reinstalls stop registering duplicates
-    /// (features.md 5.1). `None` clears the pin and returns to hostname matching.
+    /// so hostname changes and reinstalls stop registering duplicates.
+    /// `None` clears the pin and returns to hostname matching.
     ///
     /// Refuses a uid that is not in the account: the whole point of the pin is
     /// that it is authoritative, so accepting a bad one would defer the failure
@@ -260,7 +277,108 @@ impl Core {
         })
     }
 
-    // ---- device folder sync (devices.md, Phase 1) -------------------------
+    /// Move every folder another device backs up into this machine's own
+    /// device, so this machine carries on backing them up as itself. The other
+    /// device stays registered, without those folders.
+    ///
+    /// Device roots all live on the main volume, so each folder is one
+    /// server-side move: nothing is downloaded or uploaded, and no quota is
+    /// used twice. A folder whose name is taken here keeps its content under
+    /// "<name> (<device>)". A failed folder does not stop the others, and a
+    /// second run picks up whatever is still left on the other device.
+    ///
+    /// Nothing is synced to this disk here. The moved folders are now this
+    /// device's, so the ordinary restore offers them. Only folders that were
+    /// already synced here from the other device are touched: their uid
+    /// survives the move but their share does not.
+    pub(crate) fn migrate_device(&self, uid: &str) -> CoreResult<String> {
+        let source = self.restore_source(Some(uid))?;
+        let target = self.ensure_device()?;
+        if source.uid == target.uid {
+            return Err(CoreError::invalid(format!(
+                "{} is this computer's own device",
+                source.name
+            )));
+        }
+        let bad_root = |d: &StoredDevice| {
+            parse_uid(&d.root_uid)
+                .ok_or_else(|| CoreError::internal(format!("bad device root uid: {}", d.root_uid)))
+        };
+        let (source_root, target_root) = (bad_root(&source)?, bad_root(&target)?);
+        if source_root.volume_id != target_root.volume_id {
+            return Err(CoreError::invalid(
+                "the two devices are on different Proton Drive volumes; copy it instead",
+            ));
+        }
+
+        let mut taken: Vec<String> = self
+            .device_root_nodes(&target_root)?
+            .into_iter()
+            .filter(|n| !n.trashed)
+            .map(|n| n.name)
+            .collect();
+        let synced = self
+            .db
+            .sync_folder_list()
+            .map_err(|e| CoreError::internal(format!("db: {e:?}")))?;
+
+        let mut moved = 0usize;
+        let mut renamed: Vec<String> = Vec::new();
+        let mut left: Vec<String> = Vec::new();
+        let mut failed: Vec<String> = Vec::new();
+        for node in self.device_root_nodes(&source_root)? {
+            if node.trashed || node.name == PROFILE_DIR_NAME {
+                continue;
+            }
+            // A device root only ever holds folders (B68); anything else was
+            // put there by hand and is left for the user to deal with.
+            if !node.is_folder() {
+                left.push(node.name);
+                continue;
+            }
+            let new_name = migrated_name(&node.name, &source.name, &taken);
+            if let Err(e) = self.move_rename_remote(&node.uid, &target_root, new_name.as_deref()) {
+                warn!(name = %node.name, error = %e, "migrate: could not move folder");
+                failed.push(format!("{}: {e}", node.name));
+                continue;
+            }
+            let landed = new_name.clone().unwrap_or_else(|| node.name.clone());
+            if new_name.is_some() {
+                renamed.push(format!("{} -> {landed}", node.name));
+            }
+            taken.push(landed);
+            moved += 1;
+
+            let uid = node.uid.to_string();
+            for folder in synced.iter().filter(|f| f.remote_uid == uid) {
+                if let Err(e) = self.db.sync_folder_set_share(folder.id, &target.share_id) {
+                    warn!(id = folder.id, error = ?e, "migrate: could not re-point sync folder");
+                }
+                self.sync_now(Some(folder.id));
+            }
+        }
+        self.invalidate_children_of(&source_root);
+        self.invalidate_children_of(&target_root);
+
+        let mut message = format!("moved {moved} folder(s) from {}", source.name);
+        if !renamed.is_empty() {
+            message.push_str(&format!("; renamed: {}", renamed.join(", ")));
+        }
+        if !left.is_empty() {
+            message.push_str(&format!("; left behind: {}", left.join(", ")));
+        }
+        if !failed.is_empty() {
+            message.push_str(&format!("; failed: {}", failed.join(", ")));
+        }
+        info!(from = %source.name, to = %target.name, moved, failed = failed.len(),
+            "device migrated");
+        if moved == 0 && !failed.is_empty() {
+            return Err(CoreError::conflict(message));
+        }
+        Ok(message)
+    }
+
+    // ---- device folder sync -------------------------
 
     /// Auto-register (or recover) this machine as a Proton Drive Device, caching
     /// it so restarts reuse the same device. Recovery matches an existing remote
@@ -270,8 +388,7 @@ impl Core {
     /// Resolution order: the *adopted* uid pinned in `config.json`, then the
     /// cached DB row (validated remotely), then a hostname match, then create.
     /// The pin exists because the hostname heuristic silently registers a second
-    /// device after a rename or reinstall, orphaning the first one's folders
-    /// (features.md 5.1).
+    /// device after a rename or reinstall, orphaning the first one's folders.
     pub(crate) fn ensure_device(&self) -> CoreResult<StoredDevice> {
         let name = this_hostname();
         // Enumerate the remote devices once: used to validate the pin, validate
@@ -361,23 +478,27 @@ impl Core {
         root_uid: &NodeUid,
         name: &str,
     ) -> CoreResult<Option<NodeUid>> {
-        let uids = self
-            .rt
-            .block_on(self.client.enumerate_folder_children_node_uids(root_uid))
-            .map_err(|e| CoreError::from_api(&e, "list device root"))?;
-        if uids.is_empty() {
-            return Ok(None);
-        }
-        let nodes = self
-            .rt
-            .block_on(self.client.enumerate_nodes(&uids))
-            .map_err(|e| CoreError::from_api(&e, "resolve device root children"))?;
-        Ok(nodes
+        Ok(self
+            .device_root_nodes(root_uid)?
             .into_iter()
             .find(|n| n.is_folder() && !n.trashed && n.name == name)
             .map(|n| n.uid))
     }
 
+    /// Everything directly under a device root, trashed nodes included.
+    fn device_root_nodes(&self, root_uid: &NodeUid) -> CoreResult<Vec<Node>> {
+        let uids = self
+            .rt
+            .block_on(self.drive.enumerate_folder_children_node_uids(root_uid))
+            .map_err(|e| CoreError::from_api(&e, "list device root"))?;
+        if uids.is_empty() {
+            return Ok(Vec::new());
+        }
+        self.rt
+            .block_on(self.drive.enumerate_nodes(&uids))
+            .map_err(|e| CoreError::from_api(&e, "resolve device root children"))
+    }
+
     /// Add a local folder to this device's sync set: register the device if
     /// needed, create a matching folder under the device root, upload the local
     /// tree into it once, and record the mapping. Phase 1 is a one-shot upload —
@@ -446,10 +567,7 @@ impl Core {
             }
             None => self
                 .rt
-                .block_on(
-                    self.client
-                        .create_folder(&root_uid, &name, Some(now_secs())),
-                )
+                .block_on(self.drive.create_folder(&root_uid, &name, Some(now_secs())))
                 .map_err(|e| CoreError::from_api(&e, &format!("create device folder {name}")))?,
         };
 
@@ -539,12 +657,16 @@ impl Core {
                     } else {
                         p.total.max(p.done) as u64
                     },
+                    // Most passes find nothing; only one that queues work is
+                    // the drive syncing.
+                    background: true,
                 },
                 SyncPhase::Applying => JobItem {
                     title: format!("Syncing {folder}"),
                     detail: p.current.clone(),
                     done: p.done as u64,
                     total: p.total.max(p.done) as u64,
+                    background: false,
                 },
             });
         }
@@ -603,7 +725,7 @@ impl Core {
             && let Some(uid) = parse_uid(&folder.remote_uid)
             && let Err(e) = self
                 .rt
-                .block_on(self.client.trash_nodes(&[uid]))
+                .block_on(self.drive.trash_nodes(&[uid]))
                 .and_then(batch::into_unit)
         {
             warn!(id, error = %e, "delete remote device folder failed");
@@ -619,23 +741,16 @@ impl Core {
         };
     }
 
-    /// A sibling Core that shares this one's client/rt/cache/db (and transfer,
-    /// activity, mount registries) but gets a **fresh, empty `State`** — its own
-    /// inode space starting at [`ROOT_INO`]. Used to root a secondary FUSE session
-    /// at an `ondemand` sync folder without colliding with the main mount's inodes
-    /// (devices.md Phase 3).
+    /// A sibling Core for a secondary FUSE session rooted at an `ondemand` sync
+    /// folder. It shares everything with this one,
+    /// the tree included, except what belongs to a session: its root and its
+    /// kernel channel, both filled in when the session is built.
     pub(crate) fn fork_state(&self) -> Core {
         let mut fork = self.clone();
         fork.primary = false;
-        let share_access = self.state().share_access.clone();
-        fork.state = Arc::new(Mutex::new(State::new(self.db.clone(), share_access, 2)));
-        // A fresh inode space needs a fresh notification channel: this fork's
-        // session is the only one that knows these inodes, so it must be the one
-        // notified about them. Filled in by `spawn_ondemand_mount`.
+        fork.root = Arc::new(OnceLock::new());
         fork.notifier = Arc::new(OnceLock::new());
         fork.session_live = Arc::new(std::sync::atomic::AtomicBool::new(false));
-        // Size upgrades are keyed by inode, which is per-fork too.
-        fork.size_upgrades = Arc::new(Mutex::new(HashMap::new()));
         fork
     }
 
@@ -853,12 +968,29 @@ impl Core {
                 if folder.state != "idle" {
                     return Err(SwitchBlocked::NotNow);
                 }
+                // `idle` only says the last pass applied everything it tried.
+                // It never tries an ignored path, a symlink or a folder it
+                // cannot read, it defers a file open for writing, and a file can
+                // change after it ends. The eviction below deletes all of those
+                // for good, so it waits until nothing here is missing from Drive
+                // (B198).
+                let baseline = self
+                    .db
+                    .sync_entries(id)
+                    .map_err(|e| SwitchBlocked::Failed(format!("db: {e:?}")))?;
+                if let Some(reason) =
+                    sync::mirror_tree_unsynced(&local, &baseline, &self.ignore_rules(&local))
+                {
+                    return Err(SwitchBlocked::Failed(format!(
+                        "going online-only would delete what is only on this computer: {reason}"
+                    )));
+                }
                 let root_uid = parse_uid(&folder.remote_uid).ok_or_else(|| {
                     SwitchBlocked::Failed(format!("bad remote uid: {}", folder.remote_uid))
                 })?;
                 let root = self
                     .rt
-                    .block_on(self.client.enumerate_nodes(std::slice::from_ref(&root_uid)))
+                    .block_on(self.drive.enumerate_nodes(std::slice::from_ref(&root_uid)))
                     .map_err(|e| SwitchBlocked::Failed(format!("fetch remote root: {e}")))?
                     .into_iter()
                     .next()
@@ -937,8 +1069,8 @@ impl Core {
         }
     }
 
-    /// Spawn a secondary FUSE session rooted at `root` over `local` on a forked
-    /// inode space. Clears any stale kernel mount first (a crashed run can leave
+    /// Spawn a secondary FUSE session rooted at `root` over `local` from a
+    /// [`Core::fork_state`] sibling. Clears any stale kernel mount first (a crashed run can leave
     /// one, which would fail the fresh mount with EBUSY).
     pub(crate) fn spawn_ondemand_mount(
         &self,
@@ -996,8 +1128,7 @@ impl Core {
     /// restart (their local dirs are empty on disk — the files live in the cloud).
     /// Best-effort per folder: a missing local path or a failed remote fetch marks
     /// the folder `error` and moves on rather than aborting the rest. Runs on its
-    /// own thread from `mount` so the network fetches never block startup
-    /// (devices.md Phase 4).
+    /// own thread from `mount` so the network fetches never block startup.
     pub(crate) fn restore_ondemand_mounts(&self) {
         let folders = match self.db.sync_folder_list() {
             Ok(f) => f,
@@ -1017,7 +1148,7 @@ impl Core {
             };
             let root = match self
                 .rt
-                .block_on(self.client.enumerate_nodes(std::slice::from_ref(&root_uid)))
+                .block_on(self.drive.enumerate_nodes(std::slice::from_ref(&root_uid)))
             {
                 Ok(v) => match v.into_iter().next() {
                     Some(n) => n,
@@ -1119,10 +1250,38 @@ mod tests {
     use pdfs_core::db::StoredSyncFolder;
 
     use super::{
-        ApplicableMountMode, commit_after_teardown, pending_intent_matches,
+        ApplicableMountMode, commit_after_teardown, migrated_name, pending_intent_matches,
         restore_snapshot_matches, select_mode_transition,
     };
 
+    #[test]
+    fn migrated_folder_keeps_its_name_when_it_is_free() {
+        let taken = vec!["Pictures".to_string()];
+        assert_eq!(migrated_name("Documents", "DESKTOP-1", &taken), None);
+    }
+
+    #[test]
+    fn migrated_folder_is_named_after_its_device_on_a_clash() {
+        let taken = vec!["Documents".to_string()];
+        assert_eq!(
+            migrated_name("Documents", "DESKTOP-1", &taken).as_deref(),
+            Some("Documents (DESKTOP-1)")
+        );
+    }
+
+    #[test]
+    fn migrated_folder_is_numbered_when_the_device_name_is_taken_too() {
+        let taken = vec![
+            "Documents".to_string(),
+            "Documents (DESKTOP-1)".to_string(),
+            "Documents (DESKTOP-1) 2".to_string(),
+        ];
+        assert_eq!(
+            migrated_name("Documents", "DESKTOP-1", &taken).as_deref(),
+            Some("Documents (DESKTOP-1) 3")
+        );
+    }
+
     #[test]
     fn unknown_mode_cannot_select_a_destructive_transition() {
         let mut unmounts = 0;

crates/pdfs-fuse/src/drive.rs

@@ -0,0 +1,473 @@
+//! The calls the sync core makes to Drive, behind a trait.
+//!
+//! `Core` used to hold a concrete [`ProtonDriveClient`], so no test could make
+//! Drive answer late, answer stale, or not answer at all, and the interleavings
+//! behind most recent bugs could only be found on a real account over a slow
+//! link. [`DriveApi`] is the part of the
+//! client the mount, the drain, the event feed and the mirror engine use; the
+//! real client implements it by forwarding, and the simulation tests implement
+//! it with an in-memory Drive that injects Drive's known faults.
+//!
+//! Sharing, Photos, devices, invitations and public links stay on the concrete
+//! client (`Core::client`) until a test needs them faked.
+//!
+//! The method names match the client's own, so a call site reads the same
+//! whichever it goes through. The client's generic methods (a reader or writer
+//! of any type) cannot be part of an object-safe trait, so the trait takes them
+//! as trait objects and `impl dyn DriveApi` puts the generic signatures back.
+
+use std::io::{Read, Write};
+use std::sync::Arc;
+
+use async_trait::async_trait;
+use futures::StreamExt as _;
+use futures::stream::BoxStream;
+use proton_drive_rs::proton_sdk::account::Quota;
+use proton_drive_rs::proton_sdk::error::Result;
+use proton_drive_rs::proton_sdk::ids::{DriveEventId, NodeUid};
+use proton_drive_rs::{
+    DriveEvent, DriveEventScopeId, Node, NodeMoveItem, ProtonDriveClient, RevisionReader, Thumbnail,
+};
+
+/// One outcome per node of a batch request; see [`ProtonDriveClient::trash_nodes`].
+pub(crate) type NodeOutcomes = Vec<(NodeUid, Result<()>)>;
+
+/// The outcomes of a streaming batch request, one item per node as it lands.
+pub(crate) type OutcomeStream<'a> = BoxStream<'a, Result<(NodeUid, Result<()>)>>;
+
+/// Drive as the sync core sees it. See the module documentation.
+#[async_trait]
+pub(crate) trait DriveApi: Send + Sync {
+    async fn get_my_files_folder(&self) -> Result<Node>;
+
+    async fn get_node(&self, uid: &NodeUid) -> Result<Option<Node>>;
+
+    async fn enumerate_nodes(&self, uids: &[NodeUid]) -> Result<Vec<Node>>;
+
+    /// As [`DriveApi::enumerate_nodes`], but files carry no claimed size or
+    /// modification time; see [`ProtonDriveClient::enumerate_nodes_light`].
+    async fn enumerate_nodes_light(&self, uids: &[NodeUid]) -> Result<Vec<Node>>;
+
+    async fn enumerate_folder_children_node_uids(
+        &self,
+        folder_uid: &NodeUid,
+    ) -> Result<Vec<NodeUid>>;
+
+    async fn enumerate_events(
+        &self,
+        scope: &DriveEventScopeId,
+        cursor: Option<&DriveEventId>,
+    ) -> Result<Vec<DriveEvent>>;
+
+    async fn invalidate_caches_for_event(&self, event: &DriveEvent) -> Result<()>;
+
+    async fn create_folder(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        last_modification_time: Option<i64>,
+    ) -> Result<NodeUid>;
+
+    async fn upload_file(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        media_type: &str,
+        contents: &[u8],
+    ) -> Result<NodeUid>;
+
+    #[allow(clippy::too_many_arguments)]
+    async fn upload_file_from_dyn(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        media_type: &str,
+        reader: &mut (dyn Read + Send),
+        intended_size: i64,
+        thumbnails: Vec<Thumbnail>,
+        last_modification_time: Option<i64>,
+        aead: bool,
+    ) -> Result<NodeUid>;
+
+    #[allow(clippy::too_many_arguments)]
+    async fn upload_file_replacing_draft_from_dyn(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        media_type: &str,
+        reader: &mut (dyn Read + Send),
+        intended_size: i64,
+        thumbnails: Vec<Thumbnail>,
+        last_modification_time: Option<i64>,
+        aead: bool,
+    ) -> Result<NodeUid>;
+
+    async fn upload_new_revision_from_dyn(
+        &self,
+        file_uid: &NodeUid,
+        reader: &mut (dyn Read + Send),
+        intended_size: i64,
+        thumbnails: Vec<Thumbnail>,
+        last_modification_time: Option<i64>,
+    ) -> Result<()>;
+
+    async fn open_revision(&self, uid: &NodeUid) -> Result<Arc<dyn RevisionRead>>;
+
+    async fn download_file_to_dyn(
+        &self,
+        uid: &NodeUid,
+        output: &mut (dyn Write + Send),
+    ) -> Result<()>;
+
+    async fn download_revision_to_dyn(
+        &self,
+        file_uid: &NodeUid,
+        revision_id: &str,
+        writer: &mut (dyn Write + Send),
+    ) -> Result<()>;
+
+    async fn rename_node(
+        &self,
+        uid: &NodeUid,
+        new_name: &str,
+        new_media_type: Option<&str>,
+    ) -> Result<()>;
+
+    async fn move_node(&self, uid: &NodeUid, new_parent: &NodeUid) -> Result<()>;
+
+    fn move_nodes_streaming<'a>(
+        &'a self,
+        items: Vec<NodeMoveItem>,
+        new_parent: NodeUid,
+    ) -> OutcomeStream<'a>;
+
+    async fn trash_nodes(&self, uids: &[NodeUid]) -> Result<NodeOutcomes>;
+
+    async fn restore_nodes(&self, uids: &[NodeUid]) -> Result<NodeOutcomes>;
+
+    fn restore_nodes_streaming<'a>(&'a self, uids: &[NodeUid]) -> OutcomeStream<'a>;
+
+    fn delete_nodes_streaming<'a>(&'a self, uids: &[NodeUid]) -> OutcomeStream<'a>;
+
+    async fn enumerate_trash_node_uids(&self) -> Result<Vec<NodeUid>>;
+
+    /// The account's storage, across every Proton product.
+    async fn quota(&self) -> Result<Quota>;
+
+    /// Called by the drain once it has let go of the blob of an upload to
+    /// `uid` that landed, or retired the create that made `uid`, before the
+    /// tree has the node, so a simulation can hold it there. Blocks the drain
+    /// worker it is called on.
+    #[cfg(test)]
+    fn landing(&self, _uid: &NodeUid) {}
+}
+
+/// The generic signatures of the client, over the object-safe ones above.
+impl dyn DriveApi {
+    #[allow(clippy::too_many_arguments)]
+    pub(crate) async fn upload_file_from<R: Read + Send>(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        media_type: &str,
+        mut reader: R,
+        intended_size: i64,
+        thumbnails: Vec<Thumbnail>,
+        last_modification_time: Option<i64>,
+        aead: bool,
+    ) -> Result<NodeUid> {
+        self.upload_file_from_dyn(
+            parent_uid,
+            name,
+            media_type,
+            &mut reader,
+            intended_size,
+            thumbnails,
+            last_modification_time,
+            aead,
+        )
+        .await
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    pub(crate) async fn upload_file_replacing_draft_from<R: Read + Send>(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        media_type: &str,
+        mut reader: R,
+        intended_size: i64,
+        thumbnails: Vec<Thumbnail>,
+        last_modification_time: Option<i64>,
+        aead: bool,
+    ) -> Result<NodeUid> {
+        self.upload_file_replacing_draft_from_dyn(
+            parent_uid,
+            name,
+            media_type,
+            &mut reader,
+            intended_size,
+            thumbnails,
+            last_modification_time,
+            aead,
+        )
+        .await
+    }
+
+    pub(crate) async fn upload_new_revision_from<R: Read + Send>(
+        &self,
+        file_uid: &NodeUid,
+        mut reader: R,
+        intended_size: i64,
+        thumbnails: Vec<Thumbnail>,
+        last_modification_time: Option<i64>,
+    ) -> Result<()> {
+        self.upload_new_revision_from_dyn(
+            file_uid,
+            &mut reader,
+            intended_size,
+            thumbnails,
+            last_modification_time,
+        )
+        .await
+    }
+
+    pub(crate) async fn download_file_to<W: Write + Send>(
+        &self,
+        uid: &NodeUid,
+        output: &mut W,
+    ) -> Result<()> {
+        self.download_file_to_dyn(uid, output).await
+    }
+
+    pub(crate) async fn download_revision_to<W: Write + Send>(
+        &self,
+        file_uid: &NodeUid,
+        revision_id: &str,
+        writer: &mut W,
+    ) -> Result<()> {
+        self.download_revision_to_dyn(file_uid, revision_id, writer)
+            .await
+    }
+}
+
+/// An open revision that block reads are served from; see [`RevisionReader`].
+#[async_trait]
+pub(crate) trait RevisionRead: Send + Sync {
+    /// Plaintext size of the revision.
+    fn size(&self) -> u64;
+
+    /// Plaintext size of each block, in block order.
+    fn block_sizes(&self) -> &[u64];
+
+    async fn read_at(&self, offset: u64, length: u64) -> Result<Vec<u8>>;
+}
+
+#[async_trait]
+impl RevisionRead for RevisionReader {
+    fn size(&self) -> u64 {
+        RevisionReader::size(self)
+    }
+
+    fn block_sizes(&self) -> &[u64] {
+        RevisionReader::block_sizes(self)
+    }
+
+    async fn read_at(&self, offset: u64, length: u64) -> Result<Vec<u8>> {
+        RevisionReader::read_at(self, offset, length).await
+    }
+}
+
+#[async_trait]
+impl DriveApi for ProtonDriveClient {
+    async fn get_my_files_folder(&self) -> Result<Node> {
+        ProtonDriveClient::get_my_files_folder(self).await
+    }
+
+    async fn get_node(&self, uid: &NodeUid) -> Result<Option<Node>> {
+        ProtonDriveClient::get_node(self, uid).await
+    }
+
+    async fn enumerate_nodes(&self, uids: &[NodeUid]) -> Result<Vec<Node>> {
+        ProtonDriveClient::enumerate_nodes(self, uids).await
+    }
+
+    async fn enumerate_nodes_light(&self, uids: &[NodeUid]) -> Result<Vec<Node>> {
+        ProtonDriveClient::enumerate_nodes_light(self, uids).await
+    }
+
+    async fn enumerate_folder_children_node_uids(
+        &self,
+        folder_uid: &NodeUid,
+    ) -> Result<Vec<NodeUid>> {
+        ProtonDriveClient::enumerate_folder_children_node_uids(self, folder_uid).await
+    }
+
+    async fn enumerate_events(
+        &self,
+        scope: &DriveEventScopeId,
+        cursor: Option<&DriveEventId>,
+    ) -> Result<Vec<DriveEvent>> {
+        ProtonDriveClient::enumerate_events(self, scope, cursor).await
+    }
+
+    async fn invalidate_caches_for_event(&self, event: &DriveEvent) -> Result<()> {
+        ProtonDriveClient::invalidate_caches_for_event(self, event).await
+    }
+
+    async fn create_folder(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        last_modification_time: Option<i64>,
+    ) -> Result<NodeUid> {
+        ProtonDriveClient::create_folder(self, parent_uid, name, last_modification_time).await
+    }
+
+    async fn upload_file(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        media_type: &str,
+        contents: &[u8],
+    ) -> Result<NodeUid> {
+        ProtonDriveClient::upload_file(self, parent_uid, name, media_type, contents).await
+    }
+
+    async fn upload_file_from_dyn(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        media_type: &str,
+        reader: &mut (dyn Read + Send),
+        intended_size: i64,
+        thumbnails: Vec<Thumbnail>,
+        last_modification_time: Option<i64>,
+        aead: bool,
+    ) -> Result<NodeUid> {
+        ProtonDriveClient::upload_file_from(
+            self,
+            parent_uid,
+            name,
+            media_type,
+            reader,
+            intended_size,
+            thumbnails,
+            last_modification_time,
+            aead,
+        )
+        .await
+    }
+
+    async fn upload_file_replacing_draft_from_dyn(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        media_type: &str,
+        reader: &mut (dyn Read + Send),
+        intended_size: i64,
+        thumbnails: Vec<Thumbnail>,
+        last_modification_time: Option<i64>,
+        aead: bool,
+    ) -> Result<NodeUid> {
+        ProtonDriveClient::upload_file_replacing_draft_from(
+            self,
+            parent_uid,
+            name,
+            media_type,
+            reader,
+            intended_size,
+            thumbnails,
+            last_modification_time,
+            aead,
+        )
+        .await
+    }
+
+    async fn upload_new_revision_from_dyn(
+        &self,
+        file_uid: &NodeUid,
+        reader: &mut (dyn Read + Send),
+        intended_size: i64,
+        thumbnails: Vec<Thumbnail>,
+        last_modification_time: Option<i64>,
+    ) -> Result<()> {
+        ProtonDriveClient::upload_new_revision_from(
+            self,
+            file_uid,
+            reader,
+            intended_size,
+            thumbnails,
+            last_modification_time,
+        )
+        .await
+    }
+
+    async fn open_revision(&self, uid: &NodeUid) -> Result<Arc<dyn RevisionRead>> {
+        let reader = ProtonDriveClient::open_revision(self, uid).await?;
+        Ok(Arc::new(reader))
+    }
+
+    async fn download_file_to_dyn(
+        &self,
+        uid: &NodeUid,
+        output: &mut (dyn Write + Send),
+    ) -> Result<()> {
+        ProtonDriveClient::download_file_to(self, uid, &mut &mut *output).await
+    }
+
+    async fn download_revision_to_dyn(
+        &self,
+        file_uid: &NodeUid,
+        revision_id: &str,
+        writer: &mut (dyn Write + Send),
+    ) -> Result<()> {
+        ProtonDriveClient::download_revision_to(self, file_uid, revision_id, &mut &mut *writer)
+            .await
+    }
+
+    async fn rename_node(
+        &self,
+        uid: &NodeUid,
+        new_name: &str,
+        new_media_type: Option<&str>,
+    ) -> Result<()> {
+        ProtonDriveClient::rename_node(self, uid, new_name, new_media_type).await
+    }
+
+    async fn move_node(&self, uid: &NodeUid, new_parent: &NodeUid) -> Result<()> {
+        ProtonDriveClient::move_node(self, uid, new_parent).await
+    }
+
+    fn move_nodes_streaming<'a>(
+        &'a self,
+        items: Vec<NodeMoveItem>,
+        new_parent: NodeUid,
+    ) -> OutcomeStream<'a> {
+        ProtonDriveClient::move_nodes_streaming(self, items, new_parent).boxed()
+    }
+
+    async fn trash_nodes(&self, uids: &[NodeUid]) -> Result<NodeOutcomes> {
+        ProtonDriveClient::trash_nodes(self, uids).await
+    }
+
+    async fn restore_nodes(&self, uids: &[NodeUid]) -> Result<NodeOutcomes> {
+        ProtonDriveClient::restore_nodes(self, uids).await
+    }
+
+    fn restore_nodes_streaming<'a>(&'a self, uids: &[NodeUid]) -> OutcomeStream<'a> {
+        ProtonDriveClient::restore_nodes_streaming(self, uids).boxed()
+    }
+
+    fn delete_nodes_streaming<'a>(&'a self, uids: &[NodeUid]) -> OutcomeStream<'a> {
+        ProtonDriveClient::delete_nodes_streaming(self, uids).boxed()
+    }
+
+    async fn enumerate_trash_node_uids(&self) -> Result<Vec<NodeUid>> {
+        ProtonDriveClient::enumerate_trash_node_uids(self).await
+    }
+
+    async fn quota(&self) -> Result<Quota> {
+        ProtonDriveClient::quota(self).await
+    }
+}

crates/pdfs-fuse/src/events.rs

@@ -9,7 +9,7 @@
 //! through one place (the status, transfers, sync progress) and publishes them
 //! when they differ.
 
-use std::collections::BTreeSet;
+use std::collections::{BTreeSet, HashMap};
 use std::sync::Arc;
 use std::time::Duration;
 
@@ -153,13 +153,15 @@ pub(crate) fn transfers_line(items: Vec<TransferItem>, jobs: Vec<JobItem>) -> Op
 
 /// Watch what changes without a single place to publish it from, and publish it
 /// when it differs from the last look: the status (queue counts, cache use,
-/// online, pause), the transfers snapshot, and the synced folders with their
-/// live progress. Looks only while someone is subscribed.
+/// online, pause), the transfers snapshot, the synced folders with their
+/// live progress, and which nodes have a sync issue. Looks only while someone
+/// is subscribed.
 pub(crate) fn run_event_sampler(core: Core, username: String, mountpoint: std::path::PathBuf) {
     let mut transfers: Option<Arc<str>> = None;
     let mut status: Option<String> = None;
     let mut queue: Option<String> = None;
     let mut locations: Option<String> = None;
+    let mut issues: Option<HashMap<i64, String>> = None;
     let mut tick = 0u32;
     while core.shutdown.sleep(SAMPLE_INTERVAL) {
         if !core.events.has_subscribers() {
@@ -169,6 +171,7 @@ pub(crate) fn run_event_sampler(core: Core, username: String, mountpoint: std::p
             status = None;
             queue = None;
             locations = None;
+            issues = None;
             continue;
         }
         let line = transfers_line(core.transfers.snapshot(), core.jobs_snapshot());
@@ -196,6 +199,15 @@ pub(crate) fn run_event_sampler(core: Core, username: String, mountpoint: std::p
         }
         queue = Some(queue_key);
 
+        // An issue shows on its node in the file browser: raised, cleared,
+        // landed or discarded, the listing is out of date.
+        if let Ok(now) = core.db.node_issues() {
+            if issues.as_ref().is_some_and(|last| *last != now) {
+                core.events.publish(&[Topic::Files]);
+            }
+            issues = Some(now);
+        }
+
         if let Ok(now) = core.list_locations() {
             let key = serde_json::to_string(&now).unwrap_or_default();
             if locations.as_ref().is_some_and(|last| *last != key) {
@@ -223,6 +235,8 @@ fn status_keys(status: &CtlResponse) -> (String, String) {
         used,
         budget,
         online,
+        session_expired,
+        tokens_unsaved,
         pending_uploads,
         pending_changes,
         ..
@@ -235,7 +249,7 @@ fn status_keys(status: &CtlResponse) -> (String, String) {
     );
     let key = format!(
         "{queue}/{staged_bytes}/{paused}/{paused_until:?}/{username}/{mountpoint}/{pinned}/\
-         {used}/{budget}/{online}"
+         {used}/{budget}/{online}/{session_expired}/{tokens_unsaved}"
     );
     (key, queue)
 }
@@ -313,6 +327,8 @@ mod tests {
             budget: 0,
             pins: Vec::new(),
             online: true,
+            session_expired: false,
+            tokens_unsaved: false,
             pending_uploads: 1,
             pending_changes: 0,
         };

crates/pdfs-fuse/src/link.rs

@@ -0,0 +1,436 @@
+//! Noticing that the network went away mid-session, and that it came back.
+//!
+//! The mount used to learn it was offline only at startup: a daemon that had
+//! connected once kept `online` true for the rest of its life, so a Wi-Fi drop
+//! turned every create, mkdir, delete and rename into a two-minute wait for an
+//! `EIO`, while the queue that exists for exactly this sat unused. Now any
+//! remote call a handler waits on reports a failure to reach Proton through
+//! [`Core::lost_link`], which flips the mount offline; the handler then takes its
+//! queued path, and the probe thread here flips it back when Proton answers.
+
+use std::future::Future;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::time::{Duration, Instant};
+
+use parking_lot::{Condvar, Mutex};
+use pdfs_core::error::session_revoked;
+use proton_drive_rs::proton_sdk::api::ResponseCode;
+use proton_drive_rs::proton_sdk::error::{ProtonApiError, ProtonError};
+use tracing::{debug, info, warn};
+
+use crate::{Core, ONLINE_PROBE_MAX, ONLINE_PROBE_MIN};
+
+/// How long a remote call a FUSE handler is waiting on may take before the link
+/// is treated as down.
+///
+/// The SDK's own budget for one request is four attempts of up to 30 seconds
+/// each, so a dead link held the caller for about two minutes. A metadata call
+/// that has had no answer in 20 seconds is not going to be one the user wants to
+/// keep waiting for; queueing the change is the better answer.
+pub(crate) const INTERACTIVE_CALL_TIMEOUT: Duration = Duration::from_secs(20);
+
+/// How long one probe may wait for an answer. A probe is a single small request,
+/// and a probe stuck in the SDK's retry budget would delay noticing the link is
+/// back by as long as it waits.
+const PROBE_TIMEOUT: Duration = Duration::from_secs(10);
+
+/// First delay between probes after a drop seen mid-session, and the ceiling it
+/// doubles to while the outage is young. A blip should end in seconds, not in
+/// the minutes [`ONLINE_PROBE_MAX`] allows.
+const PROBE_AFTER_DROP: Duration = Duration::from_secs(2);
+const PROBE_YOUNG_MAX: Duration = Duration::from_secs(30);
+/// How long an outage counts as young. Past it the probe backs off to
+/// [`ONLINE_PROBE_MAX`], because a laptop can sit offline for days and each
+/// probe is a real API round trip.
+const YOUNG_OUTAGE: Duration = Duration::from_secs(10 * 60);
+
+/// How often the idle probe thread checks for teardown while the link is up.
+const IDLE_CHECK: Duration = Duration::from_secs(1);
+
+/// The shared half of the online flag: when the link went down, and a condvar
+/// that fires on every change so waiters need not poll.
+#[derive(Default)]
+pub(crate) struct Link {
+    lost_at: Mutex<Option<Instant>>,
+    changed: Condvar,
+    /// Folders listed from the DB alone while offline, to relist once back.
+    pub(crate) stale_listings: Mutex<std::collections::HashSet<u64>>,
+    /// Proton refused the session itself ([`session_revoked`]). The mount is
+    /// offline then, but no probe brings it back: only a new login does, and
+    /// that restarts the daemon. Read by front-ends through `Response::Status`,
+    /// so they can ask the user to sign in again rather than say "offline".
+    pub(crate) session_expired: AtomicBool,
+    /// Proton refused the session, but only because another process rotated
+    /// it (`pdfs unlock`): the keyring holds the live tokens. The mount loop
+    /// ends the mount for the daemon to mount again from the keyring.
+    pub(crate) resume_stored: AtomicBool,
+}
+
+impl Link {
+    /// The link of a mount that comes up with Proton refusing its session, or
+    /// not.
+    pub(crate) fn starting(session_expired: bool) -> Self {
+        Self {
+            session_expired: AtomicBool::new(session_expired),
+            ..Default::default()
+        }
+    }
+}
+
+/// Whether a failed call failed because Proton could not be reached, rather
+/// than because it answered and refused.
+///
+/// A transport error is the network. So is a request timeout: the SDK reports
+/// Proton's own "try again" codes that way, and [`no_answer`] reports our
+/// deadline that way. Anything else Proton actually said, and says again on a
+/// retry, so it must reach the caller rather than be queued.
+pub(crate) fn is_network_error(e: &ProtonError) -> bool {
+    match e {
+        ProtonError::Transport(_) => true,
+        ProtonError::Api(api) => {
+            matches!(
+                api.code,
+                ResponseCode::RequestTimeout | ResponseCode::Timeout
+            )
+        }
+        _ => false,
+    }
+}
+
+/// The error a call reports when it runs past `after` without an answer.
+pub(crate) fn no_answer(after: Duration) -> ProtonError {
+    ProtonError::Api(ProtonApiError {
+        code: ResponseCode::RequestTimeout,
+        http_status: 408,
+        message: format!("no answer within {}s", after.as_secs()),
+        details: None,
+    })
+}
+
+/// The slowest upload rate an upload's deadline allows for, past the
+/// metadata budget it starts with. Far below any link that works, so only a
+/// transfer that has stopped moving runs into it.
+const SLOWEST_UPLOAD: u64 = 32 * 1024;
+
+/// How long an upload of `len` bytes may take before the link is treated as
+/// down: the budget of a metadata call, plus the bytes at [`SLOWEST_UPLOAD`].
+pub(crate) fn upload_deadline(len: u64) -> Duration {
+    INTERACTIVE_CALL_TIMEOUT + Duration::from_secs(len / SLOWEST_UPLOAD)
+}
+
+/// Run a remote call, giving up after [`INTERACTIVE_CALL_TIMEOUT`].
+pub(crate) async fn bounded<T>(
+    call: impl Future<Output = Result<T, ProtonError>>,
+) -> Result<T, ProtonError> {
+    bounded_by(INTERACTIVE_CALL_TIMEOUT, call).await
+}
+
+/// Run a remote call, giving up after `limit`.
+pub(crate) async fn bounded_by<T>(
+    limit: Duration,
+    call: impl Future<Output = Result<T, ProtonError>>,
+) -> Result<T, ProtonError> {
+    match tokio::time::timeout(limit, call).await {
+        Ok(result) => result,
+        Err(_) => Err(no_answer(limit)),
+    }
+}
+
+/// The next delay between probes, given the current one and how long the
+/// outage has lasted.
+fn next_probe_delay(delay: Duration, outage: Duration) -> Duration {
+    let cap = if outage < YOUNG_OUTAGE {
+        PROBE_YOUNG_MAX
+    } else {
+        ONLINE_PROBE_MAX
+    };
+    (delay * 2).min(cap)
+}
+
+impl Core {
+    /// Whether the mount currently believes Proton is reachable.
+    pub(crate) fn is_online(&self) -> bool {
+        self.online.load(Ordering::Relaxed)
+    }
+
+    /// Whether a namespace change through the mount goes to Drive inside the
+    /// syscall. Only with [`AppConfig::local_first`] off, and only online;
+    /// otherwise it is queued and the drain sends it.
+    ///
+    /// [`AppConfig::local_first`]: pdfs_core::config::AppConfig::local_first
+    pub(crate) fn sends_inline(&self) -> bool {
+        !self.local_first && self.is_online()
+    }
+
+    /// Run a remote call a caller is waiting on, giving up after
+    /// [`INTERACTIVE_CALL_TIMEOUT`]. The timer is built inside the runtime: a
+    /// FUSE worker has no reactor of its own.
+    pub(crate) fn block_on_bounded<T>(
+        &self,
+        call: impl Future<Output = Result<T, ProtonError>>,
+    ) -> Result<T, ProtonError> {
+        self.rt.block_on(bounded(call))
+    }
+
+    /// Run a remote call, giving up after `limit`: an upload, whose budget
+    /// grows with its size ([`upload_deadline`]).
+    pub(crate) fn block_on_within<T>(
+        &self,
+        limit: Duration,
+        call: impl Future<Output = Result<T, ProtonError>>,
+    ) -> Result<T, ProtonError> {
+        self.rt.block_on(bounded_by(limit, call))
+    }
+
+    /// Whether Proton refused the session itself, so nothing reaches it until
+    /// the user signs in again.
+    pub(crate) fn session_expired(&self) -> bool {
+        self.link.session_expired.load(Ordering::Relaxed)
+    }
+
+    /// Report a failed remote call. Returns whether it failed for want of a
+    /// network, or of a session, in which case the mount is now offline and the
+    /// caller should take its queued path instead of failing.
+    pub(crate) fn lost_link(&self, e: &ProtonError, what: &str) -> bool {
+        if session_revoked(e) {
+            self.mark_session_expired(what, e);
+            return true;
+        }
+        if !is_network_error(e) {
+            return false;
+        }
+        self.mark_offline(what, e);
+        true
+    }
+
+    /// Flip the mount offline for good: Proton refused the session, and only a
+    /// new login brings it back. Changes stay queued for the daemon that login
+    /// starts. Only the first caller logs it.
+    ///
+    /// Unless the keyring holds a newer session than the refused one: then
+    /// the mount ends, for the daemon to mount again on that one.
+    pub(crate) fn mark_session_expired(&self, what: &str, error: &dyn std::fmt::Display) {
+        if self.link.resume_stored.load(Ordering::Relaxed) {
+            return self.mark_offline(what, error);
+        }
+        if pdfs_core::auth::stored_session_is_newer() {
+            info!(during = what, %error,
+                  "Proton refused a session another process has since refreshed; resuming it");
+            self.link.resume_stored.store(true, Ordering::Relaxed);
+            return self.mark_offline(what, error);
+        }
+        if !self.link.session_expired.swap(true, Ordering::Relaxed) {
+            warn!(during = what, %error,
+                  "Proton refused the session; run `pdfs login` to sign in again");
+        }
+        self.mark_offline(what, error);
+    }
+
+    /// Flip the mount offline and wake the probe. Only the first caller of an
+    /// outage logs it; the rest are the same outage.
+    pub(crate) fn mark_offline(&self, what: &str, error: &dyn std::fmt::Display) {
+        let mut lost_at = self.link.lost_at.lock();
+        if self.online.swap(false, Ordering::Relaxed) {
+            *lost_at = Some(Instant::now());
+            warn!(during = what, %error,
+                  "lost the connection to Proton; queueing changes until it returns");
+            self.link.changed.notify_all();
+        }
+    }
+
+    /// Flip the mount back online, wake everything waiting for it, and let the
+    /// queue drain.
+    fn mark_online(&self) {
+        {
+            let mut lost_at = self.link.lost_at.lock();
+            self.online.store(true, Ordering::Relaxed);
+            match lost_at.take() {
+                Some(since) => {
+                    info!(
+                        offline_secs = since.elapsed().as_secs(),
+                        "connection to Proton is back"
+                    )
+                }
+                None => info!("back online"),
+            }
+            self.link.changed.notify_all();
+        }
+        self.relist_offline_listings();
+        // Anything written while offline is queued and waiting on exactly this,
+        // including ops that failed on the way down and are sitting out a
+        // backoff sized for a server that keeps refusing.
+        if let Err(e) = self.db.retry_failed_ops_now(crate::now_millis()) {
+            warn!(error = %e, "moving backed-off ops up after a reconnect failed");
+        }
+        self.wake_drain();
+    }
+
+    /// Wait up to `budget` for the link to come back. Returns whether it is up.
+    pub(crate) fn wait_online(&self, budget: Duration) -> bool {
+        let deadline = Instant::now() + budget;
+        let mut lost_at = self.link.lost_at.lock();
+        while !self.is_online() {
+            if self.shutdown.is_stopping()
+                || self
+                    .link
+                    .changed
+                    .wait_until(&mut lost_at, deadline)
+                    .timed_out()
+            {
+                return self.is_online();
+            }
+        }
+        true
+    }
+
+    /// Wait out `interval` before a background poll of Proton, and while the
+    /// link is down, until it is back. Returns as soon as it comes back, so the
+    /// poll catches up on what changed during the outage at once instead of
+    /// one interval later. A poll into a dead link would only wait out the
+    /// SDK's retries and fail.
+    pub(crate) async fn next_poll(&self, interval: Duration) {
+        let due = Instant::now() + interval;
+        let mut was_offline = false;
+        loop {
+            if !self.is_online() {
+                was_offline = true;
+            } else if was_offline || Instant::now() >= due {
+                return;
+            }
+            tokio::time::sleep(IDLE_CHECK).await;
+        }
+    }
+
+    /// Watch the link for the life of the mount: sleep while it is up, and
+    /// probe it back while it is down.
+    ///
+    /// A mount that started from the cache is down from the first moment; one
+    /// that started online goes down when [`Core::mark_offline`] says so.
+    pub(crate) fn run_online_probe(&self) {
+        // Only an offline start never had a chance to repair its share id.
+        let mut repair_share_id = !self.is_online();
+        loop {
+            {
+                let mut lost_at = self.link.lost_at.lock();
+                while self.is_online() {
+                    if self.shutdown.is_stopping() {
+                        return;
+                    }
+                    self.link.changed.wait_for(&mut lost_at, IDLE_CHECK);
+                }
+            }
+            if !self.probe_until_online() {
+                return;
+            }
+            if std::mem::take(&mut repair_share_id) {
+                self.repair_primary_share_id(&self.primary_root_uid);
+            }
+        }
+    }
+
+    /// Probe until Proton answers, then flip the mount online. Returns `false`
+    /// if the daemon is stopping.
+    ///
+    /// A refused session is not probed: every probe would be refused the same
+    /// way, forever (issue #35). The thread waits for the stop instead.
+    fn probe_until_online(&self) -> bool {
+        let started = self.link.lost_at.lock().unwrap_or_else(Instant::now);
+        let mut delay = if started.elapsed() < YOUNG_OUTAGE {
+            PROBE_AFTER_DROP
+        } else {
+            ONLINE_PROBE_MIN
+        };
+        loop {
+            if !self.shutdown.sleep(delay) {
+                return false;
+            }
+            if self.session_expired() {
+                delay = ONLINE_PROBE_MAX;
+                continue;
+            }
+            let probe = self.rt.block_on(async {
+                match tokio::time::timeout(PROBE_TIMEOUT, self.drive.get_my_files_folder()).await {
+                    Ok(result) => result,
+                    Err(_) => Err(no_answer(PROBE_TIMEOUT)),
+                }
+            });
+            match probe {
+                Ok(root) => {
+                    {
+                        let root_ino = self.root_ino();
+                        let mut st = self.state();
+                        if let Some(e) = st.entries.get_mut(&root_ino) {
+                            e.node = root.clone();
+                        }
+                    }
+                    if let Err(e) = self.db.upsert_node(&root) {
+                        warn!(error = %e, "refresh root after reconnect failed");
+                    }
+                    self.mark_online();
+                    return true;
+                }
+                Err(e) if session_revoked(&e) => self.mark_session_expired("online probe", &e),
+                Err(e) => {
+                    debug!(error = %e, ?delay, "online probe failed; still offline");
+                    delay = next_probe_delay(delay, started.elapsed());
+                }
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn api(code: ResponseCode) -> ProtonError {
+        ProtonError::Api(ProtonApiError {
+            code,
+            http_status: 422,
+            message: String::new(),
+            details: None,
+        })
+    }
+
+    #[test]
+    fn only_an_unanswered_call_counts_as_a_lost_link() {
+        assert!(is_network_error(&no_answer(INTERACTIVE_CALL_TIMEOUT)));
+        assert!(is_network_error(&api(ResponseCode::Timeout)));
+        assert!(!is_network_error(&api(ResponseCode::AlreadyExists)));
+        assert!(!is_network_error(&api(ResponseCode::InvalidRequirements)));
+        assert!(!is_network_error(&ProtonError::invalid_operation("bug")));
+    }
+
+    #[test]
+    fn an_upload_gets_longer_the_bigger_it_is() {
+        assert_eq!(upload_deadline(0), INTERACTIVE_CALL_TIMEOUT);
+        assert_eq!(
+            upload_deadline(1 << 30),
+            INTERACTIVE_CALL_TIMEOUT + Duration::from_secs(32_768)
+        );
+    }
+
+    #[test]
+    fn a_call_past_its_deadline_reads_as_a_lost_link() {
+        let rt = tokio::runtime::Builder::new_current_thread()
+            .enable_time()
+            .build()
+            .unwrap();
+        let limit = Duration::from_millis(20);
+        let result: Result<(), _> = rt.block_on(bounded_by(limit, std::future::pending()));
+        assert!(result.is_err_and(|e| is_network_error(&e)));
+    }
+
+    #[test]
+    fn a_young_outage_is_probed_often_and_an_old_one_rarely() {
+        let young = Duration::from_secs(60);
+        let old = YOUNG_OUTAGE + Duration::from_secs(1);
+        assert_eq!(
+            next_probe_delay(PROBE_AFTER_DROP, young),
+            2 * PROBE_AFTER_DROP
+        );
+        assert_eq!(next_probe_delay(PROBE_YOUNG_MAX, young), PROBE_YOUNG_MAX);
+        assert_eq!(next_probe_delay(PROBE_YOUNG_MAX, old), 2 * PROBE_YOUNG_MAX);
+        assert_eq!(next_probe_delay(ONLINE_PROBE_MAX, old), ONLINE_PROBE_MAX);
+    }
+}

crates/pdfs-fuse/src/mount.rs

@@ -12,6 +12,10 @@ pub enum MountOutcome {
     /// The kernel mount ended on its own (e.g. an external `fusermount -u`).
     /// The caller may want to remount.
     Unmounted,
+    /// Proton refused the session, and the keyring holds a newer one: another
+    /// process (`pdfs unlock`) refreshed it, or a new login replaced it. We
+    /// unmounted ourselves; the caller should mount again, which resumes it.
+    ResumeStored,
 }
 
 /// Whether `path` is a mountpoint whose FUSE connection is dead — the state a
@@ -193,7 +197,7 @@ pub(super) fn clear_stale_mount(mountpoint: &Path) {
 }
 
 /// `sync_state` key holding the uid of the My Files root, so a later run can
-/// recover it from `nodes` without the API (offline.md Phase 1).
+/// recover it from `nodes` without the API.
 const ROOT_UID_KEY: &str = "root_uid";
 
 /// The My Files root, and whether we got it from the API (`true`) or from the
@@ -207,33 +211,63 @@ const ROOT_UID_KEY: &str = "root_uid";
 /// means an empty tree, and mounting that would show the user an empty Drive
 /// rather than an honest error.
 fn fetch_or_recall_root(
-    client: &ProtonDriveClient,
+    drive: &dyn DriveApi,
     rt: &tokio::runtime::Handle,
     db: &Db,
-) -> std::io::Result<(Node, bool)> {
-    let err = match rt.block_on(client.get_my_files_folder()) {
+) -> std::io::Result<(Node, Start)> {
+    let err = match rt.block_on(drive.get_my_files_folder()) {
         Ok(root) => {
             if let Err(e) = db.set_state_str(ROOT_UID_KEY, &root.uid.to_string()) {
                 warn!(error = %e, "persist root uid failed");
             }
-            return Ok((root, true));
+            return Ok((root, Start::Online));
         }
         Err(e) => e,
     };
+    // Still mounted from the cache, so cached files stay readable and changes
+    // queue for the daemon the next login starts.
+    let start = if pdfs_core::error::session_revoked(&err) {
+        Start::SessionExpired
+    } else {
+        Start::Offline
+    };
+    if start == Start::SessionExpired && pdfs_core::auth::stored_session_is_newer() {
+        return Err(std::io::Error::other(format!(
+            "Proton refused a session another process has since refreshed ({err}); resuming it"
+        )));
+    }
     let cached = db
         .state_str(ROOT_UID_KEY)
         .ok()
         .flatten()
         .and_then(|uid| db.node_by_uid(&uid).ok().flatten());
     match cached {
+        Some(root) if start == Start::SessionExpired => {
+            warn!(error = %err,
+                  "Proton refused the session; mounting from cache until `pdfs login`");
+            Ok((root, start))
+        }
         Some(root) => {
             warn!(error = %err, "fetch My Files root failed; mounting from cache (offline)");
-            Ok((root, false))
+            Ok((root, start))
         }
+        None if start == Start::SessionExpired => Err(std::io::Error::other(format!(
+            "Proton refused the session ({err}); run `pdfs login`"
+        ))),
         None => Err(std::io::Error::other(format!("fetch My Files root: {err}"))),
     }
 }
 
+/// How a mount comes up, from what fetching its root said.
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Start {
+    Online,
+    /// Proton could not be reached: serve the cache and probe for the link.
+    Offline,
+    /// Proton refused the session: serve the cache until a new login.
+    SessionExpired,
+}
+
 /// Per-mount settings resolved from [`pdfs_core::config::AppConfig`] by the
 /// caller, so `mount` itself never reads config or the environment.
 pub struct MountOptions {
@@ -244,6 +278,9 @@ pub struct MountOptions {
     /// Upload and download caps in bytes per second (`0` = no cap).
     pub upload_limit: u64,
     pub download_limit: u64,
+    /// Namespace changes through the mount are queued, not sent in the
+    /// syscall. See [`pdfs_core::config::AppConfig::local_first`].
+    pub local_first: bool,
 }
 
 /// Spawn one FUSE session rooted at an arbitrary remote node.
@@ -276,13 +313,14 @@ pub(super) fn spawn_session(
     info!(mountpoint = %mountpoint.display(), "mounting Proton Drive location");
     let fs = ProtonFs::new(core.clone(), root);
     if core.primary {
-        // Only My Files rehydrates the daemon-wide node cache. A secondary
-        // inode space is rooted at one device subtree and must not import every
-        // unrelated persisted node.
+        // Only My Files rehydrates the daemon-wide node cache, once. A
+        // secondary mount shares the tree it fills.
         core.hydrate();
     }
     let session = Session::new(fs, mountpoint, &config)?.spawn()?;
-    let _ = core.notifier.set(session.notifier());
+    let _ = core
+        .notifier
+        .set(KernelChannel::new(session.notifier(), core.root_ino()));
     core.session_live.store(true, Ordering::Release);
     Ok(session)
 }
@@ -339,17 +377,58 @@ pub fn mount(
     control_socket: &Path,
     db: Arc<Db>,
     options: MountOptions,
+) -> std::io::Result<MountOutcome> {
+    let drive = Arc::new(client.clone());
+    mount_with(
+        client,
+        drive,
+        rt,
+        mountpoint,
+        cache,
+        control_socket,
+        db,
+        options,
+        Host::Daemon,
+    )
+}
+
+/// What a mount runs in.
+pub(crate) enum Host {
+    /// The daemon: stopped by SIGTERM or SIGINT, and indexing the user's home
+    /// for the launcher prompt.
+    Daemon,
+    /// One of several simulated daemons in a test process (`sim`): stopped by
+    /// a message on this channel, and with no home to index.
+    #[cfg(test)]
+    Simulation(std::sync::mpsc::Receiver<()>),
+}
+
+/// [`mount`], reaching Drive through `drive` and hosted by `host`; `client`
+/// serves only what [`DriveApi`] does not cover.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn mount_with(
+    client: ProtonDriveClient,
+    drive: Arc<dyn DriveApi>,
+    rt: tokio::runtime::Handle,
+    mountpoint: &Path,
+    cache: ContentCache,
+    control_socket: &Path,
+    db: Arc<Db>,
+    options: MountOptions,
+    host: Host,
 ) -> std::io::Result<MountOutcome> {
     let MountOptions {
         username,
         sweep_mode,
         upload_limit,
         download_limit,
+        local_first,
     } = options;
     // Start the uptime clock here rather than at the first `pdfs diagnostics`,
     // so the age it reports is the daemon's own.
     super::diagnostics::start_clock();
-    let (root, online) = fetch_or_recall_root(&client, &rt, &db)?;
+    let (root, start) = fetch_or_recall_root(drive.as_ref(), &rt, &db)?;
+    let online = start == Start::Online;
     let scope = root.tree_event_scope_id();
     db.mount_upsert_my_files(&mountpoint.to_string_lossy(), &root.uid.to_string(), None)
         .map_err(|error| std::io::Error::other(format!("project My Files mount: {error}")))?;
@@ -357,19 +436,21 @@ pub fn mount(
         .all_share_access()
         .map_err(|error| std::io::Error::other(format!("load shared access: {error}")))?;
 
-    // The folder-sync engine (devices.md Phase 2) runs on its own thread and is
+    // The folder-sync engine runs on its own thread and is
     // nudged over this channel; the sender lives in Core so control-socket
     // handlers can trigger reconciles.
     let (sync_tx, sync_rx) = std::sync::mpsc::channel::<sync::SyncMsg>();
 
     let paused_until = pause::load_paused_until(&db);
     let core = Core {
-        client: client.clone(),
+        drive,
+        client,
         rt: rt.clone(),
         maintenance: Arc::new(Mutex::new(Default::default())),
         primary_root_uid: root.uid.clone(),
         primary: true,
-        state: Arc::new(Mutex::new(State::new(db.clone(), share_access, 2))),
+        state: Arc::new(Mutex::new(State::new(db.clone(), share_access))),
+        root: Arc::new(OnceLock::new()),
         cache: Arc::new(cache),
         readers: Arc::new(Mutex::new(HashMap::new())),
         block_ring: Arc::new(Mutex::new(BlockRing::default())),
@@ -383,13 +464,19 @@ pub fn mount(
         shared_generation: Arc::new(AtomicU64::new(0)),
         shared_refresh_deadlines: Arc::new(Mutex::new(SharedRefreshDeadlines::default())),
         online: Arc::new(AtomicBool::new(online)),
+        link: Arc::new(link::Link::starting(start == Start::SessionExpired)),
         sync_paused_until: Arc::new(AtomicI64::new(paused_until)),
         pending: Arc::new(Mutex::new(HashMap::new())),
         hidden: Arc::new(Mutex::new(HashSet::new())),
+        creating: Arc::new(Mutex::new(HashMap::new())),
+        sealed_unread: Arc::new(Mutex::new(HashMap::new())),
+        landed: Arc::new(Mutex::new(HashMap::new())),
+        unadopted: Arc::new(Mutex::new(HashMap::new())),
         drain_wake: Arc::new((Mutex::new(false), Condvar::new())),
         shutdown: Arc::new(crate::shutdown::Shutdown::default()),
         upload_times: Arc::new(Mutex::new(HashMap::new())),
         upload_cancel: Arc::new(Mutex::new(HashMap::new())),
+        landing_uploads: Arc::new(AtomicU64::new(0)),
         timeline_refreshing: Arc::new(AtomicBool::new(false)),
         timeline_progress: Arc::new(Mutex::new(None)),
         similar_hashing: Arc::new(AtomicBool::new(false)),
@@ -398,7 +485,7 @@ pub fn mount(
         trash_progress: Arc::new(tokio::sync::Notify::new()),
         conflict_notified: Arc::new(Mutex::new(HashSet::new())),
         sweep_mode,
-        own_sealed_revs: Arc::new(Mutex::new(HashMap::new())),
+        local_first,
         self_changes: Arc::new(Mutex::new(HashMap::new())),
         thumb_gen: Arc::new(Mutex::new(HashSet::new())),
         thumb_gen_budget: Arc::new(tokio::sync::Semaphore::new(
@@ -411,6 +498,7 @@ pub fn mount(
         thumbnail_build_cancel: Arc::new(tokio::sync::Notify::new()),
         thumbnail_misses: Arc::new(Mutex::new(Default::default())),
         quota: Arc::new(Mutex::new(None)),
+        quota_refreshing: Arc::new(AtomicBool::new(false)),
         size_upgrades: Arc::new(Mutex::new(HashMap::new())),
         size_waiters: Arc::new(Default::default()),
         notifier: Arc::new(OnceLock::new()),
@@ -422,10 +510,11 @@ pub fn mount(
         sync_tx,
         mounts: Arc::new(Mutex::new(SecondaryMountRegistry::default())),
         sync_locks: Arc::new(Mutex::new(HashMap::new())),
+        sync_unscanned: Arc::new(Mutex::new(HashMap::new())),
         states: Arc::new(StateRegistry::default()),
     };
     // Before anything can queue work against it: the drain thread below reaches
-    // every mount's inode space through this registry, not through `core.state`.
+    // every mount's session through this registry.
     core.register_state(mountpoint);
     core.transfers.set_limits(upload_limit, download_limit);
 
@@ -448,7 +537,7 @@ pub fn mount(
     // Every long-lived thread started from here on is kept in `workers` and
     // joined at the end of this function. Leaving them running turned an
     // in-process remount into a second generation of drain workers, sync engines
-    // and sweeps all operating on a mount that no longer exists (bugs.md B44).
+    // and sweeps all operating on a mount that no longer exists (`docs/BUGS.md` B44).
     let mut workers: Vec<std::thread::JoinHandle<()>> = Vec::new();
     for worker in 0..DRAIN_WORKERS {
         let core = core.clone();
@@ -484,9 +573,10 @@ pub fn mount(
         );
     }
 
-    // Mounted from the cache: watch for the network coming back so the mount can
-    // stop being read-only-ish without the user restarting the daemon.
-    if !online {
+    // Watch the link for the life of the mount: a mount from the cache waits for
+    // the network to come back, and an online one can lose it at any moment and
+    // must notice it coming back just the same.
+    {
         let core = core.clone();
         workers.push(
             std::thread::Builder::new()
@@ -497,7 +587,7 @@ pub fn mount(
 
     // Keep the launcher prompt's "This computer" index fresh. Its own thread:
     // the walk is I/O-heavy and must never sit in front of a FUSE callback.
-    {
+    if matches!(host, Host::Daemon) {
         let db = core.db.clone();
         let indexing = core.indexing.clone();
         let transfers = core.transfers.clone();
@@ -621,11 +711,13 @@ pub fn mount(
             }
         }
     };
-    rt.spawn(run_event_sync(client, scope, core.clone()));
+    rt.spawn(run_event_sync(core.drive.clone(), scope, core.clone()));
     // The photos volume has its own event stream; without it the gallery only
     // learns about a phone-side deletion when the timeline goes stale.
     rt.spawn(run_photos_event_sync(core.clone()));
-    if online {
+    // Not in a simulation: `client` there reaches no API, and the thread, still
+    // waiting on it after the stop, held the database a test opens next.
+    if online && matches!(host, Host::Daemon) {
         let repair_core = core.clone();
         let root_uid = core.primary_root_uid.clone();
         if let Err(error) = std::thread::Builder::new()
@@ -640,6 +732,82 @@ pub fn mount(
     // are delivered onto the async runtime; bridge them onto a sync channel so
     // the loop below can react without blocking a worker thread. A bounded
     // channel of 1 is enough — we only need to know that *a* stop arrived.
+    let sig_rx = match host {
+        Host::Daemon => signal_stop(&rt),
+        #[cfg(test)]
+        Host::Simulation(rx) => rx,
+    };
+
+    // Wait for whichever happens first: a stop signal (→ we unmount ourselves
+    // via the lazy MNT_DETACH path, clean even mid-download), or the kernel
+    // mount ending on its own (→ the session thread finishes). Poll instead of
+    // blocking on `join` so we can also notice the signal.
+    let outcome = loop {
+        match sig_rx.recv_timeout(Duration::from_millis(500)) {
+            Ok(()) => {
+                info!("stop requested; unmounting");
+                core.mounts.lock().close();
+                if let Err(e) = teardown_session(&core.session_live, || {
+                    umount_session_unblocked(bg, main_conn)
+                }) {
+                    warn!(error = %e, "umount_and_join failed");
+                }
+                break MountOutcome::Shutdown;
+            }
+            Err(std::sync::mpsc::RecvTimeoutError::Timeout)
+                if core.link.resume_stored.load(Ordering::Relaxed) =>
+            {
+                info!("unmounting to resume the stored session");
+                core.mounts.lock().close();
+                if let Err(e) = teardown_session(&core.session_live, || {
+                    umount_session_unblocked(bg, main_conn)
+                }) {
+                    warn!(error = %e, "umount_and_join failed");
+                }
+                break MountOutcome::ResumeStored;
+            }
+            Err(std::sync::mpsc::RecvTimeoutError::Timeout) => {
+                if bg.guard.is_finished() {
+                    info!("mount ended externally");
+                    core.mounts.lock().close();
+                    if let Err(e) = teardown_session(&core.session_live, || bg.join()) {
+                        warn!(error = %e, "session join failed");
+                    }
+                    break MountOutcome::Unmounted;
+                }
+            }
+            Err(std::sync::mpsc::RecvTimeoutError::Disconnected) => {
+                // Signal task gone (failed to install); fall back to join.
+                core.mounts.lock().close();
+                let _ = teardown_session(&core.session_live, || bg.join());
+                break MountOutcome::Unmounted;
+            }
+        }
+    };
+
+    // Unmount every on-demand sync folder too, or the kernel mounts linger as
+    // stale and the next start fails with EBUSY.
+    if let Some(worker) = restore_worker
+        && worker.join().is_err()
+    {
+        warn!("on-demand restore worker panicked");
+    }
+    let secondaries = core.mounts.lock().close_and_drain();
+    for (id, mount) in secondaries {
+        if let Err(e) = mount.teardown() {
+            warn!(id, error = %e, "unmount on-demand folder failed");
+        }
+    }
+    core.queue_unreleased_writes();
+
+    // Last, because the workers may legitimately be finishing an upload, and
+    // nothing they can still do is harmful once the mounts are down.
+    stop_workers(&core, control_socket, workers);
+    Ok(outcome)
+}
+
+/// A channel that receives once SIGTERM or SIGINT arrives.
+fn signal_stop(rt: &tokio::runtime::Handle) -> std::sync::mpsc::Receiver<()> {
     let (sig_tx, sig_rx) = std::sync::mpsc::sync_channel::<()>(1);
     rt.spawn(async move {
         let mut sigterm =
@@ -664,65 +832,13 @@ pub fn mount(
         }
         let _ = sig_tx.try_send(());
     });
-
-    // Wait for whichever happens first: a stop signal (→ we unmount ourselves
-    // via the lazy MNT_DETACH path, clean even mid-download), or the kernel
-    // mount ending on its own (→ the session thread finishes). Poll instead of
-    // blocking on `join` so we can also notice the signal.
-    let outcome = loop {
-        match sig_rx.recv_timeout(Duration::from_millis(500)) {
-            Ok(()) => {
-                info!("stop requested; unmounting");
-                core.mounts.lock().close();
-                if let Err(e) = teardown_session(&core.session_live, || {
-                    umount_session_unblocked(bg, main_conn)
-                }) {
-                    warn!(error = %e, "umount_and_join failed");
-                }
-                break MountOutcome::Shutdown;
-            }
-            Err(std::sync::mpsc::RecvTimeoutError::Timeout) => {
-                if bg.guard.is_finished() {
-                    info!("mount ended externally");
-                    core.mounts.lock().close();
-                    if let Err(e) = teardown_session(&core.session_live, || bg.join()) {
-                        warn!(error = %e, "session join failed");
-                    }
-                    break MountOutcome::Unmounted;
-                }
-            }
-            Err(std::sync::mpsc::RecvTimeoutError::Disconnected) => {
-                // Signal task gone (failed to install); fall back to join.
-                core.mounts.lock().close();
-                let _ = teardown_session(&core.session_live, || bg.join());
-                break MountOutcome::Unmounted;
-            }
-        }
-    };
-
-    // Unmount every on-demand sync folder too, or the kernel mounts linger as
-    // stale and the next start fails with EBUSY (devices.md Phase 3).
-    if let Some(worker) = restore_worker
-        && worker.join().is_err()
-    {
-        warn!("on-demand restore worker panicked");
-    }
-    let secondaries = core.mounts.lock().close_and_drain();
-    for (id, mount) in secondaries {
-        if let Err(e) = mount.teardown() {
-            warn!(id, error = %e, "unmount on-demand folder failed");
-        }
-    }
-
-    // Last, because the workers may legitimately be finishing an upload, and
-    // nothing they can still do is harmful once the mounts are down.
-    stop_workers(&core, control_socket, workers);
-    Ok(outcome)
+    sig_rx
 }
 
-/// How long teardown waits for the FUSE worker pool before proceeding without
-/// it. Long enough for an in-flight block to finish, short enough that
-/// `systemctl --user stop` still returns inside `TimeoutStopSec`.
+/// How long teardown waits for the background workers and then the FUSE worker
+/// pool before proceeding without them. Long enough for an in-flight block to
+/// finish, short enough that `systemctl --user stop` still returns inside
+/// `TimeoutStopSec`.
 const WORKER_JOIN_DEADLINE: Duration = Duration::from_secs(10);
 
 /// Signal every background loop, wake the ones that are blocked, and join them.
@@ -730,14 +846,15 @@ const WORKER_JOIN_DEADLINE: Duration = Duration::from_secs(10);
 /// The mount used to return with its drain workers, sync engine, sweep, online
 /// probe, indexer and control listener all still running on `Core` clones. The
 /// process usually exited straight afterwards and hid it; an in-process remount
-/// did not, and started a second full set on top of the first (bugs.md B44).
+/// did not, and started a second full set on top of the first (`docs/BUGS.md` B44).
 ///
 /// Two of the waits need waking rather than merely flagging: the drain workers
 /// block on their own condvar (`wake_drain`), and the control listener blocks
 /// inside `accept`, which only returns when a connection arrives — so it gets
 /// one, from us, after the flag is already set. A join that takes a while is
 /// expected and correct: a worker part-way through an upload finishes it rather
-/// than abandoning the user's bytes mid-flight.
+/// than abandoning the user's bytes mid-flight. Up to [`WORKER_JOIN_DEADLINE`]:
+/// past it, systemd kills the daemon anyway, and a queued op is sent again.
 fn stop_workers(core: &Core, control_socket: &Path, workers: Vec<std::thread::JoinHandle<()>>) {
     // Say so before the joins: a teardown that takes a while must not be read as
     // a missed watchdog ping and turned into a kill.
@@ -751,25 +868,71 @@ fn stop_workers(core: &Core, control_socket: &Path, workers: Vec<std::thread::Jo
     // unlink cannot put it back to sleep.
     let _ = std::os::unix::net::UnixStream::connect(control_socket);
     let _ = std::fs::remove_file(control_socket);
-    for worker in workers {
-        if worker.join().is_err() {
-            warn!("a background worker panicked before shutdown");
-        }
+    let deadline = Instant::now() + WORKER_JOIN_DEADLINE;
+    let running = join_until(workers, deadline);
+    if !running.is_empty() {
+        warn!(
+            running = running.join(","),
+            "background workers did not finish in time; shutting down around them"
+        );
     }
     // The FUSE worker pool last, and *before* the caller drops the tokio
     // runtime: a worker still inside a job when the runtime goes away panics on
     // its next timer with "A Tokio 1.x context was found, but it is being
     // shutdown" (seen 2026-09-18 09:58:35). Bounded, so a worker wedged on the
     // network cannot hold the stop the user asked for.
-    core.workers.stop_and_join(WORKER_JOIN_DEADLINE);
+    core.workers
+        .stop_and_join(deadline.saturating_duration_since(Instant::now()));
     debug!("background workers stopped");
 }
 
+/// Join `workers` until `deadline`, and name the ones still running then.
+///
+/// A stop used to wait for each one however long it took. The sync engine's
+/// mirror pass waits on Drive with no deadline, and a stop that waited for it
+/// was killed by systemd (`docs/BUGS.md` B165).
+fn join_until(workers: Vec<std::thread::JoinHandle<()>>, deadline: Instant) -> Vec<String> {
+    let mut running = Vec::new();
+    for worker in workers {
+        while !worker.is_finished() && Instant::now() < deadline {
+            std::thread::sleep(Duration::from_millis(10));
+        }
+        if !worker.is_finished() {
+            running.push(worker.thread().name().unwrap_or("unnamed").to_string());
+        } else if worker.join().is_err() {
+            warn!("a background worker panicked before shutdown");
+        }
+    }
+    running
+}
+
 #[cfg(test)]
 mod tests {
     use std::sync::atomic::{AtomicBool, Ordering};
+    use std::time::{Duration, Instant};
 
-    use super::{SecondaryInsertRejection, SecondaryMountRegistry, teardown_session};
+    use super::{SecondaryInsertRejection, SecondaryMountRegistry, join_until, teardown_session};
+
+    #[test]
+    fn a_stop_names_the_workers_still_running_at_its_deadline() {
+        let (release, wait) = std::sync::mpsc::channel::<()>();
+        let done = std::thread::Builder::new()
+            .name("done".into())
+            .spawn(|| {})
+            .unwrap();
+        let stuck = std::thread::Builder::new()
+            .name("stuck".into())
+            .spawn(move || {
+                let _ = wait.recv();
+            })
+            .unwrap();
+        let running = join_until(
+            vec![done, stuck],
+            Instant::now() + Duration::from_millis(100),
+        );
+        assert_eq!(running, ["stuck"]);
+        drop(release);
+    }
 
     #[test]
     fn session_is_unroutable_before_teardown_starts() {

crates/pdfs-fuse/src/photos.rs

@@ -1038,7 +1038,7 @@ impl Core {
         }
         let outcomes = self
             .rt
-            .block_on(self.client.trash_nodes(uids))
+            .block_on(self.drive.trash_nodes(uids))
             .map_err(|e| CoreError::from_api(&e, "trash"))?;
         let (trashed, failed) = pdfs_core::batch::split(outcomes);
 

crates/pdfs-fuse/src/profile.rs

@@ -1,5 +1,5 @@
 //! Reading and writing this machine's `profile.json` in its device root, and
-//! the restore that rebuilds a machine from one (features.md 5.2 and 5.3).
+//! the restore that rebuilds a machine from one.
 //!
 //! The document itself is defined in [`pdfs_core::profile`]; this is the half
 //! that talks to Drive. Saving is best-effort and never blocks a user action:
@@ -101,7 +101,7 @@ impl Core {
         match existing {
             Some(uid) => self
                 .rt
-                .block_on(self.client.upload_new_revision_from(
+                .block_on(self.drive.upload_new_revision_from(
                     &uid,
                     Cursor::new(bytes),
                     len,
@@ -112,7 +112,7 @@ impl Core {
                 .map_err(|e| CoreError::from_api(&e, "upload profile revision"))?,
             None => {
                 self.rt
-                    .block_on(self.client.upload_file_replacing_draft_from(
+                    .block_on(self.drive.upload_file_replacing_draft_from(
                         &dir_uid,
                         PROFILE_FILE_NAME,
                         "application/json",
@@ -182,14 +182,14 @@ impl Core {
     ) -> CoreResult<Option<NodeUid>> {
         let uids = self
             .rt
-            .block_on(self.client.enumerate_folder_children_node_uids(parent_uid))
+            .block_on(self.drive.enumerate_folder_children_node_uids(parent_uid))
             .map_err(|e| CoreError::from_api(&e, "list device root"))?;
         if uids.is_empty() {
             return Ok(None);
         }
         let nodes = self
             .rt
-            .block_on(self.client.enumerate_nodes(&uids))
+            .block_on(self.drive.enumerate_nodes(&uids))
             .map_err(|e| CoreError::from_api(&e, "resolve device root children"))?;
         Ok(nodes
             .into_iter()
@@ -210,7 +210,7 @@ impl Core {
         let uid = self
             .rt
             .block_on(
-                self.client
+                self.drive
                     .create_folder(root_uid, PROFILE_DIR_NAME, Some(now_secs())),
             )
             .map_err(|e| CoreError::from_api(&e, "create profile folder"))?;
@@ -241,12 +241,12 @@ impl Core {
         };
         let mut buf: Vec<u8> = Vec::new();
         self.rt
-            .block_on(self.client.download_file_to(&uid, &mut buf))
+            .block_on(self.drive.download_file_to(&uid, &mut buf))
             .map_err(|e| CoreError::from_api(&e, "download profile"))?;
         Profile::parse(&buf).map(Some).map_err(CoreError::invalid)
     }
 
-    // ---- restore (features.md 5.2) ----------------------------------------
+    // ---- restore ----------------------------------------
 
     /// The folders under a device that could be synced here, each carrying a
     /// proposed local path. `device` names another registered device by uid;
@@ -277,13 +277,13 @@ impl Core {
 
         let uids = self
             .rt
-            .block_on(self.client.enumerate_folder_children_node_uids(&root_uid))
+            .block_on(self.drive.enumerate_folder_children_node_uids(&root_uid))
             .map_err(|e| CoreError::from_api(&e, "list device root"))?;
         let nodes = if uids.is_empty() {
             Vec::new()
         } else {
             self.rt
-                .block_on(self.client.enumerate_nodes(&uids))
+                .block_on(self.drive.enumerate_nodes(&uids))
                 .map_err(|e| CoreError::from_api(&e, "resolve device root children"))?
         };
 

crates/pdfs-fuse/src/queue.rs

@@ -1,12 +1,16 @@
 //! The user's view of the pending-op queue: what has not reached the remote
 //! yet, why, and a way to stop waiting out a backoff.
 //!
-//! Read-only apart from "retry now", which only moves a row's next-attempt time.
-//! Nothing here drops a queued op: its staged blob is the only copy of the
-//! user's write (see `docs/RECOVERY.md`).
+//! Read-only apart from "retry now", which only moves a row's next-attempt time,
+//! "export", which copies a staged blob out, and "discard". Only a discard the
+//! user asks for drops a queued op: its staged blob is the only copy of the
+//! user's write (see `docs/RECOVERY.md`), so it is the user's call, made after
+//! an export or for a change with no content.
 
 use super::*;
-use pdfs_core::control::PendingOpInfo;
+use std::io::Write;
+
+use pdfs_core::control::{PendingOpInfo, SyncIssue};
 use pdfs_core::db::{FAILING_ATTEMPTS, PARK_UNTIL};
 
 impl Core {
@@ -16,10 +20,15 @@ impl Core {
             .db
             .pending_ops()
             .map_err(|e| CoreError::internal(format!("listing the queue: {e}")))?;
+        let issues = self
+            .db
+            .op_issues()
+            .map_err(|e| CoreError::internal(format!("listing sync issues: {e}")))?;
         Ok(ops
             .into_iter()
             .map(|op| {
                 let parked = op.next_attempt_at >= PARK_UNTIL;
+                let exportable = exportable(&op).is_some();
                 let path = self
                     .db
                     .node_path(&op.uid)
@@ -37,7 +46,9 @@ impl Core {
                     queued_at: op.created_at / 1000,
                     next_attempt_at: (!parked).then_some(op.next_attempt_at / 1000),
                     parked,
-                    failing: op.attempts >= FAILING_ATTEMPTS,
+                    failing: op.attempts >= FAILING_ATTEMPTS || issues.contains_key(&op.id),
+                    issue: issues.get(&op.id).map(|issue| SyncIssue::parse(issue)),
+                    exportable,
                 }
             })
             .collect())
@@ -57,4 +68,235 @@ impl Core {
         }
         Ok(moved)
     }
+
+    /// Copy the content of queued op `id` to `dest`, which must not exist yet.
+    /// The op stays queued. Returns the bytes written.
+    pub(crate) fn export_pending_op(&self, id: i64, dest: &Path) -> CoreResult<u64> {
+        if !dest.is_absolute() {
+            return Err(CoreError::invalid(format!(
+                "destination must be an absolute path: {}",
+                dest.display()
+            )));
+        }
+        let ops = self
+            .db
+            .pending_ops()
+            .map_err(|e| CoreError::internal(format!("listing the queue: {e}")))?;
+        let op = ops
+            .iter()
+            .find(|op| op.id == id)
+            .ok_or_else(|| CoreError::not_found(format!("no queued change {id}")))?;
+        let blob = exportable(op).ok_or_else(|| {
+            CoreError::invalid(format!("queued change {id} carries no file content"))
+        })?;
+        let written = copy_to_new_file(blob, dest)?;
+        info!(id, dest = %dest.display(), written, "exported a queued change's content");
+        Ok(written)
+    }
+
+    /// Drop queued op `id` and undo the local change it stood for. Returns the
+    /// node's path.
+    ///
+    /// A node only made here goes, as if it had been deleted before it was
+    /// sent. A node Drive has goes back to what Drive has: every change queued
+    /// on it goes, since each was made on top of the one before. What is queued
+    /// below it stays.
+    pub(crate) fn discard_pending_op(&self, id: i64) -> CoreResult<String> {
+        let ops = self
+            .db
+            .pending_ops()
+            .map_err(|e| CoreError::internal(format!("listing the queue: {e}")))?;
+        let op = ops
+            .into_iter()
+            .find(|op| op.id == id)
+            .ok_or_else(|| CoreError::not_found(format!("no queued change {id}")))?;
+        let uid = parse_node_uid(&op.uid)
+            .ok_or_else(|| CoreError::internal(format!("queued change {id} names {}", op.uid)))?;
+        let path = self
+            .db
+            .node_path(&op.uid)
+            .ok()
+            .flatten()
+            .filter(|path| !path.is_empty())
+            .or(op.name)
+            .unwrap_or_else(|| op.uid.clone());
+        if self.is_open_anywhere(&uid) {
+            return Err(CoreError::conflict(format!(
+                "{path} is open; close it first"
+            )));
+        }
+        if is_local_uid(&uid) {
+            self.discard_local_node(&uid, &path)?;
+        } else {
+            self.discard_remote_change(&uid, &path)?;
+        }
+        info!(id, %uid, path, "discarded a queued change");
+        Ok(path)
+    }
+
+    /// Forget a node made here, and the ops that would have sent it.
+    fn discard_local_node(&self, uid: &NodeUid, path: &str) -> CoreResult<()> {
+        // Its children's ops go with its own, and their content with them.
+        if self
+            .db
+            .has_children(uid)
+            .map_err(|e| CoreError::internal(format!("listing {path}: {e}")))?
+        {
+            return Err(CoreError::conflict(format!(
+                "{path} is not empty; discard what is in it first"
+            )));
+        }
+        self.discard_queued_ops(uid)
+            .map_err(|_| CoreError::internal(format!("dropping the changes to {path}")))?;
+        self.for_each_mount(|st, notify| {
+            background::forget_and_notify(st, notify, uid);
+        });
+        self.cache.evict(uid);
+        self.evict_reader(uid);
+        Ok(())
+    }
+
+    /// Put a node Drive has back as Drive has it.
+    fn discard_remote_change(&self, uid: &NodeUid, path: &str) -> CoreResult<()> {
+        // Asked first: the change is only dropped once what replaces it is known.
+        let node = self
+            .fetch_node_remote(uid)
+            .map_err(|e| CoreError::from_api(&e, "reading the node from Drive"))?
+            .filter(|node| !node.trashed);
+        self.cancel_upload(uid);
+        let blobs = self
+            .db
+            .discard_ops_on_node(&uid.to_string())
+            .map_err(|e| CoreError::internal(format!("dropping the changes to {path}: {e}")))?
+            .ok_or_else(|| {
+                CoreError::conflict(format!("{path} is being sent right now; try again"))
+            })?;
+        self.release_dropped_ops(uid, blobs);
+        self.hidden.lock().remove(uid);
+        match node {
+            Some(node) => self.for_each_mount(|st, notify| {
+                put_back(st, notify, node);
+            }),
+            None => self.for_each_mount(|st, notify| {
+                background::forget_and_notify(st, notify, uid);
+            }),
+        }
+        self.cache.evict(uid);
+        self.evict_reader(uid);
+        Ok(())
+    }
+}
+
+/// Show `node` as Drive has it, where Drive has it, under the inode it has.
+fn put_back(st: &mut State, notify: &mut NotifyBatch, node: Node) {
+    let parent = node.parent_uid.as_ref().and_then(|parent| {
+        st.by_uid
+            .get(parent)
+            .copied()
+            .map(|ino| (ino, parent.clone()))
+    });
+    let here = st.by_uid.get(&node.uid).and_then(|ino| {
+        st.entries
+            .get(ino)
+            .map(|entry| (*ino, entry.parent, entry.node.name.clone()))
+    });
+    match (here, parent) {
+        (Some((ino, from, name)), Some((to, to_uid))) => {
+            st.relocate(ino, from, to, &to_uid, &node.name);
+            st.write_through(node.clone());
+            st.intern_mem(to, node);
+            notify.inval_entry(from, name);
+            notify.inval_inode(ino);
+        }
+        (here, parent) => {
+            if let Some((_, from, name)) = here {
+                st.forget_mem(&node.uid);
+                st.invalidate_listing(from);
+                notify.inval_entry(from, name);
+            }
+            if let Some((to, _)) = parent {
+                st.invalidate_listing(to);
+                notify.inval_entry(to, node.name.clone());
+            }
+            st.write_through(node);
+        }
+    }
+}
+
+/// Copy `blob` to `dest`, which must not exist: never replace something the
+/// user already has.
+fn copy_to_new_file(blob: &Path, dest: &Path) -> CoreResult<u64> {
+    let mut source = File::open(blob)
+        .map_err(|e| CoreError::internal(format!("open {}: {e}", blob.display())))?;
+    let mut out = std::fs::OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .open(dest)
+        .map_err(|e| match e.kind() {
+            std::io::ErrorKind::AlreadyExists => {
+                CoreError::invalid(format!("{} already exists", dest.display()))
+            }
+            _ => CoreError::internal(format!("create {}: {e}", dest.display())),
+        })?;
+    std::io::copy(&mut source, &mut out)
+        .and_then(|written| out.flush().and(out.sync_all()).map(|()| written))
+        .map_err(|e| CoreError::internal(format!("write {}: {e}", dest.display())))
+}
+
+/// The staged blob of an op that carries file content.
+fn exportable(op: &PendingOp) -> Option<&Path> {
+    matches!(op.kind.as_str(), OP_CREATE | OP_REVISION)
+        .then_some(op.blob_path.as_deref())
+        .flatten()
+        .map(Path::new)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn op(kind: &str, blob: Option<&str>) -> PendingOp {
+        PendingOp {
+            id: 1,
+            kind: kind.to_string(),
+            uid: "vol~a".to_string(),
+            parent_uid: None,
+            name: None,
+            blob_path: blob.map(str::to_string),
+            meta_json: None,
+            created_at: 0,
+            attempts: 0,
+            last_error: None,
+            next_attempt_at: 0,
+        }
+    }
+
+    #[test]
+    fn only_a_change_that_carries_file_content_can_be_exported() {
+        assert!(exportable(&op(OP_CREATE, Some("/staging/a"))).is_some());
+        assert!(exportable(&op(OP_REVISION, Some("/staging/a"))).is_some());
+        assert!(exportable(&op(OP_CREATE, None)).is_none());
+        assert!(exportable(&op(OP_RENAME, None)).is_none());
+        assert!(exportable(&op(OP_TRASH, None)).is_none());
+    }
+
+    #[test]
+    fn an_export_copies_the_bytes_and_never_replaces_a_file() {
+        let dir = std::env::temp_dir().join(format!("pdfs-export-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let blob = dir.join("blob");
+        std::fs::write(&blob, b"queued bytes").unwrap();
+
+        let dest = dir.join("copy.txt");
+        assert_eq!(copy_to_new_file(&blob, &dest).unwrap(), 12);
+        assert_eq!(std::fs::read(&dest).unwrap(), b"queued bytes");
+
+        std::fs::write(&dest, b"the user's own").unwrap();
+        assert!(copy_to_new_file(&blob, &dest).is_err());
+        assert_eq!(std::fs::read(&dest).unwrap(), b"the user's own");
+        // The staged blob is the only copy of the change: an export leaves it.
+        assert_eq!(std::fs::read(&blob).unwrap(), b"queued bytes");
+
+        let _ = std::fs::remove_dir_all(&dir);
+    }
 }

crates/pdfs-fuse/src/reads.rs

@@ -36,6 +36,21 @@ pub(super) const REPAIR_MAX: u64 = 512 * 1024 * 1024;
 /// demand read in the SDK's flat block semaphore.
 pub(super) const PREFETCH_BUDGET: usize = 8;
 
+/// How long one read may wait on the network before it fails with `EIO`.
+///
+/// The SDK bounds each request, not a read: a block that times out is retried,
+/// and a read can need several blocks, a block table and a repair. On a link
+/// that stalled without dropping, one `read` held a FUSE worker for 34 minutes
+/// and the application behind it with it (`docs/BUGS.md` B107). An error the
+/// caller can retry beats a process stuck in `D` state.
+pub(super) const READ_FETCH_TIMEOUT: Duration = Duration::from_secs(120);
+
+/// How long a read of blocks nothing has cached waits for a lost link to come
+/// back before failing. Long enough to ride out a Wi-Fi blip, short enough
+/// that a program reading while the laptop is really offline gets its `EIO`
+/// before the user gives up on it.
+const READ_OFFLINE_WAIT: Duration = Duration::from_secs(30);
+
 /// Cap on tracked sequential streams. Only reads in progress matter, so the map
 /// is cleared wholesale rather than aged — losing the ramp costs one read.
 const MAX_PREFETCH_STREAMS: usize = 256;
@@ -55,7 +70,7 @@ const MAX_OPEN_READERS: usize = 64;
 /// `(mtime, size)` — the same validity pair the content cache uses (a new
 /// revision bumps mtime). On a mismatch the reader is dropped and reopened.
 pub(super) struct CachedReader {
-    reader: Arc<RevisionReader>,
+    reader: Arc<dyn RevisionRead>,
     mtime: i64,
     size: u64,
     /// For LRU eviction.
@@ -86,7 +101,7 @@ pub(super) struct PendingOpen {
     /// must not join this open — it would get a reader for the wrong bytes.
     mtime: i64,
     size: u64,
-    rx: tokio::sync::watch::Receiver<Option<Result<Arc<RevisionReader>, Errno>>>,
+    rx: tokio::sync::watch::Receiver<Option<Result<Arc<dyn RevisionRead>, Errno>>>,
 }
 
 /// Distinguishes `PendingOpen`s. Only uniqueness matters, so a plain counter
@@ -298,16 +313,16 @@ impl Core {
         uid: &NodeUid,
         mtime: i64,
         fsize: u64,
-    ) -> Result<Arc<RevisionReader>, Errno> {
+    ) -> Result<Arc<dyn RevisionRead>, Errno> {
         loop {
             // Decide under the lock, act outside it — network I/O must never run
             // under a std `Mutex`, and an await must never hold one.
             enum Act {
-                Hit(Arc<RevisionReader>),
-                Join(tokio::sync::watch::Receiver<Option<Result<Arc<RevisionReader>, Errno>>>),
+                Hit(Arc<dyn RevisionRead>),
+                Join(tokio::sync::watch::Receiver<Option<Result<Arc<dyn RevisionRead>, Errno>>>),
                 Lead(
                     u64,
-                    tokio::sync::watch::Sender<Option<Result<Arc<RevisionReader>, Errno>>>,
+                    tokio::sync::watch::Sender<Option<Result<Arc<dyn RevisionRead>, Errno>>>,
                 ),
             }
             let act = {
@@ -361,9 +376,10 @@ impl Core {
                 }
                 Act::Lead(id, tx) => {
                     debug!(%uid, mtime, fsize, "opening revision");
-                    let result = match self.client.open_revision(uid).await {
-                        Ok(reader) => Ok(Arc::new(reader)),
+                    let result = match self.drive.open_revision(uid).await {
+                        Ok(reader) => Ok(reader),
                         Err(e) => {
+                            self.lost_link(&e, "open a revision");
                             warn!(%uid, error = %e, "open_revision failed");
                             Err(Errno::EIO)
                         }
@@ -448,7 +464,7 @@ impl Core {
     /// it, and the [`BLOCK_SIZE`] assumption when it has not — which is every
     /// first read, because learning it means opening a `RevisionReader`, and
     /// opening one per read is precisely the per-file key derivation the block
-    /// cache exists to avoid (bugs.md B12, B85).
+    /// cache exists to avoid (`docs/BUGS.md` B12, B85).
     ///
     /// Being wrong here is not a correctness problem: `read_at` plans over the
     /// real sizes and clamps to what was asked for either way. It costs a
@@ -477,15 +493,20 @@ impl Core {
     ) -> Result<Vec<u8>, Errno> {
         // A queued write has not reached the remote yet, so the remote's current
         // revision is stale and the staged blob is the truth. Serve from it until
-        // the drain worker lands the upload (offline.md Phase 3).
+        // the drain worker lands the upload.
         if let Some(pending) = self.pending.lock().get(uid).cloned() {
             return self.read_pending(&pending, offset, len);
         }
         // A node created offline and never written has no blob and no remote: it
         // is an empty file, and asking the API about a `local~` uid would only
-        // earn a 404 (offline.md Phase 3b).
+        // earn a 404. Unless its create landed since the
+        // read looked: the landing moved the queued write to the uid Drive
+        // gave it, and the row says which (`docs/BUGS.md` B179).
         if is_local_uid(uid) {
-            return Ok(Vec::new());
+            return match self.landed_stand_in_uid(uid) {
+                Some(real) => self.read_range(&real, mtime, fsize, offset, len, cache_blocks),
+                None => Ok(Vec::new()),
+            };
         }
         self.read_range_remote(uid, mtime, fsize, offset, len, cache_blocks)
     }
@@ -552,7 +573,7 @@ impl Core {
     /// leader's claim is gone by then, so this cannot recurse.
     async fn fetch_block(
         &self,
-        reader: &Arc<RevisionReader>,
+        reader: &Arc<dyn RevisionRead>,
         uid: &NodeUid,
         mtime: i64,
         fsize: u64,
@@ -615,10 +636,10 @@ impl Core {
     ///
     /// A block that comes back shorter than the file's size says it must be is
     /// never served, cached or promoted: it is repaired from the whole-file
-    /// download, or the read fails. See [`Core::repair_block`] (bugs.md B84).
+    /// download, or the read fails. See [`Core::repair_block`] (`docs/BUGS.md` B84).
     async fn read_block(
         &self,
-        reader: &Arc<RevisionReader>,
+        reader: &Arc<dyn RevisionRead>,
         uid: &NodeUid,
         mtime: i64,
         fsize: u64,
@@ -630,7 +651,7 @@ impl Core {
         // file's boundaries are wrong, and the failure is not confined to short
         // reads: sizes that *overstate* a block shift every block after it and
         // return full-length reads of the wrong bytes. So a disagreement of any
-        // kind takes the file off the range path entirely (bugs.md B84).
+        // kind takes the file off the range path entirely (`docs/BUGS.md` B84).
         let bytes = if reader.size() != fsize {
             warn!(
                 %uid, bidx = span.idx, fsize,
@@ -643,12 +664,13 @@ impl Core {
             // Learned here rather than on a path of its own: this is where a
             // reader is open anyway, and recording the real geometry is what
             // lets the *next* read plan its blocks on the revision's own
-            // boundaries instead of the 4 MiB fallback (bugs.md B85).
+            // boundaries instead of the 4 MiB fallback (`docs/BUGS.md` B85).
             if cache_blocks {
                 self.cache
                     .store_block_geometry(uid, mtime, fsize, reader.block_sizes());
             }
             let bytes = reader.read_at(span.start, span.len).await.map_err(|e| {
+                self.lost_link(&e, "read a block");
                 warn!(%uid, start = span.start, len = span.len, error = %e, "block read failed");
                 Errno::EIO
             })?;
@@ -684,7 +706,7 @@ impl Core {
     /// The range path derives every block boundary from the revision's recorded
     /// block sizes. When those understate the file, reads come back short with
     /// no error anywhere, and the caller hands userspace a truncated file that
-    /// looks like a clean EOF (bugs.md B84). `download_file_to` does not do that
+    /// looks like a clean EOF (`docs/BUGS.md` B84). `download_file_to` does not do that
     /// arithmetic — it streams the block list — so it returns the whole file
     /// where the range path cannot, which is why pinning was the workaround.
     /// This does the same thing on the user's behalf, once, and the resulting
@@ -761,7 +783,7 @@ impl Core {
             error!(%uid, %error, "creating a scratch file for a repair download failed");
             Errno::EIO
         })?;
-        let outcome = self.client.download_file_to(uid, &mut file).await;
+        let outcome = self.drive.download_file_to(uid, &mut file).await;
         let stored = (|| {
             outcome.map_err(|error| {
                 warn!(%uid, %error, "repair download failed");
@@ -896,7 +918,7 @@ impl Core {
         let end = offset.saturating_add(len).min(fsize);
         let mut out = Vec::with_capacity((end - offset) as usize);
         // On the revision's own boundaries where they are known, and on the
-        // 4 MiB fallback where they are not (bugs.md B85).
+        // 4 MiB fallback where they are not (`docs/BUGS.md` B85).
         let wanted = self.block_geometry(uid, mtime, fsize).spans(offset, end);
         let (Some(&head), Some(&tail)) = (wanted.first(), wanted.last()) else {
             return Ok(out);
@@ -939,28 +961,67 @@ impl Core {
         }
 
         if !misses.is_empty() {
-            let fetched = self.rt.block_on(async {
-                // Resolve the file's keys and block table once, then read every
-                // missing block through the shared reader. Previously each block
-                // called `download_range`, which redid that resolution per block.
-                let reader = self.revision_reader(uid, mtime, fsize).await?;
+            // One deadline for the whole read, including any wait for a lost
+            // link. A fetch that failed because the link went down is tried
+            // once more when it is back, so a blip is a slow read, not an `EIO`.
+            let deadline = Instant::now() + READ_FETCH_TIMEOUT;
+            let mut retried = false;
+            let fetched = loop {
+                if !self.is_online() {
+                    let wait =
+                        READ_OFFLINE_WAIT.min(deadline.saturating_duration_since(Instant::now()));
+                    if !self.wait_online(wait) {
+                        debug!(%uid, offset, len, "read of uncached blocks while offline; failing it");
+                        return Err(Errno::EIO);
+                    }
+                }
+                let fetch = async {
+                    // Resolve the file's keys and block table once, then read every
+                    // missing block through the shared reader. Previously each block
+                    // called `download_range`, which redid that resolution per block.
+                    let reader = self.revision_reader(uid, mtime, fsize).await?;
 
-                let mut set = tokio::task::JoinSet::new();
-                for &span in &misses {
-                    let (core, reader, uid) = (self.clone(), reader.clone(), uid.clone());
-                    set.spawn(async move {
-                        core.fetch_block(&reader, &uid, mtime, fsize, span, cache_blocks)
-                            .await
-                            .map(|bytes| (span.idx, bytes))
-                    });
+                    let mut set = tokio::task::JoinSet::new();
+                    for &span in &misses {
+                        let (core, reader, uid) = (self.clone(), reader.clone(), uid.clone());
+                        set.spawn(async move {
+                            core.fetch_block(&reader, &uid, mtime, fsize, span, cache_blocks)
+                                .await
+                                .map(|bytes| (span.idx, bytes))
+                        });
+                    }
+                    let mut out = Vec::with_capacity(misses.len());
+                    while let Some(joined) = set.join_next().await {
+                        // A join error means the task panicked; surface it as EIO.
+                        out.push(joined.map_err(|_| Errno::EIO)??);
+                    }
+                    Ok::<_, Errno>(out)
+                };
+                // Dropping the fetch on the deadline aborts the block tasks with
+                // it; blocks that already landed stay cached for the retry. The
+                // timer is built inside the runtime: a FUSE worker has no reactor
+                // of its own, and building it out here panicked every remote read.
+                let budget = deadline.saturating_duration_since(Instant::now());
+                match self
+                    .rt
+                    .block_on(async { tokio::time::timeout(budget, fetch).await })
+                {
+                    Ok(Ok(fetched)) => break fetched,
+                    // The fetch saw the link go down; the top of the loop waits
+                    // for it within what is left of the deadline.
+                    Ok(Err(_)) if !retried && !self.is_online() => retried = true,
+                    Ok(Err(e)) => return Err(e),
+                    Err(_) => {
+                        warn!(
+                            %uid, offset, len, secs = READ_FETCH_TIMEOUT.as_secs(),
+                            "read got no answer from the network in time; failing it"
+                        );
+                        self.evict_reader(uid);
+                        self.mark_offline("read", &crate::link::no_answer(READ_FETCH_TIMEOUT));
+                        return Err(Errno::EIO);
+                    }
                 }
-                let mut out = Vec::with_capacity(misses.len());
-                while let Some(joined) = set.join_next().await {
-                    // A join error means the task panicked; surface it as EIO.
-                    out.push(joined.map_err(|_| Errno::EIO)??);
-                }
-                Ok::<_, Errno>(out)
-            })?;
+            };
             for (bidx, bytes) in fetched {
                 blocks[(bidx - first) as usize] = Some(bytes);
             }
@@ -977,7 +1038,7 @@ impl Core {
             // — the cache validates it on read, the network path in `read_block`
             // — so this refuses rather than quietly contributing fewer bytes
             // than the range covers, which is what turned a bad block into a
-            // truncated file (bugs.md B84).
+            // truncated file (`docs/BUGS.md` B84).
             if block.len() as u64 != span.len {
                 error!(
                     %uid, bidx = span.idx, len = block.len(), expected = span.len, fsize,

crates/pdfs-fuse/src/redate.rs

@@ -248,10 +248,7 @@ impl Core {
 
         let outcomes = self
             .rt
-            .block_on(
-                self.client
-                    .trash_nodes(std::slice::from_ref(&candidate.uid)),
-            )
+            .block_on(self.drive.trash_nodes(std::slice::from_ref(&candidate.uid)))
             .map_err(|e| CoreError::from_api(&e, "trash the mis-dated original"))?;
         if let Some((_, Err(e))) = outcomes.into_iter().next() {
             return Err(CoreError::from_api(&e, "trash the mis-dated original"));

crates/pdfs-fuse/src/relocate.rs

@@ -0,0 +1,611 @@
+//! Moving a file or folder between two locations without moving its content.
+//!
+//! `~/ProtonDrive` and every on-demand synced folder are separate FUSE
+//! sessions, and a mirror folder is a plain local directory. The kernel refuses
+//! `rename(2)` between two mounts with `EXDEV` before the daemon hears of it, so
+//! `mv` falls back to copy and delete: every file is downloaded, uploaded again,
+//! and the original is trashed.
+//!
+//! On Proton Drive the same move is one metadata change, because My files and
+//! this computer's device folders all live on the main volume. So a move
+//! request that names two absolute paths is resolved here, against every
+//! location this daemon knows, and done as a server-side move. The local side
+//! is then brought level: a mount forgets the node and re-lists, and a mirror
+//! folder either renames its copy along or drops it once Drive has it.
+
+use std::collections::HashMap;
+use std::path::{Component, Path, PathBuf};
+use std::sync::Arc;
+use std::time::Duration;
+
+use parking_lot::Mutex;
+use pdfs_core::db::{StoredSyncEntry, StoredSyncFolder};
+use pdfs_core::{CoreError, CoreResult};
+use proton_drive_rs::NodeKind;
+use proton_drive_rs::proton_sdk::ids::NodeUid;
+use tracing::{info, warn};
+
+use super::sync::mirror_subtree_unsynced;
+use super::{Core, is_local_uid, parse_uid};
+
+/// How long a move waits for a mirror folder's sync pass to finish before it
+/// reports the folder busy. A pass can run for hours on a first sync, so the
+/// move does not wait it out.
+const MIRROR_LOCK_WAIT: Duration = Duration::from_secs(5);
+
+/// Where one side of a move lives.
+enum Place {
+    /// My files or an on-demand folder: a live FUSE mount. `core` is rooted at
+    /// that mount and `rel` is relative to its mountpoint.
+    Mounted { core: Box<Core>, rel: PathBuf },
+    /// A mirror folder: a local directory kept in step by the sync engine.
+    /// `rel` is `/`-separated, relative to the folder, as the baseline keys it.
+    Mirror {
+        folder: StoredSyncFolder,
+        rel: String,
+    },
+}
+
+impl Place {
+    fn mirror_id(&self) -> Option<i64> {
+        match self {
+            Place::Mirror { folder, .. } => Some(folder.id),
+            Place::Mounted { .. } => None,
+        }
+    }
+
+    fn is_root(&self) -> bool {
+        match self {
+            Place::Mounted { rel, .. } => rel.as_os_str().is_empty(),
+            Place::Mirror { rel, .. } => rel.is_empty(),
+        }
+    }
+}
+
+/// The mirror folder that holds `abs`, and `abs` relative to it. The deepest
+/// folder wins, although folders are not expected to nest.
+fn mirror_covering(
+    folders: Vec<StoredSyncFolder>,
+    abs: &Path,
+) -> Option<(StoredSyncFolder, String)> {
+    let folder = folders
+        .into_iter()
+        .filter(|f| f.mode == "mirror" && abs.starts_with(&f.local_path))
+        .max_by_key(|f| Path::new(&f.local_path).components().count())?;
+    let rel = abs.strip_prefix(&folder.local_path).ok()?;
+    let parts = rel
+        .components()
+        .map(|c| match c {
+            Component::Normal(part) => part.to_str(),
+            _ => None,
+        })
+        .collect::<Option<Vec<_>>>()?;
+    Some((folder, parts.join("/")))
+}
+
+/// `name` inside the folder at `parent`, in baseline form.
+fn join_rel(parent: &str, name: &str) -> String {
+    if parent.is_empty() {
+        name.to_string()
+    } else {
+        format!("{parent}/{name}")
+    }
+}
+
+/// Rename `from` to `to`, failing with `EEXIST` rather than replacing
+/// whatever appeared at `to` since it was checked. A filesystem that cannot
+/// promise that gets a plain rename after one more look.
+fn rename_noreplace(from: &Path, to: &Path) -> std::io::Result<()> {
+    use std::ffi::CString;
+    use std::os::unix::ffi::OsStrExt;
+
+    let cstr = |p: &Path| {
+        CString::new(p.as_os_str().as_bytes())
+            .map_err(|_| std::io::Error::from_raw_os_error(libc::EINVAL))
+    };
+    let (c_from, c_to) = (cstr(from)?, cstr(to)?);
+    // SAFETY: both are valid NUL-terminated paths that outlive the call.
+    let rc = unsafe {
+        libc::syscall(
+            libc::SYS_renameat2,
+            libc::AT_FDCWD,
+            c_from.as_ptr(),
+            libc::AT_FDCWD,
+            c_to.as_ptr(),
+            libc::RENAME_NOREPLACE,
+        )
+    };
+    if rc == 0 {
+        return Ok(());
+    }
+    let err = std::io::Error::last_os_error();
+    match err.raw_os_error() {
+        Some(libc::EINVAL | libc::ENOSYS) => {
+            if std::fs::symlink_metadata(to).is_ok() {
+                return Err(std::io::Error::from_raw_os_error(libc::EEXIST));
+            }
+            std::fs::rename(from, to)
+        }
+        _ => Err(err),
+    }
+}
+
+/// Whether `uid` is `root` or lies under it, as far as the nodes table knows.
+fn under(core: &Core, root: &NodeUid, uid: &str) -> bool {
+    let root = root.to_string();
+    uid == root || matches!(core.db.path_relative_to(&root, uid), Ok(Some(_)))
+}
+
+impl Core {
+    /// Move the file or folder at `src` into the folder at `dest_parent`. Both
+    /// are absolute local paths and may be in different locations: My files,
+    /// an on-demand folder, or a mirror folder. Returns the moved name.
+    ///
+    /// Within one mount this is [`Core::move_to`]. Across locations it
+    /// is a server-side move followed by local bookkeeping; see the module
+    /// documentation. Anything the move could lose is refused up front.
+    pub(crate) fn move_between(&self, src: &Path, dest_parent: &Path) -> CoreResult<String> {
+        let source = self.locate(src)?;
+        let dest = self.locate(dest_parent)?;
+        if let (
+            Place::Mounted { core, rel },
+            Place::Mounted {
+                core: dest_core,
+                rel: dest_rel,
+            },
+        ) = (&source, &dest)
+            && Arc::ptr_eq(&core.root, &dest_core.root)
+        {
+            return core.move_to(rel, dest_rel);
+        }
+        if source.is_root() {
+            return Err(CoreError::invalid(format!(
+                "{} is the root of a synced location and cannot be moved",
+                src.display()
+            )));
+        }
+        if dest_parent.starts_with(src) {
+            return Err(CoreError::invalid("cannot move a folder into itself"));
+        }
+        let name = src
+            .file_name()
+            .and_then(|n| n.to_str())
+            .ok_or_else(|| CoreError::invalid(format!("{} has no usable name", src.display())))?
+            .to_string();
+
+        // Hold every mirror folder involved, lowest id first, so no sync pass
+        // sees the move half done and two moves cannot deadlock.
+        let mut ids: Vec<i64> = [source.mirror_id(), dest.mirror_id()]
+            .into_iter()
+            .flatten()
+            .collect();
+        ids.sort_unstable();
+        ids.dedup();
+        let locks: Vec<Arc<Mutex<()>>> = ids.iter().map(|&id| self.sync_lock(id)).collect();
+        let mut guards = Vec::with_capacity(locks.len());
+        for lock in &locks {
+            guards.push(lock.try_lock_for(MIRROR_LOCK_WAIT).ok_or_else(|| {
+                CoreError::conflict("a synced folder is busy syncing; try again when it is done")
+            })?);
+        }
+
+        let mut baselines: HashMap<i64, HashMap<String, StoredSyncEntry>> = HashMap::new();
+        for &id in &ids {
+            let baseline = self
+                .db
+                .sync_entries(id)
+                .map_err(|e| CoreError::internal(format!("db: {e}")))?;
+            baselines.insert(id, baseline);
+        }
+
+        let src_uid = self.source_uid(&source, &baselines)?;
+        let dest_uid = self.dest_uid(&dest, &baselines, &name)?;
+        if src_uid.volume_id != dest_uid.volume_id {
+            return Err(CoreError::invalid(
+                "the two locations are on different Proton Drive volumes; copy it instead",
+            ));
+        }
+        if under(self, &src_uid, &dest_uid.to_string()) {
+            return Err(CoreError::invalid("cannot move a folder into itself"));
+        }
+
+        // Mirror to mirror renames the local copy along, so it needs nothing
+        // proven about it. Another filesystem makes that impossible, and the
+        // pair then drops the source copy like any other move out of a mirror.
+        let mut renamed = None;
+        if let (
+            Place::Mirror { folder, rel },
+            Place::Mirror {
+                folder: dest_folder,
+                rel: dest_rel,
+            },
+        ) = (&source, &dest)
+        {
+            let from = src.to_path_buf();
+            let to = dest_parent.join(&name);
+            match rename_noreplace(&from, &to) {
+                Ok(()) => renamed = Some((from, to)),
+                Err(e) if e.raw_os_error() == Some(libc::EXDEV) => {
+                    info!(from = %folder.local_path, to = %dest_folder.local_path,
+                        "move: mirror folders are on different filesystems");
+                }
+                Err(e) if e.raw_os_error() == Some(libc::EEXIST) => {
+                    return Err(CoreError::conflict(format!(
+                        "{name} already exists in {}",
+                        dest_parent.display()
+                    )));
+                }
+                Err(e) => {
+                    return Err(CoreError::internal(format!(
+                        "could not move {} to {}: {e}",
+                        rel,
+                        join_rel(dest_rel, &name)
+                    )));
+                }
+            }
+        }
+        if renamed.is_none()
+            && let Place::Mirror { folder, rel } = &source
+            && let Some(reason) =
+                mirror_subtree_unsynced(Path::new(&folder.local_path), rel, &baselines[&folder.id])
+        {
+            return Err(CoreError::conflict(format!(
+                "{name} is not fully synced yet ({reason}); wait for the sync to finish"
+            )));
+        }
+
+        if let Err(e) = self.move_remote(&src_uid, &dest_uid) {
+            if let Some((from, to)) = &renamed
+                && let Err(back) = std::fs::rename(to, from)
+            {
+                warn!(from = %to.display(), to = %from.display(), error = %back,
+                    "move: could not put the local copy back after the move failed");
+            }
+            return Err(CoreError::from_api(&e, "move"));
+        }
+
+        self.settle_source(
+            &source,
+            &src_uid,
+            renamed.is_some(),
+            &dest,
+            &dest_uid,
+            &name,
+            src,
+        );
+        self.settle_dest(&dest, &dest_uid, &name);
+        drop(guards);
+        if renamed.is_none()
+            && let Place::Mirror { folder, .. } = &dest
+        {
+            // Nothing local exists yet; the folder's next pass downloads it.
+            self.sync_now(Some(folder.id));
+        }
+        Ok(name)
+    }
+
+    /// Which location `abs` is in. A mount is looked for first: a mirror folder
+    /// cannot live inside a FUSE mount, and a mount is what the kernel sees.
+    fn locate(&self, abs: &Path) -> CoreResult<Place> {
+        if let Some((core, rel)) = self.rooted_at(abs) {
+            if !rel
+                .components()
+                .all(|c| matches!(c, Component::Normal(_) | Component::CurDir))
+            {
+                return Err(CoreError::invalid(format!(
+                    "{} escapes its location",
+                    abs.display()
+                )));
+            }
+            return Ok(Place::Mounted {
+                core: Box::new(core),
+                rel,
+            });
+        }
+        let folders = self
+            .db
+            .sync_folder_list()
+            .map_err(|e| CoreError::internal(format!("db: {e}")))?;
+        mirror_covering(folders, abs)
+            .map(|(folder, rel)| Place::Mirror { folder, rel })
+            .ok_or_else(|| {
+                CoreError::invalid(format!(
+                    "{} is not in a Proton Drive location",
+                    abs.display()
+                ))
+            })
+    }
+
+    /// The node being moved, once everything that must hold before it leaves
+    /// its location has been checked.
+    fn source_uid(
+        &self,
+        source: &Place,
+        baselines: &HashMap<i64, HashMap<String, StoredSyncEntry>>,
+    ) -> CoreResult<NodeUid> {
+        match source {
+            Place::Mounted { core, rel } => {
+                let (ino, uid) = core.resolve(rel)?;
+                if is_local_uid(&uid) {
+                    return Err(CoreError::conflict(
+                        "it is not uploaded yet; wait for the upload to finish",
+                    ));
+                }
+                let old_parent = core.source_parent_uid(ino, rel)?;
+                for authority in [&uid, &old_parent] {
+                    core.require_uid_writable(authority)
+                        .map_err(|e| core.errno_error(e, "move access"))?;
+                }
+                if self.has_pending_work_under(&uid)? {
+                    return Err(CoreError::conflict(
+                        "it has changes that are not uploaded yet; wait for the upload to finish",
+                    ));
+                }
+                Ok(uid)
+            }
+            Place::Mirror { folder, rel } => baselines[&folder.id]
+                .get(rel)
+                .and_then(|entry| entry.remote_uid.as_deref())
+                .and_then(parse_uid)
+                .ok_or_else(|| {
+                    CoreError::conflict(
+                        "it is not on Proton Drive yet; wait for the sync to finish",
+                    )
+                }),
+        }
+    }
+
+    /// The folder the node moves into. Refuses one that already holds `name`
+    /// on this disk; Drive refuses a clash on its side by itself.
+    fn dest_uid(
+        &self,
+        dest: &Place,
+        baselines: &HashMap<i64, HashMap<String, StoredSyncEntry>>,
+        name: &str,
+    ) -> CoreResult<NodeUid> {
+        let uid = match dest {
+            Place::Mounted { core, rel } => {
+                let (ino, uid) = core.resolve(rel)?;
+                let is_folder = core
+                    .state()
+                    .entries
+                    .get(&ino)
+                    .is_some_and(|entry| matches!(entry.node.kind, NodeKind::Folder));
+                if !is_folder {
+                    return Err(CoreError::invalid("the destination is not a folder"));
+                }
+                core.require_uid_writable(&uid)
+                    .map_err(|e| core.errno_error(e, "move access"))?;
+                uid
+            }
+            Place::Mirror { folder, rel } => {
+                let local = Path::new(&folder.local_path).join(rel);
+                if !local.is_dir() {
+                    return Err(CoreError::invalid("the destination is not a folder"));
+                }
+                if std::fs::symlink_metadata(local.join(name)).is_ok() {
+                    return Err(CoreError::conflict(format!(
+                        "{name} already exists in the destination"
+                    )));
+                }
+                let uid = if rel.is_empty() {
+                    Some(folder.remote_uid.as_str())
+                } else {
+                    baselines[&folder.id]
+                        .get(rel)
+                        .and_then(|entry| entry.remote_uid.as_deref())
+                };
+                uid.and_then(parse_uid).ok_or_else(|| {
+                    CoreError::conflict(
+                        "the destination is not on Proton Drive yet; wait for the sync to finish",
+                    )
+                })?
+            }
+        };
+        if is_local_uid(&uid) {
+            return Err(CoreError::conflict(
+                "the destination is not uploaded yet; wait for the upload to finish",
+            ));
+        }
+        Ok(uid)
+    }
+
+    /// Whether the queue owes Drive anything for `uid` or a node under it, or a
+    /// file under it is open for writing. Moving such a node away would strand
+    /// the pending change against a path that no longer leads to it.
+    fn has_pending_work_under(&self, uid: &NodeUid) -> CoreResult<bool> {
+        let ops = self
+            .db
+            .pending_ops()
+            .map_err(|e| CoreError::internal(format!("db: {e}")))?;
+        if ops.iter().any(|op| {
+            under(self, uid, &op.uid)
+                || op
+                    .parent_uid
+                    .as_deref()
+                    .is_some_and(|p| under(self, uid, p))
+        }) {
+            return Ok(true);
+        }
+        // Collected first so no State lock is held across the nodes-table reads.
+        let mut writing = Vec::new();
+        self.for_each_state(|st| {
+            writing.extend(st.active_writes.values().map(|w| w.uid.to_string()));
+        });
+        Ok(writing.iter().any(|w| under(self, uid, w)))
+    }
+
+    /// Bring the source location level with a move Drive has made.
+    #[allow(clippy::too_many_arguments)]
+    fn settle_source(
+        &self,
+        source: &Place,
+        uid: &NodeUid,
+        renamed: bool,
+        dest: &Place,
+        dest_uid: &NodeUid,
+        name: &str,
+        src: &Path,
+    ) {
+        match source {
+            Place::Mounted { core, rel } => {
+                // Moved everywhere, so no mount keeps serving it under the old
+                // path and its row stays (`docs/BUGS.md` B117). The content
+                // cache is keyed by uid and stays valid.
+                self.relocate_everywhere(uid, dest_uid, name);
+                core.invalidate_parent_listing(rel);
+            }
+            Place::Mirror { folder, rel } if renamed => {
+                let Place::Mirror {
+                    folder: dest_folder,
+                    rel: dest_rel,
+                } = dest
+                else {
+                    unreachable!("a local rename needs a mirror destination");
+                };
+                if let Err(e) = self.db.sync_entries_move(
+                    folder.id,
+                    rel,
+                    dest_folder.id,
+                    &join_rel(dest_rel, name),
+                ) {
+                    // The next passes see a copy with no baseline on one side
+                    // and a baseline with no copy on the other. That uploads
+                    // the files again and trashes the moved node, but loses
+                    // nothing.
+                    warn!(error = ?e, "move: could not carry the sync baseline along");
+                }
+            }
+            Place::Mirror { folder, rel } => {
+                // Drive had all of it when the move was checked, so the local
+                // copy is only a stale duplicate now. Something written into it
+                // since would go with it, so look again first; if anything is
+                // new, the copy stays and the next pass uploads it as new.
+                let changed = match self.db.sync_entries(folder.id) {
+                    Ok(baseline) => {
+                        mirror_subtree_unsynced(Path::new(&folder.local_path), rel, &baseline)
+                    }
+                    Err(e) => Some(format!("db: {e}")),
+                };
+                if let Err(e) = self.db.sync_entries_remove_subtree(folder.id, rel) {
+                    warn!(error = ?e, "move: could not drop the sync baseline");
+                }
+                if let Some(reason) = changed {
+                    warn!(path = %src.display(), reason,
+                        "move: the local copy changed during the move; keeping it");
+                    return;
+                }
+                let removed = if src.is_dir() {
+                    std::fs::remove_dir_all(src)
+                } else {
+                    std::fs::remove_file(src)
+                };
+                if let Err(e) = removed {
+                    warn!(path = %src.display(), error = %e,
+                        "move: could not remove the local copy after the move");
+                }
+            }
+        }
+    }
+
+    /// Bring the destination location level with a move Drive has made.
+    fn settle_dest(&self, dest: &Place, uid: &NodeUid, name: &str) {
+        if let Place::Mounted { .. } = dest {
+            self.invalidate_children_of(uid);
+            // A lookup that missed before the move may be cached as absent.
+            self.for_each_mount(|st, notify| {
+                if let Some(&ino) = st.by_uid.get(uid) {
+                    notify.inval_entry(ino, name.to_string());
+                }
+            });
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn folder(id: i64, local_path: &str, mode: &str) -> StoredSyncFolder {
+        StoredSyncFolder {
+            id,
+            local_path: local_path.to_string(),
+            remote_uid: format!("vol~root{id}"),
+            remote_share_id: String::new(),
+            mode: mode.to_string(),
+            pending_mode: None,
+            state: "idle".to_string(),
+            last_sync: 0,
+        }
+    }
+
+    #[test]
+    fn mirror_covering_finds_the_mirror_folder_and_the_path_inside_it() {
+        let folders = vec![folder(1, "/home/u/Docs", "mirror")];
+        let (found, rel) = mirror_covering(folders, Path::new("/home/u/Docs/a/b.txt")).unwrap();
+        assert_eq!(found.id, 1);
+        assert_eq!(rel, "a/b.txt");
+    }
+
+    #[test]
+    fn mirror_covering_gives_an_empty_path_for_the_folder_itself() {
+        let folders = vec![folder(1, "/home/u/Docs", "mirror")];
+        let (_, rel) = mirror_covering(folders, Path::new("/home/u/Docs")).unwrap();
+        assert_eq!(rel, "");
+    }
+
+    #[test]
+    fn mirror_covering_prefers_the_deepest_folder() {
+        let folders = vec![
+            folder(1, "/home/u/Docs", "mirror"),
+            folder(2, "/home/u/Docs/Work", "mirror"),
+        ];
+        let (found, rel) = mirror_covering(folders, Path::new("/home/u/Docs/Work/x")).unwrap();
+        assert_eq!(found.id, 2);
+        assert_eq!(rel, "x");
+    }
+
+    #[test]
+    fn mirror_covering_skips_on_demand_folders_and_name_prefixed_siblings() {
+        let folders = || {
+            vec![
+                folder(1, "/home/u/Docs", "mirror"),
+                folder(2, "/home/u/Media", "ondemand"),
+            ]
+        };
+        assert!(mirror_covering(folders(), Path::new("/home/u/Media/x")).is_none());
+        assert!(mirror_covering(folders(), Path::new("/home/u/Docs2/x")).is_none());
+    }
+
+    #[test]
+    fn mirror_covering_refuses_a_path_that_climbs_out() {
+        let folders = vec![folder(1, "/home/u/Docs", "mirror")];
+        assert!(mirror_covering(folders, Path::new("/home/u/Docs/../etc")).is_none());
+    }
+
+    #[test]
+    fn join_rel_names_a_child_of_the_folder_root_without_a_slash() {
+        assert_eq!(join_rel("", "a"), "a");
+        assert_eq!(join_rel("x/y", "a"), "x/y/a");
+    }
+
+    #[test]
+    fn a_local_rename_never_replaces_what_is_already_there() {
+        let dir = std::env::temp_dir().join(format!("pdfs-relocate-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let (a, b, c) = (dir.join("a"), dir.join("b"), dir.join("c"));
+        std::fs::write(&a, b"moved").unwrap();
+        std::fs::write(&b, b"kept").unwrap();
+
+        let err = rename_noreplace(&a, &b).unwrap_err();
+        assert_eq!(err.raw_os_error(), Some(libc::EEXIST));
+        assert_eq!(std::fs::read(&b).unwrap(), b"kept");
+        assert!(a.exists());
+
+        rename_noreplace(&a, &c).unwrap();
+        assert!(!a.exists());
+        assert_eq!(std::fs::read(&c).unwrap(), b"moved");
+        std::fs::remove_dir_all(&dir).unwrap();
+    }
+}

crates/pdfs-fuse/src/revisions.rs

@@ -232,7 +232,7 @@ impl Core {
         let mut out = std::io::BufWriter::new(file);
         let written = match self
             .rt
-            .block_on(self.client.download_revision_to(uid, revision_id, &mut out))
+            .block_on(self.drive.download_revision_to(uid, revision_id, &mut out))
             .map_err(|e| CoreError::from_api(&e, "download revision"))
             .and_then(|()| {
                 use std::io::Write as _;

crates/pdfs-fuse/src/sharing.rs

@@ -21,7 +21,7 @@ use proton_drive_rs::{MemberRole, NodeKind};
 
 use proton_drive_rs::Node;
 
-use super::{Core, ROOT_INO, node_size, parse_uid, public_link_info, role_from_str, role_to_str};
+use super::{Core, node_size, parse_uid, public_link_info, role_from_str, role_to_str};
 
 /// A node from a *shared* listing as a [`DirEntry`].
 ///
@@ -75,6 +75,7 @@ fn shared_entry_of(core: &Core, n: Node) -> DirEntry {
         shared_by_unverified,
         trashed_at: 0,
         trashed_from: None,
+        issue: None,
     }
 }
 
@@ -463,7 +464,7 @@ impl Core {
         }
         let nodes = self
             .rt
-            .block_on(self.client.enumerate_nodes(&uids))
+            .block_on(self.drive.enumerate_nodes(&uids))
             .map_err(|e| CoreError::from_api(&e, "enumerate nodes"))?;
         Ok(nodes
             .into_iter()
@@ -481,14 +482,14 @@ impl Core {
             parse_uid(uid).ok_or_else(|| CoreError::invalid(format!("invalid uid: {uid}")))?;
         let child_uids = self
             .rt
-            .block_on(self.client.enumerate_folder_children_node_uids(&uid))
+            .block_on(self.drive.enumerate_folder_children_node_uids(&uid))
             .map_err(|e| CoreError::from_api(&e, "enumerate shared children"))?;
         if child_uids.is_empty() {
             return Ok(Vec::new());
         }
         let nodes = self
             .rt
-            .block_on(self.client.enumerate_nodes(&child_uids))
+            .block_on(self.drive.enumerate_nodes(&child_uids))
             .map_err(|e| CoreError::from_api(&e, "enumerate nodes"))?;
         Ok(nodes
             .into_iter()
@@ -509,7 +510,7 @@ impl Core {
             parse_uid(uid).ok_or_else(|| CoreError::invalid(format!("invalid uid: {uid}")))?;
         let node = self
             .rt
-            .block_on(self.client.get_node(&uid))
+            .block_on(self.drive.get_node(&uid))
             .map_err(|e| CoreError::from_api(&e, "get shared node"))?
             .ok_or_else(|| CoreError::not_found("shared node not found"))?;
         if !node.is_file() {
@@ -610,10 +611,10 @@ impl Core {
     /// Proton products (not Drive-only). A remote round-trip; nothing here is
     /// cached.
     pub(crate) fn account_quota(&self) -> CoreResult<(i64, i64)> {
-        let q = self
-            .rt
-            .block_on(self.client.quota())
-            .map_err(|e| CoreError::from_api(&e, "account quota"))?;
+        let q = self.block_on_bounded(self.drive.quota()).map_err(|e| {
+            self.lost_link(&e, "account quota");
+            CoreError::from_api(&e, "account quota")
+        })?;
         *self.quota.lock() = Some((std::time::Instant::now(), q.max_space, q.used_space));
         Ok((q.max_space, q.used_space))
     }
@@ -632,11 +633,22 @@ impl Core {
         {
             return Some((max_space, used_space));
         }
-        match self.account_quota() {
+        let last = || self.quota.lock().map(|(_, max, used)| (max, used));
+        if !self.is_online()
+            || self
+                .quota_refreshing
+                .swap(true, std::sync::atomic::Ordering::AcqRel)
+        {
+            return last();
+        }
+        let refreshed = self.account_quota();
+        self.quota_refreshing
+            .store(false, std::sync::atomic::Ordering::Release);
+        match refreshed {
             Ok(q) => Some(q),
             Err(error) => {
                 debug!(%error, "account quota refresh failed; serving the last known figures");
-                self.quota.lock().map(|(_, max, used)| (max, used))
+                last()
             }
         }
     }
@@ -648,6 +660,12 @@ impl Core {
     /// the shared uids; the per-node detail is then gathered best-effort — a single
     /// node racing with an unshare drops from the list rather than failing the whole
     /// request.
+    ///
+    /// A share with no member, no invitation and no link is left out: it is
+    /// shared with no one. Stop Sharing leaves exactly that behind, since the SDK
+    /// cannot delete a share, and Drive keeps listing it until its backend gets
+    /// round to removing it, minutes later. A share whose details could not all
+    /// be read stays listed, so a failed lookup never hides a live share.
     pub(crate) fn list_shared_by_me(&self) -> CoreResult<Vec<SharedItem>> {
         let uids = self
             .rt
@@ -658,7 +676,7 @@ impl Core {
         }
         let nodes = self
             .rt
-            .block_on(self.client.enumerate_nodes(&uids))
+            .block_on(self.drive.enumerate_nodes(&uids))
             .map_err(|e| CoreError::from_api(&e, "enumerate nodes"))?;
         let mut items = Vec::with_capacity(nodes.len());
         for n in nodes {
@@ -666,24 +684,26 @@ impl Core {
             let members = self
                 .rt
                 .block_on(self.client.list_share_members(&uid))
-                .map(|m| m.len())
-                .unwrap_or(0);
+                .map(|m| m.len());
             let proton_invites = self
                 .rt
                 .block_on(self.client.list_share_invitations(&uid))
-                .map(|i| i.len())
-                .unwrap_or(0);
+                .map(|i| i.len());
             let external_invites = self
                 .rt
                 .block_on(self.client.list_external_invitations(&uid))
-                .map(|i| i.len())
-                .unwrap_or(0);
-            let link = self
-                .rt
-                .block_on(self.client.get_public_link(&uid))
-                .ok()
-                .flatten()
-                .map(public_link_info);
+                .map(|i| i.len());
+            let link = self.rt.block_on(self.client.get_public_link(&uid));
+            if let (Ok(0), Ok(0), Ok(0), Ok(None)) =
+                (&members, &proton_invites, &external_invites, &link)
+            {
+                debug!(%uid, "shared by me: skipping an emptied share");
+                continue;
+            }
+            let members = members.unwrap_or(0);
+            let proton_invites = proton_invites.unwrap_or(0);
+            let external_invites = external_invites.unwrap_or(0);
+            let link = link.ok().flatten().map(public_link_info);
             items.push(SharedItem {
                 uid: uid.to_string(),
                 is_dir: n.is_folder(),
@@ -703,19 +723,10 @@ impl Core {
     /// been seen through the mount (e.g. shared but not browsed to this session) —
     /// the caller then leaves the path empty.
     pub(crate) fn rel_path_for_uid(&self, uid: &NodeUid) -> Option<String> {
-        // Searched across every mount: a node browsed through a sync folder is
-        // interned in that fork's inode space, so the primary state alone had no
-        // entry for it and the caller silently showed an empty path
-        // (`docs/BUGS.md` B74). The path is relative to whichever mount holds
-        // it, which is the one the user reached it through.
-        let mut path = None;
-        self.for_each_state(|st| {
-            if path.is_some() {
-                return;
-            }
-            path = walk_to_root(st, uid);
-        });
-        path
+        // Relative to whichever root the node sits under: a node browsed
+        // through a sync folder is under that fork's root, not My Files
+        // (`docs/BUGS.md` B74).
+        walk_to_root(&self.state(), uid)
     }
 }
 
@@ -760,14 +771,18 @@ impl StopSharingOutcome {
     }
 }
 
-/// Walk one inode space from `uid` up to its root, building the path. `None` if
-/// that mount has never interned the node, or if the chain breaks partway —
+/// Walk the tree from `uid` up to the root it sits under, building the path.
+/// `None` if the node has never been interned, or if the chain breaks partway —
 /// a broken chain is a missing path, never a partial one.
 fn walk_to_root(st: &super::State, uid: &NodeUid) -> Option<String> {
     let mut ino = *st.by_uid.get(uid)?;
     let mut parts = Vec::new();
-    while ino != ROOT_INO {
+    while !st.roots.contains(&ino) {
         let entry = st.entries.get(&ino)?;
+        // An orphan is its own parent without being a root.
+        if entry.parent == ino {
+            return None;
+        }
         parts.push(entry.node.name.clone());
         ino = entry.parent;
     }

crates/pdfs-fuse/src/shutdown.rs

@@ -6,7 +6,7 @@
 //! invisible; in an in-process remount — which is how the daemon recovers from a
 //! mount going away underneath it — it leaks a whole generation of threads that
 //! keep writing to the database and calling the API on behalf of a mount that no
-//! longer exists (bugs.md B44).
+//! longer exists (`docs/BUGS.md` B44).
 //!
 //! The primitive is deliberately small: a flag plus a condvar. Every loop that
 //! would otherwise call `thread::sleep` calls [`Shutdown::sleep`] instead, which

crates/pdfs-fuse/src/sim/mod.rs

@@ -0,0 +1,9 @@
+//! The simulation tests of `docs/TESTING.md`: a fake Drive with
+//! the faults the real one has, and the tools to drive daemons against it.
+
+pub(crate) mod daemon;
+pub(crate) mod fake_drive;
+pub(crate) mod model;
+pub(crate) mod rng;
+pub(crate) mod run;
+pub(crate) mod watchdog;

crates/pdfs-fuse/src/sim/model.rs

@@ -0,0 +1,445 @@
+//! The reference file system of the simulation (`docs/TESTING.md`,
+//! "Simulation runs", property 1): what each syscall a simulated client makes should
+//! answer, and the tree it should leave, on a POSIX file system.
+//!
+//! A [`Model`] covers one client's own folder; paths are relative to it. The
+//! same type is used for the trees read back from a mount and from Drive.
+
+use std::collections::BTreeMap;
+
+use super::rng::Rng;
+
+/// A tree by path: `None` is a folder, `Some` a file's content.
+pub(crate) type Tree = BTreeMap<String, Option<Vec<u8>>>;
+
+/// One file system call, or the few a program makes in a row.
+#[derive(Clone, Debug)]
+pub(crate) enum FsOp {
+    /// `open(O_CREAT | O_TRUNC)`, write `data`, close.
+    Create {
+        path: String,
+        data: Vec<u8>,
+    },
+    /// Open an existing file, write `data` at `offset` (past the end leaves
+    /// a hole), close.
+    Write {
+        path: String,
+        offset: u64,
+        data: Vec<u8>,
+    },
+    /// Open an existing file and `ftruncate` it to `len`.
+    Truncate {
+        path: String,
+        len: u64,
+    },
+    Mkdir {
+        path: String,
+    },
+    Rename {
+        from: String,
+        to: String,
+    },
+    Unlink {
+        path: String,
+    },
+    /// Open a file, unlink it, append `data`, read it all back, close.
+    UnlinkOpen {
+        path: String,
+        data: Vec<u8>,
+    },
+    Rmdir {
+        path: String,
+    },
+}
+
+impl FsOp {
+    /// The paths the op names, for the log.
+    pub(crate) fn describe(&self) -> String {
+        match self {
+            FsOp::Create { path, data } => format!("create {path} ({} bytes)", data.len()),
+            FsOp::Write { path, offset, data } => {
+                format!("write {path} at {offset} ({} bytes)", data.len())
+            }
+            FsOp::Truncate { path, len } => format!("truncate {path} to {len}"),
+            FsOp::Mkdir { path } => format!("mkdir {path}"),
+            FsOp::Rename { from, to } => format!("rename {from} -> {to}"),
+            FsOp::Unlink { path } => format!("unlink {path}"),
+            FsOp::UnlinkOpen { path, data } => {
+                format!("unlink {path} while open, then append {} bytes", data.len())
+            }
+            FsOp::Rmdir { path } => format!("rmdir {path}"),
+        }
+    }
+}
+
+/// The tree one client should have, and what its syscalls should answer.
+#[derive(Clone, Debug, Default)]
+pub(crate) struct Model {
+    tree: Tree,
+}
+
+/// Names are drawn from small pools, so ops collide: a create over an existing
+/// file, a rename over another, a mkdir of a name that is taken.
+const FILE_NAMES: [&str; 6] = ["a.txt", "b.txt", "c.bin", "d", "e.md", "f.txt"];
+const DIR_NAMES: [&str; 3] = ["x", "y", "z"];
+
+impl Model {
+    pub(crate) fn tree(&self) -> &Tree {
+        &self.tree
+    }
+
+    pub(crate) fn content(&self, path: &str) -> Option<&Vec<u8>> {
+        self.tree.get(path)?.as_ref()
+    }
+
+    /// What `op` should answer on a POSIX file system, applying it on success.
+    pub(crate) fn apply(&mut self, op: &FsOp) -> Result<(), i32> {
+        match op {
+            FsOp::Create { path, data } => {
+                self.check_parent(path)?;
+                match self.tree.get(path) {
+                    Some(None) => Err(libc::EISDIR),
+                    _ => {
+                        self.tree.insert(path.clone(), Some(data.clone()));
+                        Ok(())
+                    }
+                }
+            }
+            FsOp::Write { path, offset, data } => {
+                let content = self.file_mut(path)?;
+                // Writing nothing changes nothing, even past the end.
+                if data.is_empty() {
+                    return Ok(());
+                }
+                let end = *offset as usize + data.len();
+                if content.len() < end {
+                    content.resize(end, 0);
+                }
+                content[*offset as usize..end].copy_from_slice(data);
+                Ok(())
+            }
+            FsOp::Truncate { path, len } => {
+                self.file_mut(path)?.resize(*len as usize, 0);
+                Ok(())
+            }
+            FsOp::Mkdir { path } => {
+                self.check_parent(path)?;
+                if self.tree.contains_key(path) {
+                    return Err(libc::EEXIST);
+                }
+                self.tree.insert(path.clone(), None);
+                Ok(())
+            }
+            FsOp::Rename { from, to } => self.rename(from, to),
+            FsOp::Unlink { path } | FsOp::UnlinkOpen { path, .. } => {
+                self.check_parent(path)?;
+                match self.tree.get(path) {
+                    None => Err(libc::ENOENT),
+                    Some(None) => Err(libc::EISDIR),
+                    Some(Some(_)) => {
+                        self.tree.remove(path);
+                        Ok(())
+                    }
+                }
+            }
+            FsOp::Rmdir { path } => {
+                self.check_parent(path)?;
+                match self.tree.get(path) {
+                    None => Err(libc::ENOENT),
+                    Some(Some(_)) => Err(libc::ENOTDIR),
+                    Some(None) if self.has_children(path) => Err(libc::ENOTEMPTY),
+                    Some(None) => {
+                        self.tree.remove(path);
+                        Ok(())
+                    }
+                }
+            }
+        }
+    }
+
+    fn rename(&mut self, from: &str, to: &str) -> Result<(), i32> {
+        self.check_parent(from)?;
+        let Some(moving) = self.tree.get(from).cloned() else {
+            return Err(libc::ENOENT);
+        };
+        self.check_parent(to)?;
+        if from == to {
+            return Ok(());
+        }
+        if is_below(to, from) {
+            return Err(libc::EINVAL);
+        }
+        match (&moving, self.tree.get(to)) {
+            (None, Some(Some(_))) => return Err(libc::ENOTDIR),
+            (Some(_), Some(None)) => return Err(libc::EISDIR),
+            (None, Some(None)) if self.has_children(to) => return Err(libc::ENOTEMPTY),
+            _ => {}
+        }
+        let below: Vec<(String, Option<Vec<u8>>)> = self
+            .tree
+            .iter()
+            .filter(|(path, _)| is_below(path, from))
+            .map(|(path, entry)| (path.clone(), entry.clone()))
+            .collect();
+        self.tree.remove(from);
+        self.tree.insert(to.to_owned(), moving);
+        for (path, entry) in below {
+            self.tree.remove(&path);
+            self.tree
+                .insert(format!("{to}{}", &path[from.len()..]), entry);
+        }
+        Ok(())
+    }
+
+    fn file_mut(&mut self, path: &str) -> Result<&mut Vec<u8>, i32> {
+        self.check_parent(path)?;
+        match self.tree.get_mut(path) {
+            None => Err(libc::ENOENT),
+            Some(None) => Err(libc::EISDIR),
+            Some(Some(content)) => Ok(content),
+        }
+    }
+
+    fn check_parent(&self, path: &str) -> Result<(), i32> {
+        let mut at = String::new();
+        let mut names = path.split('/').peekable();
+        while let Some(name) = names.next() {
+            if names.peek().is_none() {
+                break;
+            }
+            if !at.is_empty() {
+                at.push('/');
+            }
+            at.push_str(name);
+            match self.tree.get(&at) {
+                None => return Err(libc::ENOENT),
+                Some(Some(_)) => return Err(libc::ENOTDIR),
+                Some(None) => {}
+            }
+        }
+        Ok(())
+    }
+
+    fn has_children(&self, path: &str) -> bool {
+        self.tree.keys().any(|other| is_below(other, path))
+    }
+
+    pub(crate) fn files(&self) -> Vec<&String> {
+        self.tree
+            .iter()
+            .filter(|(_, entry)| entry.is_some())
+            .map(|(path, _)| path)
+            .collect()
+    }
+
+    /// Folders, the client's own root (`""`) first.
+    fn dirs(&self) -> Vec<String> {
+        std::iter::once(String::new())
+            .chain(
+                self.tree
+                    .iter()
+                    .filter(|(_, entry)| entry.is_none())
+                    .map(|(path, _)| path.clone()),
+            )
+            .collect()
+    }
+
+    /// A random op, mostly one that should succeed.
+    pub(crate) fn next_op(&self, rng: &mut Rng) -> FsOp {
+        let dirs = self.dirs();
+        let files = self.files();
+        let in_dir = |rng: &mut Rng, names: &[&str]| {
+            let parent = rng.pick(&dirs).expect("the root is always there");
+            join(parent, rng.pick(names).expect("names"))
+        };
+        let a_file = |rng: &mut Rng| rng.pick(&files).map(|path| (*path).clone());
+        let roll = rng.below(100);
+        let op = match roll {
+            0..30 => Some(FsOp::Create {
+                path: in_dir(rng, &FILE_NAMES),
+                data: data(rng),
+            }),
+            30..45 => a_file(rng).map(|path| {
+                let len = self.content(&path).map_or(0, Vec::len) as u64;
+                FsOp::Write {
+                    offset: rng.below(len + 8),
+                    path,
+                    data: data(rng),
+                }
+            }),
+            45..50 => a_file(rng).map(|path| FsOp::Truncate {
+                len: rng.below(32),
+                path,
+            }),
+            50..60 => Some(FsOp::Mkdir {
+                path: in_dir(rng, &DIR_NAMES),
+            }),
+            // A rename in place, over another file as often as not.
+            60..72 => a_file(rng).map(|from| FsOp::Rename {
+                to: join(parent_of(&from), rng.pick(&FILE_NAMES).expect("names")),
+                from,
+            }),
+            // A move to another folder, renamed or not.
+            72..82 => a_file(rng).map(|from| {
+                let name = if rng.chance(0.5) {
+                    name_of(&from)
+                } else {
+                    rng.pick(&FILE_NAMES).expect("names")
+                };
+                let parent = rng.pick(&dirs).expect("the root is always there");
+                FsOp::Rename {
+                    to: join(parent, name),
+                    from,
+                }
+            }),
+            // A folder renamed or moved, with what is in it.
+            82..86 => {
+                let from = rng.pick(&dirs[1..]).cloned();
+                from.map(|from| FsOp::Rename {
+                    to: in_dir(rng, &DIR_NAMES),
+                    from,
+                })
+            }
+            86..94 => a_file(rng).map(|path| FsOp::Unlink { path }),
+            94..97 => a_file(rng).map(|path| FsOp::UnlinkOpen {
+                path,
+                data: data(rng),
+            }),
+            _ => rng
+                .pick(&dirs[1..])
+                .cloned()
+                .map(|path| FsOp::Rmdir { path }),
+        };
+        op.unwrap_or_else(|| FsOp::Create {
+            path: in_dir(rng, &FILE_NAMES),
+            data: data(rng),
+        })
+    }
+}
+
+/// Content for a write: short and recognisable, now and then empty.
+pub(crate) fn data(rng: &mut Rng) -> Vec<u8> {
+    let len = if rng.chance(0.1) {
+        0
+    } else {
+        rng.between(1, 48)
+    };
+    let tag = rng.next_u64();
+    (0..len).map(|i| b'a' + ((tag + i) % 26) as u8).collect()
+}
+
+pub(crate) fn join(parent: &str, name: &str) -> String {
+    if parent.is_empty() {
+        name.to_owned()
+    } else {
+        format!("{parent}/{name}")
+    }
+}
+
+pub(crate) fn parent_of(path: &str) -> &str {
+    path.rsplit_once('/').map_or("", |(parent, _)| parent)
+}
+
+pub(crate) fn name_of(path: &str) -> &str {
+    path.rsplit_once('/').map_or(path, |(_, name)| name)
+}
+
+fn is_below(path: &str, ancestor: &str) -> bool {
+    path.len() > ancestor.len() + 1
+        && path.starts_with(ancestor)
+        && path.as_bytes()[ancestor.len()] == b'/'
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn create(path: &str, data: &[u8]) -> FsOp {
+        FsOp::Create {
+            path: path.into(),
+            data: data.to_vec(),
+        }
+    }
+
+    #[test]
+    fn a_rename_over_a_file_replaces_it_and_a_folder_moves_with_its_contents() {
+        let mut model = Model::default();
+        model.apply(&FsOp::Mkdir { path: "x".into() }).unwrap();
+        model.apply(&create("x/a", b"1")).unwrap();
+        model.apply(&create("b", b"2")).unwrap();
+        model
+            .apply(&FsOp::Rename {
+                from: "b".into(),
+                to: "x/a".into(),
+            })
+            .unwrap();
+        assert_eq!(model.content("x/a"), Some(&b"2".to_vec()));
+        model
+            .apply(&FsOp::Rename {
+                from: "x".into(),
+                to: "y".into(),
+            })
+            .unwrap();
+        assert_eq!(model.tree().keys().collect::<Vec<_>>(), vec!["y", "y/a"]);
+    }
+
+    #[test]
+    fn calls_fail_the_way_posix_says() {
+        let mut model = Model::default();
+        model.apply(&FsOp::Mkdir { path: "x".into() }).unwrap();
+        model.apply(&create("x/a", b"1")).unwrap();
+        assert_eq!(
+            model.apply(&FsOp::Mkdir { path: "x".into() }),
+            Err(libc::EEXIST)
+        );
+        assert_eq!(model.apply(&create("x", b"")), Err(libc::EISDIR));
+        assert_eq!(model.apply(&create("x/a/b", b"")), Err(libc::ENOTDIR));
+        assert_eq!(model.apply(&create("q/a", b"")), Err(libc::ENOENT));
+        assert_eq!(
+            model.apply(&FsOp::Rmdir { path: "x".into() }),
+            Err(libc::ENOTEMPTY)
+        );
+        assert_eq!(
+            model.apply(&FsOp::Unlink { path: "x".into() }),
+            Err(libc::EISDIR)
+        );
+        let into_itself = FsOp::Rename {
+            from: "x".into(),
+            to: "x/y".into(),
+        };
+        assert_eq!(model.apply(&into_itself), Err(libc::EINVAL));
+    }
+
+    #[test]
+    fn a_write_past_the_end_leaves_a_hole() {
+        let mut model = Model::default();
+        model.apply(&create("a", b"ab")).unwrap();
+        let write = FsOp::Write {
+            path: "a".into(),
+            offset: 4,
+            data: b"z".to_vec(),
+        };
+        model.apply(&write).unwrap();
+        assert_eq!(model.content("a"), Some(&b"ab\0\0z".to_vec()));
+        let nothing = FsOp::Write {
+            path: "a".into(),
+            offset: 9,
+            data: Vec::new(),
+        };
+        model.apply(&nothing).unwrap();
+        assert_eq!(model.content("a"), Some(&b"ab\0\0z".to_vec()));
+    }
+
+    #[test]
+    fn generated_ops_mostly_succeed() {
+        let mut rng = Rng::new(9);
+        let mut model = Model::default();
+        let ok = (0..500)
+            .filter(|_| {
+                let op = model.next_op(&mut rng);
+                model.apply(&op).is_ok()
+            })
+            .count();
+        assert!(ok > 350, "{ok} of 500 succeeded");
+    }
+}

crates/pdfs-fuse/src/sim/rng.rs

@@ -0,0 +1,79 @@
+//! A small seeded random number generator, so a failing simulation is a seed
+//! that can be replayed. SplitMix64: fast, good enough for choosing operations
+//! and faults, and no dependency.
+
+#[derive(Clone, Debug)]
+pub(crate) struct Rng(u64);
+
+impl Rng {
+    pub(crate) fn new(seed: u64) -> Self {
+        Self(seed)
+    }
+
+    pub(crate) fn next_u64(&mut self) -> u64 {
+        self.0 = self.0.wrapping_add(0x9E37_79B9_7F4A_7C15);
+        let mut z = self.0;
+        z = (z ^ (z >> 30)).wrapping_mul(0xBF58_476D_1CE4_E5B9);
+        z = (z ^ (z >> 27)).wrapping_mul(0x94D0_49BB_1331_11EB);
+        z ^ (z >> 31)
+    }
+
+    /// A value in `0..n`; `0` when `n` is `0`.
+    pub(crate) fn below(&mut self, n: u64) -> u64 {
+        if n == 0 { 0 } else { self.next_u64() % n }
+    }
+
+    /// A value in `lo..=hi`.
+    pub(crate) fn between(&mut self, lo: u64, hi: u64) -> u64 {
+        lo + self.below(hi.saturating_sub(lo) + 1)
+    }
+
+    /// True with probability `p`.
+    pub(crate) fn chance(&mut self, p: f64) -> bool {
+        p > 0.0 && (self.next_u64() >> 11) as f64 / (1u64 << 53) as f64 <= p
+    }
+
+    pub(crate) fn pick<'a, T>(&mut self, items: &'a [T]) -> Option<&'a T> {
+        items.get(self.below(items.len() as u64) as usize)
+    }
+
+    /// A child generator, so one consumer's draws do not shift another's.
+    pub(crate) fn fork(&mut self) -> Self {
+        Self::new(self.next_u64())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::Rng;
+
+    #[test]
+    fn a_seed_replays_the_same_sequence() {
+        let (mut a, mut b) = (Rng::new(7), Rng::new(7));
+        for _ in 0..100 {
+            assert_eq!(a.next_u64(), b.next_u64());
+        }
+        assert_ne!(Rng::new(7).next_u64(), Rng::new(8).next_u64());
+    }
+
+    #[test]
+    fn bounded_draws_stay_in_range() {
+        let mut rng = Rng::new(1);
+        for _ in 0..1000 {
+            assert!(rng.below(5) < 5);
+            assert!((3..=9).contains(&rng.between(3, 9)));
+        }
+        assert_eq!(rng.below(0), 0);
+        assert!(!rng.chance(0.0));
+        assert!(rng.chance(1.0));
+        assert!([1, 2, 3].contains(rng.pick(&[1, 2, 3]).unwrap()));
+        assert_eq!(rng.pick::<u8>(&[]), None);
+    }
+
+    #[test]
+    fn a_fork_draws_apart_from_its_parent() {
+        let mut parent = Rng::new(3);
+        let mut child = parent.fork();
+        assert_ne!(parent.next_u64(), child.next_u64());
+    }
+}

crates/pdfs-fuse/src/sim/run.rs

@@ -0,0 +1,766 @@
+//! The simulation runs described in `docs/TESTING.md`.
+//!
+//! A run starts one or more daemons on a shared [`FakeDrive`], each owning a
+//! folder `c<n>` that only it writes, so there is one writer per file. A seed
+//! draws a sequence of steps: syscalls through a client's mount, the link of a
+//! client going down or up, a client restarting, a pause, a settle (every
+//! queue must drain within a budget), or a file deleted while the drain holds
+//! a write to it. Every syscall is checked against the
+//! client's [`Model`] as it happens. After the sequence every link comes up
+//! and the run checks:
+//!
+//! 1. **No loss** and **POSIX**: Drive's copy of each client's folder is what
+//!    its model says.
+//! 2. **No false conflicts**: no conflict copy anywhere, and the drain never
+//!    takes a client's own delete for another device's.
+//! 3. **Convergence**: each mount shows Drive's tree.
+//! 4. **Liveness**: no syscall took longer than its budget, settles drained in
+//!    theirs, and every queue drained once the links were up. A call that
+//!    never returns is caught by the [`Watchdog`], which keeps the stacks.
+//!
+//! A restart here is a stop and a start: the next run finds what the last
+//! one wrote down, but in-flight work is let finish rather than cut. A kill
+//! at an arbitrary point needs the daemon in a process of its own.
+//!
+//! Any of these fails the seed. No open bug is tolerated: the matchers that
+//! counted the ones still open instead (B125 to B134) went once a run on
+//! 812eb3d passed every profile without them.
+//!
+//! The runs are ignored by default because they mount FUSE; run them with
+//! `cargo test -p pdfs-fuse --lib sim::run -- --ignored --test-threads=1`.
+//! `PDFS_SIM_SEEDS=n` sets how many seeds each runs, `PDFS_SIM_SEED=s` replays
+//! one, and `RUST_LOG=pdfs_fuse=debug` with `--nocapture` shows the daemons'
+//! logs.
+
+use std::fs::OpenOptions;
+use std::io::{self, Read, Seek, SeekFrom, Write};
+use std::path::{Path, PathBuf};
+use std::time::{Duration, Instant};
+
+use super::daemon::{Daemon, scratch, take_logged, wait_until};
+use super::fake_drive::{Entry, FakeDrive, Faults};
+use super::model::{FsOp, Model, Tree, data, join};
+use super::rng::Rng;
+use super::watchdog::Watchdog;
+
+/// What a run looks like.
+pub(crate) struct Profile {
+    pub(crate) name: &'static str,
+    pub(crate) clients: usize,
+    pub(crate) steps: usize,
+    pub(crate) faults: fn() -> Faults,
+    /// Whether links go down and come back during the sequence.
+    pub(crate) link_flaps: bool,
+    pub(crate) restarts: bool,
+    /// Whether files are deleted while the drain holds a write to them.
+    pub(crate) deletes_mid_upload: bool,
+    /// How long a settle may take; `None` leaves settles out.
+    pub(crate) settle_budget: Option<Duration>,
+    /// How long one syscall may take.
+    pub(crate) syscall_budget: Duration,
+    /// How long the queues may take to drain at the end.
+    pub(crate) drain_budget: Duration,
+}
+
+/// How long the mounts may take to show Drive's tree at the end: one event
+/// poll (`POLL_INTERVAL`) and change.
+const CONVERGE_BUDGET: Duration = Duration::from_secs(30);
+
+/// How long the drain may take to pick up a write: its debounce, and then
+/// some.
+const PICKUP_BUDGET: Duration = Duration::from_secs(8);
+
+/// Steps shown before a failure. All of them are written to `steps.log` in
+/// the state the failure keeps.
+const LOG_TAIL: usize = 40;
+
+/// How long past its own budget a step, or the checks after the last one, may
+/// run before the watchdog takes it for hung. Longer than a restart may wait
+/// for the last run and the mount.
+const STALL: Duration = Duration::from_secs(120);
+
+struct Client {
+    daemon: Option<Daemon>,
+    model: Model,
+    online: bool,
+}
+
+impl Client {
+    fn daemon(&self) -> &Daemon {
+        self.daemon
+            .as_ref()
+            .expect("a client always has a daemon between steps")
+    }
+
+    fn root(&self, index: usize) -> PathBuf {
+        self.daemon().mountpoint.join(owned_folder(index))
+    }
+}
+
+struct Run {
+    seed: u64,
+    profile: &'static Profile,
+    drive: std::sync::Arc<FakeDrive>,
+    clients: Vec<Client>,
+    log: Vec<String>,
+    started: Instant,
+    /// What the daemons logged at `INFO` and above so far.
+    logged: Vec<String>,
+    watchdog: Watchdog,
+}
+
+/// Run `profile` on `seed`. It answers a report of what went wrong, if
+/// anything did.
+pub(crate) fn run(seed: u64, profile: &'static Profile) -> Result<(), String> {
+    let dir = scratch(&format!("{}-{seed}", profile.name));
+    let mut rng = Rng::new(seed);
+    let drive = FakeDrive::new();
+    let mut run = Run {
+        seed,
+        profile,
+        drive: drive.clone(),
+        clients: Vec::new(),
+        log: Vec::new(),
+        started: Instant::now(),
+        logged: Vec::new(),
+        watchdog: Watchdog::new(&dir),
+    };
+    let outcome = run.execute(&dir, &mut rng);
+    run.watchdog.stop();
+    // A hang is what failed, whatever the aborted call answered.
+    let outcome = match run.watchdog.fired() {
+        Some(hung) => Err(format!("liveness: {}", hung.what)),
+        None => outcome,
+    };
+    for client in &mut run.clients {
+        if let Some(daemon) = client.daemon.take() {
+            let _ = daemon.stop();
+        }
+    }
+    match outcome {
+        Ok(()) => {
+            let _ = std::fs::remove_dir_all(&dir);
+            Ok(())
+        }
+        Err(failure) => Err(run.report(&failure, &dir)),
+    }
+}
+
+impl Run {
+    fn execute(&mut self, dir: &Path, rng: &mut Rng) -> Result<(), String> {
+        for index in 0..self.profile.clients {
+            let client = self.drive.client(rng.next_u64(), (self.profile.faults)());
+            let daemon = Daemon::start(&dir.join(format!("client{index}")), client)
+                .map_err(|error| format!("client {index} did not mount: {error}"))?;
+            let folder = daemon.mountpoint.join(owned_folder(index));
+            std::fs::create_dir(&folder)
+                .map_err(|error| format!("client {index}: mkdir {}: {error}", folder.display()))?;
+            self.clients.push(Client {
+                daemon: Some(daemon),
+                model: Model::default(),
+                online: true,
+            });
+        }
+        for step in 0..self.profile.steps {
+            let _watching = self.watchdog.arm(self.step_limit(), format!("step {step}"));
+            self.step(rng)?;
+        }
+        let _watching = self.watchdog.arm(
+            self.profile.drain_budget + STALL,
+            "the checks after the last step",
+        );
+        self.finish()
+    }
+
+    /// How long a step may run before the watchdog takes it for hung.
+    fn step_limit(&self) -> Duration {
+        let budget = self.profile.settle_budget.unwrap_or_default();
+        budget.max(self.profile.syscall_budget) + STALL
+    }
+
+    fn step(&mut self, rng: &mut Rng) -> Result<(), String> {
+        let index = rng.below(self.clients.len() as u64) as usize;
+        let roll = rng.below(100);
+        match roll {
+            0..4 if self.profile.link_flaps => {
+                let client = &mut self.clients[index];
+                client.online = !client.online;
+                client.daemon().client.set_online(client.online);
+                let state = if client.online { "up" } else { "down" };
+                self.note(format!("client {index}: link {state}"));
+            }
+            4..6 if self.profile.restarts => {
+                self.note(format!("client {index}: restart"));
+                let daemon = self.clients[index].daemon.take().expect("daemon");
+                let daemon = daemon
+                    .restart()
+                    .map_err(|error| format!("client {index} did not come back: {error}"))?;
+                self.clients[index].daemon = Some(daemon);
+            }
+            6..12 => {
+                let ms = rng.below(400);
+                self.note(format!("pause {ms} ms"));
+                std::thread::sleep(Duration::from_millis(ms));
+            }
+            12..15 => {
+                if let Some(budget) = self.profile.settle_budget
+                    && self.clients.iter().all(|client| client.online)
+                {
+                    self.settle(budget)?;
+                }
+            }
+            15..25 if self.profile.deletes_mid_upload => self.delete_mid_upload(index, rng)?,
+            _ => {
+                let op = self.clients[index].model.next_op(rng);
+                self.syscall(index, op)?;
+            }
+        }
+        Ok(())
+    }
+
+    /// Wait until every queue is empty and Drive holds what the models say.
+    fn settle(&mut self, budget: Duration) -> Result<(), String> {
+        self.note("settle".into());
+        let start = Instant::now();
+        // What the drain logs meanwhile is what explains a known bug's damage.
+        if !wait_until(budget, || {
+            self.logged.extend(take_logged());
+            self.landed()
+        }) {
+            return Err(format!(
+                "liveness: the queues did not drain within {budget:?}\n{}",
+                self.difference()
+            ));
+        }
+        self.note(format!("settled in {:?}", start.elapsed()));
+        Ok(())
+    }
+
+    /// Write a file Drive holds and delete it once the drain has picked the
+    /// write up. The drain's read of the node is held until the delete has
+    /// landed and a read shows it, so the drain finds the file trashed while
+    /// it holds a write that is no longer queued (B105). Half the time the
+    /// file is made again meanwhile, which queues a write under the op id the
+    /// delete freed (B133).
+    fn delete_mid_upload(&mut self, index: usize, rng: &mut Rng) -> Result<(), String> {
+        let file = rng
+            .pick(&self.clients[index].model.files())
+            .map(|path| (*path).clone());
+        let (Some(path), Some(budget), true) = (
+            file,
+            self.profile.settle_budget,
+            self.clients.iter().all(|client| client.online),
+        ) else {
+            let op = self.clients[index].model.next_op(rng);
+            return self.syscall(index, op);
+        };
+        self.settle(budget)?;
+        let Some(uid) = self.drive.lookup(&join(&owned_folder(index), &path)) else {
+            return Err(format!(
+                "no loss: client {index}'s {path} is not on Drive after a settle"
+            ));
+        };
+        let held = self.clients[index].daemon().client.hold_next_read(&uid);
+        self.note(format!("client {index}: hold the next read of {path}"));
+        let mut bytes = data(rng);
+        bytes.push(b'.');
+        self.syscall(
+            index,
+            FsOp::Write {
+                path: path.clone(),
+                offset: 0,
+                data: bytes,
+            },
+        )?;
+        if !wait_until(PICKUP_BUDGET, || held.reached()) {
+            self.note(format!("client {index}: nothing read {path} back"));
+            return Ok(());
+        }
+        self.syscall(index, FsOp::Unlink { path: path.clone() })?;
+        if rng.chance(0.5) {
+            self.syscall(
+                index,
+                FsOp::Create {
+                    path: path.clone(),
+                    data: data(rng),
+                },
+            )?;
+        }
+        let faults = (self.profile.faults)();
+        let latency = Duration::from_millis(faults.latency_ms.1);
+        std::thread::sleep(faults.listing_lag + latency);
+        drop(held);
+        self.note(format!("client {index}: the read of {path} goes on"));
+        // Nothing else is queued before the drain has answered.
+        std::thread::sleep(2 * latency + Duration::from_millis(50));
+        Ok(())
+    }
+
+    fn syscall(&mut self, index: usize, op: FsOp) -> Result<(), String> {
+        let client = &mut self.clients[index];
+        let root = client.root(index);
+        let before = client.model.content(target(&op)).cloned();
+        let expected = client.model.apply(&op);
+        self.logged.extend(take_logged());
+        let start = Instant::now();
+        let actual = perform(&root, &op, before.as_deref());
+        let took = start.elapsed();
+        self.note(format!(
+            "client {index}: {} = {} in {took:?}",
+            op.describe(),
+            outcome(&actual)
+        ));
+        let actual = actual?;
+        self.logged.extend(take_logged());
+        if actual != expected {
+            return Err(format!(
+                "posix: client {index}: {} answered {}, expected {}",
+                op.describe(),
+                errno(actual),
+                errno(expected)
+            ));
+        }
+        if took > self.profile.syscall_budget {
+            return Err(format!(
+                "liveness: client {index}: {} took {took:?}, over {:?}",
+                op.describe(),
+                self.profile.syscall_budget
+            ));
+        }
+        Ok(())
+    }
+
+    fn finish(&mut self) -> Result<(), String> {
+        for client in &mut self.clients {
+            client.online = true;
+            client.daemon().client.set_online(true);
+        }
+        self.note("every link up; waiting for the queues".into());
+        if !wait_until(self.profile.drain_budget, || {
+            self.logged.extend(take_logged());
+            self.landed()
+        }) {
+            return Err(format!(
+                "no loss: Drive does not hold what the clients wrote, {:?} after the links came up\n{}",
+                self.profile.drain_budget,
+                self.difference()
+            ));
+        }
+        // Each client's folder is its own, so a file of it gone from Drive was
+        // deleted by the client.
+        if let Some(line) = self.logged.iter().find(|line| is_own_delete_kept(line)) {
+            return Err(format!(
+                "no false conflicts: the drain took a client's own delete for another device's: {line}"
+            ));
+        }
+        let drive = self.drive_tree();
+        let conflicts: Vec<String> = drive
+            .into_keys()
+            .filter(|path| is_conflict_copy(path))
+            .collect();
+        if !conflicts.is_empty() {
+            return Err(format!("no false conflicts: {conflicts:?}"));
+        }
+        for index in 0..self.clients.len() {
+            let mut last = Tree::new();
+            let converged = wait_until(CONVERGE_BUDGET, || {
+                last = read_tree(&self.clients[index].daemon().mountpoint);
+                last == self.drive_tree()
+            });
+            if !converged {
+                return Err(format!(
+                    "convergence: client {index}'s mount differs from Drive\n{}",
+                    diff(&last, &self.drive_tree(), "mount", "Drive")
+                ));
+            }
+        }
+        Ok(())
+    }
+
+    /// Whether every client's queue is empty and Drive holds what its model
+    /// says.
+    fn landed(&self) -> bool {
+        let drive = self.drive_tree();
+        self.clients.iter().enumerate().all(|(index, client)| {
+            client
+                .daemon()
+                .pending()
+                .is_ok_and(|items| items.is_empty())
+                && subtree(&drive, &owned_folder(index)) == *client.model.tree()
+        })
+    }
+
+    fn difference(&self) -> String {
+        let drive = self.drive_tree();
+        let mut out = String::new();
+        for (index, client) in self.clients.iter().enumerate() {
+            let pending = client.daemon().pending().unwrap_or_default();
+            for item in pending {
+                out.push_str(&format!(
+                    "  client {index} still owes: {} {} (attempts {}, last error {:?})\n",
+                    item.kind, item.path, item.attempts, item.last_error
+                ));
+            }
+            out.push_str(&diff(
+                client.model.tree(),
+                &subtree(&drive, &owned_folder(index)),
+                &format!("client {index}'s model"),
+                "Drive",
+            ));
+        }
+        out
+    }
+
+    fn drive_tree(&self) -> Tree {
+        self.drive
+            .tree()
+            .into_iter()
+            .map(|(path, entry)| {
+                let content = match entry {
+                    Entry::Folder => None,
+                    Entry::File(content) => Some(content.as_ref().clone()),
+                };
+                (path, content)
+            })
+            .collect()
+    }
+
+    fn note(&mut self, line: String) {
+        let line = format!("{:>8.3}s {line}", self.started.elapsed().as_secs_f64());
+        self.log.push(line);
+    }
+
+    fn report(&self, failure: &str, dir: &Path) -> String {
+        let _ = std::fs::write(dir.join("steps.log"), self.log.join("\n") + "\n");
+        let tail = &self.log[self.log.len().saturating_sub(LOG_TAIL)..];
+        format!(
+            "{} seed {} failed: {failure}\nreplay with PDFS_SIM_SEED={}; state kept in {}\nlast steps:\n{}",
+            self.profile.name,
+            self.seed,
+            self.seed,
+            dir.display(),
+            tail.join("\n")
+        )
+    }
+}
+
+/// Make `op` under `root`. The outer error is a check that failed on the
+/// way (the content an open file reads back), the inner one the errno.
+fn perform(root: &Path, op: &FsOp, before: Option<&[u8]>) -> Result<Result<(), i32>, String> {
+    let at = |path: &str| root.join(path);
+    let result: io::Result<()> = match op {
+        FsOp::Create { path, data } => std::fs::write(at(path), data),
+        FsOp::Write { path, offset, data } => OpenOptions::new()
+            .write(true)
+            .open(at(path))
+            .and_then(|mut file| {
+                file.seek(SeekFrom::Start(*offset))?;
+                file.write_all(data)
+            }),
+        FsOp::Truncate { path, len } => OpenOptions::new()
+            .write(true)
+            .open(at(path))
+            .and_then(|file| file.set_len(*len)),
+        FsOp::Mkdir { path } => std::fs::create_dir(at(path)),
+        FsOp::Rename { from, to } => std::fs::rename(at(from), at(to)),
+        FsOp::Unlink { path } => std::fs::remove_file(at(path)),
+        FsOp::Rmdir { path } => std::fs::remove_dir(at(path)),
+        FsOp::UnlinkOpen { path, data } => {
+            let mut read = Vec::new();
+            let result = OpenOptions::new()
+                .read(true)
+                .write(true)
+                .open(at(path))
+                .and_then(|mut file| {
+                    std::fs::remove_file(at(path))?;
+                    file.seek(SeekFrom::End(0))?;
+                    file.write_all(data)?;
+                    file.seek(SeekFrom::Start(0))?;
+                    file.read_to_end(&mut read).map(|_| ())
+                });
+            if result.is_ok() {
+                let expected = [before.unwrap_or_default(), data].concat();
+                if read != expected {
+                    return Err(format!(
+                        "posix: {} read back {:?}, expected {:?}",
+                        op.describe(),
+                        String::from_utf8_lossy(&read),
+                        String::from_utf8_lossy(&expected)
+                    ));
+                }
+            }
+            result
+        }
+    };
+    Ok(result.map_err(|error| error.raw_os_error().unwrap_or(libc::EIO)))
+}
+
+fn target(op: &FsOp) -> &str {
+    match op {
+        FsOp::Create { path, .. }
+        | FsOp::Write { path, .. }
+        | FsOp::Truncate { path, .. }
+        | FsOp::Mkdir { path }
+        | FsOp::Unlink { path }
+        | FsOp::UnlinkOpen { path, .. }
+        | FsOp::Rmdir { path } => path,
+        FsOp::Rename { from, .. } => from,
+    }
+}
+
+/// The tree a mount shows, read through it, without the folders it makes up
+/// that are not on Drive.
+fn read_tree(mountpoint: &Path) -> Tree {
+    fn walk(dir: &Path, prefix: &str, tree: &mut Tree) {
+        let Ok(entries) = std::fs::read_dir(dir) else {
+            return;
+        };
+        for entry in entries.flatten() {
+            let name = entry.file_name().to_string_lossy().into_owned();
+            if prefix.is_empty() && name == crate::r#virtual::SHARED_WITH_ME_BASE {
+                continue;
+            }
+            let path = super::model::join(prefix, &name);
+            if entry.file_type().is_ok_and(|kind| kind.is_dir()) {
+                tree.insert(path.clone(), None);
+                walk(&entry.path(), &path, tree);
+            } else {
+                tree.insert(path, std::fs::read(entry.path()).ok());
+            }
+        }
+    }
+    let mut tree = Tree::new();
+    walk(mountpoint, "", &mut tree);
+    tree
+}
+
+/// The part of `tree` below `folder`, relative to it.
+fn subtree(tree: &Tree, folder: &str) -> Tree {
+    let prefix = format!("{folder}/");
+    tree.iter()
+        .filter_map(|(path, entry)| Some((path.strip_prefix(&prefix)?.to_owned(), entry.clone())))
+        .collect()
+}
+
+fn owned_folder(index: usize) -> String {
+    format!("c{index}")
+}
+
+/// Whether `line` is the drain keeping a queued write as a conflict copy
+/// because Drive no longer holds the file, or holds it in the trash.
+fn is_own_delete_kept(line: &str) -> bool {
+    line.starts_with("queued write conflicts; keeping a conflict copy")
+        && (line.contains(" reason=\"the file was trashed remotely\"")
+            || line.contains(" reason=\"the file no longer exists remotely\""))
+}
+
+fn is_conflict_copy(path: &str) -> bool {
+    path.split('/')
+        .any(|name| name.contains("(sync-conflict") || name.starts_with("recovered-"))
+}
+
+fn diff(left: &Tree, right: &Tree, left_name: &str, right_name: &str) -> String {
+    let show = |entry: &Option<Vec<u8>>| match entry {
+        None => "folder".to_owned(),
+        Some(content) => format!("{:?}", String::from_utf8_lossy(content)),
+    };
+    let mut out = String::new();
+    for (path, entry) in left {
+        match right.get(path) {
+            None => out.push_str(&format!(
+                "  {path}: only in {left_name} ({})\n",
+                show(entry)
+            )),
+            Some(other) if other != entry => out.push_str(&format!(
+                "  {path}: {left_name} has {}, {right_name} has {}\n",
+                show(entry),
+                show(other)
+            )),
+            Some(_) => {}
+        }
+    }
+    for (path, entry) in right {
+        if !left.contains_key(path) {
+            out.push_str(&format!(
+                "  {path}: only in {right_name} ({})\n",
+                show(entry)
+            ));
+        }
+    }
+    out
+}
+
+fn errno(outcome: Result<(), i32>) -> String {
+    match outcome {
+        Ok(()) => "ok".into(),
+        Err(code) => io::Error::from_raw_os_error(code).to_string(),
+    }
+}
+
+fn outcome(actual: &Result<Result<(), i32>, String>) -> String {
+    match actual {
+        Ok(result) => errno(*result),
+        Err(check) => check.clone(),
+    }
+}
+
+/// Run `profile` over the seeds the environment asks for: `PDFS_SIM_SEED`
+/// alone, or `PDFS_SIM_SEEDS` of them (default `default_seeds`) from 1.
+pub(crate) fn run_seeds(profile: &'static Profile, default_seeds: u64) {
+    let seeds: Vec<u64> = match std::env::var("PDFS_SIM_SEED") {
+        Ok(seed) => vec![seed.parse().expect("PDFS_SIM_SEED is a number")],
+        Err(_) => {
+            let count = std::env::var("PDFS_SIM_SEEDS")
+                .ok()
+                .and_then(|count| count.parse().ok())
+                .unwrap_or(default_seeds);
+            (1..=count).collect()
+        }
+    };
+    let failures: Vec<String> = seeds
+        .into_iter()
+        .filter_map(|seed| run(seed, profile).err())
+        .collect();
+    assert!(failures.is_empty(), "\n{}", failures.join("\n\n"));
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    static ONE_CLIENT_LAN: Profile = Profile {
+        name: "one-client-lan",
+        clients: 1,
+        steps: 80,
+        faults: Faults::lan,
+        link_flaps: false,
+        restarts: false,
+        deletes_mid_upload: false,
+        settle_budget: Some(Duration::from_secs(4)),
+        syscall_budget: Duration::from_secs(2),
+        drain_budget: Duration::from_secs(20),
+    };
+
+    static ONE_CLIENT_DELETES: Profile = Profile {
+        name: "one-client-deletes",
+        clients: 1,
+        steps: 30,
+        faults: Faults::lan,
+        link_flaps: false,
+        restarts: false,
+        deletes_mid_upload: true,
+        settle_budget: Some(Duration::from_secs(4)),
+        syscall_budget: Duration::from_secs(2),
+        drain_budget: Duration::from_secs(20),
+    };
+
+    static ONE_CLIENT_ECHOES: Profile = Profile {
+        name: "one-client-echoes",
+        clients: 1,
+        steps: 60,
+        faults: Faults::echoes,
+        link_flaps: false,
+        restarts: false,
+        deletes_mid_upload: false,
+        settle_budget: Some(Duration::from_secs(6)),
+        syscall_budget: Duration::from_secs(2),
+        drain_budget: Duration::from_secs(20),
+    };
+
+    static ONE_CLIENT_FLAKY: Profile = Profile {
+        name: "one-client-flaky",
+        clients: 1,
+        steps: 80,
+        faults: Faults::wifi,
+        link_flaps: true,
+        restarts: true,
+        deletes_mid_upload: false,
+        settle_budget: None,
+        syscall_budget: Duration::from_secs(10),
+        drain_budget: Duration::from_secs(120),
+    };
+
+    /// Wi-Fi's latency, lag and lost replies without the outages: the queue
+    /// has to drain within a settle, not merely by the end.
+    static ONE_CLIENT_WIFI: Profile = Profile {
+        name: "one-client-wifi",
+        clients: 1,
+        steps: 80,
+        faults: Faults::wifi,
+        link_flaps: false,
+        restarts: false,
+        deletes_mid_upload: false,
+        settle_budget: Some(Duration::from_secs(30)),
+        syscall_budget: Duration::from_secs(10),
+        drain_budget: Duration::from_secs(120),
+    };
+
+    static THREE_CLIENTS: Profile = Profile {
+        name: "three-clients",
+        clients: 3,
+        steps: 90,
+        faults: Faults::lan,
+        link_flaps: true,
+        restarts: true,
+        deletes_mid_upload: false,
+        settle_budget: Some(Duration::from_secs(4)),
+        syscall_budget: Duration::from_secs(2),
+        drain_budget: Duration::from_secs(60),
+    };
+
+    #[test]
+    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse --lib sim::run -- --ignored`"]
+    fn one_client_on_a_good_link() {
+        run_seeds(&ONE_CLIENT_LAN, 12);
+    }
+
+    #[test]
+    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse --lib sim::run -- --ignored`"]
+    fn one_client_deleting_files_as_they_upload() {
+        run_seeds(&ONE_CLIENT_DELETES, 3);
+    }
+
+    #[test]
+    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse --lib sim::run -- --ignored`"]
+    fn one_client_with_stale_hashes_and_reordered_echoes() {
+        run_seeds(&ONE_CLIENT_ECHOES, 6);
+    }
+
+    #[test]
+    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse --lib sim::run -- --ignored`"]
+    fn one_client_on_a_flaky_link() {
+        run_seeds(&ONE_CLIENT_FLAKY, 4);
+    }
+
+    #[test]
+    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse --lib sim::run -- --ignored`"]
+    fn one_client_on_a_slow_link() {
+        run_seeds(&ONE_CLIENT_WIFI, 4);
+    }
+
+    #[test]
+    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse --lib sim::run -- --ignored`"]
+    fn three_clients_one_writer_each() {
+        run_seeds(&THREE_CLIENTS, 3);
+    }
+
+    #[test]
+    fn conflict_copies_are_recognised_by_name() {
+        assert!(is_conflict_copy("c0/x/a (sync-conflict 1790000000).txt"));
+        assert!(is_conflict_copy("recovered-XrPUSW5W"));
+        assert!(!is_conflict_copy("c0/x/a.txt"));
+    }
+
+    #[test]
+    fn a_write_kept_because_its_file_is_gone_is_recognised() {
+        let kept = "queued write conflicts; keeping a conflict copy uid=simvol~L10 \
+                    name=\"f.txt\" reason=\"the file was trashed remotely\"";
+        assert!(is_own_delete_kept(kept));
+        assert!(is_own_delete_kept(
+            &kept.replace("was trashed", "no longer exists")
+        ));
+        assert!(!is_own_delete_kept(
+            &kept.replace("the file was trashed remotely", "revision changed")
+        ));
+    }
+}

crates/pdfs-fuse/src/sim/watchdog.rs

@@ -0,0 +1,322 @@
+//! Turns a call through a mount that never returns into a failed seed.
+//!
+//! A deadlock in a daemon leaves the run's own thread blocked in the kernel,
+//! where no budget check is reached, and a CI job then waits for its timeout.
+//! The watchdog runs beside the run. When what it was armed for outlives its
+//! limit, it aborts the FUSE connections of the run's mounts, so the blocked
+//! call fails and the run reports the hang, and writes where every thread was
+//! to `stacks.txt`.
+//!
+//! The stacks are taken in the process: no tracer can stop a thread that
+//! waits on a FUSE request, so `gdb` and `eu-stack` wait as long as the hang.
+//! Each thread is sent [`stack_signal`] and captures its own backtrace in the
+//! handler. A thread in the kernel takes the signal only once it leaves, so
+//! the mounts are aborted after the others have answered, and its backtrace
+//! is the call it was blocked in. Its kernel wait channel is recorded first.
+
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::thread::JoinHandle;
+use std::time::{Duration, Instant};
+
+use parking_lot::Mutex;
+
+use super::daemon::wait_until;
+
+/// How long the threads that are not blocked in the kernel have to answer,
+/// and the blocked ones once the mounts are aborted.
+const ANSWER: Duration = Duration::from_secs(5);
+
+pub(crate) struct Watchdog {
+    shared: Arc<Shared>,
+    thread: Option<JoinHandle<()>>,
+}
+
+struct Shared {
+    /// The run's directory: its mounts are below it, and the stacks go in it.
+    dir: PathBuf,
+    armed: Mutex<Option<Armed>>,
+    /// What hung, once something has.
+    fired: Mutex<Option<Hung>>,
+    stop: AtomicBool,
+}
+
+struct Armed {
+    what: String,
+    limit: Duration,
+    since: Instant,
+}
+
+/// What hung, and where every thread was then.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct Hung {
+    pub(crate) what: String,
+    pub(crate) stacks: String,
+}
+
+/// Disarms the watchdog when dropped.
+pub(crate) struct Watching(Arc<Shared>);
+
+impl Watchdog {
+    pub(crate) fn new(dir: &Path) -> Self {
+        let shared = Arc::new(Shared {
+            dir: dir.to_path_buf(),
+            armed: Mutex::new(None),
+            fired: Mutex::new(None),
+            stop: AtomicBool::new(false),
+        });
+        let thread = {
+            let shared = shared.clone();
+            std::thread::Builder::new()
+                .name("sim-watchdog".into())
+                .spawn(move || watch(&shared))
+                .expect("spawn the simulation watchdog")
+        };
+        Self {
+            shared,
+            thread: Some(thread),
+        }
+    }
+
+    /// Watch `what` until the guard is dropped, and abort the mounts if it is
+    /// still going after `limit`.
+    pub(crate) fn arm(&self, limit: Duration, what: impl Into<String>) -> Watching {
+        *self.shared.armed.lock() = Some(Armed {
+            what: what.into(),
+            limit,
+            since: Instant::now(),
+        });
+        Watching(self.shared.clone())
+    }
+
+    /// What hung, if something did. Call [`Watchdog::stop`] first, or the
+    /// stacks may still be on their way.
+    pub(crate) fn fired(&self) -> Option<Hung> {
+        self.shared.fired.lock().clone()
+    }
+
+    /// Stop watching, once the stacks of a hang that was caught are taken.
+    pub(crate) fn stop(&mut self) {
+        self.shared.stop.store(true, Ordering::Relaxed);
+        if let Some(thread) = self.thread.take() {
+            let _ = thread.join();
+        }
+    }
+}
+
+impl Drop for Watching {
+    fn drop(&mut self) {
+        *self.0.armed.lock() = None;
+    }
+}
+
+impl Drop for Watchdog {
+    fn drop(&mut self) {
+        self.stop();
+    }
+}
+
+fn watch(shared: &Shared) {
+    while !shared.stop.load(Ordering::Relaxed) {
+        std::thread::sleep(Duration::from_millis(200));
+        let hung = shared
+            .armed
+            .lock()
+            .as_ref()
+            .filter(|armed| armed.since.elapsed() > armed.limit)
+            .map(|armed| format!("{} has not returned after {:?}", armed.what, armed.limit));
+        let Some(hung) = hung else { continue };
+        *shared.armed.lock() = None;
+        let path = shared.dir.join("stacks.txt");
+        // Before anything is let go: the run reports the hang, not whatever
+        // the aborted call answers.
+        *shared.fired.lock() = Some(Hung {
+            what: format!("{hung}; the stacks are in {}", path.display()),
+            stacks: String::new(),
+        });
+        let stacks = take_stacks(|| abort_mounts_below(&shared.dir));
+        let what = match std::fs::write(&path, &stacks) {
+            Ok(()) => format!("{hung}; the stacks are in {}", path.display()),
+            Err(error) => format!("{hung}; the stacks could not be kept: {error}"),
+        };
+        *shared.fired.lock() = Some(Hung { what, stacks });
+    }
+}
+
+/// One thread of this process as the kernel sees it.
+struct Task {
+    tid: i32,
+    name: String,
+    /// `D` while it waits in the kernel uninterruptibly.
+    state: String,
+    wchan: String,
+}
+
+/// Where every other thread of this process is, with `release` called once
+/// those not blocked in the kernel have answered.
+fn take_stacks(release: impl FnOnce()) -> String {
+    let own = gettid();
+    let tasks = tasks();
+    STACKS.lock().clear();
+    install_stack_handler();
+    for task in &tasks {
+        if task.tid != own {
+            // SAFETY: tgkill only sends a signal, whose handler is installed.
+            unsafe {
+                libc::syscall(
+                    libc::SYS_tgkill,
+                    std::process::id() as i32,
+                    task.tid,
+                    stack_signal(),
+                )
+            };
+        }
+    }
+    let answered = |blocked: bool| {
+        let stacks = STACKS.lock();
+        tasks
+            .iter()
+            .filter(|task| task.tid != own && (blocked || task.state != "D"))
+            .all(|task| stacks.contains_key(&task.tid))
+    };
+    wait_until(ANSWER, || answered(false));
+    release();
+    wait_until(ANSWER, || answered(true));
+    let stacks = std::mem::take(&mut *STACKS.lock());
+    let mut out = String::new();
+    for task in tasks.iter().filter(|task| task.tid != own) {
+        out.push_str(&format!(
+            "thread {} {:?}, state {}, waiting in {}\n",
+            task.tid, task.name, task.state, task.wchan
+        ));
+        match stacks.get(&task.tid) {
+            Some(stack) => out.push_str(&format!("{stack}\n")),
+            None => out.push_str("  (no answer)\n\n"),
+        }
+    }
+    out
+}
+
+fn tasks() -> Vec<Task> {
+    let Ok(entries) = std::fs::read_dir("/proc/self/task") else {
+        return Vec::new();
+    };
+    let read = |dir: &Path, file: &str| {
+        std::fs::read_to_string(dir.join(file))
+            .unwrap_or_default()
+            .trim()
+            .to_owned()
+    };
+    entries
+        .flatten()
+        .filter_map(|entry| {
+            let tid = entry.file_name().to_str()?.parse().ok()?;
+            let dir = entry.path();
+            // The state follows the name in parentheses, which may hold spaces.
+            let stat = read(&dir, "stat");
+            let state = stat.rsplit_once(") ")?.1.split(' ').next()?.to_owned();
+            Some(Task {
+                tid,
+                name: read(&dir, "comm"),
+                state,
+                wchan: read(&dir, "wchan"),
+            })
+        })
+        .collect()
+}
+
+/// The backtraces the threads captured, by thread id.
+static STACKS: Mutex<BTreeMap<i32, std::backtrace::Backtrace>> = Mutex::new(BTreeMap::new());
+
+/// The signal that asks a thread for its stack: one of the real-time signals
+/// that nothing in the daemon uses.
+fn stack_signal() -> i32 {
+    libc::SIGRTMIN() + 7
+}
+
+fn install_stack_handler() {
+    static INSTALLED: std::sync::Once = std::sync::Once::new();
+    extern "C" fn handler(_: i32) {
+        // Not async-signal-safe: the capture allocates. The process is being
+        // taken down for a hang anyway, and a thread interrupted inside the
+        // allocator only fails to answer.
+        let stack = std::backtrace::Backtrace::force_capture();
+        STACKS.lock().insert(gettid(), stack);
+    }
+    INSTALLED.call_once(|| {
+        // SAFETY: a zeroed sigaction with a handler and SA_RESTART is valid,
+        // and the handler only touches `STACKS`.
+        unsafe {
+            let mut action: libc::sigaction = std::mem::zeroed();
+            action.sa_sigaction = handler as extern "C" fn(i32) as usize;
+            action.sa_flags = libc::SA_RESTART;
+            libc::sigemptyset(&mut action.sa_mask);
+            libc::sigaction(stack_signal(), &action, std::ptr::null_mut());
+        }
+    });
+}
+
+fn gettid() -> i32 {
+    // SAFETY: gettid has no arguments and cannot fail.
+    unsafe { libc::gettid() }
+}
+
+/// Abort the FUSE connection of every mount below `dir`. Its connection is
+/// named by the mount's device minor, and the mount's owner may abort it.
+fn abort_mounts_below(dir: &Path) {
+    let Ok(mountinfo) = std::fs::read_to_string("/proc/self/mountinfo") else {
+        return;
+    };
+    for line in mountinfo.lines() {
+        let fields: Vec<&str> = line.split(' ').collect();
+        let (Some(device), Some(mountpoint)) = (fields.get(2), fields.get(4)) else {
+            continue;
+        };
+        if !Path::new(mountpoint).starts_with(dir) {
+            continue;
+        }
+        if let Some((_, minor)) = device.split_once(':') {
+            let _ = std::fs::write(format!("/sys/fs/fuse/connections/{minor}/abort"), "1");
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::sim::daemon::scratch;
+
+    #[test]
+    #[ignore = "signals every thread of the test process: run with `cargo test -p pdfs-fuse sim:: -- --ignored`"]
+    fn a_call_past_its_limit_is_reported_with_the_stacks() {
+        let dir = scratch("watchdog");
+        let mut watchdog = Watchdog::new(&dir);
+        {
+            let _watching = watchdog.arm(Duration::from_millis(100), "a nap");
+            std::thread::sleep(Duration::from_secs(1));
+        }
+        watchdog.stop();
+        let hung = watchdog.fired().expect("the watchdog fired");
+        assert!(
+            hung.what.starts_with("a nap has not returned after"),
+            "{hung:?}"
+        );
+        assert!(hung.stacks.contains("a_call_past_its_limit"), "{hung:?}");
+        let kept = std::fs::read_to_string(dir.join("stacks.txt")).unwrap_or_default();
+        assert_eq!(kept, hung.stacks);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn a_call_within_its_limit_is_not() {
+        let dir = scratch("watchdog-quiet");
+        let watchdog = Watchdog::new(&dir);
+        drop(watchdog.arm(Duration::from_millis(100), "a quick call"));
+        std::thread::sleep(Duration::from_millis(500));
+        assert_eq!(watchdog.fired(), None);
+        drop(watchdog);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}

crates/pdfs-fuse/src/state.rs

@@ -128,7 +128,62 @@ pub(crate) struct WriteHandle {
     pub(crate) open_count: usize,
 }
 
-/// A released write whose upload has not happened yet (offline.md Phase 3).
+impl WriteHandle {
+    /// A handle on a file `create` just made: an empty base, so everything
+    /// written through it is authored.
+    ///
+    /// The base is `node` as it actually exists — the empty file the server just
+    /// minted, or a queued create's placeholder — never the local clock or a
+    /// blank. `queue_revision` turns it into `StagedWrite::based_on` and the
+    /// drain compares the remote against that. A `now_secs()` mtime differs from
+    /// the server's stamp by the create round-trip. A missing revision id drops
+    /// the check to `(mtime, size)`, and moving or renaming the file advances
+    /// its mtime on the server. Either way the first write to a brand-new file
+    /// lands as a conflict copy of its own empty create (`docs/BUGS.md` B113).
+    pub(crate) fn created(ino: u64, node: &Node, file: File, path: PathBuf) -> Self {
+        Self {
+            ino,
+            uid: node.uid.clone(),
+            file: Arc::new(file),
+            path,
+            written: Intervals::default(),
+            len: 0,
+            base_size: 0,
+            base_mtime: node.modification_time,
+            base_revision_id: crate::node_revision_id(node),
+            dirty: false,
+            open_count: 0,
+        }
+    }
+
+    /// Write over `node` from now on: a revision this daemon has just put on the
+    /// server under the handle, by sealing an upload or by landing the queued
+    /// create the handle was opened on. The base the handle opened over is gone,
+    /// and keeping it would make the drain read our own revision as another
+    /// device's edit.
+    pub(crate) fn rebase_onto(&mut self, node: &Node) {
+        self.base_mtime = node.modification_time;
+        self.base_size = crate::node_size(node);
+        self.base_revision_id = crate::node_revision_id(node);
+    }
+
+    /// Account for `[offset, end)` having been written through this handle.
+    ///
+    /// A write past the end leaves a hole that reads as zeros, exactly like a
+    /// grow through `setattr`, so the hole is authored too. Left unauthored, a
+    /// hole below the base size was refilled from the base at commit: a file
+    /// shrunk and then written past its new end got its old bytes back.
+    pub(crate) fn record_write(&mut self, offset: u64, end: u64) {
+        if offset > self.len {
+            self.written.add(self.len, offset);
+        }
+        self.written.add(offset, end);
+        self.len = self.len.max(end);
+        self.dirty = true;
+    }
+}
+
+/// A released write whose upload has not happened yet.
 ///
 /// The bytes live in the content cache's staging dir and the intent lives in the
 /// `pending_op` table; this pairs them in memory so a read can be served without
@@ -146,8 +201,29 @@ pub(crate) struct PendingRevision {
 /// time so this module stays free of `fuser`.
 pub(crate) type DirListing = Vec<(u64, bool, String)>;
 
+/// Where [`State::next_ino`] starts: far above any local id a database hands
+/// out, so a fallback inode never names a node that has a row.
+pub(crate) const FALLBACK_INO: u64 = 1 << 48;
+
+/// The inode of the node with local id `lid` ([`Db::lids_for`]). One above the
+/// lid, so no node takes [`crate::ROOT_INO`], which each session uses for its
+/// own root. The same in every mount and after a restart.
+pub(crate) fn lid_ino(lid: i64) -> u64 {
+    lid.unsigned_abs() + crate::ROOT_INO
+}
+
+/// The local id of the node at inode `ino`, the inverse of [`lid_ino`]:
+/// `None` for the root and a fallback inode.
+pub(crate) fn ino_lid(ino: u64) -> Option<i64> {
+    (ino > crate::ROOT_INO && ino < FALLBACK_INO).then(|| (ino - crate::ROOT_INO) as i64)
+}
+
 /// Mutable inode bookkeeping, guarded by a mutex because fuser drives the
 /// `Filesystem` trait through `&self`.
+///
+/// One tree for every mount of the daemon. Each FUSE session sees it from its
+/// own root ([`State::roots`]) and calls that root inode 1; `ProtonFs`
+/// translates at the kernel boundary.
 pub(crate) struct State {
     /// inode -> node metadata.
     pub(crate) entries: HashMap<u64, Entry>,
@@ -156,6 +232,12 @@ pub(crate) struct State {
     /// Cached directory listings: parent inode -> child inodes. Presence of a
     /// key means the directory has been enumerated.
     pub(crate) children: HashMap<u64, Vec<u64>>,
+    /// The inodes some session has been rooted at ([`State::install_root`]).
+    /// A root is its own parent. Kept after its session unmounts: the node is
+    /// still one of ours.
+    pub(crate) roots: HashSet<u64>,
+    /// The next inode for a node the database could not give a local id, from
+    /// a range lids never reach ([`FALLBACK_INO`]).
     pub(crate) next_ino: u64,
     /// Shared write state keyed by inode. Concurrent writers share the scratch file.
     pub(crate) active_writes: HashMap<u64, WriteHandle>,
@@ -171,13 +253,13 @@ pub(crate) struct State {
     /// two pages shifted every later entry, and the caller silently skipped or
     /// repeated whatever crossed the page boundary. Each entry is
     /// `(ino, is_dir, name)` — the kernel type is mapped at reply time so this
-    /// module stays free of `fuser` (bugs.md B43).
+    /// module stays free of `fuser` (`docs/BUGS.md` B43).
     pub(crate) dir_snapshots: HashMap<u64, Arc<DirListing>>,
     /// Resident inode attributes whose effective access changed during an
     /// intern/root refresh. Core drains this set and notifies the matching
     /// kernel only after releasing the State lock.
     pub(crate) access_changes: HashSet<u64>,
-    /// Persisted shared-root authority, loaded once per inode space and updated
+    /// Persisted shared-root authority, loaded once and updated
     /// on every explicit role/tombstone change. Descendant inheritance reads
     /// this map instead of issuing one SQLite query per interned inode.
     pub(crate) share_access: HashMap<NodeUid, Access>,
@@ -245,15 +327,6 @@ pub(crate) struct StateGuard<'a> {
     db: &'a Arc<Db>,
 }
 
-/// Take a mount's inode lock through a [`StateGuard`], for the loops that walk
-/// every live mount rather than this `Core`'s own.
-pub(crate) fn lock_state<'a>(
-    state: &'a parking_lot::Mutex<State>,
-    db: &'a Arc<Db>,
-) -> StateGuard<'a> {
-    StateGuard::new(state.lock(), db)
-}
-
 impl<'a> StateGuard<'a> {
     pub(crate) fn new(guard: parking_lot::MutexGuard<'a, State>, db: &'a Arc<Db>) -> Self {
         Self {
@@ -294,9 +367,6 @@ impl Drop for StateGuard<'_> {
 impl State {
     /// A fresh, empty inode space over `db`.
     ///
-    /// `next_ino` differs by caller: a real mount hands out [`crate::ROOT_INO`]
-    /// to its root and starts allocating above it, while a bare state under test
-    /// has no root and starts at 1.
     /// Apply the write-throughs this state owes SQLite, here and now.
     ///
     /// Production code never calls this: [`StateGuard`] releases the inode lock
@@ -323,12 +393,15 @@ impl State {
         self.db.clone()
     }
 
-    pub(crate) fn new(db: Arc<Db>, share_access: HashMap<NodeUid, Access>, next_ino: u64) -> Self {
+    /// A fresh, empty tree over `db`. A node's inode comes from its local id
+    /// ([`lid_ino`]).
+    pub(crate) fn new(db: Arc<Db>, share_access: HashMap<NodeUid, Access>) -> Self {
         Self {
             entries: HashMap::new(),
             by_uid: HashMap::new(),
             children: HashMap::new(),
-            next_ino,
+            roots: HashSet::new(),
+            next_ino: FALLBACK_INO,
             active_writes: HashMap::new(),
             handles: HashMap::new(),
             next_fh: 1,
@@ -339,18 +412,55 @@ impl State {
             outbox: Vec::new(),
         }
     }
-    /// Whether `uid` names an owned node currently reachable from this mount's
-    /// root. Resident entries can outlive their dentries for open-handle and
-    /// access-revocation semantics, so `by_uid` membership alone is not proof
-    /// that a control-socket operation may address the node.
-    pub(crate) fn owns_visible_uid(&self, uid: &NodeUid) -> bool {
-        let Some(root) = self.entries.get(&crate::ROOT_INO) else {
-            return false;
-        };
-        if uid.volume_id != root.uid.volume_id {
-            return false;
+    /// Make `root` the root of a session and return its inode, which comes
+    /// from its local id like any other node's.
+    ///
+    /// The root is always owned. It must never be classified as a shared root,
+    /// even when the API returns membership data (which happens when the owner
+    /// shares the folder with someone else), so a stale share row a downgrade
+    /// may have left for it is dropped. A node already in the tree keeps its
+    /// inode and its lookups, and stops naming a parent: a session's `..` at
+    /// its root is the root.
+    pub(crate) fn install_root(&mut self, root: Node) -> u64 {
+        if let Err(e) = self.db.upsert_node(&root) {
+            warn!(uid = %root.uid, error = %e, "db upsert root failed");
         }
+        self.share_access.remove(&root.uid);
+        let _ = self.db.delete_share_access(&root.uid);
+        let ino = match self.by_uid.get(&root.uid) {
+            Some(&ino) => ino,
+            None => self.new_inos(&[&root])[&root.uid],
+        };
+        if let Some(old) = self.entries.get(&ino).map(|e| e.parent)
+            && old != ino
+            && let Some(kids) = self.children.get_mut(&old)
+        {
+            kids.retain(|&k| k != ino);
+        }
+        self.by_uid.insert(root.uid.clone(), ino);
+        let lookup_count = self.entries.get(&ino).map_or(1, |e| e.lookup_count.max(1));
+        self.entries.insert(
+            ino,
+            Entry {
+                uid: root.uid.clone(),
+                parent: ino,
+                node: root,
+                access: Access::Owner,
+                lookup_count,
+                open_count: 0,
+                unlinked: false,
+            },
+        );
+        self.roots.insert(ino);
+        ino
+    }
 
+    /// Whether `uid` names an owned node currently reachable from one of
+    /// `roots`, the roots of the sessions that are mounted. Resident entries
+    /// can outlive their dentries for open-handle and access-revocation
+    /// semantics, so `by_uid` membership alone is not proof that a
+    /// control-socket operation may address the node.
+    pub(crate) fn owns_visible_uid(&self, uid: &NodeUid, roots: &[u64]) -> bool {
         let Some(&target) = self.by_uid.get(uid) else {
             return false;
         };
@@ -363,7 +473,9 @@ impl State {
             let Some(entry) = self.entries.get(&current) else {
                 return false;
             };
-            if entry.uid.volume_id != root.uid.volume_id
+            // The node's root scopes it to its own volume, excluding foreign
+            // shared-with-me residents from uid-addressed sharing.
+            if entry.uid.volume_id != uid.volume_id
                 || entry.unlinked
                 || entry.node.trashed
                 || entry.uid != entry.node.uid
@@ -371,7 +483,7 @@ impl State {
             {
                 return false;
             }
-            if current == crate::ROOT_INO {
+            if roots.contains(&current) {
                 return true;
             }
 
@@ -413,15 +525,17 @@ impl State {
         self.access_changes.drain().collect()
     }
 
-    /// Whether `uid` lives on the volume this mount is rooted in.
+    /// Whether `uid` lives on a volume some mount is rooted in.
     ///
     /// Used to decide how a node with no resolvable parent is classified:
     /// our own volume fails open (it is owned content), a foreign volume
     /// fails closed (it can only be there because of a share).
     pub(crate) fn is_own_volume(&self, uid: &NodeUid) -> bool {
-        self.entries
-            .get(&crate::ROOT_INO)
-            .is_some_and(|root| root.uid.volume_id == uid.volume_id)
+        self.roots.iter().any(|ino| {
+            self.entries
+                .get(ino)
+                .is_some_and(|root| root.uid.volume_id == uid.volume_id)
+        })
     }
 
     fn stored_share_access(&self, uid: &NodeUid) -> Option<Access> {
@@ -770,11 +884,59 @@ impl State {
         }
     }
 
-    pub(crate) fn intern(&mut self, parent: u64, node: Node) -> u64 {
+    /// Write `node` through as it is, in order with the tree's other changes.
+    pub(crate) fn write_through(&mut self, node: Node) {
+        self.outbox.push(DbWrite::Upsert(vec![node]));
+    }
+
+    pub(crate) fn intern(&mut self, parent: u64, mut node: Node) -> u64 {
+        self.keep_revision_mtime(&mut node);
         self.outbox.push(DbWrite::Upsert(vec![node.clone()]));
         self.intern_mem(parent, node)
     }
 
+    /// Keep what is already known of a file whose content has not changed.
+    ///
+    /// Drive stamps a link's `ModifyTime` on a rename or a move as well, while
+    /// POSIX leaves a file's mtime alone there. The content cache is keyed by
+    /// it, too: taking the new stamp made the cached bytes unreachable, so the
+    /// next partial write could not fill its gaps (docs/BUGS.md B123). The
+    /// active revision id says whether the content is still the same, and so
+    /// whether the size and digest a listing left out are still the ones known.
+    fn keep_revision_mtime(&self, node: &mut Node) {
+        let Some(entry) = self
+            .by_uid
+            .get(&node.uid)
+            .and_then(|ino| self.entries.get(ino))
+        else {
+            return;
+        };
+        if let (
+            NodeKind::File {
+                active_revision_id: Some(now),
+                claimed_size,
+                content_sha1,
+                ..
+            },
+            NodeKind::File {
+                active_revision_id: Some(was),
+                claimed_size: size_was,
+                content_sha1: sha1_was,
+                ..
+            },
+        ) = (&mut node.kind, &entry.node.kind)
+            && now == was
+        {
+            node.modification_time = entry.node.modification_time;
+            if claimed_size.is_none() {
+                *claimed_size = *size_was;
+            }
+            if content_sha1.is_none() {
+                content_sha1.clone_from(sha1_was);
+            }
+        }
+    }
+
     /// Allocate (or reuse) a stable inode for a node, updating the hot-cache maps
     /// only. Every caller owes the DB a write-through — see the callers below;
     /// the split exists so a batch can pay for one transaction instead of `n`.
@@ -784,11 +946,24 @@ impl State {
     }
 
     fn intern_mem_with_access(&mut self, parent: u64, node: Node, access: Access) -> u64 {
+        self.intern_mem_at(parent, node, access, None)
+    }
+
+    /// [`State::intern_mem_with_access`], with the inode a new entry takes when
+    /// the caller already has it ([`State::new_inos`]).
+    fn intern_mem_at(
+        &mut self,
+        parent: u64,
+        mut node: Node,
+        access: Access,
+        ino: Option<u64>,
+    ) -> u64 {
         if let Some(&ino) = self.by_uid.get(&node.uid) {
             let changed = self
                 .entries
                 .get(&ino)
                 .is_some_and(|entry| entry.access != access);
+            self.keep_open_write_size(ino, &mut node);
             if let Some(e) = self.entries.get_mut(&ino) {
                 e.node = node;
                 e.parent = parent;
@@ -801,8 +976,13 @@ impl State {
             }
             return ino;
         }
-        let ino = self.next_ino;
-        self.next_ino += 1;
+        let ino = match ino {
+            Some(ino) => ino,
+            None => self
+                .new_inos(&[&node])
+                .remove(&node.uid)
+                .unwrap_or_default(),
+        };
         self.by_uid.insert(node.uid.clone(), ino);
         self.entries.insert(
             ino,
@@ -819,6 +999,41 @@ impl State {
         ino
     }
 
+    /// The inodes for nodes that have no entry yet, from their local ids, in
+    /// one transaction. Should the database fail, they come from
+    /// [`State::next_ino`] instead, so the mount keeps working, with inodes
+    /// that last only this run. So do the inodes of virtual folders, which are
+    /// never stored.
+    fn new_inos(&mut self, nodes: &[&Node]) -> HashMap<NodeUid, u64> {
+        let (virtual_nodes, stored): (Vec<&Node>, Vec<&Node>) = nodes
+            .iter()
+            .partition(|node| crate::r#virtual::is_virtual_uid(&node.uid));
+        let mut inos = match self.db.lids_for(&stored) {
+            Ok(lids) => stored
+                .iter()
+                .zip(lids)
+                .map(|(node, lid)| (node.uid.clone(), lid_ino(lid)))
+                .collect(),
+            Err(error) => {
+                warn!(%error, "no local ids for new inodes; numbering them for this run");
+                self.run_inos(&stored)
+            }
+        };
+        inos.extend(self.run_inos(&virtual_nodes));
+        inos
+    }
+
+    fn run_inos(&mut self, nodes: &[&Node]) -> HashMap<NodeUid, u64> {
+        nodes
+            .iter()
+            .map(|node| {
+                let ino = self.next_ino;
+                self.next_ino += 1;
+                (node.uid.clone(), ino)
+            })
+            .collect()
+    }
+
     /// Decrement lookup count for an inode and prune if lookup_count == 0 && open_count == 0 && unlinked.
     pub(crate) fn forget_lookup(&mut self, ino: u64, nlookup: u64) -> Option<(u64, String)> {
         if let Some(entry) = self.entries.get_mut(&ino) {
@@ -833,6 +1048,23 @@ impl State {
 
     /// Allocate (or reuse) a stable inode for a node that came *from* the
     /// database, which is why nothing is written back.
+    /// Carry the size and mtime of a file open for writing over onto `node`,
+    /// which is about to replace its entry.
+    ///
+    /// The open handle is ahead of anything Drive can report until release
+    /// queues it. Taking the remote's size shrank a SQLite database to its empty
+    /// create while SQLite held it open, and the kernel then capped every read
+    /// at that size (docs/BUGS.md B109).
+    pub(crate) fn keep_open_write_size(&self, ino: u64, node: &mut Node) {
+        let (Some(aw), Some(entry)) = (self.active_writes.get(&ino), self.entries.get(&ino)) else {
+            return;
+        };
+        if let NodeKind::File { claimed_size, .. } = &mut node.kind {
+            *claimed_size = Some(aw.len as i64);
+            node.modification_time = entry.node.modification_time;
+        }
+    }
+
     pub(crate) fn intern_from_db(&mut self, parent: u64, node: Node) -> u64 {
         self.intern_mem(parent, node)
     }
@@ -842,11 +1074,27 @@ impl State {
     ///
     /// This is what keeps `ls` on a large folder quick: one commit for the
     /// listing, rather than one autocommit — and one fsync — per child.
-    pub(crate) fn intern_batch(&mut self, parent: u64, nodes: Vec<Node>) -> Vec<u64> {
+    pub(crate) fn intern_batch(&mut self, parent: u64, mut nodes: Vec<Node>) -> Vec<u64> {
+        for node in &mut nodes {
+            self.keep_revision_mtime(node);
+        }
         self.outbox.push(DbWrite::Upsert(nodes.clone()));
+        let fresh: Vec<&Node> = nodes
+            .iter()
+            .filter(|node| !self.by_uid.contains_key(&node.uid))
+            .collect();
+        let mut inos = if fresh.is_empty() {
+            HashMap::new()
+        } else {
+            self.new_inos(&fresh)
+        };
         nodes
             .into_iter()
-            .map(|node| self.intern_mem(parent, node))
+            .map(|node| {
+                let access = self.access_for_node(parent, &node);
+                let ino = inos.remove(&node.uid);
+                self.intern_mem_at(parent, node, access, ino)
+            })
             .collect()
     }
 
@@ -950,7 +1198,7 @@ impl State {
     /// re-enumerate, which is the cheaper way to stay honest about what the
     /// server did. A queued rename cannot: re-enumerating needs the network, and
     /// the server has not been told yet in any case — so this *is* the tree's
-    /// new truth until the op drains (offline.md Phase 3b).
+    /// new truth until the op drains.
     pub(crate) fn rename_in_place(
         &mut self,
         ino: u64,
@@ -1069,7 +1317,7 @@ impl State {
     /// created offline, nothing at all), so this row is the only record that the
     /// file is as long as the caller was told it is. Without it a restart serves
     /// the stale size and the file reads as truncated — or empty — while its
-    /// bytes sit safely in staging (offline.md Phase 3).
+    /// bytes sit safely in staging.
     /// Returns the node to persist rather than queueing it in the outbox, and is
     /// the one mutation here whose write-through the caller must do itself:
     /// failure has to be reported, not logged. Dropping the row silently means
@@ -1088,6 +1336,13 @@ mod tests {
     use proton_drive_rs::ShareMembership;
     use proton_drive_rs::proton_sdk::ids::{LinkId, ShareId, ShareMembershipId, VolumeId};
 
+    #[test]
+    fn an_inode_gives_back_the_lid_it_was_made_from() {
+        assert_eq!(ino_lid(lid_ino(7)), Some(7));
+        assert_eq!(ino_lid(crate::ROOT_INO), None);
+        assert_eq!(ino_lid(FALLBACK_INO + 3), None);
+    }
+
     fn uid(link: &str) -> NodeUid {
         NodeUid::new(VolumeId::from("vol"), LinkId::from(link))
     }
@@ -1164,7 +1419,7 @@ mod tests {
         let dir = TempDir::new();
         let db = Db::open(&dir.0.join("cache.db")).unwrap();
         let share_access = db.all_share_access().unwrap();
-        let st = State::new(Arc::new(db), share_access, 1);
+        let st = State::new(Arc::new(db), share_access);
         (st, dir)
     }
 
@@ -1182,6 +1437,36 @@ mod tests {
         (st, dir, src, dst)
     }
 
+    /// A node's inode comes from its row's local id, so it is the same in
+    /// every mount, after the hot cache drops it, and after a restart.
+    #[test]
+    fn a_node_keeps_its_inode_across_mounts_evictions_and_restarts() {
+        let (mut st, _dir) = state();
+        let inos = st.intern_batch(
+            0,
+            vec![
+                node("a", "root", "a.txt", false),
+                node("b", "root", "b.txt", false),
+            ],
+        );
+        st.flush_outbox();
+        let db = st.db.clone();
+        assert_ne!(inos[0], inos[1]);
+        assert!(!inos.contains(&crate::ROOT_INO));
+
+        let mut other = State::new(db.clone(), HashMap::new());
+        assert_eq!(other.intern(0, node("b", "root", "b.txt", false)), inos[1]);
+
+        st.forget_mem(&uid("a"));
+        assert_eq!(st.intern(0, node("a", "root", "a.txt", false)), inos[0]);
+
+        let mut restarted = State::new(db, HashMap::new());
+        assert_eq!(
+            restarted.intern_batch(0, vec![node("a", "root", "a.txt", false)]),
+            [inos[0]]
+        );
+    }
+
     /// Audit A5. Moving a file out of a folder leaves that folder's DB row
     /// claiming a complete listing, so once the hot cache drops it, remote
     /// changes under it stop being seen. `relocate` has to clear both sides.
@@ -1247,7 +1532,7 @@ mod tests {
         let root = uid("root").to_string();
         let state = parking_lot::Mutex::new(st);
         {
-            let mut guard = lock_state(&state, &db);
+            let mut guard = StateGuard::new(state.lock(), &db);
             guard.intern(0, node("root", "none", "My Files", true));
             assert!(
                 db.node_by_uid(&root).unwrap().is_none(),
@@ -1490,6 +1775,7 @@ mod tests {
             })
             .collect();
         st.next_ino = crate::ROOT_INO + nodes.len() as u64;
+        st.roots.insert(crate::ROOT_INO);
         // Reverse order so entries are inserted before their parents, matching
         // the hydration path's non-topological materialization.
         for (i, node) in nodes.iter().enumerate().rev() {
@@ -1863,4 +2149,137 @@ mod tests {
         let shared = st.intern(owned_root, shared);
         assert_eq!(st.entries[&shared].access, Access::Viewer);
     }
+
+    fn at_revision(mut node: Node, revision: &str, mtime: i64) -> Node {
+        node.modification_time = mtime;
+        if let NodeKind::File {
+            active_revision_id, ..
+        } = &mut node.kind
+        {
+            *active_revision_id = Some(revision.into());
+        }
+        node
+    }
+
+    #[test]
+    fn a_renamed_file_keeps_its_mtime_until_its_content_changes() {
+        let (mut st, _dir) = state();
+        let root = st.intern(0, node("root", "none", "My Files", true));
+        let mut file = node("file", "root", "a.txt", false);
+        if let NodeKind::File {
+            claimed_size,
+            total_size_on_storage,
+            ..
+        } = &mut file.kind
+        {
+            *claimed_size = Some(7);
+            *total_size_on_storage = 519;
+        }
+        let ino = st.intern(root, at_revision(file.clone(), "r1", 100));
+        // Drive stamps the link on a rename; the content is still r1.
+        let mut renamed = at_revision(file.clone(), "r1", 160);
+        renamed.name = "b.txt".into();
+        st.intern_batch(root, vec![renamed]);
+        assert_eq!(st.entries[&ino].node.modification_time, 100);
+        assert_eq!(st.entries[&ino].node.name, "b.txt");
+        // A listing that leaves the size out still describes revision r1.
+        let mut bare = at_revision(file.clone(), "r1", 170);
+        assert_eq!(crate::node_size(&st.entries[&ino].node), 7);
+        if let NodeKind::File { claimed_size, .. } = &mut bare.kind {
+            *claimed_size = None;
+        }
+        st.intern(root, bare);
+        assert_eq!(st.entries[&ino].node.modification_time, 100);
+        assert_eq!(crate::node_size(&st.entries[&ino].node), 7);
+        st.intern(root, at_revision(file, "r2", 200));
+        assert_eq!(st.entries[&ino].node.modification_time, 200);
+    }
+
+    fn handle(len: u64, base_size: u64) -> WriteHandle {
+        let path = std::env::temp_dir().join(format!("pdfs-handle-test-{}", std::process::id()));
+        let file = File::create(&path).unwrap();
+        let _ = std::fs::remove_file(&path);
+        WriteHandle {
+            ino: 2,
+            uid: uid("file"),
+            file: Arc::new(file),
+            path,
+            written: Intervals::default(),
+            len,
+            base_size,
+            base_mtime: 0,
+            base_revision_id: None,
+            dirty: false,
+            open_count: 1,
+        }
+    }
+
+    /// A file created offline is written while its queued create lands. The
+    /// placeholder had no revision, so the handle takes the empty file the
+    /// create made as its base (docs/BUGS.md B113).
+    #[test]
+    fn a_handle_on_a_placeholder_is_based_on_the_create_that_landed() {
+        let mut h = handle(0, 0);
+        assert_eq!(h.base_revision_id, None);
+        let mut landed = node("real", "root", "f.mkv", false);
+        landed.modification_time = 160;
+        if let NodeKind::File {
+            active_revision_id, ..
+        } = &mut landed.kind
+        {
+            *active_revision_id = Some("empty".into());
+        }
+        h.rebase_onto(&landed);
+        assert_eq!(h.base_mtime, 160);
+        assert_eq!(h.base_size, 0);
+        assert_eq!(h.base_revision_id.as_deref(), Some("empty"));
+    }
+
+    #[test]
+    fn a_listing_does_not_shrink_a_file_open_for_writing() {
+        let (mut st, _dir) = state();
+        let ino = st.intern(0, node("file", "root", "workload.db", false));
+        let mut h = handle(16384, 0);
+        h.ino = ino;
+        st.active_writes.insert(ino, h);
+        st.set_size(ino, 16384);
+        st.touch_mtime(ino, 500);
+
+        // The remote still holds the empty file the create sealed.
+        st.intern(0, node("file", "root", "workload.db", false));
+        assert_eq!(crate::node_size(&st.entries[&ino].node), 16384);
+        assert_eq!(st.entries[&ino].node.modification_time, 500);
+
+        // Once the handle is gone the remote is authoritative again.
+        st.active_writes.remove(&ino);
+        st.intern(0, node("file", "root", "workload.db", false));
+        assert_eq!(crate::node_size(&st.entries[&ino].node), 0);
+    }
+
+    #[test]
+    fn a_write_past_the_end_authors_the_hole_it_leaves() {
+        // Opened over a 100-byte base, shrunk to 10, then written at 50: bytes
+        // 10..50 are zeros now, not the base's bytes 10..50.
+        let mut h = handle(100, 100);
+        h.written.clip(10);
+        h.len = 10;
+        h.record_write(50, 60);
+        assert_eq!(h.len, 60);
+        assert_eq!(
+            h.written.segments(0, 60),
+            vec![(0, 10, false), (10, 60, true)],
+            "only the head still comes from the base"
+        );
+    }
+
+    #[test]
+    fn a_write_inside_the_file_leaves_the_rest_to_the_base() {
+        let mut h = handle(100, 100);
+        h.record_write(40, 50);
+        assert_eq!(h.len, 100);
+        assert_eq!(
+            h.written.segments(0, 100),
+            vec![(0, 40, false), (40, 50, true), (50, 100, false)]
+        );
+    }
 }

crates/pdfs-fuse/src/sweep.rs

@@ -68,7 +68,7 @@ impl Core {
     /// docs for the identical/divergent policy.
     pub(crate) fn run_conflict_sweep_loop(&self) {
         // Both waits are interruptible, so teardown does not have to sit out a
-        // five-minute interval to join this thread (bugs.md B44).
+        // five-minute interval to join this thread (`docs/BUGS.md` B44).
         if !self.shutdown.sleep(CONFLICT_SWEEP_WARMUP) {
             return;
         }
@@ -165,7 +165,7 @@ impl Core {
         }
         match self
             .rt
-            .block_on(self.client.trash_nodes(std::slice::from_ref(uid)))
+            .block_on(self.drive.trash_nodes(std::slice::from_ref(uid)))
             .and_then(batch::into_unit)
         {
             Ok(()) => {}
@@ -175,10 +175,9 @@ impl Core {
                 return;
             }
         }
-        // Every mount, not just the primary: a conflict copy inside a sync
-        // folder lives in that fork's inode space, and leaving it hooked up
-        // there keeps a node we have just trashed remotely visible and
-        // readable there (`docs/BUGS.md` B74).
+        // Leaving a conflict copy hooked up in the tree keeps a node we have
+        // just trashed remotely visible and readable in whichever mount shows
+        // it (`docs/BUGS.md` B74).
         self.for_each_state(|st| {
             st.forget_or_unlink(uid);
         });

crates/pdfs-fuse/src/sync/engine.rs

@@ -33,7 +33,7 @@ pub(crate) enum SyncMsg {
     /// Re-read the folder set and adjust the filesystem watches (after add/remove).
     Rewatch,
     /// The daemon is tearing down: finish the current pass and end the engine
-    /// thread, so the mount can join it (bugs.md B44).
+    /// thread, so the mount can join it (`docs/BUGS.md` B44).
     Stop,
 }
 
@@ -57,9 +57,10 @@ pub(crate) fn spawn(core: Core, rx: Receiver<SyncMsg>) -> Option<std::thread::Jo
 fn engine_loop(core: Core, rx: Receiver<SyncMsg>) {
     // Paths the watcher currently covers, mapped to their folder id, so an event
     // path can be resolved back to the folder it belongs to.
-    let watched: Mutex<Vec<(PathBuf, i64)>> = Mutex::new(Vec::new());
+    let watched: Arc<Mutex<Vec<(PathBuf, i64)>>> = Arc::new(Mutex::new(Vec::new()));
 
     let tx_events = core.sync_tx.clone();
+    let watched_events = watched.clone();
     let mut watcher =
         match notify::recommended_watcher(move |res: notify::Result<notify::Event>| {
             let Ok(event) = res else { return };
@@ -67,7 +68,8 @@ fn engine_loop(core: Core, rx: Receiver<SyncMsg>) {
             if matches!(event.kind, notify::EventKind::Access(_)) {
                 return;
             }
-            let _ = tx_events.send(SyncMsg::ReconcileAll);
+            let msg = event_target(&watched_events.lock(), &event.paths);
+            let _ = tx_events.send(msg);
         }) {
             Ok(w) => w,
             Err(e) => {
@@ -256,8 +258,31 @@ fn reconcile_all(core: &Core) {
     }
 }
 
+/// The reconcile a watcher event asks for: the one mirror folder all its paths
+/// lie in, so an edit in one folder does not walk every other one too. An event
+/// that spans folders, or that no watched folder claims (a watch list a moment
+/// out of date), falls back to every folder.
+pub(super) fn event_target(watched: &[(PathBuf, i64)], paths: &[PathBuf]) -> SyncMsg {
+    let mut ids = paths.iter().map(|path| {
+        watched
+            .iter()
+            .filter(|(root, _)| path.starts_with(root))
+            // The deepest root, should one mirror folder sit inside another.
+            .max_by_key(|(root, _)| root.components().count())
+            .map(|(_, id)| *id)
+    });
+    match ids.next() {
+        Some(Some(first)) if ids.all(|id| id == Some(first)) => SyncMsg::Reconcile(first),
+        _ => SyncMsg::ReconcileAll,
+    }
+}
+
 /// Bring the filesystem watches in line with the current mirror-folder set:
 /// watch newly-added folders, drop removed ones.
+///
+/// The watch calls run on a copy, outside the lock: the watcher's event
+/// callback takes the same lock, and a backend that hands a watch request to
+/// its event thread and waits for the answer would deadlock against it.
 fn rewatch(
     core: &Core,
     watcher: &mut notify::RecommendedWatcher,
@@ -274,7 +299,7 @@ fn rewatch(
             return;
         }
     };
-    let mut have = watched.lock();
+    let mut have = watched.lock().clone();
     // Drop watches no longer wanted.
     have.retain(|(path, _)| {
         if want.iter().any(|(p, _)| p == path) {
@@ -294,6 +319,7 @@ fn rewatch(
             Err(e) => warn!(path = %path.display(), error = %e, "sync: watch failed"),
         }
     }
+    *watched.lock() = have;
 }
 
 // ---- reconcile ------------------------------------------------------------

crates/pdfs-fuse/src/sync/model.rs

@@ -20,7 +20,7 @@ impl LocalSig {
     /// Nanoseconds decide it when both sides have them; otherwise the comparison
     /// falls back to whole seconds, which is what a baseline row written before
     /// schema 28 — or a filesystem that reports no sub-second time — can support
-    /// (bugs.md B25).
+    /// (`docs/BUGS.md` B25).
     pub(super) fn same_content(&self, other: &Self) -> bool {
         if self.size != other.size {
             return false;
@@ -98,6 +98,11 @@ pub(super) struct Outcome {
     pub(super) errors: usize,
     /// Files skipped because another process held them open for writing.
     pub(super) deferred: usize,
+    /// Paths the local scan could not read, left out of the pass. Not part of
+    /// [`is_empty`](Self::is_empty) or the summary: an unreadable folder stays
+    /// unreadable from one poll to the next, so the pass reports it once, when
+    /// the set changes, rather than on every poll.
+    pub(super) unscanned: Vec<String>,
 }
 
 impl Outcome {
@@ -108,6 +113,7 @@ impl Outcome {
             Applied::Uploaded => self.uploaded += 1,
             Applied::Downloaded => self.downloaded += 1,
             Applied::Conflict => self.conflicts += 1,
+            Applied::Vanished => {}
         }
     }
 
@@ -160,7 +166,7 @@ pub(super) enum Pending {
     /// was there. A download can run for minutes, so the apply step revalidates
     /// against it immediately before it renames over the destination: a writer
     /// that finished an edit in the meantime must not be overwritten without a
-    /// conflict copy (bugs.md B39).
+    /// conflict copy (`docs/BUGS.md` B39).
     Download {
         rel: String,
         uid: NodeUid,
@@ -226,6 +232,10 @@ pub(super) enum PassAbort {
     Interrupted,
     /// The pass could not establish its diff (a walk or the baseline load failed).
     Failed(String),
+    /// The daemon is stopping. What the pass sent before the stop has landed or
+    /// will be cancelled with the runtime; nothing more is sent, and the next
+    /// start's pass picks up from the baseline.
+    Stopped,
 }
 
 impl From<String> for PassAbort {

crates/pdfs-fuse/src/sync/planner.rs

@@ -90,6 +90,96 @@ pub(super) fn filter_baseline<'a, B>(
         .collect()
 }
 
+/// The paths a local scan left out because it could not read them: a folder
+/// it has no permission for, an entry that vanished between the listing and
+/// its `stat`, a name that is not UTF-8.
+///
+/// A left-out path is not a deleted one. A pass drops everything an entry
+/// covers from classification, exactly as it drops ignored paths, so a
+/// baseline row under an unreadable folder is neither read as a local deletion
+/// nor answered with a download into a folder the pass cannot write. Failing
+/// the whole pass instead is what B55 did, and it left one root-owned folder
+/// stopping every other file in the tree from syncing (B196).
+#[derive(Default)]
+pub(super) struct Unscanned {
+    covered: HashSet<String>,
+    /// The subset worth telling the user about, with why: an entry that only
+    /// vanished mid-scan is not, since the next pass sees it settled.
+    unreadable: Vec<String>,
+}
+
+impl Unscanned {
+    /// Leave out `rel`, which vanished while the scan looked at it.
+    pub(super) fn vanished(&mut self, rel: String) {
+        self.covered.insert(rel);
+    }
+
+    /// Leave out `rel`, which cannot be read for `reason`.
+    pub(super) fn unreadable(&mut self, rel: String, reason: &str) {
+        self.unreadable.push(format!("{rel} ({reason})"));
+        self.covered.insert(rel);
+    }
+
+    /// Whether `rel` is a left-out path or lies under one.
+    pub(super) fn covers(&self, rel: &str) -> bool {
+        if self.covered.is_empty() {
+            return false;
+        }
+        let mut at = rel;
+        loop {
+            if self.covered.contains(at) {
+                return true;
+            }
+            match at.rfind('/') {
+                Some(i) => at = &at[..i],
+                None => return false,
+            }
+        }
+    }
+
+    /// The unreadable paths with their reasons, sorted, for the activity feed.
+    pub(super) fn report(&self) -> Vec<String> {
+        let mut lines = self.unreadable.clone();
+        lines.sort_unstable();
+        lines
+    }
+}
+
+/// The baseline paths a pass can see: [`filter_baseline`], minus everything
+/// under a path the scan could not read. This is the set [`guard_local_wipe`]
+/// checks and the set a push pass reads deletions from, since a path outside
+/// it is absent from the local walk by rule or by failure, never by loss.
+pub(super) fn tracked_baseline<'a, B>(
+    baseline: &'a HashMap<String, B>,
+    rules: &IgnoreRules,
+    unscanned: &Unscanned,
+) -> HashMap<String, &'a B> {
+    let mut tracked = filter_baseline(baseline, rules);
+    tracked.retain(|rel, _| !unscanned.covers(rel));
+    tracked
+}
+
+/// The baseline paths a push pass has to trash on Drive: tracked, and gone
+/// from the local walk. Shallowest first, so a trashed folder takes its
+/// children with it.
+///
+/// Built from [`tracked_baseline`] rather than from the raw baseline. Reading
+/// it raw trashed every synced path that later became ignored, because the walk
+/// skips those, and the switch to on-demand that the push pass runs for then
+/// deleted the local copy too (B197).
+pub(super) fn local_deletions<B, L>(
+    tracked: &HashMap<String, &B>,
+    local: &HashMap<String, L>,
+) -> Vec<String> {
+    let mut missing: Vec<String> = tracked
+        .keys()
+        .filter(|rel| !local.contains_key(*rel))
+        .cloned()
+        .collect();
+    missing.sort_by_key(|p| p.matches('/').count());
+    missing
+}
+
 /// Refuse to run a pass whose local side has vanished in its entirety.
 ///
 /// When every baseline path is absent locally, the likely cause is an unavailable
@@ -218,7 +308,7 @@ pub(super) fn plan_file(
     }
 
     let local_changed = local.is_some_and(|item| {
-        // Nanoseconds where both sides have them (bugs.md B25): whole seconds
+        // Nanoseconds where both sides have them (`docs/BUGS.md` B25): whole seconds
         // could not see an edit made in the same second as the last sync that
         // left the file the same length, so it was never uploaded.
         baseline.is_none_or(|base| !LocalSig::from(item).same_content(&LocalSig::from(base)))
@@ -291,7 +381,7 @@ mod file_plan_tests {
 
     /// Whole seconds cannot see an edit made inside the same second that leaves the
     /// file the same length, so a mirror silently stopped uploading it. With a
-    /// nanosecond time on both sides it is an ordinary local change (bugs.md B25).
+    /// nanosecond time on both sides it is an ordinary local change (`docs/BUGS.md` B25).
     #[test]
     fn a_same_second_same_size_edit_is_still_a_local_change() {
         let mut base = baseline(10, 20, 30, 40);

crates/pdfs-fuse/src/systemd.rs

@@ -74,6 +74,26 @@ pub(crate) fn watchdog_ping() {
     let _ = notify("WATCHDOG=1\n");
 }
 
+/// Sleep for `duration`, pinging the watchdog on the way.
+///
+/// For the stretches where the daemon is alive but has no mount, and so no
+/// supervisor: waiting for a login, or backing off after a failed mount. The
+/// manager arms the watchdog when the process starts, so without these pings a
+/// daemon that is merely retrying is aborted after `WatchdogSec` and leaves a
+/// coredump instead of the error it was logging. Never use this while mounted:
+/// there the ping must prove the control socket answers.
+pub fn idle_sleep(duration: Duration) {
+    const CHUNK: Duration = Duration::from_secs(10);
+    let mut left = duration;
+    watchdog_ping();
+    while !left.is_zero() {
+        let step = left.min(CHUNK);
+        std::thread::sleep(step);
+        left -= step;
+        watchdog_ping();
+    }
+}
+
 /// Tell the manager the daemon is stopping, so a slow teardown is not mistaken
 /// for a hang by the watchdog it is racing.
 pub(crate) fn stopping() {

crates/pdfs-fuse/src/takeout.rs

@@ -530,7 +530,7 @@ fn open_archive(
 
 /// The lowercase-hex SHA-1 of everything `reader` yields — the digest Proton's
 /// photo duplicate detection is keyed on.
-fn sha1_of(reader: &mut (dyn Read + Send)) -> CoreResult<String> {
+pub(crate) fn sha1_of(reader: &mut (dyn Read + Send)) -> CoreResult<String> {
     let mut hasher = Sha1::new();
     let mut buffer = vec![0u8; 256 * 1024];
     loop {

crates/pdfs-fuse/src/transfers.rs

@@ -46,6 +46,8 @@ struct JobEntry {
     detail: Mutex<String>,
     done: AtomicU64,
     total: AtomicU64,
+    /// Housekeeping that moves nothing; see [`JobItem::background`].
+    background: bool,
 }
 
 /// The set of transfers and jobs currently in flight. Cloned `Arc`-style across
@@ -160,12 +162,25 @@ impl TransferRegistry {
     /// that carries its progress and deregisters the job when dropped. The job
     /// starts indeterminate; give it a `total` once one is known.
     pub fn begin_job(self: &Arc<Self>, title: impl Into<String>) -> JobGuard {
+        self.register_job(title.into(), false)
+    }
+
+    /// [`TransferRegistry::begin_job`] for housekeeping the user did not ask
+    /// for and that changes nothing in their files, such as an index rebuild or
+    /// a cache check. It is reported, but front ends don't call the drive busy
+    /// over it.
+    pub fn begin_background_job(self: &Arc<Self>, title: impl Into<String>) -> JobGuard {
+        self.register_job(title.into(), true)
+    }
+
+    fn register_job(self: &Arc<Self>, title: String, background: bool) -> JobGuard {
         let id = self.next.fetch_add(1, Ordering::Relaxed);
         let entry = Arc::new(JobEntry {
-            title: title.into(),
+            title,
             detail: Mutex::new(String::new()),
             done: AtomicU64::new(0),
             total: AtomicU64::new(0),
+            background,
         });
         self.jobs.lock().insert(id, entry.clone());
         JobGuard {
@@ -191,6 +206,7 @@ impl TransferRegistry {
                     detail: e.detail.lock().clone(),
                     done: e.done.load(Ordering::Relaxed),
                     total: e.total.load(Ordering::Relaxed),
+                    background: e.background,
                 }
             })
             .collect()

crates/pdfs-fuse/src/upload.rs

@@ -73,7 +73,7 @@ async fn run_uploads(
                 .upload_thumbnails_async(t.path.clone(), t.name.clone())
                 .await;
             match core
-                .client
+                .drive
                 .upload_file_from(
                     &t.parent_uid,
                     &t.name,
@@ -238,14 +238,11 @@ impl Core {
             .map_err(|error| self.errno_error(error, "upload destination"))?;
         let new_uid = self
             .rt
-            .block_on(
-                self.client
-                    .create_folder(parent_uid, name, Some(now_secs())),
-            )
+            .block_on(self.drive.create_folder(parent_uid, name, Some(now_secs())))
             .map_err(|e| CoreError::from_api(&e, &format!("create folder {name}")))?;
         let node = self
-            .fetch_node(&new_uid)
-            .map_err(|e| self.errno_error(e, "fetch node"))?;
+            .fetch_minted_node(&new_uid, name)
+            .ok_or_else(|| minted_but_unlisted(name))?;
         let mut st = self.state();
         let ino = st.intern(pino, node);
         if let Some(kids) = st.children.get_mut(&pino)

crates/pdfs-gui/build.rs

@@ -27,5 +27,6 @@ fn main() {
     println!("cargo:rerun-if-changed=resources/icons");
     println!("cargo:rerun-if-changed=resources/style.css");
     println!("cargo:rerun-if-changed=resources/proton-theme.css");
+    println!("cargo:rerun-if-changed=resources/prompt.css");
     println!("cargo:rerun-if-changed=../../packaging/io.narl.proton-drive-linux.svg");
 }

crates/pdfs-gui/resources/icons/scalable/actions/pdfs-menu-symbolic.svg

@@ -1,5 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16">
-  <!-- Main menu: three bars. Bundled because themes such as Papirus draw
-       open-menu-symbolic as three dots, the same as every row's "more" menu. -->
-  <path fill="#222222" d="M 2,2.5 H 14 A 1,1 0 0 1 14,4.5 H 2 A 1,1 0 0 1 2,2.5 Z M 2,7 H 14 A 1,1 0 0 1 14,9 H 2 A 1,1 0 0 1 2,7 Z M 2,11.5 H 14 A 1,1 0 0 1 14,13.5 H 2 A 1,1 0 0 1 2,11.5 Z"/>
-</svg>

crates/pdfs-gui/resources/pdfs.gresource.xml

@@ -14,7 +14,6 @@
     <file preprocess="xml-stripblanks">scalable/actions/pdfs-details-pane-symbolic.svg</file>
     <file preprocess="xml-stripblanks">scalable/actions/pdfs-link-symbolic.svg</file>
     <file preprocess="xml-stripblanks">scalable/actions/pdfs-map-symbolic.svg</file>
-    <file preprocess="xml-stripblanks">scalable/actions/pdfs-menu-symbolic.svg</file>
     <file preprocess="xml-stripblanks">scalable/actions/pdfs-people-symbolic.svg</file>
     <file preprocess="xml-stripblanks">scalable/actions/pdfs-share-symbolic.svg</file>
     <file preprocess="xml-stripblanks">scalable/actions/pdfs-sync-symbolic.svg</file>
@@ -33,5 +32,7 @@
   <gresource prefix="/de/nils/protondrivelinux">
     <file>style.css</file>
     <file>proton-theme.css</file>
+    <!-- The search launcher's own sheet, over the same palette. -->
+    <file>prompt.css</file>
   </gresource>
 </gresources>

crates/pdfs-gui/resources/prompt.css

@@ -0,0 +1,224 @@
+/* The search launcher (pdfs-prompt). Colours come from the libadwaita
+   palette, so the launcher follows the system accent, light/dark and high
+   contrast like the app; the opt-in Proton theme recolours both alike. */
+
+window.launcher-window {
+  background: transparent;
+}
+
+.launcher-card {
+  background-color: var(--view-bg-color);
+  color: var(--view-fg-color);
+  border: 1px solid var(--border-color);
+  border-radius: 14px;
+  box-shadow: 0 16px 48px rgb(0 0 0 / 35%);
+}
+
+.search-bar {
+  padding: 14px 18px;
+  border-bottom: 1px solid var(--border-color);
+}
+
+.search-icon {
+  -gtk-icon-size: 20px;
+  color: color-mix(in srgb, currentColor 55%, transparent);
+}
+
+.search-entry {
+  background: none;
+  border: none;
+  box-shadow: none;
+  outline: none;
+  padding: 2px 0;
+  font-size: 1.15rem;
+}
+
+.key-hint {
+  padding: 2px 8px;
+  border-radius: 6px;
+  background-color: color-mix(in srgb, currentColor 8%, transparent);
+  font-size: 0.75rem;
+  opacity: 0.55;
+}
+
+.chip-row {
+  padding: 10px 14px;
+  border-bottom: 1px solid var(--border-color);
+}
+
+.chip {
+  padding: 4px 14px;
+  min-height: 0;
+  border-radius: 999px;
+  background: none;
+  border: 1px solid var(--border-color);
+  box-shadow: none;
+  font-size: 0.86rem;
+  font-weight: 500;
+}
+
+.chip:hover {
+  background-color: color-mix(in srgb, currentColor 6%, transparent);
+}
+
+.chip:checked {
+  background-color: var(--accent-bg-color);
+  color: var(--accent-fg-color);
+  border-color: var(--accent-bg-color);
+}
+
+/* --- results ------------------------------------------------------------ */
+
+.results {
+  padding: 2px 8px 10px 8px;
+}
+
+.section-header {
+  padding: 12px 10px 6px 10px;
+}
+
+.section-title {
+  font-size: 0.78rem;
+  font-weight: 700;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+  opacity: 0.55;
+}
+
+.section-icon {
+  -gtk-icon-size: 14px;
+  opacity: 0.55;
+}
+
+.result-list {
+  background: none;
+}
+
+.result-row {
+  padding: 6px 10px;
+  border-radius: 10px;
+}
+
+.result-row:hover {
+  background-color: color-mix(in srgb, currentColor 5%, transparent);
+}
+
+/* A soft tint rather than a solid accent bar: the text keeps its colour, so
+   the highlighted match stays readable on the selected row. */
+.result-row:selected,
+.result-row:selected:hover {
+  background-color: color-mix(in srgb, var(--accent-bg-color) 18%, transparent);
+  color: inherit;
+}
+
+.result-name {
+  font-weight: 500;
+}
+
+.result-location,
+.result-meta {
+  font-size: 0.8rem;
+  opacity: 0.55;
+}
+
+.result-row:selected .result-location,
+.result-row:selected .result-meta {
+  opacity: 0.7;
+}
+
+.thumb {
+  border-radius: 6px;
+}
+
+.result-badge,
+.preview-badge {
+  -gtk-icon-size: 14px;
+}
+
+.badge-pinned {
+  color: var(--success-color);
+}
+
+.badge-cached {
+  color: var(--accent-color);
+}
+
+.badge-cloud,
+.badge-local {
+  opacity: 0.55;
+}
+
+/* --- preview ------------------------------------------------------------ */
+
+.preview {
+  padding: 16px;
+  background-color: color-mix(in srgb, currentColor 3%, transparent);
+}
+
+.preview-thumb {
+  margin-bottom: 12px;
+}
+
+.preview-thumb .thumb {
+  border-radius: 10px;
+}
+
+.preview-name {
+  font-weight: 700;
+  font-size: 1.05rem;
+}
+
+.preview-kind {
+  font-size: 0.85rem;
+  opacity: 0.6;
+  margin-bottom: 12px;
+}
+
+.preview-key {
+  font-size: 0.8rem;
+  opacity: 0.55;
+}
+
+.preview-value {
+  font-size: 0.85rem;
+}
+
+.preview-actions {
+  margin-top: 12px;
+}
+
+.preview-action {
+  padding: 6px 8px;
+  border-radius: 8px;
+}
+
+.preview-shortcut {
+  font-size: 0.75rem;
+  opacity: 0.6;
+}
+
+.preview-feedback {
+  margin-top: 6px;
+  font-size: 0.8rem;
+  color: var(--accent-color);
+}
+
+.preview-empty {
+  opacity: 0.2;
+}
+
+/* --- footer ------------------------------------------------------------- */
+
+.footer {
+  padding: 8px 16px;
+  border-top: 1px solid var(--border-color);
+}
+
+.footer-text {
+  font-size: 0.78rem;
+  opacity: 0.5;
+}
+
+statuspage.compact > scrolledwindow > viewport > box {
+  margin: 24px 12px;
+}

crates/pdfs-gui/resources/style.css

@@ -18,7 +18,9 @@
 .sidebar-status image.warning { color: var(--warning-color); }
 .sidebar-status image.error { color: var(--error-color); }
 .sidebar-quota progressbar trough, .sidebar-quota progressbar progress { min-height: 4px; }
-.sidebar-account { padding: 4px 4px 4px 8px; }
+/* The account row is the main menu's button: a row, not a pushbutton, so
+ * the name keeps the text weight. */
+button.sidebar-account { padding: 4px 8px; font-weight: normal; }
 /* A count of what waits on a page, at the end of its sidebar row */
 .sidebar-badge {
   min-width: 10px;
@@ -46,7 +48,11 @@
 .badge-pinned { color: var(--success-color); }
 .badge-cached { color: var(--success-color); }
 .badge-cloud { color: color-mix(in srgb, currentColor 55%, transparent); }
+.badge-issue { color: var(--error-color); }
 .browser-statusbar { background-color: alpha(currentColor, 0.025); }
+/* The folder on screen, last in the breadcrumb trail: a flat button's side
+ * padding, so the "›" before it is spaced like the ones between buttons. */
+.crumb-current { padding: 0 10px; }
 scale.browser-status-meter trough { min-width: 104px; min-height: 6px; }
 .bulk-bar { padding: 6px 8px; border-radius: 12px; background: color-mix(in srgb, var(--accent-bg-color) 12%, transparent); }
 .dropzone { border: 2px dashed alpha(currentColor, 0.25); border-radius: 16px; padding: 28px 18px; transition: background 160ms ease, border-color 160ms ease; }

crates/pdfs-gui/src/app/main.rs

@@ -8,6 +8,8 @@ pub(crate) mod events;
 pub(crate) mod i18n;
 pub(crate) mod pages;
 pub(crate) mod reload;
+#[path = "../theme.rs"]
+pub(crate) mod theme;
 pub(crate) mod widgets;
 
 use compat::*;
@@ -30,7 +32,9 @@ use pages::takeout::*;
 use pages::trash::*;
 use pages::verify::*;
 use reload::{LoadTicket, Loader, replace_items};
+use theme::{load_resources, proton_theme_active, set_proton_theme};
 use widgets::compat::*;
+use widgets::crumb::*;
 use widgets::details::*;
 use widgets::file_list::*;
 use widgets::menu::*;
@@ -72,8 +76,8 @@ use pdfs_core::control::{
     DirEntry, ErrorKind, ImportSummary, InvitationInfo, JobItem, MappingProgress, PendingOpInfo,
     PhotoItem, PhotoKind, PhotoMonth, PlaceInfo, PublicLinkInfo, RefreshScope, Request, Response,
     RestorableFolder, RestoreItem, RevisionInfo, SearchHit, ShareEntry, ShareEntryKind, SharedItem,
-    SyncFolderInfo, SyncPhase, SyncProgress, ThumbnailBuildStatus, Topic, TransferDirection,
-    TransferItem, send,
+    SyncFolderInfo, SyncIssue, SyncPhase, SyncProgress, ThumbnailBuildStatus, Topic,
+    TransferDirection, TransferItem, send,
 };
 
 use pdfs_core::mounts::{MountAccess, MountKind, MountMode, MountSpec};
@@ -116,6 +120,9 @@ struct Ui {
     /// keyring (a DBus round-trip). Populated at startup and updated only on
     /// login / logout. `None` = signed out.
     session: RefCell<Option<auth::StoredSession>>,
+    /// Whether this run already asked for the mailbox password of a locked
+    /// account, so a refresh never re-opens a dialog the user cancelled.
+    unlock_offered: Cell<bool>,
     /// Whether the last refresh saw a live mount daemon. Gates the unpin buttons
     /// (which need the daemon to evict + re-hydrate) and every mutating action.
     mounted: RefCell<bool>,
@@ -196,12 +203,20 @@ impl Ui {
 }
 
 fn main() -> glib::ExitCode {
-    tracing_subscriber::fmt()
-        .with_env_filter(
-            tracing_subscriber::EnvFilter::try_from_default_env().unwrap_or_else(|_| "info".into()),
-        )
-        .init();
+    let verify = std::env::args().nth(1).as_deref() == Some(VERIFY_ARG);
+    let logs = tracing_subscriber::fmt().with_env_filter(
+        tracing_subscriber::EnvFilter::try_from_default_env().unwrap_or_else(|_| "info".into()),
+    );
+    // The verification window's stdout carries its token back to the app.
+    if verify {
+        logs.with_writer(std::io::stderr).init();
+    } else {
+        logs.init();
+    }
     i18n::init();
+    if verify {
+        return run_verification_window();
+    }
 
     // The tray launches the app with arguments ("--page locations",
     // "--confirm-stop"), which a running instance must receive too.
@@ -210,7 +225,7 @@ fn main() -> glib::ExitCode {
         .flags(gio::ApplicationFlags::HANDLES_COMMAND_LINE)
         .build();
     app.connect_startup(|_| {
-        load_proton_theme();
+        load_resources("/de/nils/protondrivelinux/style.css");
         if let Ok(dirs) = AppDirs::new() {
             set_proton_theme(dirs.load_config().proton_theme.unwrap_or(false));
         }
@@ -287,157 +302,6 @@ pub(crate) fn spawn_tray() {
     }
 }
 
-/// Register the bundled GResources (custom icons, the stylesheet) and load the
-/// app stylesheet. The Proton theme is a separate provider, applied by
-/// [`set_proton_theme`] from the saved preference.
-fn load_proton_theme() {
-    let bytes = include_bytes!(concat!(env!("OUT_DIR"), "/pdfs.gresource"));
-    let resource_data = glib::Bytes::from_static(bytes);
-    if let Ok(resource) = gio::Resource::from_data(&resource_data) {
-        gio::resources_register(&resource);
-    } else {
-        tracing::error!("failed to load gresource bundle");
-    }
-
-    let Some(display) = gtk4::gdk::Display::default() else {
-        return;
-    };
-    let provider = gtk4::CssProvider::new();
-    provider.load_from_resource("/de/nils/protondrivelinux/style.css");
-    // Above the user's own gtk.css, which often imports a whole theme: its
-    // `button { padding: 6px 10px; min-width: 16px }` would otherwise pad every
-    // photo tile and push the grid past the window. Every rule in the sheet is
-    // scoped to the app's own classes, so nothing else the user styled changes.
-    // One above the Proton theme too, so the app's rules refine it.
-    gtk4::style_context_add_provider_for_display(
-        &display,
-        &provider,
-        gtk4::STYLE_PROVIDER_PRIORITY_USER + 2,
-    );
-    gtk4::IconTheme::for_display(&display).add_resource_path("/de/nils/protondrivelinux/icons");
-}
-
-thread_local! {
-    /// The Proton theme provider while it is installed. Kept so turning the
-    /// preference off can remove exactly what turning it on added.
-    static PROTON_THEME: RefCell<Option<gtk4::CssProvider>> = const { RefCell::new(None) };
-}
-
-/// Whether the Proton theme is on.
-fn proton_theme_active() -> bool {
-    PROTON_THEME.with(|slot| slot.borrow().is_some())
-}
-
-/// libadwaita's own stylesheet, bundled in the library.
-const ADWAITA_STYLESHEET: &str = "/org/gnome/Adwaita/styles/gtk.css";
-
-/// The Proton palette laid over it, from our own bundle.
-const PROTON_PALETTE: &str = "/de/nils/protondrivelinux/proton-theme.css";
-
-/// Make the theme provider's `@media (prefers-color-scheme)` and
-/// `(prefers-contrast)` rules match what libadwaita shows, now and whenever it
-/// changes. A provider evaluates those itself, and a new one assumes light.
-///
-/// The properties are set by name because they only exist since GTK 4.20, and
-/// the app still runs on older GTK, whose libadwaita has no such rules anyway.
-fn follow_style_manager(provider: &gtk4::CssProvider) {
-    fn set_enum(provider: &gtk4::CssProvider, property: &str, nick: &str) {
-        let Some(pspec) = provider.find_property(property) else {
-            return;
-        };
-        if let Some(value) = glib::EnumClass::with_type(pspec.value_type())
-            .and_then(|class| class.to_value_by_nick(nick))
-        {
-            provider.set_property_from_value(property, &value);
-        }
-    }
-    fn apply(provider: &gtk4::CssProvider, manager: &adw::StyleManager) {
-        let scheme = if manager.is_dark() { "dark" } else { "light" };
-        set_enum(provider, "prefers-color-scheme", scheme);
-        let contrast = if manager.is_high_contrast() {
-            "more"
-        } else {
-            "no-preference"
-        };
-        set_enum(provider, "prefers-contrast", contrast);
-    }
-
-    let manager = adw::StyleManager::default();
-    apply(provider, &manager);
-    // Weak, so a provider the preference removed isn't kept alive; its
-    // handlers then do nothing.
-    let weak = provider.downgrade();
-    let weak_dark = weak.clone();
-    manager.connect_dark_notify(move |manager| {
-        if let Some(provider) = weak_dark.upgrade() {
-            apply(&provider, manager);
-        }
-    });
-    manager.connect_high_contrast_notify(move |manager| {
-        if let Some(provider) = weak.upgrade() {
-            apply(&provider, manager);
-        }
-    });
-}
-
-/// Paint the app in the Proton web apps' colours (`on`) or follow the system
-/// theme and accent colour.
-///
-/// Setting libadwaita's colour variables alone isn't enough: a GTK theme the
-/// user's `gtk.css` imports (Catppuccin, Fluent, ...) sits above the app and
-/// hard-codes its own accent into hundreds of rules. So the theme provider,
-/// one above the user's CSS, first resets every property, then re-applies
-/// libadwaita's whole stylesheet and finally the Proton palette, which leaves
-/// nothing of the user's theme inside the app.
-fn set_proton_theme(on: bool) {
-    let Some(display) = gtk4::gdk::Display::default() else {
-        return;
-    };
-    PROTON_THEME.with(|slot| {
-        let mut slot = slot.borrow_mut();
-        match (on, slot.as_ref()) {
-            (true, None) => {
-                let stylesheet = |path| {
-                    gio::resources_lookup_data(path, gio::ResourceLookupFlags::NONE)
-                        .map(|bytes| String::from_utf8_lossy(&bytes).into_owned())
-                };
-                let palette = stylesheet(PROTON_PALETTE).unwrap_or_default();
-                let css = match stylesheet(ADWAITA_STYLESHEET) {
-                    // Its images are named relative to the sheet, which a
-                    // string loaded here doesn't have.
-                    Ok(adwaita) => format!(
-                        "* {{ all: unset; }}\n{}\n{palette}",
-                        adwaita.replace(
-                            "url(\"assets/",
-                            "url(\"resource:///org/gnome/Adwaita/styles/assets/"
-                        )
-                    ),
-                    // Still recolours everything that follows libadwaita's
-                    // variables; only a custom theme's own rules show through.
-                    Err(e) => {
-                        tracing::warn!("libadwaita stylesheet not found, only recolouring: {e}");
-                        palette
-                    }
-                };
-                let provider = gtk4::CssProvider::new();
-                follow_style_manager(&provider);
-                provider.load_from_string(&css);
-                gtk4::style_context_add_provider_for_display(
-                    &display,
-                    &provider,
-                    gtk4::STYLE_PROVIDER_PRIORITY_USER + 1,
-                );
-                *slot = Some(provider);
-            }
-            (false, Some(provider)) => {
-                gtk4::style_context_remove_provider_for_display(&display, provider);
-                *slot = None;
-            }
-            _ => {}
-        }
-    });
-}
-
 /// Build the application window, wire the two pages, kick off the refresh loop,
 /// and present it.
 fn build_window(app: &adw::Application) {
@@ -448,6 +312,11 @@ fn build_window(app: &adw::Application) {
             return;
         }
     };
+    // On a fresh install the daemon has not run yet to make these, and the
+    // Takeout page keeps its staged archives in the state dir (B194).
+    if let Err(e) = dirs.ensure() {
+        tracing::warn!("cannot create the app's directories: {e}");
+    }
 
     let stack = adw::ViewStack::new();
     let (login_page, login_widgets) = build_login_page();
@@ -510,6 +379,7 @@ fn build_window(app: &adw::Application) {
         busy: Cell::new(0),
         opening: RefCell::new(HashSet::new()),
         session: RefCell::new(auth::load().ok()),
+        unlock_offered: Cell::new(false),
         mounted: RefCell::new(false),
         sidebar: sidebar_list.clone(),
         nav: split.clone(),
@@ -709,6 +579,7 @@ fn build_window(app: &adw::Application) {
                 detail: locations_widgets.card_detail.clone(),
                 pause: locations_widgets.pause.clone(),
                 paused: Cell::new(false),
+                sign_in: locations_widgets.card_sign_in.clone(),
             },
             queue: QueueState {
                 group: locations_widgets.queue_group.clone(),
@@ -816,6 +687,15 @@ fn build_window(app: &adw::Application) {
         sync_sidebar(&ui_nav);
         match st.visible_child_name().as_deref() {
             Some("browser") => load_browser(&ui_nav),
+            // The Albums and Places listings are re-read in place. Loading the
+            // timeline instead would swap it in under the Albums or Places toggle.
+            Some("gallery") if !ui_nav.gallery.in_collection() => {
+                match ui_nav.gallery.view_switch.active() {
+                    VIEW_ALBUMS => load_albums(&ui_nav),
+                    VIEW_PLACES => load_places(&ui_nav),
+                    _ => load_gallery(&ui_nav, false),
+                }
+            }
             Some("gallery") => load_gallery(&ui_nav, false),
             // Every visit reads the page again. The rows already on screen stay
             // up while it does, so arriving costs no "Loading…" flash.
@@ -952,7 +832,6 @@ fn build_sidebar(footer: &gtk4::Box) -> (adw::NavigationPage, gtk4::ListBox) {
 
     let header = adw::HeaderBar::new();
     header.set_title_widget(Some(&brand));
-    header.pack_end(&build_primary_menu());
 
     let scroll = gtk4::ScrolledWindow::builder()
         .hscrollbar_policy(gtk4::PolicyType::Never)
@@ -1275,25 +1154,7 @@ fn toast_failure(ui: &Rc<Ui>, what: &str, message: &str, kind: ErrorKind) {
     }
 }
 
-/// The sidebar's primary (hamburger) menu: the app-level entries that don't
-/// belong on any one page.
-fn build_primary_menu() -> gtk4::MenuButton {
-    let menu = gio::Menu::new();
-    menu.append(Some(&gettext("Preferences")), Some("win.preferences"));
-    menu.append(Some(&gettext("Keyboard Shortcuts")), Some("win.shortcuts"));
-    menu.append(
-        Some(&gettext("About Proton Drive for Linux")),
-        Some("win.about"),
-    );
-    gtk4::MenuButton::builder()
-        .icon_name("pdfs-menu-symbolic")
-        .tooltip_text(gettext("Main menu"))
-        .primary(true)
-        .menu_model(&menu)
-        .build()
-}
-
-/// Back the primary and account menus' entries with window actions.
+/// Back the main menu's entries with window actions.
 fn install_window_actions(ui: &Rc<Ui>, window: &adw::ApplicationWindow) {
     let preferences = gio::SimpleAction::new("preferences", None);
     let ui_prefs = ui.clone();
@@ -1345,9 +1206,9 @@ fn install_window_actions(ui: &Rc<Ui>, window: &adw::ApplicationWindow) {
         let dialog = adw::AboutDialog::builder()
             .application_name(gettext("Proton Drive for Linux"))
             .application_icon("io.narl.proton-drive-linux")
-            .version(pdfs_core::config::APP_VERSION)
+            .version(env!("CARGO_PKG_VERSION"))
             .developer_name("Nils Pukropp")
-            .website("https://github.com/narrrl/proton-drive-linux")
+            .website("https://proton-drive.narl.io")
             .issue_url("https://github.com/narrrl/proton-drive-linux/issues")
             .copyright("© 2026 Nils Pukropp (contact@narl.io)")
             .license_type(gtk4::License::MitX11)
@@ -1430,6 +1291,12 @@ fn install_launch_actions(ui: &Rc<Ui>, app: &adw::Application, window: &adw::App
         if ui_page.session.borrow().is_none() {
             return;
         }
+        // Signed in, but Proton refused the session (the tray's "Sign In
+        // Again…"): the login page, with the rest of the app still reachable.
+        if page == "login" {
+            show_login(&ui_page);
+            return;
+        }
         // Activity lives on as the Sync page's History view.
         if page == "activity" {
             ui_page.locations.views.set_visible_child_name("history");
@@ -1485,8 +1352,8 @@ fn debug_info(ui: &Rc<Ui>) -> String {
     format!(
         "App version: {}\nUser agent: {}\nlibadwaita: {}.{}.{}\nGTK: {}.{}.{}\n\
          Mountpoint: {}\nControl socket: {}\nMount service running: {}\n",
-        pdfs_core::config::APP_VERSION,
-        pdfs_core::config::USER_AGENT,
+        config.resolved_app_version(),
+        config.resolved_user_agent(),
         adw::major_version(),
         adw::minor_version(),
         adw::micro_version(),

crates/pdfs-gui/src/app/pages/activity_text.rs

@@ -341,6 +341,59 @@ fn detail_label(entry: &ActivityEntry) -> Option<String> {
             &[("name", alt)],
         ));
     }
+    if let Some((reason, copy)) = detail.split_once("; local changes uploaded as ") {
+        let args = [("name", copy)];
+        return Some(match edit_conflict(reason) {
+            // Translators: {name} is the copy the changes made on this
+            // computer were uploaded as.
+            EditConflict::Gone => gettext_f(
+                "It no longer exists on Proton Drive, so your changes were uploaded as {name}",
+                &args,
+            ),
+            // Translators: {name} is the copy the changes made on this
+            // computer were uploaded as.
+            EditConflict::Trashed => gettext_f(
+                "It was moved to the Trash on Proton Drive, so your changes were uploaded as {name}",
+                &args,
+            ),
+            // Translators: {name} is the copy the changes made on this
+            // computer were uploaded as.
+            EditConflict::Changed => gettext_f(
+                "It was changed on Proton Drive, so your changes were uploaded as {name}",
+                &args,
+            ),
+            // Translators: {name} is the copy the changes made on this
+            // computer were uploaded as.
+            EditConflict::Other => gettext_f("Your changes were uploaded as {name}", &args),
+        });
+    }
+    if let Some((reason, path)) = detail.split_once("; local changes kept at ") {
+        let path = tilde_path(path);
+        let args = [("path", path.as_str())];
+        return Some(match edit_conflict(reason) {
+            // Translators: {path} is the file on this computer that holds the
+            // changes which could not be uploaded.
+            EditConflict::Gone => gettext_f(
+                "It no longer exists on Proton Drive, so your changes were kept in {path}",
+                &args,
+            ),
+            // Translators: {path} is the file on this computer that holds the
+            // changes which could not be uploaded.
+            EditConflict::Trashed => gettext_f(
+                "It was moved to the Trash on Proton Drive, so your changes were kept in {path}",
+                &args,
+            ),
+            // Translators: {path} is the file on this computer that holds the
+            // changes which could not be uploaded.
+            EditConflict::Changed => gettext_f(
+                "It was changed on Proton Drive, so your changes were kept in {path}",
+                &args,
+            ),
+            // Translators: {path} is the file on this computer that holds the
+            // changes which could not be uploaded.
+            EditConflict::Other => gettext_f("Your changes were kept in {path}", &args),
+        });
+    }
     if let Some(base) = detail.strip_prefix("differs from ") {
         // Translators: {name} is the file the conflicting copy was made from.
         return Some(gettext_f("Differs from {name}", &[("name", base)]));
@@ -388,6 +441,26 @@ fn detail_label(entry: &ActivityEntry) -> Option<String> {
     Some(capitalize(detail))
 }
 
+/// Why a queued edit could not land on its file, from the reason the daemon
+/// gives before "; local changes uploaded as" or "; local changes kept at".
+enum EditConflict {
+    Gone,
+    Trashed,
+    Changed,
+    Other,
+}
+
+fn edit_conflict(reason: &str) -> EditConflict {
+    match reason {
+        "the file no longer exists remotely" => EditConflict::Gone,
+        "the file was trashed remotely" => EditConflict::Trashed,
+        r if r.starts_with("the remote revision changed under the queued write") => {
+            EditConflict::Changed
+        }
+        _ => EditConflict::Other,
+    }
+}
+
 /// A sync pass summary such as "2 uploaded, 1 folder(s) created", as a
 /// list of counts. `None` when a part is not one the daemon writes.
 fn sync_summary(detail: &str) -> Option<String> {
@@ -596,6 +669,38 @@ mod tests {
         assert_eq!(d.details, vec!["1 person can view"]);
     }
 
+    #[test]
+    fn an_edit_kept_as_a_copy_says_why_in_words() {
+        let d = describe(&entry(
+            ActivityKind::Upload,
+            "notes.txt",
+            "the remote revision changed under the queued write \
+             (based on revision r1, remote now at r2); \
+             local changes uploaded as notes (sync-conflict 1700000000).txt",
+            false,
+        ));
+        assert_eq!(
+            d.details,
+            vec![
+                "It was changed on Proton Drive, so your changes were uploaded as \
+                 notes (sync-conflict 1700000000).txt"
+            ]
+        );
+        let d = describe(&entry(
+            ActivityKind::Upload,
+            "notes.txt",
+            "the file was trashed remotely; local changes kept at /var/staging/7",
+            false,
+        ));
+        assert_eq!(
+            d.details,
+            vec![
+                "It was moved to the Trash on Proton Drive, so your changes were kept in \
+                 /var/staging/7"
+            ]
+        );
+    }
+
     #[test]
     fn unknown_details_show_as_written() {
         let d = describe(&entry(

crates/pdfs-gui/src/app/pages/browser.rs

@@ -832,8 +832,8 @@ fn show_location_column(ui: &Rc<Ui>, visible: bool) {
     }
 }
 
-/// The menu for one entry, in the order of `docs/UI_UX_PLAN.md` §6: open,
-/// offline, sharing, organising, and the destructive item last on its own.
+/// The menu for one entry, in a fixed order: open, offline, sharing,
+/// organising, and the destructive item last on its own.
 pub(crate) fn entry_context_menu(ui: &Rc<Ui>, entry: &DirEntry) -> ActionMenu {
     let mut menu = ActionMenu::new();
     let (ui_c, entry_c) = (ui.clone(), entry.clone());
@@ -1220,9 +1220,7 @@ pub(crate) fn repaint_crumb(ui: &Rc<Ui>, path: &str) {
     ));
     let mut acc = String::new();
     for (i, seg) in segments.iter().enumerate() {
-        let sep = gtk4::Label::new(Some("›"));
-        sep.add_css_class("dim-label");
-        ui.browser.crumb.append(&sep);
+        ui.browser.crumb.append(&crumb_separator());
         acc = if acc.is_empty() {
             seg.to_string()
         } else {
@@ -1237,12 +1235,7 @@ pub(crate) fn repaint_crumb(ui: &Rc<Ui>, path: &str) {
 /// flat button that navigates to `target` (clearing any active search first).
 pub(crate) fn crumb_node(ui: &Rc<Ui>, label: &str, target: &str, current: bool) -> gtk4::Widget {
     if current {
-        let l = gtk4::Label::builder()
-            .label(label)
-            .ellipsize(gtk4::pango::EllipsizeMode::Start)
-            .build();
-        l.add_css_class("heading");
-        return l.upcast();
+        return crumb_current(label);
     }
     let button = gtk4::Button::builder().label(label).build();
     button.add_css_class("flat");
@@ -1920,6 +1913,10 @@ pub(crate) fn prompt_rename(ui: &Rc<Ui>, entry: &DirEntry) {
 
 /// Pick a destination folder by browsing Drive's folders, and move `entries`
 /// there through the daemon.
+///
+/// Besides My files the picker offers every synced folder. A move into one is
+/// still made on Proton Drive, so nothing is downloaded or uploaded again; it
+/// is sent with absolute paths, which is how the daemon tells locations apart.
 pub(crate) fn prompt_move(ui: &Rc<Ui>, entries: Vec<DirEntry>) {
     if entries.is_empty() {
         return;
@@ -1967,6 +1964,7 @@ pub(crate) fn prompt_move(ui: &Rc<Ui>, entries: Vec<DirEntry>) {
     dialog.set_default_response(Some("move"));
     dialog.set_close_response("cancel");
 
+    let mountpoint = ui.dirs.resolved_mountpoint(&ui.dirs.load_config());
     let picker = Rc::new(MovePicker {
         ui: ui.clone(),
         dialog: dialog.clone(),
@@ -1974,28 +1972,93 @@ pub(crate) fn prompt_move(ui: &Rc<Ui>, entries: Vec<DirEntry>) {
         list,
         up: up.clone(),
         sources: sources.clone(),
-        folder: RefCell::new(String::new()),
+        folder: RefCell::new(MoveTarget::Locations),
         generation: Cell::new(0),
     });
     let picker_up = picker.clone();
     up.connect_clicked(move |_| {
-        let folder = picker_up.folder.borrow().clone();
-        let parent = folder.rfind('/').map(|i| &folder[..i]).unwrap_or_default();
-        picker_up.open(parent.to_string());
+        let parent = picker_up.folder.borrow().parent();
+        picker_up.open(parent);
     });
     // Start where the browser is: moving is most often one level up or down.
-    picker.open(ui.browser.path.borrow().clone());
+    picker.open(MoveTarget::Drive(ui.browser.path.borrow().clone()));
 
     let ui = ui.clone();
     let picker_done = picker.clone();
     dialog.connect_response(None, move |_, resp| {
-        if resp == "move" {
-            run_bulk_move(&ui, sources.clone(), picker_done.folder.borrow().clone());
+        if resp != "move" {
+            return;
+        }
+        match picker_done.folder.borrow().clone() {
+            MoveTarget::Locations => {}
+            MoveTarget::Drive(folder) => run_bulk_move(&ui, sources.clone(), folder),
+            MoveTarget::Synced { path, .. } => {
+                let absolute = sources
+                    .iter()
+                    .map(|rel| mountpoint.join(rel).to_string_lossy().into_owned())
+                    .collect();
+                run_bulk_move(&ui, absolute, path);
+            }
         }
     });
     dialog.present(ui_window(&picker.ui).as_ref());
 }
 
+/// Where the Move dialog is looking, and the destination if the user confirms.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) enum MoveTarget {
+    /// The list of places to move to: My files and each synced folder.
+    Locations,
+    /// A folder in My files, mountpoint-relative; empty for My files itself.
+    Drive(String),
+    /// A folder inside a synced folder, as an absolute local path. `root` is
+    /// the synced folder. A mirror folder is a plain directory, read from disk.
+    Synced {
+        root: String,
+        path: String,
+        mirror: bool,
+    },
+}
+
+impl MoveTarget {
+    /// One level up. The top of a location leads back to the list of them.
+    pub(crate) fn parent(&self) -> MoveTarget {
+        match self {
+            MoveTarget::Locations => MoveTarget::Locations,
+            MoveTarget::Drive(folder) if folder.is_empty() => MoveTarget::Locations,
+            MoveTarget::Drive(folder) => MoveTarget::Drive(
+                folder
+                    .rfind('/')
+                    .map(|i| folder[..i].to_string())
+                    .unwrap_or_default(),
+            ),
+            MoveTarget::Synced { root, path, .. } if path == root => MoveTarget::Locations,
+            MoveTarget::Synced { root, path, mirror } => MoveTarget::Synced {
+                root: root.clone(),
+                path: Path::new(path)
+                    .parent()
+                    .map(|p| p.to_string_lossy().into_owned())
+                    .unwrap_or_else(|| root.clone()),
+                mirror: *mirror,
+            },
+        }
+    }
+
+    /// `name` inside this folder, in the same form.
+    fn child(&self, name: &str) -> MoveTarget {
+        match self {
+            MoveTarget::Locations => MoveTarget::Locations,
+            MoveTarget::Drive(folder) if folder.is_empty() => MoveTarget::Drive(name.to_string()),
+            MoveTarget::Drive(folder) => MoveTarget::Drive(format!("{folder}/{name}")),
+            MoveTarget::Synced { root, path, mirror } => MoveTarget::Synced {
+                root: root.clone(),
+                path: Path::new(path).join(name).to_string_lossy().into_owned(),
+                mirror: *mirror,
+            },
+        }
+    }
+}
+
 /// The Move dialog's folder browser.
 struct MovePicker {
     ui: Rc<Ui>,
@@ -2006,71 +2069,81 @@ struct MovePicker {
     /// What is being moved, mountpoint-relative.
     sources: Vec<String>,
     /// The folder on show, and the destination if the user confirms now.
-    folder: RefCell<String>,
+    folder: RefCell<MoveTarget>,
     /// Drops a listing that arrives after the user went elsewhere.
     generation: Cell<u64>,
 }
 
 impl MovePicker {
-    fn open(self: &Rc<Self>, folder: String) {
+    fn open(self: &Rc<Self>, folder: MoveTarget) {
         let generation = self.generation.get().wrapping_add(1);
         self.generation.set(generation);
-        self.location.set_label(if folder.is_empty() {
-            "Proton Drive"
-        } else {
-            &folder
-        });
-        self.location.set_tooltip_text(Some(&folder));
-        self.up.set_sensitive(!folder.is_empty());
-        self.dialog
-            .set_response_enabled("move", move_target_allowed(&self.sources, &folder));
+        let (label, tooltip) = match &folder {
+            MoveTarget::Locations => (gettext("Locations"), String::new()),
+            MoveTarget::Drive(rel) if rel.is_empty() => (gettext("My files"), String::new()),
+            MoveTarget::Drive(rel) => (rel.clone(), rel.clone()),
+            MoveTarget::Synced { path, .. } => (path.clone(), path.clone()),
+        };
+        self.location.set_label(&label);
+        self.location.set_tooltip_text(Some(&tooltip));
+        self.up
+            .set_sensitive(!matches!(folder, MoveTarget::Locations));
+        let allowed = match &folder {
+            MoveTarget::Locations => false,
+            MoveTarget::Drive(rel) => move_target_allowed(&self.sources, rel),
+            // What is moved is in My files, so it cannot be in a synced folder.
+            MoveTarget::Synced { .. } => true,
+        };
+        self.dialog.set_response_enabled("move", allowed);
         *self.folder.borrow_mut() = folder.clone();
         while let Some(row) = self.list.first_child() {
             self.list.remove(&row);
         }
         self.list.append(&picker_note(&gettext("Loading…")));
-        let rx = spawn_request(
-            self.ui.dirs.control_socket(),
-            Request::ListDir {
-                path: folder.clone(),
-            },
-        );
+
         let picker = self.clone();
         glib::spawn_future_local(async move {
-            let result = rx.recv().await;
+            let listed = match &folder {
+                MoveTarget::Locations => picker.locations().await,
+                MoveTarget::Drive(rel) => picker.drive_folders(&folder, rel.clone()).await,
+                MoveTarget::Synced {
+                    path, mirror: true, ..
+                } => local_folders(&folder, path.clone()).await,
+                MoveTarget::Synced { path, .. } => {
+                    picker.drive_folders(&folder, path.clone()).await
+                }
+            };
             if picker.generation.get() != generation {
                 return;
             }
             while let Some(row) = picker.list.first_child() {
                 picker.list.remove(&row);
             }
-            let Ok(Ok(Response::Entries { entries })) = result else {
+            let Some(rows) = listed else {
                 picker
                     .list
                     .append(&picker_note(&gettext("Couldn't read this folder.")));
                 return;
             };
-            let mut folders: Vec<DirEntry> = entries.into_iter().filter(|e| e.is_dir).collect();
-            folders.sort_by_key(|e| e.name.to_lowercase());
             let mut shown = 0;
-            for entry in folders {
-                let path = if folder.is_empty() {
-                    entry.name.clone()
-                } else {
-                    format!("{folder}/{}", entry.name)
-                };
+            for (title, subtitle, target) in rows {
                 // A folder cannot go inside itself, so do not offer to open it.
-                if picker.sources.contains(&path) {
+                if let MoveTarget::Drive(path) = &target
+                    && picker.sources.contains(path)
+                {
                     continue;
                 }
                 let row = adw::ActionRow::builder()
-                    .title(glib::markup_escape_text(&entry.name).as_str())
+                    .title(glib::markup_escape_text(&title).as_str())
                     .activatable(true)
                     .build();
+                if let Some(subtitle) = subtitle {
+                    row.set_subtitle(glib::markup_escape_text(&subtitle).as_str());
+                }
                 row.add_prefix(&gtk4::Image::from_icon_name("folder-symbolic"));
                 row.add_suffix(&gtk4::Image::from_icon_name("go-next-symbolic"));
                 let open = picker.clone();
-                row.connect_activated(move |_| open.open(path.clone()));
+                row.connect_activated(move |_| open.open(target.clone()));
                 picker.list.append(&row);
                 shown += 1;
             }
@@ -2081,6 +2154,92 @@ impl MovePicker {
             }
         });
     }
+
+    /// My files and every synced folder, as rows of the top level.
+    async fn locations(&self) -> Option<Vec<PickerRow>> {
+        let mut rows = vec![(gettext("My files"), None, MoveTarget::Drive(String::new()))];
+        let rx = spawn_request(self.ui.dirs.control_socket(), Request::ListSyncFolders);
+        let Ok(Ok(Response::SyncFolders { mut items })) = rx.recv().await else {
+            // My files alone is still somewhere to move to.
+            return Some(rows);
+        };
+        items.sort_by_key(|f| f.local_path.to_lowercase());
+        for folder in items {
+            let name = Path::new(&folder.local_path)
+                .file_name()
+                .map(|n| n.to_string_lossy().into_owned())
+                .unwrap_or_else(|| folder.local_path.clone());
+            rows.push((
+                name,
+                Some(folder.local_path.clone()),
+                MoveTarget::Synced {
+                    root: folder.local_path.clone(),
+                    path: folder.local_path,
+                    mirror: folder.mode == "mirror",
+                },
+            ));
+        }
+        Some(rows)
+    }
+
+    /// The folders in a mounted folder: `folder` is mountpoint-relative for My
+    /// files and absolute for an on-demand synced folder.
+    async fn drive_folders(&self, here: &MoveTarget, folder: String) -> Option<Vec<PickerRow>> {
+        let rx = spawn_request(
+            self.ui.dirs.control_socket(),
+            Request::ListDir {
+                path: folder.clone(),
+            },
+        );
+        let Ok(Ok(Response::Entries { entries })) = rx.recv().await else {
+            return None;
+        };
+        let mut names: Vec<String> = entries
+            .into_iter()
+            .filter(|e| e.is_dir)
+            .map(|e| e.name)
+            .collect();
+        names.sort_by_key(|name| name.to_lowercase());
+        Some(
+            names
+                .into_iter()
+                .map(|name| {
+                    let target = here.child(&name);
+                    (name, None, target)
+                })
+                .collect(),
+        )
+    }
+}
+
+/// One row of the picker: its title, an optional subtitle, and where it leads.
+type PickerRow = (String, Option<String>, MoveTarget);
+
+/// The folders in a mirror folder's directory `path`, read from disk off the
+/// main thread. A mirror folder has no mount for `ListDir` to read.
+async fn local_folders(here: &MoveTarget, path: String) -> Option<Vec<PickerRow>> {
+    let names = gio::spawn_blocking(move || {
+        let mut names: Vec<String> = std::fs::read_dir(&path)
+            .ok()?
+            .flatten()
+            .filter(|e| e.file_type().is_ok_and(|t| t.is_dir()))
+            .filter_map(|e| e.file_name().into_string().ok())
+            .filter(|name| !name.contains(".pdfs-tmp-"))
+            .collect();
+        names.sort_by_key(|name| name.to_lowercase());
+        Some(names)
+    })
+    .await
+    .ok()??;
+    Some(
+        names
+            .into_iter()
+            .map(|name| {
+                let target = here.child(&name);
+                (name, None, target)
+            })
+            .collect(),
+    )
 }
 
 fn picker_note(text: &str) -> gtk4::ListBoxRow {
@@ -2329,9 +2488,13 @@ pub(crate) fn start_upload(ui: &Rc<Ui>, sources: Vec<String>) {
 }
 
 /// The sync-state badge for an entry: `(icon, css-class)`, or `None` for folders
-/// (which carry no per-file cache state). Pinned (kept offline) ranks above merely
+/// (which carry no per-file cache state). A sync issue ranks first, on folders
+/// too: the change waits for the user. Pinned (kept offline) ranks above merely
 /// cached (downloaded, evictable); everything else is online-only.
 pub(crate) fn badge_for(entry: &DirEntry) -> Option<(&'static str, &'static str)> {
+    if entry.issue.is_some() {
+        return Some(("dialog-warning-symbolic", "badge-issue"));
+    }
     if entry.is_dir {
         return None;
     }
@@ -2347,9 +2510,11 @@ pub(crate) fn badge_for(entry: &DirEntry) -> Option<(&'static str, &'static str)
 /// Paint `badge` to reflect the entry's sync state (see [`badge_for`]). Clears any
 /// prior colour class first, since list factories recycle cells.
 pub(crate) fn apply_badge(badge: &gtk4::Image, entry: &DirEntry) {
-    for class in ["badge-pinned", "badge-cached", "badge-cloud"] {
+    for class in ["badge-pinned", "badge-cached", "badge-cloud", "badge-issue"] {
         badge.remove_css_class(class);
     }
+    let issue = entry.issue.map(super::locations::issue_text);
+    badge.set_tooltip_text(issue.as_deref());
     match badge_for(entry) {
         Some((icon, class)) => {
             badge.set_icon_name(Some(icon));
@@ -2749,6 +2914,7 @@ pub(crate) fn repaint_search(ui: &Rc<Ui>, hits: &[SearchHit]) {
             shared_by_unverified: false,
             trashed_at: 0,
             trashed_from: None,
+            issue: None,
         })
         .collect();
     sort_entries(&mut entries, ui.browser.view.get());
@@ -2786,11 +2952,11 @@ fn listing_summary(files: usize, folders: usize, file_bytes: u64) -> String {
 #[cfg(test)]
 mod tests {
     use super::{
-        hit_location, listing_summary, move_target_allowed, show_thumbnail_build_progress,
-        sort_entries,
+        MoveTarget, badge_for, hit_location, listing_summary, move_target_allowed,
+        show_thumbnail_build_progress, sort_entries,
     };
     use pdfs_core::config::{FileSort, FilesView};
-    use pdfs_core::control::{DirEntry, ThumbnailBuildStatus};
+    use pdfs_core::control::{DirEntry, SyncIssue, ThumbnailBuildStatus};
 
     fn entry(name: &str, is_dir: bool, size: u64, modified: i64) -> DirEntry {
         DirEntry {
@@ -2808,6 +2974,7 @@ mod tests {
             shared_by_unverified: false,
             trashed_at: 0,
             trashed_from: None,
+            issue: None,
         }
     }
 
@@ -2815,6 +2982,20 @@ mod tests {
         entries.iter().map(|e| e.name.as_str()).collect()
     }
 
+    #[test]
+    fn a_sync_issue_shows_on_the_node_before_its_cache_state() {
+        let mut file = entry("a.txt", false, 1, 0);
+        file.pinned = true;
+        assert_eq!(badge_for(&file).unwrap().1, "badge-pinned");
+        file.issue = Some(SyncIssue::Quota);
+        assert_eq!(badge_for(&file).unwrap().1, "badge-issue");
+
+        let mut folder = entry("d", true, 0, 0);
+        assert_eq!(badge_for(&folder), None);
+        folder.issue = Some(SyncIssue::Missing);
+        assert_eq!(badge_for(&folder).unwrap().1, "badge-issue");
+    }
+
     #[test]
     fn a_search_hit_location_is_its_parent_folder() {
         assert_eq!(hit_location("Work/Old/a.txt"), "Work/Old");
@@ -2880,4 +3061,43 @@ mod tests {
         status.running = false;
         assert!(!show_thumbnail_build_progress(&status));
     }
+
+    #[test]
+    fn move_picker_climbs_from_a_location_top_to_the_list_of_locations() {
+        assert_eq!(
+            MoveTarget::Drive(String::new()).parent(),
+            MoveTarget::Locations
+        );
+        let root = MoveTarget::Synced {
+            root: "/home/u/Docs".into(),
+            path: "/home/u/Docs".into(),
+            mirror: true,
+        };
+        assert_eq!(root.parent(), MoveTarget::Locations);
+    }
+
+    #[test]
+    fn move_picker_climbs_one_folder_at_a_time_inside_a_location() {
+        assert_eq!(
+            MoveTarget::Drive("a/b".into()).parent(),
+            MoveTarget::Drive("a".into())
+        );
+        assert_eq!(
+            MoveTarget::Drive("a".into()).parent(),
+            MoveTarget::Drive(String::new())
+        );
+        let inner = MoveTarget::Synced {
+            root: "/home/u/Docs".into(),
+            path: "/home/u/Docs/x/y".into(),
+            mirror: false,
+        };
+        assert_eq!(
+            inner.parent(),
+            MoveTarget::Synced {
+                root: "/home/u/Docs".into(),
+                path: "/home/u/Docs/x".into(),
+                mirror: false,
+            }
+        );
+    }
 }

crates/pdfs-gui/src/app/pages/devices.rs

@@ -439,6 +439,10 @@ fn other_computer_row(ui: &Rc<Ui>, dev: &DeviceInfo) -> adw::ActionRow {
     menu.item(&gettext("Restore to This Computer…"), move || {
         prompt_restore_folders(&ui_c, Some((uid_c.clone(), name_c.clone())))
     });
+    let (ui_c, uid_c, name_c) = (ui.clone(), uid.clone(), name.clone());
+    menu.item(&gettext("Move to This Computer…"), move || {
+        prompt_migrate_device(&ui_c, &uid_c, &name_c)
+    });
     menu.section();
     let (ui_c, uid_c, name_c) = (ui.clone(), uid.clone(), name.clone());
     menu.item(&gettext("Rename…"), move || {
@@ -483,9 +487,7 @@ fn repaint_device_crumb(ui: &Rc<Ui>, nav: &[(String, String)]) {
         nav.is_empty(),
     ));
     for (i, (_, name)) in nav.iter().enumerate() {
-        let sep = gtk4::Label::new(Some("›"));
-        sep.add_css_class("dim-label");
-        crumb.append(&sep);
+        crumb.append(&crumb_separator());
         crumb.append(&device_crumb_node(ui, name, i + 1, i + 1 == nav.len()));
     }
 }
@@ -494,12 +496,7 @@ fn repaint_device_crumb(ui: &Rc<Ui>, nav: &[(String, String)]) {
 /// that goes back up to `depth` levels below the device list.
 fn device_crumb_node(ui: &Rc<Ui>, label: &str, depth: usize, current: bool) -> gtk4::Widget {
     if current {
-        let l = gtk4::Label::builder()
-            .label(label)
-            .ellipsize(gtk4::pango::EllipsizeMode::Start)
-            .build();
-        l.add_css_class("heading");
-        return l.upcast();
+        return crumb_current(label);
     }
     let button = gtk4::Button::builder().label(label).build();
     button.add_css_class("flat");
@@ -1096,6 +1093,67 @@ pub(crate) fn prompt_adopt_device(ui: &Rc<Ui>, uid: &str, name: &str) {
     dialog.present(win.as_ref());
 }
 
+/// Ask before moving another computer's folders into this computer's backup,
+/// then offer them for syncing here.
+///
+/// Destructive-looking on purpose: the other computer keeps its device but
+/// loses its folders, and a copy of Proton Drive still running there would
+/// watch them vanish.
+pub(crate) fn prompt_migrate_device(ui: &Rc<Ui>, uid: &str, name: &str) {
+    let win = ui_window(ui);
+    let dialog = adw::AlertDialog::builder()
+        .heading(gettext("Move Backup to This Computer?"))
+        // Translators: {name} is the name of the other computer whose folders move to this one.
+        .body(gettext_f(
+            "The folders backed up by “{name}” move into this computer's backup in Proton Drive, and you choose where they go on this computer. “{name}” stays in your account, without those folders.\n\nStop Proton Drive on “{name}” first. Otherwise it sees its folders disappear.",
+            &[("name", name)],
+        ))
+        .build();
+    dialog.add_response("cancel", &gettext("Cancel"));
+    dialog.add_response("move", &gettext("Move Here"));
+    dialog.set_response_appearance("move", adw::ResponseAppearance::Destructive);
+    dialog.set_default_response(Some("cancel"));
+    dialog.set_close_response("cancel");
+    let ui = ui.clone();
+    let uid = uid.to_string();
+    // Translators: {name} is the name of the computer whose folders moved to this one.
+    let done = gettext_f("Moved the backup of “{name}”", &[("name", name)]);
+    dialog.connect_response(None, move |_, resp| {
+        if resp != "move" {
+            return;
+        }
+        ui.busy_begin();
+        let rx = spawn_request(
+            ui.dirs.control_socket(),
+            Request::MigrateDevice { uid: uid.clone() },
+        );
+        let (ui, done) = (ui.clone(), done.clone());
+        glib::spawn_future_local(async move {
+            let result = rx.recv().await;
+            ui.busy_end();
+            let failed = gettext("Couldn't move that backup");
+            match result {
+                Ok(Ok(Response::Ok { .. })) => {
+                    reload_sync_pages(&ui);
+                    toast(&ui, &done);
+                    // The folders are this computer's now, so its own restore
+                    // picker is where the user chooses their local paths.
+                    prompt_restore_folders(&ui, None);
+                }
+                Ok(Ok(Response::Error { message, kind })) => {
+                    toast_failure(&ui, &failed, &message, kind)
+                }
+                _ => toast_error(
+                    &ui,
+                    &failed,
+                    &gettext("The Proton Drive service didn't respond."),
+                ),
+            }
+        });
+    });
+    dialog.present(win.as_ref());
+}
+
 /// Run a mutation raised from Computers or Locations and reload the page on success.
 pub(crate) fn run_devices_mutation(ui: &Rc<Ui>, req: Request, done: &str, failed: &str) {
     ui.busy_begin();

crates/pdfs-gui/src/app/pages/locations.rs

@@ -7,7 +7,7 @@
 //! `~/ProtonDrive` mount, plus each folder this computer backs up, whether it is
 //! a mirrored local directory or an on-demand FUSE session. The page is called
 //! *Locations* rather than *Mounts* because a mirror folder is a plain directory
-//! with no FUSE session behind it (mount-architecture.md §4).
+//! with no FUSE session behind it.
 //!
 //! The device rows drive the same control requests the Computers page used to:
 //! mode switch, sync now, remove. What is new here is that the primary mount is
@@ -46,6 +46,8 @@ pub(crate) struct SyncCard {
     pub(crate) pause: adw::SplitButton,
     /// Whether the last status said paused, so the button knows which way to go.
     pub(crate) paused: Cell<bool>,
+    /// Shown only while Proton refuses the session; opens the sign-in page.
+    pub(crate) sign_in: gtk4::Button,
 }
 
 /// What a folder row's controls are built from. The subtitle and progress bar
@@ -70,8 +72,9 @@ pub(crate) struct LocationRow {
     progress: gtk4::ProgressBar,
 }
 
-/// What a queue row shows that can change: id, attempts, next attempt, parked.
-pub(crate) type QueueKey = (i64, i64, Option<i64>, bool);
+/// What a queue row shows that can change: id, attempts, next attempt, parked,
+/// issue.
+pub(crate) type QueueKey = (i64, i64, Option<i64>, bool, Option<SyncIssue>);
 
 /// The "Waiting to Upload" list: the daemon's pending-op queue.
 pub(crate) struct QueueState {
@@ -107,6 +110,7 @@ pub(crate) struct LocationsWidgets {
     pub(crate) card_icon: gtk4::Image,
     pub(crate) card_title: gtk4::Label,
     pub(crate) card_detail: gtk4::Label,
+    pub(crate) card_sign_in: gtk4::Button,
     pub(crate) pause: adw::SplitButton,
     pub(crate) queue_group: adw::PreferencesGroup,
     pub(crate) retry_all: gtk4::Button,
@@ -133,7 +137,7 @@ pub(crate) fn build_locations_page(history: &gtk4::Widget) -> (gtk4::Widget, Loc
         .build();
     add_folder.add_css_class("flat");
     let transfers_group = build_transfers_group();
-    let (card, card_icon, card_title, card_detail) = build_sync_card();
+    let (card, card_icon, card_title, card_detail, card_sign_in) = build_sync_card();
     let pause = build_pause_button();
     let (queue_group, retry_all) = build_queue_group();
     let conflicts_group = adw::PreferencesGroup::builder()
@@ -252,6 +256,7 @@ pub(crate) fn build_locations_page(history: &gtk4::Widget) -> (gtk4::Widget, Loc
         card_icon,
         card_title,
         card_detail,
+        card_sign_in,
         pause,
         queue_group,
         retry_all,
@@ -262,20 +267,22 @@ pub(crate) fn build_locations_page(history: &gtk4::Widget) -> (gtk4::Widget, Loc
     (frame.upcast(), widgets)
 }
 
-/// `child` in a clamp that scrolls vertically only, with page margins.
+/// `child` across the page's full width, scrolling vertically only, with page
+/// margins.
 fn scrolled_column(child: &impl IsA<gtk4::Widget>) -> gtk4::ScrolledWindow {
-    let clamp = adw::Clamp::builder().child(child).build();
-    clamp.set_margin_top(18);
-    clamp.set_margin_bottom(18);
-    clamp.set_margin_start(18);
-    clamp.set_margin_end(18);
+    let column = gtk4::Box::new(gtk4::Orientation::Vertical, 0);
+    column.append(child);
+    column.set_margin_top(18);
+    column.set_margin_bottom(18);
+    column.set_margin_start(18);
+    column.set_margin_end(18);
     // Never scroll sideways: a location's subtitle holds a full path, and letting
     // the row grow to fit one pushes the controls at its end off screen.
     // Constrained, the path ellipsizes and the controls stay reachable.
     gtk4::ScrolledWindow::builder()
         .vexpand(true)
         .hscrollbar_policy(gtk4::PolicyType::Never)
-        .child(&clamp)
+        .child(&column)
         .build()
 }
 
@@ -287,6 +294,11 @@ pub(crate) fn wire_locations(ui: &Rc<Ui>, retry: &gtk4::Button, add_folder: &gtk
     let ui_add = ui.clone();
     add_folder.connect_clicked(move |_| prompt_add_sync_folder(&ui_add));
     wire_pause(ui);
+    let ui_sign_in = ui.clone();
+    ui.locations
+        .card
+        .sign_in
+        .connect_clicked(move |_| show_login(&ui_sign_in));
     let ui_retry = ui.clone();
     ui.locations
         .queue
@@ -376,9 +388,15 @@ pub(crate) fn paint_sync_banner(ui: &Rc<Ui>) {
     state.banner.set_revealed(away && title.is_some());
 }
 
-/// The status hero: a large state icon, the state in words, and what it
-/// means.
-fn build_sync_card() -> (gtk4::Box, gtk4::Image, gtk4::Label, gtk4::Label) {
+/// The status hero: a large state icon, the state in words, what it means,
+/// and the way out when there is one only the user can take.
+fn build_sync_card() -> (
+    gtk4::Box,
+    gtk4::Image,
+    gtk4::Label,
+    gtk4::Label,
+    gtk4::Button,
+) {
     let icon = gtk4::Image::builder()
         .icon_name("pdfs-sync-symbolic")
         .pixel_size(48)
@@ -405,9 +423,17 @@ fn build_sync_card() -> (gtk4::Box, gtk4::Image, gtk4::Label, gtk4::Label) {
     let card = gtk4::Box::new(gtk4::Orientation::Horizontal, 18);
     card.add_css_class("card");
     card.add_css_class("sync-card");
+    let sign_in = gtk4::Button::builder()
+        .label(gettext("Sign In Again"))
+        .valign(gtk4::Align::Center)
+        .visible(false)
+        .build();
+    sign_in.add_css_class("pill");
+    sign_in.add_css_class("suggested-action");
     card.append(&icon);
     card.append(&text);
-    (card, icon, title, detail)
+    card.append(&sign_in);
+    (card, icon, title, detail, sign_in)
 }
 
 /// Pause/Resume, with timed pauses in its menu.
@@ -589,7 +615,7 @@ fn repaint_queue(ui: &Rc<Ui>, items: &[PendingOpInfo]) {
     items.sort_by_key(|op| (!op.failing, op.attempts == 0, op.id));
     let key: Vec<QueueKey> = items
         .iter()
-        .map(|op| (op.id, op.attempts, op.next_attempt_at, op.parked))
+        .map(|op| (op.id, op.attempts, op.next_attempt_at, op.parked, op.issue))
         .collect();
     if *queue.painted.borrow() == key {
         return;
@@ -646,6 +672,10 @@ fn queue_row(ui: &Rc<Ui>, op: &PendingOpInfo, now: i64) -> adw::ActionRow {
         "{action} · {state}",
         &[("action", &action), ("state", &state)],
     );
+    if let Some(issue) = op.issue {
+        subtitle.push('\n');
+        subtitle.push_str(&issue_text(issue));
+    }
     if let Some(error) = &op.last_error {
         subtitle.push('\n');
         // Translators: {n} is how many attempts failed, {error} the last error message.
@@ -660,7 +690,7 @@ fn queue_row(ui: &Rc<Ui>, op: &PendingOpInfo, now: i64) -> adw::ActionRow {
         .title(glib::markup_escape_text(&op.path).as_str())
         .subtitle(glib::markup_escape_text(&subtitle).as_str())
         .title_lines(1)
-        .subtitle_lines(3)
+        .subtitle_lines(if op.issue.is_some() { 5 } else { 3 })
         .tooltip_text(&op.path)
         .build();
     let image = gtk4::Image::from_icon_name(if op.failing {
@@ -685,9 +715,157 @@ fn queue_row(ui: &Rc<Ui>, op: &PendingOpInfo, now: i64) -> adw::ActionRow {
         retry.connect_clicked(move |_| retry_queued(&ui, Some(id)));
         row.add_suffix(&retry);
     }
+    if op.failing && op.exportable {
+        let export = gtk4::Button::builder()
+            .label(gettext("Export"))
+            .tooltip_text(gettext("Save a copy of this file's content elsewhere"))
+            .valign(gtk4::Align::Center)
+            .build();
+        export.add_css_class("flat");
+        let ui = ui.clone();
+        let id = op.id;
+        let name = Path::new(&op.path)
+            .file_name()
+            .map(|name| name.to_string_lossy().into_owned())
+            .unwrap_or_default();
+        export.connect_clicked(move |_| prompt_export_queued(&ui, id, &name));
+        row.add_suffix(&export);
+    }
+    if op.failing {
+        let discard = gtk4::Button::builder()
+            .label(gettext("Discard"))
+            .tooltip_text(gettext("Undo this change here instead of sending it"))
+            .valign(gtk4::Align::Center)
+            .build();
+        discard.add_css_class("flat");
+        let ui = ui.clone();
+        let id = op.id;
+        let path = op.path.clone();
+        let exportable = op.exportable;
+        discard.connect_clicked(move |_| prompt_discard_queued(&ui, id, &path, exportable));
+        row.add_suffix(&discard);
+    }
     row
 }
 
+/// What a sync issue means and what the user can do about it. The change stays
+/// queued either way.
+pub(crate) fn issue_text(issue: SyncIssue) -> String {
+    match issue {
+        SyncIssue::Quota => gettext(
+            "Your Proton Drive storage is full. Free up space or upgrade your plan, and this change uploads on its own.",
+        ),
+        SyncIssue::Access => gettext(
+            "You can no longer change this on Proton Drive. Ask the owner for edit access, or export the file to keep your version.",
+        ),
+        SyncIssue::Missing => gettext(
+            "The folder this change belongs in is gone from Proton Drive. Export the file to keep your version.",
+        ),
+        SyncIssue::Limit => gettext(
+            "Proton Drive's limit on items in a folder or on folder depth is reached. Make room in the folder, then retry.",
+        ),
+        SyncIssue::Rejected | SyncIssue::Unknown => {
+            gettext("Proton Drive refused this change. It stays queued and is tried again.")
+        }
+    }
+}
+
+/// Ask where to save a copy of a queued file's content, then have the daemon
+/// write it there. The change itself stays queued.
+fn prompt_export_queued(ui: &Rc<Ui>, id: i64, name: &str) {
+    let window = ui_window(ui);
+    let dialog = gtk4::FileDialog::builder()
+        .title(gettext("Export File"))
+        .initial_name(name)
+        .build();
+    let ui = ui.clone();
+    dialog.save(window.as_ref(), gio::Cancellable::NONE, move |res| {
+        let Ok(file) = res else { return };
+        let Some(dest) = file.path().and_then(|p| p.to_str().map(str::to_string)) else {
+            toast_error(
+                &ui,
+                &gettext("Couldn't export the file"),
+                &gettext("That location isn't a local file."),
+            );
+            return;
+        };
+        let rx = spawn_request(
+            ui.dirs.control_socket(),
+            Request::ExportPendingOp { id, dest },
+        );
+        let ui = ui.clone();
+        glib::spawn_future_local(async move {
+            match rx.recv().await {
+                Ok(Ok(Response::Ok { .. })) => toast(&ui, &gettext("File exported")),
+                Ok(Ok(Response::Error { message, kind })) => {
+                    toast_failure(&ui, &gettext("Couldn't export the file"), &message, kind)
+                }
+                _ => toast_error(
+                    &ui,
+                    &gettext("Couldn't export the file"),
+                    &gettext("The Proton Drive service didn't respond."),
+                ),
+            }
+        });
+    });
+}
+
+/// Confirm, then have the daemon drop a queued change and undo it here.
+fn prompt_discard_queued(ui: &Rc<Ui>, id: i64, path: &str, exportable: bool) {
+    let body = if exportable {
+        // Translators: {path} is the file whose queued change would be dropped.
+        gettext_f(
+            "Your changes to {path} are undone here and never reach Proton Drive. Export the file first to keep your version.",
+            &[("path", path)],
+        )
+    } else {
+        // Translators: {path} is the file or folder whose queued change would be dropped.
+        gettext_f(
+            "The change to {path} is undone here and never reaches Proton Drive.",
+            &[("path", path)],
+        )
+    };
+    let dialog = adw::AlertDialog::builder()
+        .heading(gettext("Discard Change?"))
+        .body(body)
+        .build();
+    dialog.add_response("cancel", &gettext("Cancel"));
+    dialog.add_response("discard", &gettext("Discard"));
+    dialog.set_response_appearance("discard", adw::ResponseAppearance::Destructive);
+    dialog.set_default_response(Some("cancel"));
+    dialog.set_close_response("cancel");
+    let window = ui_window(ui);
+    let ui = ui.clone();
+    dialog.connect_response(None, move |_, resp| {
+        if resp == "discard" {
+            discard_queued(&ui, id);
+        }
+    });
+    dialog.present(window.as_ref());
+}
+
+fn discard_queued(ui: &Rc<Ui>, id: i64) {
+    let rx = spawn_request(ui.dirs.control_socket(), Request::DiscardPendingOp { id });
+    let ui = ui.clone();
+    glib::spawn_future_local(async move {
+        match rx.recv().await {
+            Ok(Ok(Response::Ok { .. })) => {
+                toast(&ui, &gettext("Change discarded"));
+                ui.locations.queue.painted.borrow_mut().clear();
+                refresh_queue(&ui);
+            }
+            Ok(Ok(Response::Error { message, kind })) => {
+                toast_failure(&ui, &gettext("Couldn't discard the change"), &message, kind)
+            }
+            _ => toast_error(
+                &ui,
+                &gettext("Couldn't discard the change"),
+                &gettext("The Proton Drive service didn't respond."),
+            ),
+        }
+    });
+}
+
 /// Ask the daemon to stop waiting out one op's backoff, or every failed op's.
 fn retry_queued(ui: &Rc<Ui>, id: Option<i64>) {
     let rx = spawn_request(ui.dirs.control_socket(), Request::RetryPendingOp { id });

crates/pdfs-gui/src/app/pages/login.rs

@@ -1,5 +1,5 @@
 use crate::*;
-use pdfs_core::proton_sdk::api::HumanVerificationCredential;
+use pdfs_core::proton_sdk::api::{HumanVerification, HumanVerificationCredential};
 
 pub(crate) struct LoginState {
     // Login page.
@@ -128,7 +128,12 @@ pub(crate) fn wire_login(ui: &Rc<Ui>) {
 
         set_signing_in(&ui, true);
         ui.login.login_status.set_text(&gettext("Signing in…"));
-        let (rx, totp_req_rx, hv_req_rx) = spawn_login(username, password);
+        let LoginChannels {
+            result: rx,
+            totp: totp_req_rx,
+            hv: hv_req_rx,
+            mailbox: mailbox_req_rx,
+        } = spawn_login(username, password);
 
         // Surface the 2FA dialog only if the SDK actually asks for a code (i.e.
         // the account has 2FA enabled). The worker blocks until the dialog feeds
@@ -145,15 +150,40 @@ pub(crate) fn wire_login(ui: &Rc<Ui>) {
         });
 
         // Same shape for human verification: only fires when the API gates the
-        // sign-in, and the worker is blocked on the token until it does.
+        // sign-in, and the worker is blocked on the credential until it does.
         let ui_hv = ui.clone();
         glib::spawn_future_local(async move {
-            if let Ok((url, token_tx)) = hv_req_rx.recv().await {
+            if let Ok((hv, credential_tx)) = hv_req_rx.recv().await {
                 ui_hv
                     .login
                     .login_status
                     .set_text(&gettext("Complete the verification to continue…"));
-                prompt_human_verification(&ui_hv, &url, token_tx);
+                // Anything but a credential drops the sender, which the worker
+                // reads as a cancelled sign-in.
+                match verify_human(hv.verification_url()).await {
+                    Verification::Solved(token) => {
+                        let _ = credential_tx.send(HumanVerificationCredential::captcha(token));
+                    }
+                    Verification::Cancelled => {}
+                    // The web view could not start, most likely its sandbox
+                    // (B195): the user's browser can show the page instead.
+                    Verification::Failed => verify_in_browser(&ui_hv, &hv, credential_tx),
+                }
+            }
+        });
+
+        // And for the mailbox password, which only a two-password account has.
+        // The worker asks again after a wrong answer, so this loops too.
+        let ui_mailbox = ui.clone();
+        glib::spawn_future_local(async move {
+            while let Ok((attempt, answer_tx)) = mailbox_req_rx.recv().await {
+                ask_mailbox(&ui_mailbox, attempt > 0, move |answer| {
+                    // A cancelled dialog drops the sender, which the worker
+                    // reads as a cancelled login.
+                    if let Some(answer) = answer {
+                        let _ = answer_tx.send(answer);
+                    }
+                });
             }
         });
 
@@ -209,6 +239,12 @@ pub(crate) fn login_error_message(error: &pdfs_core::Error) -> String {
         pdfs_core::Error::Other(message) if message.contains("two-factor") => {
             gettext("Sign-in cancelled: no two-factor code was entered.")
         }
+        pdfs_core::Error::Other(message) if message.contains("mailbox") => {
+            gettext("Sign-in cancelled: no mailbox password was entered.")
+        }
+        pdfs_core::Error::WrongMailboxPassword => {
+            gettext("That mailbox password didn't unlock your account.")
+        }
         pdfs_core::Error::Other(message) if message.contains("verification") => gettext(
             "Sign-in cancelled: the verification wasn't completed. Sign in again to get a new one.",
         ),
@@ -220,26 +256,34 @@ pub(crate) fn login_error_message(error: &pdfs_core::Error) -> String {
     }
 }
 
+/// What the login worker asks the UI for, and how it reports back.
+pub(crate) struct LoginChannels {
+    /// The final outcome, once.
+    pub(crate) result: async_channel::Receiver<Result<(), String>>,
+    /// Fires only if the account needs a 2FA code; carries the sender for it.
+    pub(crate) totp: async_channel::Receiver<std::sync::mpsc::Sender<String>>,
+    /// Fires only if the sign-in is gated: the challenge, and the sender for the
+    /// credential the user earns by solving it.
+    pub(crate) hv: async_channel::Receiver<(
+        HumanVerification,
+        std::sync::mpsc::Sender<HumanVerificationCredential>,
+    )>,
+    /// Fires only for a two-password account: how many answers were already
+    /// wrong, and the sender for the password and the "remember" choice.
+    pub(crate) mailbox: async_channel::Receiver<(u32, std::sync::mpsc::Sender<(String, bool)>)>,
+}
+
 /// Run the async SRP + optional 2FA login on a dedicated current-thread Tokio
-/// runtime. Returns two channels: the first yields the final login result once;
-/// the second fires *only if* the account needs a 2FA code, carrying a
-/// [`std::sync::mpsc::Sender`] the UI uses to feed the code back. The login
-/// closure blocks the worker on that sender until the dialog answers, so the
-/// code is requested lazily and can't expire before the password proof.
-#[allow(clippy::type_complexity)]
-pub(crate) fn spawn_login(
-    username: String,
-    password: String,
-) -> (
-    async_channel::Receiver<Result<(), String>>,
-    async_channel::Receiver<std::sync::mpsc::Sender<String>>,
-    async_channel::Receiver<(String, std::sync::mpsc::Sender<String>)>,
-) {
+/// runtime. The returned [`LoginChannels`] carry the final result and the lazy
+/// prompts. Each login closure blocks the worker on a sender the UI answers, so
+/// a code is requested lazily and can't expire before the password proof.
+pub(crate) fn spawn_login(username: String, password: String) -> LoginChannels {
     let (tx, rx) = async_channel::bounded(1);
     // Two, not one: a CAPTCHA-gated login restarts, so a 2FA account is asked
     // for a code on each attempt and a single slot would deadlock the worker.
     let (totp_req_tx, totp_req_rx) = async_channel::bounded(2);
     let (hv_req_tx, hv_req_rx) = async_channel::bounded(1);
+    let (mailbox_req_tx, mailbox_req_rx) = async_channel::bounded(1);
     std::thread::spawn(move || {
         let rt = match tokio::runtime::Builder::new_current_thread()
             .enable_all()
@@ -267,19 +311,30 @@ pub(crate) fn spawn_login(
                         .recv()
                         .map_err(|_| pdfs_core::Error::Other("two-factor entry cancelled".into()))
                 },
-                |hv| {
-                    // Gated: hand the UI the page to show, block on the token the
-                    // user earns by solving it.
-                    let (token_tx, token_rx) = std::sync::mpsc::channel::<String>();
-                    hv_req_tx
-                        .send_blocking((hv.verification_url(), token_tx))
-                        .map_err(|_| {
-                            pdfs_core::Error::Other("verification prompt closed".into())
-                        })?;
-                    let token = token_rx
+                |attempt| {
+                    let (answer_tx, answer_rx) = std::sync::mpsc::channel::<(String, bool)>();
+                    mailbox_req_tx
+                        .send_blocking((attempt, answer_tx))
+                        .map_err(|_| pdfs_core::Error::Other("mailbox prompt closed".into()))?;
+                    let (password, remember) = answer_rx
                         .recv()
-                        .map_err(|_| pdfs_core::Error::Other("verification cancelled".into()))?;
-                    Ok(HumanVerificationCredential::captcha(token))
+                        .map_err(|_| pdfs_core::Error::Other("mailbox entry cancelled".into()))?;
+                    Ok(auth::Mailbox {
+                        password: password.into(),
+                        remember,
+                    })
+                },
+                |hv| {
+                    // Gated: hand the UI the challenge, block on the credential
+                    // the user earns by solving it.
+                    let (credential_tx, credential_rx) =
+                        std::sync::mpsc::channel::<HumanVerificationCredential>();
+                    hv_req_tx.send_blocking((hv, credential_tx)).map_err(|_| {
+                        pdfs_core::Error::Other("verification prompt closed".into())
+                    })?;
+                    credential_rx
+                        .recv()
+                        .map_err(|_| pdfs_core::Error::Other("verification cancelled".into()))
                 },
             )
             .await
@@ -287,7 +342,143 @@ pub(crate) fn spawn_login(
         });
         let _ = tx.send_blocking(result);
     });
-    (rx, totp_req_rx, hv_req_rx)
+    LoginChannels {
+        result: rx,
+        totp: totp_req_rx,
+        hv: hv_req_rx,
+        mailbox: mailbox_req_rx,
+    }
+}
+
+/// Ask for the mailbox password of a two-password account.
+///
+/// `done` gets the password and the "keep unlocked" choice, or `None` when the
+/// dialog was cancelled. `retry` says the last answer was wrong. The choice
+/// defaults to off: storing the mailbox unlock in the keyring trades away what
+/// a separate mailbox password is for, so it is something to opt into.
+pub(crate) fn ask_mailbox(
+    ui: &Rc<Ui>,
+    retry: bool,
+    done: impl FnOnce(Option<(String, bool)>) + 'static,
+) {
+    let body = if retry {
+        gettext("That mailbox password didn't unlock your account. Try again.")
+    } else {
+        gettext("This account has a separate mailbox password. Enter it to unlock your files.")
+    };
+    let dialog = adw::AlertDialog::builder()
+        .heading(gettext("Mailbox Password"))
+        .body(body)
+        .build();
+
+    let group = adw::PreferencesGroup::new();
+    let entry = adw::PasswordEntryRow::builder()
+        .title(gettext("Mailbox password"))
+        .activates_default(true)
+        .build();
+    let remember = adw::SwitchRow::builder()
+        .title(gettext("Keep unlocked on this computer"))
+        .subtitle(gettext(
+            "Stores the unlock in the system keyring, so Proton Drive opens without asking after every login. Otherwise you enter the password once per session.",
+        ))
+        .build();
+    group.add(&entry);
+    group.add(&remember);
+    dialog.set_extra_child(Some(&group));
+
+    dialog.add_response("cancel", &gettext("Cancel"));
+    dialog.add_response("unlock", &gettext("Unlock"));
+    dialog.set_response_appearance("unlock", adw::ResponseAppearance::Suggested);
+    dialog.set_default_response(Some("unlock"));
+    dialog.set_close_response("cancel");
+
+    let done = RefCell::new(Some(done));
+    dialog.connect_response(None, move |_, resp| {
+        let Some(done) = done.borrow_mut().take() else {
+            return;
+        };
+        let password = entry.text().to_string();
+        if resp == "unlock" && !password.is_empty() {
+            done(Some((password, remember.is_active())));
+        } else {
+            done(None);
+        }
+    });
+
+    let parent = ui_window(ui).map(|w| w.upcast::<gtk4::Window>());
+    dialog.present(parent.as_ref());
+}
+
+/// If the signed-in account is locked, ask for its mailbox password — once per
+/// run; after a cancel, a toast keeps an Unlock button within reach.
+///
+/// The key state is a keyring and kernel-keyring read, so it runs on a worker.
+pub(crate) fn offer_unlock(ui: &Rc<Ui>) {
+    if ui.unlock_offered.get() {
+        return;
+    }
+    let ui = ui.clone();
+    glib::spawn_future_local(async move {
+        let state = gio::spawn_blocking(|| auth::key_state().ok()).await;
+        if matches!(state, Ok(Some(auth::KeyState::Locked))) && !ui.unlock_offered.replace(true) {
+            prompt_unlock(&ui, false);
+        }
+    });
+}
+
+enum UnlockOutcome {
+    Unlocked,
+    Wrong,
+    Failed(String),
+}
+
+/// Ask for the mailbox password and unlock the account with it.
+fn prompt_unlock(ui: &Rc<Ui>, retry: bool) {
+    let ui_done = ui.clone();
+    ask_mailbox(ui, retry, move |answer| {
+        let Some((password, remember)) = answer else {
+            toast_action(
+                &ui_done,
+                &gettext("Proton Drive is locked. Enter your mailbox password to unlock it."),
+                &gettext("Unlock"),
+                |ui| prompt_unlock(ui, false),
+            );
+            return;
+        };
+        glib::spawn_future_local(async move {
+            // Verifying talks to Proton and the restart talks to systemd, so
+            // both run on a worker, never on the main loop.
+            let outcome = gio::spawn_blocking(move || {
+                let rt = match tokio::runtime::Builder::new_current_thread()
+                    .enable_all()
+                    .build()
+                {
+                    Ok(rt) => rt,
+                    Err(e) => return UnlockOutcome::Failed(e.to_string()),
+                };
+                match rt.block_on(auth::unlock(&password, remember)) {
+                    Ok(()) => {
+                        service::restart();
+                        UnlockOutcome::Unlocked
+                    }
+                    Err(pdfs_core::Error::WrongMailboxPassword) => UnlockOutcome::Wrong,
+                    Err(e) => UnlockOutcome::Failed(login_error_message(&e)),
+                }
+            })
+            .await;
+            match outcome {
+                Ok(UnlockOutcome::Unlocked) => {
+                    toast(&ui_done, &gettext("Unlocked."));
+                    refresh(&ui_done);
+                }
+                Ok(UnlockOutcome::Wrong) => prompt_unlock(&ui_done, true),
+                Ok(UnlockOutcome::Failed(message)) => {
+                    toast_error(&ui_done, &gettext("Couldn't unlock"), &message)
+                }
+                Err(_) => {}
+            }
+        });
+    });
 }
 
 /// Show the lazy two-factor dialog and feed the entered code back to the waiting
@@ -330,6 +521,63 @@ pub(crate) fn prompt_2fa(ui: &Rc<Ui>, code_tx: std::sync::mpsc::Sender<String>)
     dialog.present(parent.as_ref());
 }
 
+/// Let the user solve the challenge in their own browser, for when the
+/// verification window could not come up. The page cannot hand its token back
+/// to us, so the user says when they are done, and the retry carries the
+/// challenge token, which the solved page made good (see
+/// [`auth::browser_verified`]).
+fn verify_in_browser(
+    ui: &Rc<Ui>,
+    hv: &HumanVerification,
+    credential_tx: std::sync::mpsc::Sender<HumanVerificationCredential>,
+) {
+    let dialog = adw::AlertDialog::builder()
+        .heading(gettext("Verify in Your Browser"))
+        .body(gettext(
+            "The verification page can't be shown in the app on this system. Open it in your browser, complete it there, then come back and choose Continue.",
+        ))
+        .build();
+
+    let url = auth::browser_verification_url(hv);
+    let open = gtk4::Button::builder()
+        .label(gettext("Open Verification Page"))
+        .halign(gtk4::Align::Center)
+        .build();
+    open.add_css_class("pill");
+    dialog.set_extra_child(Some(&open));
+
+    dialog.add_response("cancel", &gettext("Cancel"));
+    dialog.add_response("continue", &gettext("Continue"));
+    dialog.set_response_appearance("continue", adw::ResponseAppearance::Suggested);
+    // Continuing before the page was even opened would only fail the retry.
+    dialog.set_response_enabled("continue", false);
+    dialog.set_default_response(Some("continue"));
+    dialog.set_close_response("cancel");
+
+    let dialog_weak = dialog.downgrade();
+    open.connect_clicked(move |_| {
+        open_uri(&url);
+        if let Some(dialog) = dialog_weak.upgrade() {
+            dialog.set_response_enabled("continue", true);
+        }
+    });
+
+    let credential = auth::browser_verified(hv);
+    let credential_tx = RefCell::new(Some(credential_tx));
+    dialog.connect_response(None, move |_, resp| {
+        // On cancel/close we take + drop `tx` without sending, so the worker's
+        // recv errors out and the login is reported as cancelled.
+        if let Some(tx) = credential_tx.borrow_mut().take()
+            && resp == "continue"
+        {
+            let _ = tx.send(credential.clone());
+        }
+    });
+
+    let parent = ui.login.login_button.root().and_downcast::<gtk4::Window>();
+    dialog.present(parent.as_ref());
+}
+
 /// Sign out, after a confirmation: disable+stop the mount service (so the
 /// daemon isn't left running without credentials), forget the stored session,
 /// and drop back to the login page.
@@ -374,6 +622,12 @@ mod tests {
         assert!(login_error_message(&hv).contains("verification wasn't completed"));
     }
 
+    #[test]
+    fn a_cancelled_mailbox_prompt_is_reported_as_such() {
+        let error = pdfs_core::Error::Other("mailbox entry cancelled".into());
+        assert!(login_error_message(&error).contains("no mailbox password"));
+    }
+
     #[test]
     fn an_unmapped_error_keeps_its_text() {
         let error = pdfs_core::Error::Other("something odd".into());

crates/pdfs-gui/src/app/pages/shared.rs

@@ -484,9 +484,7 @@ fn repaint_shared_crumb(ui: &Rc<Ui>, nav: &[(String, String)]) {
         nav.is_empty(),
     ));
     for (i, (_, name)) in nav.iter().enumerate() {
-        let sep = gtk4::Label::new(Some("›"));
-        sep.add_css_class("dim-label");
-        crumb.append(&sep);
+        crumb.append(&crumb_separator());
         crumb.append(&shared_crumb_node(ui, name, i + 1, i + 1 == nav.len()));
     }
 }
@@ -495,12 +493,7 @@ fn repaint_shared_crumb(ui: &Rc<Ui>, nav: &[(String, String)]) {
 /// that goes back up to `depth` folders below the top level.
 fn shared_crumb_node(ui: &Rc<Ui>, label: &str, depth: usize, current: bool) -> gtk4::Widget {
     if current {
-        let l = gtk4::Label::builder()
-            .label(label)
-            .ellipsize(gtk4::pango::EllipsizeMode::Start)
-            .build();
-        l.add_css_class("heading");
-        return l.upcast();
+        return crumb_current(label);
     }
     let button = gtk4::Button::builder().label(label).build();
     button.add_css_class("flat");

crates/pdfs-gui/src/app/pages/shared_by_me.rs

@@ -565,6 +565,7 @@ pub(crate) fn prompt_stop_sharing(ui: &Rc<Ui>, entries: &[DirEntry]) {
     let uids: Vec<String> = entries.iter().map(|e| e.uid.clone()).collect();
     dialog.connect_response(Some("stop"), move |_, _| {
         let done = done.clone();
+        let stopped = uids.clone();
         run_requests(
             &ui_c,
             uids.iter()
@@ -572,6 +573,7 @@ pub(crate) fn prompt_stop_sharing(ui: &Rc<Ui>, entries: &[DirEntry]) {
                 .collect(),
             gettext_noop("Couldn't stop sharing"),
             move |ui| {
+                forget_shared_by_me(ui, &stopped);
                 reload_listing(ui);
                 toast(ui, &done);
             },
@@ -580,6 +582,18 @@ pub(crate) fn prompt_stop_sharing(ui: &Rc<Ui>, entries: &[DirEntry]) {
     dialog.present(ui_window(ui).as_ref());
 }
 
+/// Take items whose sharing just stopped off the page now, rather than when
+/// the reload that confirms it comes back: that reload asks after every share
+/// in turn and takes a while with many of them.
+fn forget_shared_by_me(ui: &Rc<Ui>, uids: &[String]) {
+    let items = {
+        let mut items = ui.shared_by_me.items.borrow_mut();
+        items.retain(|item| !uids.contains(&item.uid));
+        items.clone()
+    };
+    repaint_shared_by_me(ui, &items);
+}
+
 /// Open a shared item: a folder in My Files, a file the way My Files would.
 fn open_shared_by_me(ui: &Rc<Ui>, entry: &DirEntry) {
     if entry.is_dir {
@@ -618,6 +632,7 @@ pub(crate) fn shared_item_as_entry(item: &SharedItem) -> DirEntry {
         shared_by_unverified: false,
         trashed_at: 0,
         trashed_from: None,
+        issue: None,
     }
 }
 

crates/pdfs-gui/src/app/pages/status.rs

@@ -381,23 +381,34 @@ pub(crate) fn build_main_page() -> MainWidgets {
         .hexpand(true)
         .ellipsize(gtk4::pango::EllipsizeMode::Middle)
         .build();
+    // The app's one menu, on the account row the way Proton's own apps keep it:
+    // app-wide entries first, the account's last. The whole row opens it, and
+    // F10 too, as the primary menu.
+    let app_section = gio::Menu::new();
+    app_section.append(Some(&gettext("Preferences")), Some("win.preferences"));
+    app_section.append(Some(&gettext("Keyboard Shortcuts")), Some("win.shortcuts"));
+    app_section.append(
+        Some(&gettext("About Proton Drive for Linux")),
+        Some("win.about"),
+    );
+    let account_section = gio::Menu::new();
+    account_section.append(Some(&gettext("Sign Out…")), Some("win.sign-out"));
     let account_menu = gio::Menu::new();
-    account_menu.append(Some(&gettext("Preferences")), Some("win.preferences"));
-    let sign_out = gio::Menu::new();
-    sign_out.append(Some(&gettext("Sign Out…")), Some("win.sign-out"));
-    account_menu.append_section(None, &sign_out);
-    let account_button = gtk4::MenuButton::builder()
-        .icon_name("view-more-symbolic")
-        .tooltip_text(gettext("Account"))
+    account_menu.append_section(None, &app_section);
+    account_menu.append_section(None, &account_section);
+    let row = gtk4::Box::new(gtk4::Orientation::Horizontal, 10);
+    row.append(&avatar);
+    row.append(&account_name);
+    row.append(&gtk4::Image::from_icon_name("view-more-symbolic"));
+    let account = gtk4::MenuButton::builder()
+        .child(&row)
+        .tooltip_text(gettext("Main menu"))
         .menu_model(&account_menu)
-        .valign(gtk4::Align::Center)
+        .direction(gtk4::ArrowType::Up)
+        .primary(true)
         .build();
-    account_button.add_css_class("flat");
-    let account = gtk4::Box::new(gtk4::Orientation::Horizontal, 10);
+    account.add_css_class("flat");
     account.add_css_class("sidebar-account");
-    account.append(&avatar);
-    account.append(&account_name);
-    account.append(&account_button);
 
     let footer = gtk4::Box::new(gtk4::Orientation::Vertical, 10);
     footer.add_css_class("sidebar-footer");
@@ -825,6 +836,13 @@ pub(crate) fn wire_retry(ui: &Rc<Ui>) {
         .connect_clicked(move |_| restart_service_then(&ui_trash, load_trash));
 }
 
+/// Show the sign-in page while a session is still stored, because Proton has
+/// refused it. The sidebar stays, so the user can go back to cached files; a
+/// login moves on to the files as from any sign-in ([`refresh`]).
+pub(crate) fn show_login(ui: &Rc<Ui>) {
+    ui.stack.set_visible_child_name("login");
+}
+
 /// Repaint the window from the cached login identity, then ask the daemon for
 /// its status and transfers. Runs at startup, after a login and after a service
 /// restart; the daemon's event feed keeps both current in between. The identity
@@ -860,6 +878,7 @@ pub(crate) fn refresh(ui: &Rc<Ui>) {
         }
     }
 
+    offer_unlock(ui);
     refresh_status(ui);
     refresh_transfers(ui);
 }
@@ -1069,7 +1088,11 @@ pub(crate) fn repaint_transfers(ui: &Rc<Ui>, items: &[TransferItem], jobs: &[Job
             let row_box = gtk4::Box::new(gtk4::Orientation::Vertical, 4);
             row_box.set_margin_top(8);
             row_box.set_margin_bottom(8);
-            let label = gtk4::Label::builder().halign(gtk4::Align::Start).build();
+            // Ellipsized so a long file name cannot widen the page.
+            let label = gtk4::Label::builder()
+                .halign(gtk4::Align::Start)
+                .ellipsize(gtk4::pango::EllipsizeMode::Middle)
+                .build();
             label.add_css_class("dim-label");
             let bar = gtk4::ProgressBar::new();
             row_box.append(&label);
@@ -1205,6 +1228,8 @@ pub(crate) fn paint_status(ui: &Rc<Ui>, status: Response) {
         failing_error,
         paused,
         paused_until,
+        session_expired,
+        tokens_unsaved,
         ..
     } = status
     else {
@@ -1215,7 +1240,11 @@ pub(crate) fn paint_status(ui: &Rc<Ui>, status: Response) {
     // in it: it is why a file that looks saved is not on the remote
     // yet, and offline is usually the reason it is still queued.
     let queued = i18n::pending_summary(pending_uploads, pending_changes);
-    let state = if paused {
+    let state = if session_expired {
+        SyncState::SessionExpired { queued }
+    } else if tokens_unsaved {
+        SyncState::TokensUnsaved
+    } else if paused {
         SyncState::Paused {
             until: paused_until,
             queued,
@@ -1278,6 +1307,14 @@ pub(crate) fn paint_disconnected(ui: &Rc<Ui>) {
 
 /// What the sidebar's status strip reports, most urgent first.
 pub(crate) enum SyncState {
+    /// Proton refused the session: nothing reaches it until the user signs in
+    /// again. Outranks a pause, which it makes moot.
+    SessionExpired {
+        queued: Option<String>,
+    },
+    /// The keyring refuses the session's refreshed tokens. Sync goes on, but
+    /// a reboot before the keyring takes them signs the user out.
+    TokensUnsaved,
     /// The user paused syncing; nothing goes up until it resumes. Outranks
     /// everything else, because it is the reason for everything else.
     Paused {
@@ -1312,7 +1349,29 @@ pub(crate) enum SyncState {
 fn paint_sync_status(ui: &Rc<Ui>, state: SyncState) {
     let paused = matches!(state, SyncState::Paused { .. });
     let connected = !matches!(state, SyncState::Disconnected | SyncState::NotResponding);
+    let expired = matches!(state, SyncState::SessionExpired { .. });
     let (icon, class, title, detail) = match state {
+        SyncState::SessionExpired { queued } => (
+            "dialog-password-symbolic",
+            Some("error"),
+            gettext("Session expired"),
+            Some(match queued {
+                // Translators: {queued} says what is waiting, such as "3 uploads
+                // queued".
+                Some(queued) => {
+                    gettext_f("{queued} · sign in again to sync", &[("queued", &queued)])
+                }
+                None => gettext("Sign in again to sync"),
+            }),
+        ),
+        SyncState::TokensUnsaved => (
+            "dialog-warning-symbolic",
+            Some("warning"),
+            gettext("Sign-in not saved"),
+            Some(gettext(
+                "Unlock your keyring, or the next reboot signs you out",
+            )),
+        ),
         SyncState::Paused { until, queued } => (
             "media-playback-pause-symbolic",
             Some("warning"),
@@ -1383,6 +1442,7 @@ fn paint_sync_status(ui: &Rc<Ui>, state: SyncState) {
     if let Some(class) = class {
         image.add_css_class(class);
     }
+    ui.locations.card.sign_in.set_visible(expired);
     ui.status.status_title.set_label(&title);
     ui.status.status_detail.set_visible(detail.is_some());
     ui.status

crates/pdfs-gui/src/app/pages/trash.rs

@@ -533,6 +533,7 @@ mod tests {
             shared_by_unverified: false,
             trashed_at,
             trashed_from: from.map(str::to_string),
+            issue: None,
         }
     }
 

crates/pdfs-gui/src/app/pages/verify.rs

@@ -1,4 +1,4 @@
-//! The human-verification (CAPTCHA) dialog.
+//! The human-verification (CAPTCHA) window.
 //!
 //! Proton gates logins it does not recognise — a new IP, a VPN exit — behind a
 //! CAPTCHA. The API answers the login with a challenge instead of a session, and
@@ -8,10 +8,26 @@
 //! The page is hosted in a `WebKitWebView` rather than handed to the system
 //! browser because it reports completion by posting a message to its host, not
 //! by redirecting: a browser has nowhere to post it back to.
+//!
+//! The webview runs in a child `pdfs-app` started with [`VERIFY_ARG`], not in the
+//! app itself. WebKit aborts its whole process when its sandbox cannot start, as
+//! on hardened systems that keep bubblewrap from the journal socket
+//! (`docs/BUGS.md` B195); in a child that costs the verification, not the app.
+//! The URL goes to the child on stdin, so it never shows in a process list, and
+//! the token comes back on stdout.
 
 use crate::*;
+use std::io::{BufRead, BufReader, Write as _};
+use std::process::{ExitStatus, Stdio};
 use webkit6::prelude::*;
 
+/// The argument that makes `pdfs-app` the verification window instead of the app.
+pub(crate) const VERIFY_ARG: &str = "--human-verification";
+
+/// Marks the token among whatever else lands on the child's stdout: GLib and
+/// WebKit write debug output there.
+const TOKEN_PREFIX: &str = "hv-token ";
+
 /// Bridge the verification page's `postMessage` to a handler this side can read.
 ///
 /// The page targets its embedding host (`window.parent`), which in a webview is
@@ -26,15 +42,100 @@ window.addEventListener('message', function (event) {
 });
 "#;
 
-/// Present the challenge and hand the solved token back through `token_tx`.
-///
-/// Closing the dialog without solving drops the sender, which the waiting login
-/// worker reads as a cancelled sign-in — the same contract as the 2FA prompt.
-pub(crate) fn prompt_human_verification(
-    ui: &Rc<Ui>,
-    url: &str,
-    token_tx: std::sync::mpsc::Sender<String>,
-) {
+/// How the verification window ended.
+#[derive(Debug, PartialEq, Eq)]
+pub(crate) enum Verification {
+    Solved(String),
+    /// Closed without solving.
+    Cancelled,
+    /// Never came up, or died: most likely WebKit could not start its sandbox.
+    Failed,
+}
+
+/// Show the challenge in the verification window and wait until it closes.
+pub(crate) async fn verify_human(url: String) -> Verification {
+    match gio::spawn_blocking(move || run_verification_child(&url)).await {
+        Ok(Ok(verification)) => verification,
+        Ok(Err(e)) => {
+            tracing::error!("cannot run the verification window: {e}");
+            Verification::Failed
+        }
+        Err(_) => Verification::Failed,
+    }
+}
+
+fn run_verification_child(url: &str) -> std::io::Result<Verification> {
+    let mut child = Command::new(own_exe())
+        .arg(VERIFY_ARG)
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .spawn()?;
+    if let Some(mut stdin) = child.stdin.take() {
+        // A failed write means the child is already gone; its exit status says
+        // how. Dropping `stdin` closes it.
+        let _ = writeln!(stdin, "{url}");
+    }
+    // Stops reading at the token rather than at EOF: WebKit's helper processes
+    // inherit the pipe and may hold it open a moment after the child quits.
+    let token = child
+        .stdout
+        .take()
+        .and_then(|out| find_token(BufReader::new(out)));
+    let status = child.wait()?;
+    Ok(outcome(token, status))
+}
+
+/// This very binary, so a development build opens its own window. After an
+/// upgrade replaced the file, `current_exe` names a deleted path, and the
+/// installed `pdfs-app` is the next best.
+fn own_exe() -> PathBuf {
+    std::env::current_exe()
+        .ok()
+        .filter(|path| path.is_file())
+        .unwrap_or_else(|| PathBuf::from("pdfs-app"))
+}
+
+fn find_token(out: impl BufRead) -> Option<String> {
+    out.lines()
+        .map_while(Result::ok)
+        .find_map(|line| line.strip_prefix(TOKEN_PREFIX).map(str::to_owned))
+}
+
+/// A token wins over the exit status: the user solved the page, even if
+/// WebKit's teardown crashed after it.
+fn outcome(token: Option<String>, status: ExitStatus) -> Verification {
+    match token {
+        Some(token) => Verification::Solved(token),
+        None if status.success() => Verification::Cancelled,
+        None => {
+            tracing::error!(%status, "the verification window failed");
+            Verification::Failed
+        }
+    }
+}
+
+/// Run as the verification window: read the page's URL from stdin, show it, and
+/// print the token once the user has solved it. Closing the window exits
+/// without a token, which the app reads as a cancelled sign-in.
+pub(crate) fn run_verification_window() -> glib::ExitCode {
+    let mut url = String::new();
+    if std::io::stdin().lock().read_line(&mut url).is_err() || url.trim().is_empty() {
+        tracing::error!("{VERIFY_ARG} expects the verification URL on stdin");
+        return glib::ExitCode::FAILURE;
+    }
+    let url = url.trim().to_owned();
+
+    // Not unique: the app that started it already holds APP_ID.
+    let app = adw::Application::builder()
+        .flags(gio::ApplicationFlags::NON_UNIQUE)
+        .build();
+    app.connect_activate(move |app| build_verification_window(app, &url));
+    // GApplication would refuse VERIFY_ARG as an unknown option.
+    let argv0 = std::env::args().next().unwrap_or_default();
+    app.run_with_args(&[argv0])
+}
+
+fn build_verification_window(app: &adw::Application, url: &str) {
     let content = webkit6::UserContentManager::new();
     content.add_script(&webkit6::UserScript::new(
         BRIDGE,
@@ -53,24 +154,19 @@ pub(crate) fn prompt_human_verification(
         .hexpand(true)
         .build();
 
-    let dialog = adw::Dialog::builder()
+    let body = gtk4::Box::new(gtk4::Orientation::Vertical, 0);
+    body.append(&adw::HeaderBar::new());
+    body.append(&webview);
+    let window = adw::ApplicationWindow::builder()
+        .application(app)
         .title(gettext("Verification"))
-        .content_width(420)
-        .content_height(560)
+        .icon_name(APP_ID)
+        .default_width(420)
+        .default_height(560)
+        .content(&body)
         .build();
 
-    let header = adw::HeaderBar::new();
-    let body = gtk4::Box::new(gtk4::Orientation::Vertical, 0);
-    body.append(&header);
-    body.append(&webview);
-    dialog.set_child(Some(&body));
-
-    // Taken on the first success *or* on close, so the token is sent at most
-    // once and a cancelled dialog always drops the sender.
-    let token_tx = Rc::new(RefCell::new(Some(token_tx)));
-
-    let tx = token_tx.clone();
-    let dlg_weak = dialog.downgrade();
+    let app = app.downgrade();
     content.connect_script_message_received(Some("hv"), move |_, value| {
         let Some(token) = extract_token(&value.to_str()) else {
             // Every `postMessage` on the page reaches here, most of them the
@@ -78,25 +174,17 @@ pub(crate) fn prompt_human_verification(
             // is simply not ours.
             return;
         };
-        if let Some(tx) = tx.borrow_mut().take() {
-            let _ = tx.send(token);
+        let mut stdout = std::io::stdout().lock();
+        if let Err(e) = writeln!(stdout, "{TOKEN_PREFIX}{token}").and_then(|()| stdout.flush()) {
+            tracing::error!("cannot hand the verification token back: {e}");
         }
-        if let Some(dlg) = dlg_weak.upgrade() {
-            dlg.close();
+        if let Some(app) = app.upgrade() {
+            app.quit();
         }
     });
 
-    // Covers the close button, Escape, and the user giving up.
-    dialog.connect_closed(move |_| {
-        token_tx.borrow_mut().take();
-    });
-
     webview.load_uri(url);
-
-    let parent = ui.login.login_button.root().and_downcast::<gtk4::Window>();
-    // Returns immediately; the login worker stays blocked on the channel until
-    // the handler above sends, or the dialog closes and drops the sender.
-    dialog.present(parent.as_ref());
+    window.present();
 }
 
 /// Pull the verification token out of a message posted by the verification page.
@@ -133,7 +221,12 @@ fn extract_token(raw: &str) -> Option<String> {
 
 #[cfg(test)]
 mod tests {
-    use super::extract_token;
+    use super::{Verification, extract_token, find_token, outcome};
+    use std::os::unix::process::ExitStatusExt as _;
+    use std::process::ExitStatus;
+
+    /// The wait status of a process killed by SIGABRT.
+    const ABORTED: i32 = 6;
 
     #[test]
     fn a_completion_message_yields_its_token() {
@@ -163,4 +256,39 @@ mod tests {
             assert!(extract_token(raw).is_none(), "accepted: {raw}");
         }
     }
+
+    #[test]
+    fn the_token_is_found_among_other_output() {
+        let out = "Gtk-Message: something\nhv-token tok-1\nmore\n";
+        assert_eq!(find_token(out.as_bytes()).as_deref(), Some("tok-1"));
+        assert_eq!(find_token("only chatter\n".as_bytes()), None);
+    }
+
+    #[test]
+    fn a_window_closed_without_a_token_cancels() {
+        assert_eq!(
+            outcome(None, ExitStatus::from_raw(0)),
+            Verification::Cancelled
+        );
+    }
+
+    /// WebKit aborts when its sandbox cannot start (B195). That must read as a
+    /// failure the app explains, not as the user giving up.
+    #[test]
+    fn a_window_that_died_fails() {
+        assert_eq!(
+            outcome(None, ExitStatus::from_raw(ABORTED)),
+            Verification::Failed
+        );
+        let exited_1 = ExitStatus::from_raw(1 << 8);
+        assert_eq!(outcome(None, exited_1), Verification::Failed);
+    }
+
+    #[test]
+    fn a_token_counts_even_if_the_window_died_after_it() {
+        assert_eq!(
+            outcome(Some("tok-1".into()), ExitStatus::from_raw(ABORTED)),
+            Verification::Solved("tok-1".into())
+        );
+    }
 }

crates/pdfs-gui/src/app/widgets/crumb.rs

@@ -0,0 +1,21 @@
+use crate::*;
+
+/// The "›" between two breadcrumb segments.
+pub(crate) fn crumb_separator() -> gtk4::Label {
+    let sep = gtk4::Label::new(Some("›"));
+    sep.add_css_class("dim-label");
+    sep
+}
+
+/// The last breadcrumb segment, the folder on screen: a heading rather than a
+/// button. It carries a flat button's side padding (`.crumb-current`), so the
+/// "›" before it sits as far from it as from the button before.
+pub(crate) fn crumb_current(label: &str) -> gtk4::Widget {
+    let l = gtk4::Label::builder()
+        .label(label)
+        .ellipsize(gtk4::pango::EllipsizeMode::Start)
+        .build();
+    l.add_css_class("heading");
+    l.add_css_class("crumb-current");
+    l.upcast()
+}

crates/pdfs-gui/src/app/widgets/file_list.rs

@@ -132,8 +132,13 @@ impl FileList {
                 // and the grid collapses to a single column. Allowing a mid-word
                 // break is what keeps the two-line-then-ellipsis budget below
                 // enforceable for *every* name rather than only the ones that
-                // happen to have spaces.
+                // happen to have spaces. Pango marks such a break with a hyphen
+                // that is not in the name ("SteamSetup.e-xe"); a file name is
+                // not prose, so break it bare, as Nautilus does.
+                let no_hyphens = gtk4::pango::AttrList::new();
+                no_hyphens.insert(gtk4::pango::AttrInt::new_insert_hyphens(false));
                 let label = gtk4::Label::builder()
+                    .attributes(&no_hyphens)
                     .ellipsize(gtk4::pango::EllipsizeMode::End)
                     .justify(gtk4::Justification::Center)
                     .max_width_chars(13)

crates/pdfs-gui/src/app/widgets/menu.rs

@@ -128,20 +128,34 @@ impl ActionMenu {
     }
 }
 
-/// Where a menu opened over `anchor` should live in the widget tree: the
-/// outermost grid or list view around it, or `anchor` itself. CSS descendant
-/// selectors reach through a popover to its parent, and themes style the
-/// insides of list items (`gridview > child box { margin: 12px }` in
-/// Catppuccin); a menu parented to a tile picks those rules up and puts a wide
-/// margin around every section. Under the view itself it is no item's child.
+/// Where a menu opened over `anchor` should live in the widget tree.
+///
+/// Not inside a list item: CSS descendant selectors reach through a popover to
+/// its parent, and themes style the insides of list items (`gridview > child
+/// box { margin: 12px }` in Catppuccin); a menu parented to a tile picks those
+/// rules up and puts a wide margin around every section. So the search starts
+/// at the outermost grid or list view around `anchor`.
+///
+/// Not on a widget without a layout manager either: a popover is sized and
+/// placed again when its parent's layout manager allocates it. The list views
+/// and `ScrolledWindow` have none, so a menu parented there kept the size it was
+/// first given, often too small, and opened scrolling. The host is the first
+/// widget from there up that has one.
 fn popover_host(anchor: &gtk4::Widget) -> gtk4::Widget {
-    let mut host = anchor.clone();
+    let mut start = anchor.clone();
     let mut widget = anchor.parent();
     while let Some(w) = widget {
         widget = w.parent();
         if w.is::<gtk4::GridView>() || w.is::<gtk4::ListView>() || w.is::<gtk4::ColumnView>() {
-            host = w;
+            start = w;
         }
     }
-    host
+    let mut host = Some(start.clone());
+    while let Some(w) = host {
+        if w.layout_manager().is_some() {
+            return w;
+        }
+        host = w.parent();
+    }
+    start
 }

crates/pdfs-gui/src/app/widgets/mod.rs

@@ -1,4 +1,5 @@
 pub(crate) mod compat;
+pub(crate) mod crumb;
 pub(crate) mod details;
 pub(crate) mod file_list;
 pub(crate) mod menu;

crates/pdfs-gui/src/app/widgets/share_dialog.rs

@@ -127,13 +127,33 @@ impl Drop for Busy {
     }
 }
 
+/// A section's action, such as Send Invitations. It goes under the section's
+/// rows, at their right edge, rather than in a row of its own: a row in a boxed
+/// list reads as a setting, and a button alone in one looks misplaced.
+fn group_button(label: &str) -> gtk4::Button {
+    let button = gtk4::Button::builder()
+        .label(label)
+        .halign(gtk4::Align::End)
+        .margin_top(12)
+        .build();
+    button.add_css_class("suggested-action");
+    button
+}
+
+/// A section's only row while the share is being read.
+fn loading_row() -> adw::ActionRow {
+    let row = adw::ActionRow::builder().title(gettext("Loading…")).build();
+    row.add_prefix(&spinner());
+    row
+}
+
 /// How an open Share dialog addresses its node.
 ///
 /// A node the browser is showing has a mountpoint-relative path. A node reached
 /// from Shared or Shared-with-me may not: it can live under a device folder's
 /// own inode space, or on someone else's volume, neither of which the primary
 /// mount's path space can name. Those carry a uid instead, and the daemon
-/// resolves it with `Core::resolve_anywhere` (mount-architecture.md P4).
+/// resolves it with `Core::resolve_anywhere`.
 ///
 /// The two are separate request variants rather than one request with an
 /// optional field on purpose: an older daemon that ignored `uid` would resolve
@@ -287,26 +307,17 @@ pub(crate) fn open_share_dialog(ui: &Rc<Ui>, entry: &DirEntry) {
         .selected(0)
         .valign(gtk4::Align::Center)
         .build();
-    let role_wrap = adw::ActionRow::builder().title(gettext("Role")).build();
-    role_wrap.add_suffix(&role_drop);
+    // The role goes with the addresses it applies to, at the end of their row.
+    role_drop.set_tooltip_text(Some(&gettext("Role")));
+    email_row.add_suffix(&role_drop);
     let message_row = adw::EntryRow::builder()
         .title(gettext("Message (optional)"))
         .build();
-    let invite_btn = gtk4::Button::builder()
-        .label(gettext("Send Invitations"))
-        .halign(gtk4::Align::End)
-        .margin_top(6)
-        .build();
-    invite_btn.add_css_class("suggested-action");
+    let invite_btn = group_button(&gettext("Send Invitations"));
     invite_btn.set_sensitive(false);
-    let invite_wrap = adw::PreferencesRow::builder()
-        .activatable(false)
-        .child(&invite_btn)
-        .build();
     invite_group.add(&email_row);
-    invite_group.add(&role_wrap);
     invite_group.add(&message_row);
-    invite_group.add(&invite_wrap);
+    invite_group.add(&invite_btn);
 
     let people = adw::PreferencesGroup::builder()
         .title(gettext("People with access"))
@@ -315,21 +326,18 @@ pub(crate) fn open_share_dialog(ui: &Rc<Ui>, entry: &DirEntry) {
         .title(gettext("Public link"))
         .build();
 
-    let content = gtk4::Box::new(gtk4::Orientation::Vertical, 18);
-    content.set_margin_top(12);
-    content.set_margin_bottom(12);
-    content.set_margin_start(12);
-    content.set_margin_end(12);
-    content.append(&invite_group);
-    content.append(&people);
-    content.append(&link_group);
-    let clamp = adw::Clamp::builder().child(&content).build();
-    let scroll = gtk4::ScrolledWindow::builder()
-        .vexpand(true)
-        .hscrollbar_policy(gtk4::PolicyType::Never)
-        .child(&clamp)
-        .build();
-    toolbar.set_content(Some(&scroll));
+    // Until the share is read, each section says so rather than standing
+    // empty under its title.
+    let people_loading = loading_row();
+    people.add(&people_loading);
+    let link_loading = loading_row();
+    link_group.add(&link_loading);
+
+    let content = adw::PreferencesPage::new();
+    content.add(&invite_group);
+    content.add(&people);
+    content.add(&link_group);
+    toolbar.set_content(Some(&content));
 
     let dialog = adw::Dialog::builder()
         .title(pgettext("verb", "Share"))
@@ -343,8 +351,8 @@ pub(crate) fn open_share_dialog(ui: &Rc<Ui>, entry: &DirEntry) {
         target,
         people,
         link_group,
-        people_rows: RefCell::new(Vec::new()),
-        link_rows: RefCell::new(Vec::new()),
+        people_rows: RefCell::new(vec![people_loading.upcast()]),
+        link_rows: RefCell::new(vec![link_loading.upcast()]),
     });
 
     // Check the addresses as they are typed: a malformed one marks the row as
@@ -430,17 +438,35 @@ pub(crate) fn share_dialog_reload(state: &Rc<ShareDialog>) {
                 repaint_share_link(&state, link.as_ref());
             }
             Ok(Ok(Response::Error { message, .. })) => {
+                share_dialog_unread(&state);
                 toast_error(&state.ui, &gettext("Couldn't load sharing"), &message)
             }
-            _ => toast_error(
-                &state.ui,
-                &gettext("Couldn't load sharing"),
-                &gettext("The Proton Drive service didn't respond."),
-            ),
+            _ => {
+                share_dialog_unread(&state);
+                toast_error(
+                    &state.ui,
+                    &gettext("Couldn't load sharing"),
+                    &gettext("The Proton Drive service didn't respond."),
+                )
+            }
         }
     });
 }
 
+/// The share couldn't be read: what the sections showed (rows still loading,
+/// or ones that may now be stale) gives way to one line that says so.
+fn share_dialog_unread(state: &Rc<ShareDialog>) {
+    for row in state.people_rows.borrow_mut().drain(..) {
+        state.people.remove(&row);
+    }
+    for row in state.link_rows.borrow_mut().drain(..) {
+        state.link_group.remove(&row);
+    }
+    let row = dim_row(&gettext("Couldn't load sharing"));
+    state.people.add(&row);
+    state.people_rows.borrow_mut().push(row.upcast());
+}
+
 /// Rebuild the "People with access" rows from a fresh share listing.
 pub(crate) fn repaint_share_people(state: &Rc<ShareDialog>, entries: &[ShareEntry]) {
     for row in state.people_rows.borrow_mut().drain(..) {
@@ -455,15 +481,18 @@ pub(crate) fn repaint_share_people(state: &Rc<ShareDialog>, entries: &[ShareEntr
         return;
     }
     for entry in entries {
+        // A member is the plain case and needs no word; an invitation says
+        // it is still waiting on the other side.
         let subtitle = match entry.kind {
-            ShareEntryKind::Member => gettext("Member"),
-            ShareEntryKind::ProtonInvite => gettext("Invited (pending)"),
-            ShareEntryKind::ExternalInvite => gettext("Invited (external, pending)"),
+            ShareEntryKind::Member => String::new(),
+            ShareEntryKind::ProtonInvite => gettext("Invitation pending"),
+            ShareEntryKind::ExternalInvite => gettext("Invitation pending, no Proton account yet"),
         };
         let row = adw::ActionRow::builder()
             .title(&entry.email)
             .subtitle(&subtitle)
             .build();
+        row.add_prefix(&adw::Avatar::new(32, Some(&entry.email), true));
 
         // External invites can't have their role changed; show it read-only.
         // Members and Proton invites get a role dropdown.
@@ -653,16 +682,7 @@ pub(crate) fn repaint_share_link(state: &Rc<ShareDialog>, link: Option<&PublicLi
                 .build();
             let expiry_row = adw::ActionRow::builder().title(gettext("Expires")).build();
             expiry_row.add_suffix(&expiry_drop);
-            let create = gtk4::Button::builder()
-                .label(gettext("Create Public Link"))
-                .halign(gtk4::Align::End)
-                .margin_top(6)
-                .build();
-            create.add_css_class("suggested-action");
-            let create_wrap = adw::PreferencesRow::builder()
-                .activatable(false)
-                .child(&create)
-                .build();
+            let create = group_button(&gettext("Create Public Link"));
 
             // Enter in the password field creates the link.
             let btn = create.clone();
@@ -689,11 +709,11 @@ pub(crate) fn repaint_share_link(state: &Rc<ShareDialog>, link: Option<&PublicLi
             state.link_group.add(&role_row);
             state.link_group.add(&pw_row);
             state.link_group.add(&expiry_row);
-            state.link_group.add(&create_wrap);
+            state.link_group.add(&create);
             rows.push(role_row.upcast());
             rows.push(pw_row.upcast());
             rows.push(expiry_row.upcast());
-            rows.push(create_wrap.upcast());
+            rows.push(create.upcast());
         }
     }
     *state.link_rows.borrow_mut() = rows;

crates/pdfs-gui/src/hud/highlight.rs

@@ -0,0 +1,143 @@
+//! Match highlighting: which characters of a result name the query matched,
+//! as Pango markup with those characters in bold.
+//!
+//! Each query term is looked for as a substring of the name first, and as a
+//! subsequence ("rpt" in "report") when that fails, which is roughly how the
+//! daemon's ranking treats a term too. Case is folded one character at a
+//! time, so every range stays on a character boundary of the original name,
+//! whatever the script.
+
+use gtk4::glib;
+
+/// One character of a name: its byte range and its case-folded form.
+struct Folded {
+    start: usize,
+    end: usize,
+    folded: String,
+}
+
+fn fold(text: &str) -> Vec<Folded> {
+    text.char_indices()
+        .map(|(start, c)| Folded {
+            start,
+            end: start + c.len_utf8(),
+            folded: c.to_lowercase().collect(),
+        })
+        .collect()
+}
+
+/// The byte ranges of `name` that `query` matched, sorted and merged.
+pub(crate) fn ranges(name: &str, query: &str) -> Vec<(usize, usize)> {
+    let chars = fold(name);
+    let mut found: Vec<(usize, usize)> = Vec::new();
+    for term in query.split_whitespace() {
+        let term: Vec<String> = fold(term).into_iter().map(|c| c.folded).collect();
+        if let Some(at) = substring(&chars, &term) {
+            found.push((chars[at].start, chars[at + term.len() - 1].end));
+        } else if let Some(hits) = subsequence(&chars, &term) {
+            found.extend(hits.into_iter().map(|at| (chars[at].start, chars[at].end)));
+        }
+    }
+    found.sort_unstable();
+    let mut merged: Vec<(usize, usize)> = Vec::with_capacity(found.len());
+    for (start, end) in found {
+        match merged.last_mut() {
+            Some(last) if start <= last.1 => last.1 = last.1.max(end),
+            _ => merged.push((start, end)),
+        }
+    }
+    merged
+}
+
+/// Where `term` first occurs in `chars`, as a character index.
+fn substring(chars: &[Folded], term: &[String]) -> Option<usize> {
+    if term.is_empty() || term.len() > chars.len() {
+        return None;
+    }
+    (0..=chars.len() - term.len()).find(|&at| {
+        chars[at..at + term.len()]
+            .iter()
+            .zip(term)
+            .all(|(c, t)| c.folded == *t)
+    })
+}
+
+/// The character indices of the leftmost match of `term` as a subsequence,
+/// or `None` when not every character of it can be found in order.
+fn subsequence(chars: &[Folded], term: &[String]) -> Option<Vec<usize>> {
+    if term.is_empty() {
+        return None;
+    }
+    let mut hits = Vec::with_capacity(term.len());
+    let mut next = 0;
+    for wanted in term {
+        let at = (next..chars.len()).find(|&i| chars[i].folded == *wanted)?;
+        hits.push(at);
+        next = at + 1;
+    }
+    Some(hits)
+}
+
+/// `name` as Pango markup, escaped, with the matched characters in bold.
+pub(crate) fn markup(name: &str, query: &str) -> String {
+    let mut out = String::with_capacity(name.len() + 16);
+    let mut done = 0;
+    for (start, end) in ranges(name, query) {
+        out.push_str(&glib::markup_escape_text(&name[done..start]));
+        out.push_str("<b>");
+        out.push_str(&glib::markup_escape_text(&name[start..end]));
+        out.push_str("</b>");
+        done = end;
+    }
+    out.push_str(&glib::markup_escape_text(&name[done..]));
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_substring_match_is_one_range_in_any_case() {
+        assert_eq!(ranges("Tax Report.pdf", "REP"), vec![(4, 7)]);
+    }
+
+    #[test]
+    fn a_term_that_is_no_substring_falls_back_to_a_subsequence() {
+        // r, p and t of "report", not the "rt" pair at the end of a substring.
+        assert_eq!(ranges("report.txt", "rpt"), vec![(0, 1), (2, 3), (5, 6)]);
+    }
+
+    #[test]
+    fn a_term_with_no_match_highlights_nothing() {
+        assert!(ranges("report.txt", "xyz").is_empty());
+        assert!(ranges("report.txt", "").is_empty());
+    }
+
+    #[test]
+    fn several_terms_merge_into_sorted_ranges() {
+        assert_eq!(
+            ranges("tax return 2024", "2024 tax ret"),
+            vec![(0, 3), (4, 7), (11, 15)]
+        );
+        assert_eq!(ranges("abc", "ab bc"), vec![(0, 3)]);
+    }
+
+    #[test]
+    fn non_ascii_names_keep_ranges_on_character_boundaries() {
+        assert_eq!(ranges("Über Größe.odt", "über"), vec![(0, 5)]);
+        assert_eq!(ranges("Über Größe.odt", "GRÖ"), vec![(6, 10)]);
+        assert_eq!(markup("Über Größe.odt", "größe"), "Über <b>Größe</b>.odt");
+        assert_eq!(
+            markup("日本語のメモ.txt", "メモ"),
+            "日本語の<b>メモ</b>.txt"
+        );
+    }
+
+    #[test]
+    fn markup_escapes_the_name_inside_and_outside_matches() {
+        assert_eq!(markup("a<b>&c", "b"), "a&lt;<b>b</b>&gt;&amp;c");
+        assert_eq!(markup("R&D.pdf", "r&d"), "<b>R&amp;D</b>.pdf");
+        assert_eq!(markup("<none>", "zzz"), "&lt;none&gt;");
+    }
+}

crates/pdfs-gui/src/hud/history.rs

@@ -0,0 +1,363 @@
+//! Recent files and frecency.
+//!
+//! The launcher remembers what it opened in `prompt-history.json` under the
+//! state directory. With an empty query those files come first, and while
+//! searching a file opened often and lately gets a bonus on top of its match
+//! score (see [`frecency_bonus`]).
+//!
+//! One writer thread owns the file: it loads it, applies every recorded visit
+//! in order and writes the result back atomically. A visit recorded before the
+//! first load finished simply waits in the channel, so it is merged into the
+//! loaded list rather than overwriting it. The main thread only ever sees
+//! snapshots.
+
+use std::cell::RefCell;
+use std::collections::HashMap;
+use std::io::Write;
+use std::path::{Path, PathBuf};
+use std::rc::Rc;
+
+use gtk4::glib;
+
+use crate::Hit;
+
+/// How many files the history keeps. More than the launcher ever shows, so
+/// frecency still knows a file that dropped off the recent list.
+const MAX_VISITS: usize = 50;
+
+/// The frecency bonus of one visit made just now.
+const VISIT_BONUS: f64 = 1500.0;
+
+/// The bonus halves every this many days without a visit.
+const HALF_LIFE_DAYS: f64 = 14.0;
+
+/// The largest frecency bonus. A name match is worth up to 20000 points, so
+/// history breaks ties between similar matches but cannot beat a much better
+/// one.
+const MAX_BONUS: f64 = 6000.0;
+
+#[derive(Clone, serde::Serialize, serde::Deserialize)]
+pub(crate) struct Visit {
+    pub(crate) hit: Hit,
+    /// When the file was last opened, in epoch seconds.
+    pub(crate) last: i64,
+    pub(crate) count: u32,
+}
+
+/// The history bonus for a file opened `count` times, the last time
+/// `age_secs` ago.
+pub(crate) fn frecency_bonus(count: u32, age_secs: i64) -> i64 {
+    let age_days = age_secs.max(0) as f64 / 86_400.0;
+    let bonus = f64::from(count) * VISIT_BONUS * 0.5f64.powf(age_days / HALF_LIFE_DAYS);
+    bonus.min(MAX_BONUS) as i64
+}
+
+/// Count one more visit of `hit` at `now`, newest first, and keep at most
+/// [`MAX_VISITS`]. The stored hit is replaced, so its size, date and sync
+/// state are the ones from the latest search.
+fn record(visits: &mut Vec<Visit>, hit: Hit, now: i64) {
+    let key = hit.key();
+    let count = match visits.iter().position(|visit| visit.hit.key() == key) {
+        Some(at) => visits.remove(at).count.saturating_add(1),
+        None => 1,
+    };
+    visits.insert(
+        0,
+        Visit {
+            hit,
+            last: now,
+            count,
+        },
+    );
+    visits.truncate(MAX_VISITS);
+}
+
+/// Drop local files that no longer exist. Drive files stay: checking them
+/// would touch the mount, and a stale one only costs a row.
+fn prune(visits: &mut Vec<Visit>) -> bool {
+    let before = visits.len();
+    visits.retain(|visit| match &visit.hit {
+        Hit::Local(hit) => Path::new(&hit.path).symlink_metadata().is_ok(),
+        Hit::Drive(_) => true,
+    });
+    visits.len() != before
+}
+
+fn load(path: &Path) -> Vec<Visit> {
+    match std::fs::read(path) {
+        Ok(bytes) => serde_json::from_slice(&bytes).unwrap_or_else(|e| {
+            tracing::warn!("ignoring unreadable {}: {e}", path.display());
+            Vec::new()
+        }),
+        Err(_) => Vec::new(),
+    }
+}
+
+/// Write the history through a temporary file and a rename, so a crash
+/// mid-write leaves the old file rather than half a new one.
+fn save(path: &Path, visits: &[Visit]) -> std::io::Result<()> {
+    let json = serde_json::to_vec(visits).map_err(std::io::Error::other)?;
+    if let Some(dir) = path.parent() {
+        std::fs::create_dir_all(dir)?;
+    }
+    let tmp = path.with_extension("json.tmp");
+    let mut file = std::fs::File::create(&tmp)?;
+    file.write_all(&json)?;
+    file.sync_all()?;
+    std::fs::rename(&tmp, path)
+}
+
+enum Command {
+    Record(Hit, i64),
+    Prune,
+}
+
+/// The writer thread's loop: load, then apply commands until the launcher
+/// exits. `publish` receives the list after the load and after every change.
+fn serve(path: &Path, commands: &async_channel::Receiver<Command>, publish: impl Fn(Vec<Visit>)) {
+    let mut visits = load(path);
+    let pruned = prune(&mut visits);
+    publish(visits.clone());
+    if pruned && let Err(e) = save(path, &visits) {
+        tracing::warn!("cannot write {}: {e}", path.display());
+    }
+    while let Ok(command) = commands.recv_blocking() {
+        let changed = match command {
+            Command::Record(hit, now) => {
+                record(&mut visits, hit, now);
+                true
+            }
+            Command::Prune => prune(&mut visits),
+        };
+        if changed {
+            if let Err(e) = save(path, &visits) {
+                tracing::warn!("cannot write {}: {e}", path.display());
+            }
+            publish(visits.clone());
+        }
+    }
+}
+
+/// The main thread's view of the history.
+pub(crate) struct History {
+    visits: Rc<RefCell<Vec<Visit>>>,
+    commands: async_channel::Sender<Command>,
+}
+
+impl History {
+    /// Start the writer thread. `changed` runs on the main thread whenever a
+    /// new snapshot arrives.
+    pub(crate) fn start(path: PathBuf, changed: impl Fn() + 'static) -> Self {
+        let (commands, inbox) = async_channel::unbounded();
+        let (snapshots, updates) = async_channel::unbounded::<Vec<Visit>>();
+        let spawned = std::thread::Builder::new()
+            .name("prompt-history".into())
+            .spawn(move || {
+                serve(&path, &inbox, |visits| {
+                    let _ = snapshots.send_blocking(visits);
+                })
+            });
+        if let Err(e) = spawned {
+            tracing::warn!("cannot start the history writer: {e}");
+        }
+
+        let visits = Rc::new(RefCell::new(Vec::new()));
+        let shared = visits.clone();
+        glib::spawn_future_local(async move {
+            while let Ok(snapshot) = updates.recv().await {
+                *shared.borrow_mut() = snapshot;
+                changed();
+            }
+        });
+        Self { visits, commands }
+    }
+
+    /// Remember that `hit` was opened just now.
+    pub(crate) fn record(&self, hit: Hit) {
+        let _ = self.commands.try_send(Command::Record(hit, now()));
+    }
+
+    /// Forget local files that were deleted since they were opened.
+    pub(crate) fn prune(&self) {
+        let _ = self.commands.try_send(Command::Prune);
+    }
+
+    /// The most recently opened files, newest first.
+    pub(crate) fn recent(&self, limit: usize) -> Vec<Hit> {
+        self.visits
+            .borrow()
+            .iter()
+            .take(limit)
+            .map(|visit| visit.hit.clone())
+            .collect()
+    }
+
+    /// The frecency bonus of every remembered file, by [`Hit::key`].
+    pub(crate) fn bonuses(&self) -> HashMap<(bool, String), i64> {
+        let now = now();
+        self.visits
+            .borrow()
+            .iter()
+            .map(|visit| {
+                (
+                    visit.hit.key(),
+                    frecency_bonus(visit.count, now - visit.last),
+                )
+            })
+            .collect()
+    }
+}
+
+fn now() -> i64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map_or(0, |d| d.as_secs() as i64)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use pdfs_core::control::{LocalHit, SearchHit};
+
+    const DAY: i64 = 86_400;
+
+    fn drive(name: &str) -> Hit {
+        Hit::Drive(SearchHit {
+            name: name.into(),
+            path: format!("Docs/{name}"),
+            is_dir: false,
+            size: 1,
+            modified: 1,
+            pinned: false,
+            cached: false,
+            uid: format!("v~{name}"),
+            mounted_path: None,
+            score: 0,
+        })
+    }
+
+    fn scratch_dir(test: &str) -> PathBuf {
+        let dir = std::env::temp_dir().join(format!(
+            "pdfs-prompt-history-{test}-{}-{}",
+            std::process::id(),
+            now()
+        ));
+        std::fs::create_dir_all(&dir).unwrap();
+        dir
+    }
+
+    #[test]
+    fn the_bonus_halves_every_two_weeks() {
+        assert_eq!(frecency_bonus(1, 0), 1500);
+        assert_eq!(frecency_bonus(1, 14 * DAY), 750);
+        assert_eq!(frecency_bonus(1, 28 * DAY), 375);
+        assert_eq!(frecency_bonus(2, 14 * DAY), 1500);
+        // A clock that went backwards counts as "just now", not as a boost.
+        assert_eq!(frecency_bonus(1, -DAY), 1500);
+    }
+
+    #[test]
+    fn the_bonus_is_capped() {
+        assert_eq!(frecency_bonus(4, 0), 6000);
+        assert_eq!(frecency_bonus(1000, 0), 6000);
+        assert!(frecency_bonus(1000, 365 * DAY) < 6000);
+    }
+
+    #[test]
+    fn a_repeat_visit_moves_the_file_to_the_top_and_counts_it() {
+        let mut visits = Vec::new();
+        record(&mut visits, drive("a.pdf"), 10);
+        record(&mut visits, drive("b.pdf"), 20);
+        record(&mut visits, drive("a.pdf"), 30);
+        assert_eq!(visits.len(), 2);
+        assert_eq!(visits[0].hit.name(), "a.pdf");
+        assert_eq!((visits[0].count, visits[0].last), (2, 30));
+        assert_eq!(visits[1].count, 1);
+    }
+
+    #[test]
+    fn the_history_keeps_the_newest_fifty_files() {
+        let mut visits = Vec::new();
+        for n in 0..60 {
+            record(&mut visits, drive(&format!("{n}.pdf")), n);
+        }
+        assert_eq!(visits.len(), MAX_VISITS);
+        assert_eq!(visits[0].hit.name(), "59.pdf");
+        assert_eq!(visits[MAX_VISITS - 1].hit.name(), "10.pdf");
+    }
+
+    #[test]
+    fn the_history_file_round_trips() {
+        let dir = scratch_dir("round-trip");
+        let path = dir.join("prompt-history.json");
+        let mut visits = Vec::new();
+        record(&mut visits, drive("a.pdf"), 10);
+        record(&mut visits, drive("a.pdf"), 20);
+        save(&path, &visits).unwrap();
+
+        let loaded = load(&path);
+        assert_eq!(loaded.len(), 1);
+        assert_eq!(loaded[0].hit.key(), drive("a.pdf").key());
+        assert_eq!((loaded[0].count, loaded[0].last), (2, 20));
+        assert!(!path.with_extension("json.tmp").exists());
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn visits_recorded_before_the_load_are_merged_into_it() {
+        let dir = scratch_dir("merge");
+        let path = dir.join("prompt-history.json");
+        let mut stored = Vec::new();
+        record(&mut stored, drive("old.pdf"), 10);
+        record(&mut stored, drive("old.pdf"), 20);
+        save(&path, &stored).unwrap();
+
+        // Both visits are queued before the writer has read the file.
+        let (commands, inbox) = async_channel::unbounded();
+        commands
+            .send_blocking(Command::Record(drive("old.pdf"), 30))
+            .unwrap();
+        commands
+            .send_blocking(Command::Record(drive("new.pdf"), 40))
+            .unwrap();
+        drop(commands);
+
+        let published = RefCell::new(Vec::new());
+        serve(&path, &inbox, |visits| published.borrow_mut().push(visits));
+
+        let last = published.borrow().last().cloned().unwrap();
+        assert_eq!(last.len(), 2);
+        assert_eq!(last[0].hit.name(), "new.pdf");
+        assert_eq!((last[1].hit.name(), last[1].count), ("old.pdf", 3));
+        let on_disk = load(&path);
+        assert_eq!(on_disk.len(), 2);
+        assert_eq!(on_disk[1].count, 3);
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn pruning_drops_deleted_local_files_only() {
+        let dir = scratch_dir("prune");
+        let kept = dir.join("kept.txt");
+        std::fs::write(&kept, "x").unwrap();
+        let local = |path: &Path| {
+            Hit::Local(LocalHit {
+                name: path.file_name().unwrap().to_string_lossy().into_owned(),
+                path: path.display().to_string(),
+                is_dir: false,
+                size: 1,
+                modified: 1,
+                score: 0,
+            })
+        };
+        let mut visits = Vec::new();
+        record(&mut visits, local(&kept), 1);
+        record(&mut visits, local(&dir.join("gone.txt")), 2);
+        record(&mut visits, drive("remote.pdf"), 3);
+
+        assert!(prune(&mut visits));
+        let names: Vec<&str> = visits.iter().map(|visit| visit.hit.name()).collect();
+        assert_eq!(names, ["remote.pdf", "kept.txt"]);
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+}

crates/pdfs-gui/src/hud/preview.rs

@@ -0,0 +1,323 @@
+//! The preview pane beside the results: a thumbnail of the selected hit, what
+//! it is, where it is and whether it is on this computer, and the actions for
+//! it with their shortcuts.
+
+use std::cell::RefCell;
+use std::path::Path;
+use std::rc::Rc;
+use std::time::Duration;
+
+use adw::prelude::*;
+use gtk4::{gio, glib};
+
+use super::row::{fill_slot, thumb_slot};
+use super::thumbs::Thumbs;
+use crate::{Hit, dates, gettext, human_bytes, pgettext};
+
+/// Width of the pane.
+pub(crate) const PREVIEW_WIDTH: i32 = 300;
+
+/// The thumbnail area, inside the pane's padding.
+const THUMB_WIDTH: i32 = 268;
+const THUMB_HEIGHT: i32 = 180;
+
+/// How long "Path copied" stays up.
+const COPIED_FEEDBACK: Duration = Duration::from_millis(1500);
+
+/// One label/value line of the details grid.
+struct Detail {
+    title: gtk4::Label,
+    value: gtk4::Label,
+}
+
+impl Detail {
+    fn new(grid: &gtk4::Grid, row: i32, title: &str) -> Self {
+        let title = gtk4::Label::builder()
+            .label(title)
+            .xalign(0.0)
+            .valign(gtk4::Align::Start)
+            .build();
+        title.add_css_class("preview-key");
+        // A wrapping label asks for its whole text on one line as its natural
+        // width, which would widen the pane and squeeze the results. Capping it
+        // keeps the pane at its fixed width; long values wrap, then ellipsize.
+        let value = gtk4::Label::builder()
+            .xalign(0.0)
+            .hexpand(true)
+            .wrap(true)
+            .wrap_mode(gtk4::pango::WrapMode::WordChar)
+            .max_width_chars(1)
+            .lines(3)
+            .ellipsize(gtk4::pango::EllipsizeMode::Middle)
+            .build();
+        value.add_css_class("preview-value");
+        grid.attach(&title, 0, row, 1, 1);
+        grid.attach(&value, 1, row, 1, 1);
+        Self { title, value }
+    }
+
+    /// Show `value`, or hide the line when there is nothing to say.
+    fn set(&self, value: Option<&str>) {
+        self.title.set_visible(value.is_some());
+        self.value.set_visible(value.is_some());
+        self.value.set_label(value.unwrap_or_default());
+    }
+}
+
+pub(crate) struct Preview {
+    pub(crate) root: gtk4::Box,
+    stack: gtk4::Stack,
+    slot: gtk4::Overlay,
+    name: gtk4::Label,
+    kind: gtk4::Label,
+    size: Detail,
+    modified: Detail,
+    location: Detail,
+    availability: Detail,
+    availability_icon: gtk4::Image,
+    pub(crate) open: gtk4::Button,
+    open_label: gtk4::Label,
+    pub(crate) reveal: gtk4::Button,
+    pub(crate) copy: gtk4::Button,
+    copied: gtk4::Revealer,
+    copied_timer: Rc<RefCell<Option<glib::SourceId>>>,
+}
+
+/// A flat action button: the label, and its shortcut at the far end.
+fn action(icon: &str, label: &str, accelerator: &str) -> (gtk4::Button, gtk4::Label) {
+    let content = gtk4::Box::new(gtk4::Orientation::Horizontal, 10);
+    content.append(&gtk4::Image::from_icon_name(icon));
+    let text = gtk4::Label::builder()
+        .label(label)
+        .xalign(0.0)
+        .hexpand(true)
+        .max_width_chars(1)
+        .ellipsize(gtk4::pango::EllipsizeMode::End)
+        .build();
+    content.append(&text);
+    let shortcut = gtk4::ShortcutLabel::new(accelerator);
+    shortcut.add_css_class("preview-shortcut");
+    content.append(&shortcut);
+    let button = gtk4::Button::builder()
+        .child(&content)
+        .focus_on_click(false)
+        .focusable(false)
+        .build();
+    button.add_css_class("flat");
+    button.add_css_class("preview-action");
+    (button, text)
+}
+
+impl Preview {
+    pub(crate) fn new() -> Self {
+        let details = gtk4::Box::new(gtk4::Orientation::Vertical, 0);
+
+        let slot = thumb_slot(THUMB_WIDTH, THUMB_HEIGHT, 96, gtk4::ContentFit::Contain);
+        slot.add_css_class("preview-thumb");
+        details.append(&slot);
+
+        let name = gtk4::Label::builder()
+            .xalign(0.0)
+            .wrap(true)
+            .wrap_mode(gtk4::pango::WrapMode::WordChar)
+            .max_width_chars(1)
+            .lines(3)
+            .ellipsize(gtk4::pango::EllipsizeMode::End)
+            .build();
+        name.add_css_class("preview-name");
+        details.append(&name);
+
+        let kind = gtk4::Label::builder()
+            .xalign(0.0)
+            .max_width_chars(1)
+            .ellipsize(gtk4::pango::EllipsizeMode::End)
+            .build();
+        kind.add_css_class("preview-kind");
+        details.append(&kind);
+
+        let grid = gtk4::Grid::builder()
+            .row_spacing(6)
+            .column_spacing(12)
+            .build();
+        grid.add_css_class("preview-details");
+        let size = Detail::new(&grid, 0, &pgettext("column", "Size"));
+        let modified = Detail::new(&grid, 1, &pgettext("column", "Modified"));
+        let location = Detail::new(&grid, 2, &gettext("Location"));
+        // Translators: a heading in the launcher's preview pane, followed by
+        // "Available offline", "Downloaded", "Online only" or "On this computer".
+        let availability = Detail::new(&grid, 3, &gettext("Availability"));
+        // The availability value is an icon and a text.
+        let availability_icon = gtk4::Image::new();
+        availability_icon.add_css_class("preview-badge");
+        grid.remove(&availability.value);
+        let availability_box = gtk4::Box::new(gtk4::Orientation::Horizontal, 6);
+        availability_box.append(&availability_icon);
+        availability_box.append(&availability.value);
+        grid.attach(&availability_box, 1, 3, 1, 1);
+        details.append(&grid);
+
+        let spacer = gtk4::Box::builder().vexpand(true).build();
+        details.append(&spacer);
+
+        let actions = gtk4::Box::new(gtk4::Orientation::Vertical, 2);
+        actions.add_css_class("preview-actions");
+        let (open, open_label) = action("document-open-symbolic", "", "Return");
+        let (reveal, _) = action(
+            "folder-open-symbolic",
+            &gettext("Show in Folder"),
+            "<Control>Return",
+        );
+        let (copy, _) = action("edit-copy-symbolic", &gettext("Copy Path"), "<Control>c");
+        actions.append(&open);
+        actions.append(&reveal);
+        actions.append(&copy);
+        details.append(&actions);
+
+        let copied_label = gtk4::Label::new(Some(&gettext("Path copied")));
+        copied_label.add_css_class("preview-feedback");
+        let copied = gtk4::Revealer::builder()
+            .transition_type(gtk4::RevealerTransitionType::Crossfade)
+            .child(&copied_label)
+            .build();
+        details.append(&copied);
+
+        let empty = gtk4::Image::from_icon_name("system-search-symbolic");
+        empty.set_pixel_size(64);
+        empty.add_css_class("preview-empty");
+
+        let stack = gtk4::Stack::builder()
+            .transition_type(gtk4::StackTransitionType::Crossfade)
+            .transition_duration(100)
+            .vexpand(true)
+            .build();
+        stack.add_named(&empty, Some("empty"));
+        stack.add_named(&details, Some("details"));
+
+        let root = gtk4::Box::builder()
+            .orientation(gtk4::Orientation::Vertical)
+            .width_request(PREVIEW_WIDTH)
+            .hexpand(false)
+            .build();
+        root.add_css_class("preview");
+        root.append(&stack);
+
+        Self {
+            root,
+            stack,
+            slot,
+            name,
+            kind,
+            size,
+            modified,
+            location,
+            availability,
+            availability_icon,
+            open,
+            open_label,
+            reveal,
+            copy,
+            copied,
+            copied_timer: Rc::new(RefCell::new(None)),
+        }
+    }
+
+    /// Show `hit`, or the empty pane when nothing is selected.
+    pub(crate) fn show(&self, hit: Option<&Hit>, thumbs: &Rc<Thumbs>, mountpoint: &Path) {
+        let Some(hit) = hit else {
+            self.stack.set_visible_child_name("empty");
+            return;
+        };
+        self.stack.set_visible_child_name("details");
+        fill_slot(&self.slot, hit, thumbs, mountpoint);
+
+        self.name.set_label(hit.name());
+        self.name.set_tooltip_text(Some(hit.name()));
+        let content_type = if hit.is_dir() {
+            glib::GString::from("inode/directory")
+        } else {
+            gio::functions::content_type_guess(Some(hit.name()), None).0
+        };
+        self.kind
+            .set_label(&gio::functions::content_type_get_description(&content_type));
+
+        let size = (!hit.is_dir() && hit.size() > 0).then(|| human_bytes(hit.size()));
+        self.size.set(size.as_deref());
+
+        let modified = (hit.modified() > 0).then(|| dates::relative(hit.modified()));
+        self.modified.set(modified.as_deref());
+        self.modified.value.set_tooltip_text(
+            (hit.modified() > 0)
+                .then(|| dates::full(hit.modified()))
+                .as_deref(),
+        );
+
+        let location = hit.location();
+        self.location.set(Some(&location));
+        self.location.value.set_tooltip_text(Some(&location));
+
+        match availability(hit) {
+            Some((icon, class, text)) => {
+                self.availability.set(Some(&text));
+                self.availability_icon.set_icon_name(Some(icon));
+                for other in ["badge-pinned", "badge-cached", "badge-cloud", "badge-local"] {
+                    self.availability_icon.remove_css_class(other);
+                }
+                self.availability_icon.add_css_class(class);
+                self.availability_icon.set_visible(true);
+            }
+            None => {
+                self.availability.set(None);
+                self.availability_icon.set_visible(false);
+            }
+        }
+
+        self.open_label.set_label(&if hit.is_dir() {
+            gettext("Open folder")
+        } else {
+            pgettext("verb", "Open")
+        });
+    }
+
+    /// Say "Path copied" for a moment.
+    pub(crate) fn flash_copied(&self) {
+        self.copied.set_reveal_child(true);
+        if let Some(source) = self.copied_timer.borrow_mut().take() {
+            source.remove();
+        }
+        let copied = self.copied.clone();
+        let slot = self.copied_timer.clone();
+        let timer = glib::timeout_add_local_once(COPIED_FEEDBACK, move || {
+            slot.borrow_mut().take();
+            copied.set_reveal_child(false);
+        });
+        *self.copied_timer.borrow_mut() = Some(timer);
+    }
+}
+
+/// Where the hit's content is: its icon, its style class and its wording.
+fn availability(hit: &Hit) -> Option<(&'static str, &'static str, String)> {
+    match hit {
+        Hit::Local(_) => Some((
+            "drive-harddisk-symbolic",
+            "badge-local",
+            gettext("On this computer"),
+        )),
+        Hit::Drive(drive) if drive.pinned => Some((
+            "pdfs-offline-symbolic",
+            "badge-pinned",
+            gettext("Available offline"),
+        )),
+        // A folder is never downloaded as a whole; only pinning says anything.
+        Hit::Drive(drive) if drive.is_dir => None,
+        Hit::Drive(drive) if drive.cached => Some((
+            "pdfs-cached-symbolic",
+            "badge-cached",
+            pgettext("file state", "Downloaded"),
+        )),
+        Hit::Drive(_) => Some((
+            "pdfs-online-only-symbolic",
+            "badge-cloud",
+            pgettext("file state", "Online only"),
+        )),
+    }
+}

crates/pdfs-gui/src/hud/row.rs

@@ -0,0 +1,187 @@
+//! Result rows: a thumbnail or icon, the name with its matched characters in
+//! bold, the location, and on the right the sync state, size and age.
+
+use std::cell::Cell;
+use std::path::{Path, PathBuf};
+use std::rc::Rc;
+
+use adw::prelude::*;
+use gtk4::{gdk, gio};
+
+use super::highlight;
+use super::thumbs::Thumbs;
+use crate::theme::proton_theme_active;
+use crate::{Hit, format_age, human_bytes};
+
+/// Edge of a row's thumbnail.
+const ROW_THUMB: i32 = 40;
+
+/// A thumbnail surface: an icon, with a picture laid over it that shows once
+/// the thumbnail has loaded. [`Thumbs`] paints the picture.
+pub(crate) fn thumb_slot(
+    width: i32,
+    height: i32,
+    icon_size: i32,
+    fit: gtk4::ContentFit,
+) -> gtk4::Overlay {
+    let fallback = gtk4::Image::builder().pixel_size(icon_size).build();
+    let picture = gtk4::Picture::builder()
+        .width_request(width)
+        .height_request(height)
+        .content_fit(fit)
+        .can_shrink(true)
+        .visible(false)
+        .build();
+    picture.set_overflow(gtk4::Overflow::Hidden);
+    picture.add_css_class("thumb");
+
+    let overlay = gtk4::Overlay::new();
+    overlay.set_size_request(width, height);
+    overlay.set_halign(gtk4::Align::Center);
+    overlay.set_valign(gtk4::Align::Center);
+    overlay.set_child(Some(&fallback));
+    overlay.add_overlay(&picture);
+    overlay
+}
+
+/// Show `hit` in a slot from [`thumb_slot`]: its icon at once, and its
+/// thumbnail when there is one.
+pub(crate) fn fill_slot(slot: &gtk4::Overlay, hit: &Hit, thumbs: &Rc<Thumbs>, mountpoint: &Path) {
+    let Some(fallback) = slot.child().and_downcast::<gtk4::Image>() else {
+        return;
+    };
+    let Some(picture) = fallback.next_sibling().and_downcast::<gtk4::Picture>() else {
+        return;
+    };
+    fallback.set_from_gicon(&icon_for(hit.name(), hit.is_dir()));
+    fallback.set_visible(true);
+    picture.set_visible(false);
+    picture.set_paintable(gdk::Paintable::NONE);
+    thumbs.want(hit, mountpoint, &picture);
+}
+
+/// The desktop's own full-colour icon for a file name, so results look like
+/// the user's file manager. Folders are Proton's purple ones while the Proton
+/// theme is on, as in the app's browser.
+pub(crate) fn icon_for(name: &str, is_dir: bool) -> gio::Icon {
+    if is_dir {
+        let folder = if proton_theme_active() {
+            "pdfs-proton-folder"
+        } else {
+            "folder"
+        };
+        return gio::ThemedIcon::new(folder).upcast();
+    }
+    let (content_type, _uncertain) = gio::functions::content_type_guess(Some(name), None);
+    gio::functions::content_type_get_icon(&content_type)
+}
+
+/// The sync badge of a Drive file, as in the app's browser: pinned, cached,
+/// or online only. Folders and local files have none.
+pub(crate) fn badge_for(hit: &Hit) -> Option<(&'static str, &'static str)> {
+    let Hit::Drive(drive) = hit else {
+        return None;
+    };
+    if drive.is_dir {
+        return None;
+    }
+    Some(if drive.pinned {
+        ("pdfs-offline-symbolic", "badge-pinned")
+    } else if drive.cached {
+        ("pdfs-cached-symbolic", "badge-cached")
+    } else {
+        ("pdfs-online-only-symbolic", "badge-cloud")
+    })
+}
+
+pub(crate) fn build_row(
+    hit: &Hit,
+    query: &str,
+    thumbs: &Rc<Thumbs>,
+    mountpoint: &Path,
+) -> gtk4::ListBoxRow {
+    let row = gtk4::ListBoxRow::new();
+    row.add_css_class("result-row");
+    // Focus stays in the search entry; the list only shows the cursor.
+    row.set_focusable(false);
+
+    let content = gtk4::Box::new(gtk4::Orientation::Horizontal, 12);
+
+    let slot = thumb_slot(ROW_THUMB, ROW_THUMB, 32, gtk4::ContentFit::Cover);
+    fill_slot(&slot, hit, thumbs, mountpoint);
+    content.append(&slot);
+
+    let text = gtk4::Box::new(gtk4::Orientation::Vertical, 1);
+    text.set_hexpand(true);
+    text.set_valign(gtk4::Align::Center);
+
+    let name = gtk4::Label::builder()
+        .label(highlight::markup(hit.name(), query))
+        .use_markup(true)
+        .xalign(0.0)
+        .ellipsize(gtk4::pango::EllipsizeMode::Middle)
+        .build();
+    name.add_css_class("result-name");
+    text.append(&name);
+
+    let location = gtk4::Label::builder()
+        .label(hit.location())
+        .xalign(0.0)
+        .ellipsize(gtk4::pango::EllipsizeMode::Start)
+        .build();
+    location.add_css_class("result-location");
+    text.append(&location);
+    content.append(&text);
+
+    let meta = gtk4::Box::new(gtk4::Orientation::Horizontal, 10);
+    meta.set_valign(gtk4::Align::Center);
+    if let Some((icon, class)) = badge_for(hit) {
+        let badge = gtk4::Image::from_icon_name(icon);
+        badge.add_css_class("result-badge");
+        badge.add_css_class(class);
+        meta.append(&badge);
+    }
+    if !hit.is_dir() && hit.size() > 0 {
+        let size = gtk4::Label::new(Some(&human_bytes(hit.size())));
+        size.add_css_class("result-meta");
+        meta.append(&size);
+    }
+    if hit.modified() > 0 {
+        let modified = gtk4::Label::new(Some(&format_age(hit.modified())));
+        modified.add_css_class("result-meta");
+        meta.append(&modified);
+    }
+    content.append(&meta);
+
+    row.set_child(Some(&content));
+    row
+}
+
+/// Let a row be dragged into a file manager or an application as a file.
+/// `dropped` runs once a drop was accepted; a cancelled drag changes nothing.
+pub(crate) fn attach_drag(row: &gtk4::ListBoxRow, path: PathBuf, dropped: impl Fn() + 'static) {
+    let source = gtk4::DragSource::new();
+    source.set_actions(gdk::DragAction::COPY);
+    let files = gdk::FileList::from_array(&[gio::File::for_path(&path)]);
+    source.set_content(Some(&gdk::ContentProvider::for_value(&files.to_value())));
+
+    let cancelled = Rc::new(Cell::new(false));
+    let begin = cancelled.clone();
+    source.connect_drag_begin(move |source, _| {
+        begin.set(false);
+        if let Some(widget) = source.widget() {
+            source.set_icon(Some(&gtk4::WidgetPaintable::new(Some(&widget))), 0, 0);
+        }
+    });
+    let cancel = cancelled.clone();
+    source.connect_drag_cancel(move |_, _, _| {
+        cancel.set(true);
+        false
+    });
+    source.connect_drag_end(move |_, _, _| {
+        if !cancelled.get() {
+            dropped();
+        }
+    });
+    row.add_controller(source);
+}

crates/pdfs-gui/src/hud/thumbs.rs

@@ -0,0 +1,697 @@
+//! Thumbnails for the launcher's rows and preview pane.
+//!
+//! The main thread keeps a small LRU of textures, the keys known to have no
+//! thumbnail, and the pictures waiting for one (as weak references, so a row
+//! that was rebuilt or dropped keeps nothing alive). Everything that touches
+//! a file runs on two worker threads, which try in order:
+//!
+//! 1. the freedesktop thumbnail cache, valid only when its `Thumb::MTime`
+//!    matches the file's;
+//! 2. for local images, decoding the file itself, and writing the result back
+//!    to that cache for the next time and for every other application;
+//! 3. for Drive images, the daemon's `FileThumbs`, batched after a short quiet
+//!    period.
+//!
+//! Workers hand back `gdk::Texture`s, never a `Pixbuf`, which may not cross
+//! threads. Each job carries the render epoch it was queued in, and workers
+//! skip jobs a newer query has made pointless.
+
+use std::cell::{Cell, RefCell};
+use std::collections::{HashMap, HashSet, VecDeque};
+use std::io::Write;
+use std::os::unix::fs::{DirBuilderExt, OpenOptionsExt};
+use std::path::{Path, PathBuf};
+use std::rc::{Rc, Weak};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::{Duration, UNIX_EPOCH};
+
+use gtk4::gdk_pixbuf::Pixbuf;
+use gtk4::prelude::*;
+use gtk4::{gdk, glib};
+
+use pdfs_core::control::{FileThumbRequest, Request, Response, is_thumbnail_image_name};
+
+use crate::{Hit, spawn_request};
+
+/// Decoded textures kept in memory. A launcher shows a few dozen rows, so
+/// this covers several searches back.
+const TEXTURE_CACHE_MAX: usize = 128;
+const MISSING_MAX: usize = 1024;
+const WORKERS: usize = 2;
+
+/// Edge of the thumbnails this loader decodes and writes: the freedesktop
+/// "large" size.
+const THUMB_SIZE: i32 = 256;
+
+/// Local images above this size are not decoded here; a thumbnail is not
+/// worth reading that much.
+const MAX_SOURCE_BYTES: u64 = 64 * 1024 * 1024;
+
+/// Quiet period before Drive misses go to the daemon as one batch, so typing
+/// a word asks once for the final result set.
+const DAEMON_DEBOUNCE: Duration = Duration::from_millis(150);
+const DAEMON_RETRY: Duration = Duration::from_secs(1);
+const DAEMON_BATCH: usize = 32;
+
+/// Where a job finds its image.
+enum Source {
+    /// A file on this machine.
+    Local(PathBuf),
+    /// A Drive file: the thumbnail cache is keyed by its mounted path, and
+    /// the daemon is asked on a miss.
+    Drive {
+        mounted: PathBuf,
+        request: FileThumbRequest,
+    },
+    /// A thumbnail the daemon made, in its own cache.
+    Daemon(PathBuf),
+}
+
+struct Job {
+    epoch: u64,
+    key: String,
+    source: Source,
+}
+
+enum Outcome {
+    Texture(gdk::Texture),
+    Missing,
+    /// Not in the thumbnail cache; the daemon has to make it.
+    Daemon(FileThumbRequest),
+    /// Queued for an older render; handed back in case it is wanted again.
+    Skipped(Source),
+}
+
+struct Done {
+    key: String,
+    outcome: Outcome,
+}
+
+pub(crate) struct Thumbs {
+    socket: PathBuf,
+    epoch: Arc<AtomicU64>,
+    jobs: async_channel::Sender<Job>,
+
+    textures: RefCell<HashMap<String, gdk::Texture>>,
+    /// Least recently used first.
+    order: RefCell<VecDeque<String>>,
+    missing: RefCell<HashSet<String>>,
+    missing_order: RefCell<VecDeque<String>>,
+    waiters: RefCell<HashMap<String, Vec<glib::WeakRef<gtk4::Picture>>>>,
+    /// Keys with a worker job or a daemon request outstanding.
+    working: RefCell<HashSet<String>>,
+
+    /// Drive misses waiting for the next batch, by key.
+    queued: RefCell<HashMap<String, FileThumbRequest>>,
+    /// Drive items the daemon is working on under `generation`, by key.
+    sent: RefCell<HashMap<String, FileThumbRequest>>,
+    generation: Cell<u64>,
+    reserving: Cell<bool>,
+    inflight: Cell<bool>,
+    flush: RefCell<Option<glib::SourceId>>,
+}
+
+impl Thumbs {
+    pub(crate) fn new(socket: PathBuf) -> Rc<Self> {
+        let epoch = Arc::new(AtomicU64::new(0));
+        let (jobs, inbox) = async_channel::unbounded::<Job>();
+        let (done, results) = async_channel::unbounded::<Done>();
+        for n in 0..WORKERS {
+            let inbox = inbox.clone();
+            let done = done.clone();
+            let epoch = epoch.clone();
+            let spawned = std::thread::Builder::new()
+                .name(format!("prompt-thumbs-{n}"))
+                .spawn(move || work(n, &inbox, &done, &epoch));
+            if let Err(e) = spawned {
+                tracing::warn!("cannot start a thumbnail worker: {e}");
+            }
+        }
+
+        let thumbs = Rc::new(Self {
+            socket,
+            epoch,
+            jobs,
+            textures: RefCell::new(HashMap::new()),
+            order: RefCell::new(VecDeque::new()),
+            missing: RefCell::new(HashSet::new()),
+            missing_order: RefCell::new(VecDeque::new()),
+            waiters: RefCell::new(HashMap::new()),
+            working: RefCell::new(HashSet::new()),
+            queued: RefCell::new(HashMap::new()),
+            sent: RefCell::new(HashMap::new()),
+            generation: Cell::new(0),
+            reserving: Cell::new(false),
+            inflight: Cell::new(false),
+            flush: RefCell::new(None),
+        });
+        let weak = Rc::downgrade(&thumbs);
+        glib::spawn_future_local(async move {
+            while let Ok(done) = results.recv().await {
+                let Some(thumbs) = weak.upgrade() else {
+                    break;
+                };
+                thumbs.finish(done);
+            }
+        });
+        thumbs
+    }
+
+    /// Paint `hit`'s thumbnail into `picture` now if it is known, or as soon
+    /// as it is. Folders and non-images keep the slot's icon.
+    pub(crate) fn want(self: &Rc<Self>, hit: &Hit, mountpoint: &Path, picture: &gtk4::Picture) {
+        let key = hit.thumb_key();
+        // The widget name binds the picture to one key: a late reply for
+        // another hit must not paint into it.
+        picture.set_widget_name(&key);
+        if hit.is_dir() || !is_thumbnail_image_name(hit.name()) {
+            return;
+        }
+        if matches!(hit, Hit::Drive(drive) if drive.uid.is_empty()) {
+            return;
+        }
+        let cached = self.textures.borrow().get(&key).cloned();
+        if let Some(texture) = cached {
+            self.touch(&key);
+            paint(picture, &key, &texture);
+            return;
+        }
+        if self.missing.borrow().contains(&key) {
+            return;
+        }
+        self.waiters
+            .borrow_mut()
+            .entry(key.clone())
+            .or_default()
+            .push(picture.downgrade());
+        if !self.working.borrow_mut().insert(key.clone()) {
+            return;
+        }
+        let source = match hit {
+            Hit::Local(local) => Source::Local(PathBuf::from(&local.path)),
+            Hit::Drive(drive) => Source::Drive {
+                mounted: hit.fs_path(mountpoint),
+                request: FileThumbRequest {
+                    uid: drive.uid.clone(),
+                    modified: drive.modified,
+                    name: drive.name.clone(),
+                },
+            },
+        };
+        self.dispatch(key, source);
+    }
+
+    /// The rows are about to be rebuilt: forget their pictures, and let the
+    /// workers skip what was queued for them.
+    pub(crate) fn begin_render(&self) {
+        self.epoch.fetch_add(1, Ordering::SeqCst);
+        self.waiters.borrow_mut().clear();
+    }
+
+    /// The rows are rebuilt and have asked for their thumbnails. Drive work
+    /// for hits that are gone is dropped, and cancelled at the daemon when it
+    /// had already been sent.
+    pub(crate) fn end_render(self: &Rc<Self>) {
+        let wanted: HashSet<String> = self.waiters.borrow().keys().cloned().collect();
+        let mut dropped = Vec::new();
+        self.queued.borrow_mut().retain(|key, _| {
+            let keep = wanted.contains(key);
+            if !keep {
+                dropped.push(key.clone());
+            }
+            keep
+        });
+        let stale = self.sent.borrow().keys().any(|key| !wanted.contains(key));
+        if stale {
+            self.cancel_daemon();
+            // Still-wanted items go back into the next batch, under a fresh
+            // generation.
+            let sent: Vec<(String, FileThumbRequest)> = self.sent.borrow_mut().drain().collect();
+            for (key, request) in sent {
+                if wanted.contains(&key) {
+                    self.queued.borrow_mut().insert(key, request);
+                } else {
+                    dropped.push(key);
+                }
+            }
+            self.schedule(DAEMON_DEBOUNCE);
+        }
+        let mut working = self.working.borrow_mut();
+        for key in dropped {
+            working.remove(&key);
+        }
+    }
+
+    /// The launcher was dismissed: stop everything.
+    pub(crate) fn cancel_all(&self) {
+        self.epoch.fetch_add(1, Ordering::SeqCst);
+        self.waiters.borrow_mut().clear();
+        self.working.borrow_mut().clear();
+        self.queued.borrow_mut().clear();
+        self.sent.borrow_mut().clear();
+        if let Some(source) = self.flush.borrow_mut().take() {
+            source.remove();
+        }
+        self.cancel_daemon();
+    }
+
+    fn dispatch(&self, key: String, source: Source) {
+        let job = Job {
+            epoch: self.epoch.load(Ordering::SeqCst),
+            key: key.clone(),
+            source,
+        };
+        if self.jobs.try_send(job).is_err() {
+            self.working.borrow_mut().remove(&key);
+        }
+    }
+
+    fn wanted(&self, key: &str) -> bool {
+        self.waiters.borrow().contains_key(key)
+    }
+
+    fn finish(self: &Rc<Self>, done: Done) {
+        let Done { key, outcome } = done;
+        match outcome {
+            Outcome::Texture(texture) => {
+                self.working.borrow_mut().remove(&key);
+                self.store_texture(&key, texture.clone());
+                let waiters = self.waiters.borrow_mut().remove(&key);
+                for picture in waiters.into_iter().flatten() {
+                    if let Some(picture) = picture.upgrade() {
+                        paint(&picture, &key, &texture);
+                    }
+                }
+            }
+            Outcome::Missing => {
+                self.working.borrow_mut().remove(&key);
+                self.store_missing(key.clone());
+                self.waiters.borrow_mut().remove(&key);
+            }
+            Outcome::Daemon(request) => {
+                if self.wanted(&key) {
+                    self.queued.borrow_mut().insert(key, request);
+                    self.schedule(DAEMON_DEBOUNCE);
+                } else {
+                    self.working.borrow_mut().remove(&key);
+                }
+            }
+            Outcome::Skipped(source) => {
+                // A newer render may want the same image again.
+                if self.wanted(&key) {
+                    self.dispatch(key, source);
+                } else {
+                    self.working.borrow_mut().remove(&key);
+                }
+            }
+        }
+    }
+
+    fn touch(&self, key: &str) {
+        let mut order = self.order.borrow_mut();
+        if let Some(at) = order.iter().position(|held| held == key) {
+            order.remove(at);
+            order.push_back(key.to_string());
+        }
+    }
+
+    fn store_texture(&self, key: &str, texture: gdk::Texture) {
+        let mut textures = self.textures.borrow_mut();
+        if textures.insert(key.to_string(), texture).is_none() {
+            self.order.borrow_mut().push_back(key.to_string());
+        } else {
+            drop(textures);
+            self.touch(key);
+            return;
+        }
+        let mut order = self.order.borrow_mut();
+        while order.len() > TEXTURE_CACHE_MAX {
+            if let Some(old) = order.pop_front() {
+                textures.remove(&old);
+            }
+        }
+    }
+
+    fn store_missing(&self, key: String) {
+        let mut missing = self.missing.borrow_mut();
+        let mut order = self.missing_order.borrow_mut();
+        if missing.insert(key.clone()) {
+            order.push_back(key);
+        }
+        while order.len() > MISSING_MAX {
+            if let Some(old) = order.pop_front() {
+                missing.remove(&old);
+            }
+        }
+    }
+
+    /// Stop the daemon's work for this launcher. The generation is shared
+    /// with the app, so this is only sent when something was asked for.
+    fn cancel_daemon(&self) {
+        let generation = self.generation.replace(0);
+        if generation != 0 {
+            // The reply is not needed; `spawn_request` owns the round-trip.
+            drop(spawn_request(
+                self.socket.clone(),
+                Request::CancelFileThumbs {
+                    generation: generation.saturating_add(1),
+                },
+            ));
+        }
+    }
+
+    fn schedule(self: &Rc<Self>, delay: Duration) {
+        if let Some(source) = self.flush.borrow_mut().take() {
+            source.remove();
+        }
+        let weak = Rc::downgrade(self);
+        let source = glib::timeout_add_local_once(delay, move || {
+            if let Some(thumbs) = weak.upgrade() {
+                thumbs.flush.borrow_mut().take();
+                thumbs.send_batch();
+            }
+        });
+        *self.flush.borrow_mut() = Some(source);
+    }
+
+    fn send_batch(self: &Rc<Self>) {
+        if self.inflight.get() || self.queued.borrow().is_empty() {
+            return;
+        }
+        if self.generation.get() == 0 {
+            self.reserve();
+            return;
+        }
+        let batch: Vec<(String, FileThumbRequest)> = {
+            let mut queued = self.queued.borrow_mut();
+            let keys: Vec<String> = queued.keys().take(DAEMON_BATCH).cloned().collect();
+            keys.into_iter()
+                .filter_map(|key| queued.remove_entry(&key))
+                .collect()
+        };
+        self.sent.borrow_mut().extend(batch.iter().cloned());
+        let generation = self.generation.get();
+        self.inflight.set(true);
+        let rx = spawn_request(
+            self.socket.clone(),
+            Request::FileThumbs {
+                items: batch.iter().map(|(_, request)| request.clone()).collect(),
+                generation,
+            },
+        );
+        let weak = Rc::downgrade(self);
+        glib::spawn_future_local(async move {
+            let reply = rx.recv().await;
+            let Some(thumbs) = weak.upgrade() else {
+                return;
+            };
+            thumbs.inflight.set(false);
+            thumbs.receive(generation, batch, reply);
+            if !thumbs.queued.borrow().is_empty() {
+                thumbs.schedule(Duration::ZERO);
+            }
+        });
+    }
+
+    fn receive(
+        self: &Rc<Self>,
+        generation: u64,
+        batch: Vec<(String, FileThumbRequest)>,
+        reply: Result<Result<Response, String>, async_channel::RecvError>,
+    ) {
+        // Cancelled while in flight: `end_render` or `cancel_all` already
+        // re-queued what is still wanted. A finished thumbnail is still worth
+        // painting.
+        let current = generation == self.generation.get();
+        match reply {
+            Ok(Ok(Response::Thumbs { items })) => {
+                let mut by_uid: HashMap<String, (String, FileThumbRequest)> = batch
+                    .into_iter()
+                    .map(|(key, request)| (request.uid.clone(), (key, request)))
+                    .collect();
+                let mut again = Vec::new();
+                for item in items {
+                    let Some((key, request)) = by_uid.remove(&item.uid) else {
+                        continue;
+                    };
+                    if let Some(path) = item.path {
+                        if current {
+                            self.sent.borrow_mut().remove(&key);
+                        }
+                        if self.wanted(&key) {
+                            self.working.borrow_mut().insert(key.clone());
+                            self.dispatch(key, Source::Daemon(PathBuf::from(path)));
+                        } else {
+                            self.working.borrow_mut().remove(&key);
+                        }
+                    } else if !current {
+                        continue;
+                    } else if item.pending {
+                        again.push((key, request));
+                    } else {
+                        self.sent.borrow_mut().remove(&key);
+                        self.working.borrow_mut().remove(&key);
+                        self.store_missing(key.clone());
+                        self.waiters.borrow_mut().remove(&key);
+                    }
+                }
+                if current {
+                    again.extend(by_uid.into_values());
+                    self.retry(again);
+                }
+            }
+            Ok(Ok(Response::FileThumbsStale)) if current => {
+                self.generation.set(0);
+                self.retry(batch);
+            }
+            Ok(Ok(Response::Error { message, .. })) if current => {
+                tracing::debug!("launcher thumbnails failed: {message}");
+                self.retry(batch);
+            }
+            _ if current => self.retry(batch),
+            _ => {}
+        }
+    }
+
+    /// Ask again for items the daemon is still making, after a pause.
+    fn retry(self: &Rc<Self>, items: Vec<(String, FileThumbRequest)>) {
+        if items.is_empty() {
+            return;
+        }
+        let weak = Rc::downgrade(self);
+        glib::timeout_add_local_once(DAEMON_RETRY, move || {
+            let Some(thumbs) = weak.upgrade() else {
+                return;
+            };
+            for (key, request) in items {
+                // Gone from `sent` means cancelled or already answered.
+                if thumbs.sent.borrow_mut().remove(&key).is_some() && thumbs.wanted(&key) {
+                    thumbs.queued.borrow_mut().insert(key, request);
+                } else {
+                    thumbs.working.borrow_mut().remove(&key);
+                }
+            }
+            thumbs.send_batch();
+        });
+    }
+
+    fn reserve(self: &Rc<Self>) {
+        if self.reserving.replace(true) {
+            return;
+        }
+        let rx = spawn_request(self.socket.clone(), Request::ReserveFileThumbGeneration);
+        let weak: Weak<Self> = Rc::downgrade(self);
+        glib::spawn_future_local(async move {
+            let reply = rx.recv().await;
+            let Some(thumbs) = weak.upgrade() else {
+                return;
+            };
+            thumbs.reserving.set(false);
+            match reply {
+                Ok(Ok(Response::FileThumbGeneration { generation })) if generation != 0 => {
+                    thumbs.generation.set(generation);
+                    thumbs.send_batch();
+                }
+                _ => thumbs.schedule(DAEMON_RETRY),
+            }
+        });
+    }
+}
+
+/// Show `texture` in `picture` if the picture still belongs to `key`, and hide
+/// the icon underneath it.
+fn paint(picture: &gtk4::Picture, key: &str, texture: &gdk::Texture) {
+    if picture.widget_name() != key {
+        return;
+    }
+    picture.set_paintable(Some(texture));
+    picture.set_visible(true);
+    if let Some(overlay) = picture.parent().and_downcast::<gtk4::Overlay>()
+        && let Some(fallback) = overlay.child()
+    {
+        fallback.set_visible(false);
+    }
+}
+
+fn work(
+    index: usize,
+    inbox: &async_channel::Receiver<Job>,
+    done: &async_channel::Sender<Done>,
+    epoch: &AtomicU64,
+) {
+    while let Ok(job) = inbox.recv_blocking() {
+        // A daemon thumbnail is already made; decoding it is cheap and the
+        // texture is cached for the next render.
+        let stale =
+            !matches!(job.source, Source::Daemon(_)) && job.epoch < epoch.load(Ordering::SeqCst);
+        let outcome = if stale {
+            Outcome::Skipped(job.source)
+        } else {
+            load(index, job.source)
+        };
+        if done
+            .send_blocking(Done {
+                key: job.key,
+                outcome,
+            })
+            .is_err()
+        {
+            break;
+        }
+    }
+}
+
+fn load(worker: usize, source: Source) -> Outcome {
+    match source {
+        Source::Local(path) => {
+            let Ok(meta) = std::fs::metadata(&path) else {
+                return Outcome::Missing;
+            };
+            let mtime = meta
+                .modified()
+                .ok()
+                .and_then(|at| at.duration_since(UNIX_EPOCH).ok())
+                .map_or(0, |at| at.as_secs() as i64);
+            if let Some(pixbuf) = cached(&path, mtime) {
+                return texture(&pixbuf);
+            }
+            if meta.len() > MAX_SOURCE_BYTES {
+                return Outcome::Missing;
+            }
+            let Some((pixbuf, scaled)) = decode(&path) else {
+                return Outcome::Missing;
+            };
+            // An image that already fits is its own thumbnail.
+            if scaled && let Err(e) = write_cached(worker, &path, mtime, &pixbuf) {
+                tracing::debug!("cannot cache a thumbnail of {}: {e}", path.display());
+            }
+            texture(&pixbuf)
+        }
+        Source::Drive { mounted, request } => match cached(&mounted, request.modified) {
+            Some(pixbuf) => texture(&pixbuf),
+            None => Outcome::Daemon(request),
+        },
+        Source::Daemon(path) => match gdk::Texture::from_filename(&path) {
+            Ok(texture) => Outcome::Texture(texture),
+            Err(e) => {
+                tracing::debug!("cannot decode {}: {e}", path.display());
+                Outcome::Missing
+            }
+        },
+    }
+}
+
+/// `$XDG_CACHE_HOME/thumbnails`.
+fn thumbnail_root() -> PathBuf {
+    glib::user_cache_dir().join("thumbnails")
+}
+
+/// The URI and its MD5, which name a file's entry in the thumbnail cache.
+fn cache_name(path: &Path) -> Option<(String, String)> {
+    let uri = glib::filename_to_uri(path, None).ok()?.to_string();
+    let md5 = glib::compute_checksum_for_data(glib::ChecksumType::Md5, uri.as_bytes())?.to_string();
+    Some((uri, md5))
+}
+
+/// A thumbnail from the shared cache, if one was made for this version of
+/// the file.
+fn cached(path: &Path, mtime: i64) -> Option<Pixbuf> {
+    let (_, md5) = cache_name(path)?;
+    let root = thumbnail_root();
+    ["large", "x-large", "normal"].iter().find_map(|size| {
+        let pixbuf = Pixbuf::from_file(root.join(size).join(format!("{md5}.png"))).ok()?;
+        let stamp = pixbuf.option("tEXt::Thumb::MTime")?;
+        (stamp.parse::<i64>().ok()? == mtime).then_some(pixbuf)
+    })
+}
+
+/// Decode a local image at most [`THUMB_SIZE`] on its longer edge, upright.
+/// The bool says whether it had to be scaled down.
+fn decode(path: &Path) -> Option<(Pixbuf, bool)> {
+    let (_, width, height) = Pixbuf::file_info(path)?;
+    let scaled = width > THUMB_SIZE || height > THUMB_SIZE;
+    let pixbuf = if scaled {
+        Pixbuf::from_file_at_scale(path, THUMB_SIZE, THUMB_SIZE, true)
+    } else {
+        Pixbuf::from_file(path)
+    }
+    .ok()?;
+    let pixbuf = pixbuf.apply_embedded_orientation().unwrap_or(pixbuf);
+    Some((pixbuf, scaled))
+}
+
+/// Store a thumbnail as the freedesktop spec asks: in `large/`, with
+/// `Thumb::URI` and `Thumb::MTime`, readable only by the user, and written
+/// through a temporary file so another reader never sees half of it.
+fn write_cached(worker: usize, path: &Path, mtime: i64, pixbuf: &Pixbuf) -> std::io::Result<()> {
+    let (uri, md5) = cache_name(path).ok_or_else(|| std::io::Error::other("no file URI"))?;
+    let dir = thumbnail_root().join("large");
+    std::fs::DirBuilder::new()
+        .recursive(true)
+        .mode(0o700)
+        .create(&dir)?;
+    let mtime = mtime.to_string();
+    let png = pixbuf
+        .save_to_bufferv(
+            "png",
+            &[
+                ("tEXt::Thumb::URI", uri.as_str()),
+                ("tEXt::Thumb::MTime", mtime.as_str()),
+            ],
+        )
+        .map_err(std::io::Error::other)?;
+    let tmp = dir.join(format!(
+        "{md5}.png.pdfs-{}-{worker}.tmp",
+        std::process::id()
+    ));
+    let written = std::fs::OpenOptions::new()
+        .write(true)
+        .create(true)
+        .truncate(true)
+        .mode(0o600)
+        .open(&tmp)
+        .and_then(|mut file| file.write_all(&png))
+        .and_then(|()| std::fs::rename(&tmp, dir.join(format!("{md5}.png"))));
+    if written.is_err() {
+        let _ = std::fs::remove_file(&tmp);
+    }
+    written
+}
+
+/// A `Pixbuf` may not leave its thread; its pixels, as a memory texture, can.
+fn texture(pixbuf: &Pixbuf) -> Outcome {
+    let format = if pixbuf.has_alpha() {
+        gdk::MemoryFormat::R8g8b8a8
+    } else {
+        gdk::MemoryFormat::R8g8b8
+    };
+    let texture = gdk::MemoryTexture::new(
+        pixbuf.width(),
+        pixbuf.height(),
+        format,
+        &pixbuf.read_pixel_bytes(),
+        pixbuf.rowstride() as usize,
+    );
+    Outcome::Texture(texture.upcast())
+}

crates/pdfs-gui/src/main.rs

@@ -45,6 +45,8 @@ enum Phase {
     Offline,
     /// Changes keep failing; the user has to look.
     Attention,
+    /// Mounted, but Proton refused the session: only signing in again helps.
+    SessionExpired,
     /// Signed in, but no mount daemon is running.
     Disconnected,
     SignedOut,
@@ -60,6 +62,7 @@ impl Phase {
             Phase::Paused => "media-playback-pause-symbolic",
             Phase::Offline => "network-offline-symbolic",
             Phase::Attention => "dialog-warning-symbolic",
+            Phase::SessionExpired => "dialog-password-symbolic",
             Phase::Disconnected | Phase::SignedOut => "network-offline-symbolic",
         }
     }
@@ -88,8 +91,9 @@ struct DriveState {
 /// Summarise a work snapshot into one menu line, or empty when idle. A single
 /// transfer names the file and its percentage; several collapse to counts so the
 /// menu stays one line regardless of queue depth. With nothing moving bytes, a
-/// running job speaks for itself — a scan or an index rebuild is still "busy",
-/// and the tray saying nothing there reads as "finished".
+/// running job speaks for itself — a scan or an index rebuild is still work
+/// going on, and the menu saying nothing there reads as "finished". The icon is
+/// [`busy`]'s call, not this line's.
 fn sync_line(items: &[TransferItem], jobs: &[JobItem]) -> String {
     match items {
         [] => match jobs.first() {
@@ -143,12 +147,12 @@ struct DriveTray {
 fn poll_state(socket: &Path, default_mountpoint: &Path) -> DriveState {
     match send(socket, &Request::Status) {
         Ok(status @ Response::Status { .. }) => {
-            // Same daemon is up, so a cheap follow-up request gives the sync line.
-            let sync = match send(socket, &Request::GetQueueStatus) {
-                Ok(Response::Transfers { items, jobs }) => sync_line(&items, &jobs),
-                _ => String::new(),
+            // Same daemon is up, so a cheap follow-up request says what moves.
+            let (items, jobs) = match send(socket, &Request::GetQueueStatus) {
+                Ok(Response::Transfers { items, jobs }) => (items, jobs),
+                _ => (Vec::new(), Vec::new()),
             };
-            status_state(&status, sync, default_mountpoint)
+            status_state(&status, &items, &jobs, default_mountpoint)
         }
         // Socket answered but with something unexpected — treat as up but odd.
         Ok(_) => unexpected_reply(default_mountpoint),
@@ -166,6 +170,15 @@ fn poll_state(socket: &Path, default_mountpoint: &Path) -> DriveState {
         // No daemon: describe login state instead so the menu is still useful.
         Err(_) => {
             let (line, phase) = match auth::load() {
+                Ok(s) if matches!(auth::key_state(), Ok(auth::KeyState::Locked)) => (
+                    // Translators: {username} is the Proton account name. The
+                    // account has a mailbox password that has to be entered.
+                    gettext_f(
+                        "Signed in as {username} — locked",
+                        &[("username", &s.username)],
+                    ),
+                    Phase::Attention,
+                ),
                 Ok(s) => (
                     // Translators: {username} is the Proton account name.
                     gettext_f(
@@ -208,9 +221,14 @@ fn unexpected_reply(default_mountpoint: &Path) -> DriveState {
     }
 }
 
-/// The state a running daemon's [`Response::Status`] describes, with `sync`
-/// saying what it is moving right now.
-fn status_state(status: &Response, sync: String, default_mountpoint: &Path) -> DriveState {
+/// The state a running daemon's [`Response::Status`] describes, with `items`
+/// and `jobs` saying what it is working on right now.
+fn status_state(
+    status: &Response,
+    items: &[TransferItem],
+    jobs: &[JobItem],
+    default_mountpoint: &Path,
+) -> DriveState {
     let Response::Status {
         mountpoint,
         pinned,
@@ -219,6 +237,8 @@ fn status_state(status: &Response, sync: String, default_mountpoint: &Path) -> D
         pending_changes,
         failing_ops,
         paused,
+        session_expired,
+        tokens_unsaved,
         ..
     } = status
     else {
@@ -226,14 +246,25 @@ fn status_state(status: &Response, sync: String, default_mountpoint: &Path) -> D
     };
     let (pinned, online, failing_ops, paused) = (*pinned, *online, *failing_ops, *paused);
     let queued = i18n::pending_summary(*pending_uploads, *pending_changes);
-    let phase = phase_of(
-        paused,
-        failing_ops,
-        online,
-        queued.is_some() || !sync.is_empty(),
-    );
+    let phase = if *session_expired {
+        Phase::SessionExpired
+    } else if *tokens_unsaved {
+        Phase::Attention
+    } else {
+        phase_of(
+            paused,
+            failing_ops,
+            online,
+            queued.is_some() || busy(items, jobs),
+        )
+    };
     DriveState {
         line: match (online, queued) {
+            // Outranks everything: it is why nothing else moves, and the one
+            // thing that fixes it is the user's to do.
+            _ if *session_expired => gettext("Session expired — sign in again"),
+            // Sync goes on meanwhile, but a reboot ends it until the next login.
+            _ if *tokens_unsaved => gettext("Sign-in not saved — unlock your keyring"),
             _ if paused => gettext("Sync paused"),
             _ if failing_ops > 0 => ngettext_f(
                 "{n} change needs attention",
@@ -269,11 +300,19 @@ fn status_state(status: &Response, sync: String, default_mountpoint: &Path) -> D
         mounted: true,
         paused,
         mountpoint: PathBuf::from(mountpoint),
-        sync,
+        sync: sync_line(items, jobs),
         failing: failing_ops,
     }
 }
 
+/// Whether the daemon is changing something: bytes moving, or a job the user
+/// is waiting on. A mirror folder's routine scan and the like are background
+/// jobs; they still get the menu line, but the icon spinning every two minutes
+/// for a scan that finds nothing reads as constant syncing.
+fn busy(items: &[TransferItem], jobs: &[JobItem]) -> bool {
+    !items.is_empty() || jobs.iter().any(|j| !j.background)
+}
+
 /// The phase a running mount is in. A pause is the user's own doing and says
 /// so first; failures outrank everything else the daemon reports.
 fn phase_of(paused: bool, failing: u64, online: bool, busy: bool) -> Phase {
@@ -342,7 +381,7 @@ impl Tray for DriveTray {
 
     fn status(&self) -> Status {
         match self.state.phase {
-            Phase::Attention => Status::NeedsAttention,
+            Phase::Attention | Phase::SessionExpired => Status::NeedsAttention,
             _ => Status::Active,
         }
     }
@@ -400,6 +439,9 @@ impl Tray for DriveTray {
             // Nothing to mount without a session; the app's sign-in page is the
             // way in.
             Phase::SignedOut => items.push(item(&gettext("Sign In…"), |_| open_manager(&[]))),
+            Phase::SessionExpired => items.push(item(&gettext("Sign In Again…"), |_| {
+                open_manager(&["--page", "login"])
+            })),
             _ => items.push(item(&gettext("Open Proton Drive"), |_| open_manager(&[]))),
         }
 
@@ -476,6 +518,10 @@ fn main() -> Result<()> {
         return Ok(());
     }
 
+    // The socket lives in the state dir, which nothing has made yet when the app
+    // starts the tray on a fresh install (B194).
+    dirs.ensure().context("create the app's directories")?;
+
     // Ensure only one instance of the tray runs.
     let tray_sock = dirs.tray_socket();
     if std::os::unix::net::UnixStream::connect(&tray_sock).is_ok() {
@@ -534,11 +580,7 @@ fn main() -> Result<()> {
             heard.take(feed);
         }
         let st = match &heard.status {
-            Some(status) => status_state(
-                status,
-                sync_line(&heard.items, &heard.jobs),
-                &default_mountpoint,
-            ),
+            Some(status) => status_state(status, &heard.items, &heard.jobs, &default_mountpoint),
             // Lost the daemon: ask once, which describes the sign-in instead.
             None => poll_state(&socket, &default_mountpoint),
         };
@@ -583,6 +625,80 @@ mod tests {
         assert_eq!(phase_of(false, 0, true, false), Phase::Synced);
     }
 
+    fn status(extra: &str) -> Response {
+        serde_json::from_str(&format!(
+            r#"{{"Status":{{"username":"u","mountpoint":"/m","pinned":0,"used":0,"budget":0,
+                "pins":[],"online":false,"pending_uploads":3,"failing_ops":2,"paused":true{extra}}}}}"#
+        ))
+        .unwrap()
+    }
+
+    /// Issue #35: a refused session read as "Offline — 3 uploads queued" for
+    /// good, and nothing said that signing in again was the way out.
+    #[test]
+    fn a_refused_session_outranks_everything_else() {
+        let state = status_state(
+            &status(r#","session_expired":true"#),
+            &[],
+            &[],
+            Path::new("/m"),
+        );
+        assert_eq!(state.phase, Phase::SessionExpired);
+        assert_eq!(state.line, "Session expired — sign in again");
+    }
+
+    /// B61: the keyring refusing the refreshed tokens was only in the log.
+    #[test]
+    fn a_sign_in_the_keyring_refused_needs_attention() {
+        let state = status_state(
+            &status(r#","tokens_unsaved":true"#),
+            &[],
+            &[],
+            Path::new("/m"),
+        );
+        assert_eq!(state.phase, Phase::Attention);
+        assert_eq!(state.line, "Sign-in not saved — unlock your keyring");
+    }
+
+    #[test]
+    fn a_daemon_that_does_not_say_has_a_live_session() {
+        let state = status_state(&status(""), &[], &[], Path::new("/m"));
+        assert_eq!(state.phase, Phase::Paused);
+    }
+
+    fn job(title: &str, background: bool) -> JobItem {
+        JobItem {
+            title: title.to_string(),
+            detail: String::new(),
+            done: 0,
+            total: 0,
+            background,
+        }
+    }
+
+    #[test]
+    fn a_routine_scan_is_not_busy_but_a_sync_is() {
+        assert!(!busy(&[], &[]));
+        assert!(!busy(&[], &[job("Checking Documents", true)]));
+        assert!(busy(
+            &[],
+            &[
+                job("Checking Documents", true),
+                job("Syncing Photos", false)
+            ]
+        ));
+        assert!(busy(&[], &[job("Uploading files", false)]));
+    }
+
+    #[test]
+    fn a_job_from_an_older_daemon_counts_as_busy() {
+        let job: JobItem = serde_json::from_str(
+            r#"{"title":"Checking Documents","detail":"","done":0,"total":0}"#,
+        )
+        .unwrap();
+        assert!(!job.background);
+    }
+
     #[test]
     fn the_issues_item_counts_in_the_singular_and_plural() {
         assert_eq!(issues_label(1), "1 issue — View");