chore(release): 3.4.0

test(fuse): let a held create carry its bytes in the simulation
FUSE delivers `release` after `close()` returns, and the release is what attaches the written bytes to the queued create. A drain worker that is free can claim the create first and send the file empty, with the bytes following as a revision. Tests that hold a create, its reply, or lose its reply then act on the empty create, and their assertions about the file's content race the revision. CI saw this as an occasional failure of a_listing_taken_before_a_create_commits_keeps_the_landed_file. Add Daemon::write_new, which pauses sync, writes the file, waits until the pending create carries the bytes, and resumes. Use it for every write that directly follows a create hold.
2026-11-04 08:56:59 +01:00 · 2026-10-12 18:12:00 +02:00 · 2026-10-12 18:05:45 +02:00 · 2026-10-12 15:40:56 +02:00 · 2026-10-12 00:57:10 +02:00 · 2026-10-12 00:57:04 +02:00
80 changed files with 9052 additions and 5416 deletions
@@ -0,0 +1,59 @@
+name: Nix
+
+# Builds the flake (docs/INSTALL.md#nixos-flake) whenever its recipe, the lock
+# files or the code change, so a NixOS user's `nix build` keeps working. Run it
+# from the Actions tab for any branch to get a build to try.
+on:
+  push:
+    paths:
+      - 'flake.nix'
+      - 'flake.lock'
+      - 'packaging/nix/**'
+      - 'Cargo.lock'
+      - 'Cargo.toml'
+      - 'crates/**'
+      - 'po/**'
+      - '.github/workflows/nix.yml'
+  pull_request:
+    paths:
+      - 'flake.nix'
+      - 'flake.lock'
+      - 'packaging/nix/**'
+      - 'Cargo.lock'
+      - '.github/workflows/nix.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: nix-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: cachix/install-nix-action@v31
+
+      # Pulls from the project's binary cache, and pushes what this run built
+      # when the token is there; a fork's pull request has none and only pulls.
+      - uses: cachix/cachix-action@v17
+        with:
+          name: proton-drive-linux
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+      - name: Check the flake
+        run: nix flake check --print-build-logs --no-build
+
+      - name: Build the package
+        run: nix build --print-build-logs .#proton-drive-linux
+
+      - name: Smoke test
+        run: |
+          ./result/bin/pdfs --version
+          for bin in pdfs-app pdfs-tray pdfs-prompt; do test -x "result/bin/$bin"; done
+          grep -q "ExecStart=$(readlink -f result)/bin/pdfs" result/lib/systemd/user/proton-drive.service
+          ls result/share/locale/*/LC_MESSAGES/pdfs.mo
@@ -153,6 +153,9 @@ jobs:
          cp LICENSE deb/usr/share/licenses/proton-drive-linux/
          po/build.sh deb/usr/share/locale

+          # Stops the running daemon before removal, so the mount stops mirroring deletes
+          install -m755 packaging/deb/prerm deb/DEBIAN/prerm
+
          # Calculate Installed-Size in KB for the control file
          INSTALLED_SIZE=$(du -sk deb | cut -f1)

@@ -230,21 +233,67 @@ jobs:
            *.rpm
          if-no-files-found: error

+  # The flake is the Nix release: a tag is what `github:narrrl/proton-drive-linux/vX.Y.Z`
+  # pins, so it has to build before the release is announced.
+  nix:
+    name: Build the Nix package
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: cachix/install-nix-action@v31
+
+      # Pulls from the project's binary cache, and pushes what this run built
+      # when the token is there; a fork's pull request has none and only pulls.
+      - uses: cachix/cachix-action@v17
+        with:
+          name: proton-drive-linux
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+      - name: Build the flake
+        run: nix build --print-build-logs .#proton-drive-linux
+
+      - name: Check the version
+        run: |
+          built="$(./result/bin/pdfs --version)"
+          echo "$built"
+          case "$GITHUB_REF" in
+            refs/tags/v*) grep -qF "${GITHUB_REF_NAME#v}" <<< "$built" ;;
+          esac
+
  publish:
    name: Create GitHub Release
-    needs: [checks, build-release]
+    needs: [checks, build-release, nix]
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-24.04

    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
      - name: Download packages
        uses: actions/download-artifact@v8
        with:
          name: proton-drive-linux-builds

+      # The release notes are this version's section of the changelog, from its
+      # heading up to the next one.
+      - name: Extract release notes
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          awk -v heading="## [$version]" \
+            'index($0, heading) == 1 { found = 1; print; next }
+             found && /^## \[/ { exit }
+             found' docs/CHANGELOG.md > release-notes.md
+          if [ ! -s release-notes.md ]; then
+            echo "::error::docs/CHANGELOG.md has no section for $version"
+            exit 1
+          fi
+
      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
+          body_path: release-notes.md
          files: |
            *.deb
            *.tar.gz
@@ -3,3 +3,5 @@
 *.pdb
 .env
 /rpmbuild
+/result
+/result-*
@@ -166,7 +166,7 @@ version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -177,7 +177,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
 "anstyle",
 "once_cell_polyfill",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -1254,7 +1254,7 @@ dependencies = [
 "libc",
 "option-ext",
 "redox_users",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -1433,7 +1433,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
 "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -1896,7 +1896,7 @@ dependencies = [
 "gobject-sys",
 "libc",
 "system-deps 9.0.0",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -3100,7 +3100,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -3474,7 +3474,7 @@ checksum = "2ee67f1008b1ba2321834326597b8e186293b049a023cdef258527550b9935b4"

 [[package]]
 name = "pdfs-cli"
-version = "3.2.0"
+version = "3.4.0"
 dependencies = [
 "anyhow",
 "clap",
@@ -3490,7 +3490,7 @@ dependencies = [

 [[package]]
 name = "pdfs-core"
-version = "3.2.0"
+version = "3.4.0"
 dependencies = [
 "async-trait",
 "base64 0.23.1",
@@ -3516,7 +3516,7 @@ dependencies = [

 [[package]]
 name = "pdfs-fuse"
-version = "3.2.0"
+version = "3.4.0"
 dependencies = [
 "async-trait",
 "base64 0.23.1",
@@ -3538,7 +3538,7 @@ dependencies = [

 [[package]]
 name = "pdfs-gui"
-version = "3.2.0"
+version = "3.4.0"
 dependencies = [
 "anyhow",
 "async-channel",
@@ -3778,9 +3778,9 @@ dependencies = [

 [[package]]
 name = "proton-drive-rs"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "014165ed0f2d3847a4b8956ca94a82ba16c82f2d5c7fa139c3541c15150dba21"
+checksum = "1e789cab811c5e73e47fd97810b78a513cb254f4dd763b4eb3cad680d6dd31da"
 dependencies = [
 "async-trait",
 "base64 0.23.1",
@@ -3805,9 +3805,9 @@ dependencies = [

 [[package]]
 name = "proton-sdk"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e16bf5592b7947708dd754defeaee7a58e9fa35988a6ea345b5b9a93765fd81"
+checksum = "ace260acbf88c26f5bd4aef8c8c9898c322163c56620bdef3b6dd7742bec7619"
 dependencies = [
 "aes-gcm 0.11.1",
 "async-trait",
@@ -3926,7 +3926,7 @@ dependencies = [
 "once_cell",
 "socket2",
 "tracing",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -4374,7 +4374,7 @@ dependencies = [
 "errno",
 "libc",
 "linux-raw-sys",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -4431,7 +4431,7 @@ dependencies = [
 "security-framework",
 "security-framework-sys",
 "webpki-root-certs",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -4764,7 +4764,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
 dependencies = [
 "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -4932,10 +4932,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
 "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
 "once_cell",
 "rustix",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -5266,7 +5266,7 @@ checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
 dependencies = [
 "memoffset",
 "tempfile",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -5590,7 +5590,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -3,7 +3,7 @@ resolver = "2"
 members = ["crates/pdfs-core", "crates/pdfs-fuse", "crates/pdfs-cli", "crates/pdfs-gui"]

 [workspace.package]
-version = "3.2.0"
+version = "3.4.0"
 edition = "2024"
 license = "MIT"
 authors = ["Nils Pukropp <contact@narl.io>"]
@@ -15,8 +15,8 @@ keywords = ["proton", "drive", "fuse", "sync", "linux"]
 categories = ["filesystem", "command-line-utilities"]

 [workspace.dependencies]
-proton-sdk = { version = "0.8.1" }
-proton-drive-rs = { version = "0.8.1" }
+proton-sdk = { version = "0.8.2" }
+proton-drive-rs = { version = "0.8.2" }

 # Internal crates.
 pdfs-core = { path = "crates/pdfs-core" }
@@ -76,6 +76,7 @@ scriptable CLI.
 | Debian, Ubuntu 24.04 or newer | `.deb` from the [latest release](https://github.com/narrrl/proton-drive-linux/releases/latest) |
 | Fedora 44 or newer | `.rpm` from the [latest release](https://github.com/narrrl/proton-drive-linux/releases/latest) |
 | Arch Linux | [`proton-drive-for-linux`](https://aur.archlinux.org/packages/proton-drive-for-linux) (also `-bin` and `-git`) in the AUR |
+| NixOS | The flake in this repository: see [Install → NixOS](docs/INSTALL.md#nixos-flake) |
 | Anything else | [Build from source](docs/INSTALL.md#build-from-source) |

 ```bash
@@ -108,6 +109,7 @@ video thumbnails), headless use and uninstalling.
 | [Configuration](docs/CONFIGURATION.md) | `config.json`, file locations, environment variables, the service |
 | [Troubleshooting](docs/TROUBLESHOOTING.md) | Diagnosing problems and fixing common ones |
 | [Recovering on a new computer](docs/RECOVERY.md) | Getting your synced folders back after a reinstall or a lost machine |
+| [Security model](docs/SECURITY_MODEL.md) | What protects your files, what stays on this computer, what the client connects to |
 | [Changelog](docs/CHANGELOG.md) | What changed in each release |

 For contributors: [development guide](docs/DEVELOPMENT.md), [architecture](docs/ARCHITECTURE.md),
@@ -4,6 +4,9 @@

 Fixes land on the latest release. Please reproduce on the most recent version before reporting.

+For what the client protects and what it does not, written for users, see the
+[security model](docs/SECURITY_MODEL.md).
+
 ## Reporting a vulnerability

 **Do not open a public issue.** Report privately through GitHub's
@@ -15,7 +15,7 @@ use pdfs_core::config::AppDirs;
 use pdfs_core::control::{
    ConflictKeep, ErrorKind, MountKind, RefreshScope, Request as CtlRequest,
    Response as CtlResponse, RestoreItem as CtlRestoreItem, ShareEntryKind, SyncIssue, SyncPhase,
-    pending_summary,
+    daemon_outdated, pending_summary,
 };
 use pdfs_core::db::Db;
 use pdfs_core::service;
@@ -172,17 +172,19 @@ enum Command {
        /// Mountpoint; defaults to ~/ProtonDrive.
        mountpoint: Option<PathBuf>,
    },
-    /// Keep a file on this device (download + cache it). Needs a running mount.
+    /// Keep a file or folder on this device (download + cache it). A folder's
+    /// files download in the background; `pdfs transfers` shows the progress.
+    /// Needs a running mount.
    Pin {
-        /// File path, inside the mountpoint or relative to it.
+        /// File or folder path, inside the mountpoint or relative to it.
        path: PathBuf,
    },
-    /// Stop keeping a file on this device, evicting its cached content.
+    /// Stop keeping a file or folder on this device, evicting its cached content.
    Unpin {
-        /// File path, inside the mountpoint or relative to it.
+        /// File or folder path, inside the mountpoint or relative to it.
        path: PathBuf,
    },
-    /// List files pinned to this device.
+    /// List files and folders pinned to this device.
    Pins,
    /// List a directory via the running daemon (in-app browser backend).
    Ls {
@@ -2024,9 +2026,13 @@ fn cmd_status() -> Result<()> {
            staged_oldest_secs,
            paused,
            paused_until,
+            session_expired,
+            tokens_unsaved,
+            version,
            ..
        }) => {
            let state = match (online, paused) {
+                _ if session_expired => ", session expired: run `pdfs login`",
                (_, true) => ", sync paused",
                (false, false) => ", offline",
                (true, false) => "",
@@ -2059,6 +2065,14 @@ fn cmd_status() -> Result<()> {
                    failing_error.as_deref().unwrap_or("no error recorded"),
                );
            }
+            if tokens_unsaved {
+                println!(
+                    "Keyring    refuses the refreshed sign-in; unlock it, or a reboot needs `pdfs login`"
+                );
+            }
+            if daemon_outdated(&version) {
+                println!("Daemon     {}", outdated_daemon_note(&version));
+            }
        }
        Ok(other) => println!("Mount: unexpected response {other:?}"),
        Err(_) => println!("Mount: not running."),
@@ -2066,6 +2080,20 @@ fn cmd_status() -> Result<()> {
    Ok(())
 }

+/// What `pdfs status` and `pdfs diagnose` say about a daemon still running
+/// an older release than this CLI.
+fn outdated_daemon_note(version: &str) -> String {
+    let running = if version.is_empty() {
+        "an older release".to_string()
+    } else {
+        version.to_string()
+    };
+    format!(
+        "still runs {running}, this is {}; run `systemctl --user restart proton-drive` to finish the update",
+        env!("CARGO_PKG_VERSION"),
+    )
+}
+
 fn cmd_locations() -> Result<()> {
    let response = control_request(CtlRequest::ListLocations)?;
    if emit_json(&response)? {
@@ -2191,6 +2219,9 @@ fn cmd_daemon(mountpoint: Option<PathBuf>) -> Result<()> {
                tracing::info!("daemon stopping");
                return Ok(());
            }
+            Ok(pdfs_fuse::MountOutcome::ResumeStored) => {
+                tracing::info!("resuming the session stored in the keyring");
+            }
            Ok(pdfs_fuse::MountOutcome::Unmounted) => {
                tracing::warn!("mount ended externally; remounting in 2s");
                pdfs_fuse::idle_sleep(std::time::Duration::from_secs(2));
@@ -2261,9 +2292,14 @@ fn mount_once(mountpoint: Option<PathBuf>) -> Result<pdfs_fuse::MountOutcome> {
        },
    );

-    // Clean unmount check (as a best-effort final backup).
-    if let Err(e) = rt.block_on(auth::persist(&session)) {
-        tracing::debug!(error = %e, "no new tokens to persist on shutdown");
+    // Last chance for a rotation the keyring refused when it happened. Only
+    // that: by now the keyring may hold a newer login, the one this stop was
+    // restarted for, and the tokens of this session would overwrite it.
+    if let Err(e) = auth::persist(&session) {
+        tracing::error!(
+            error = %e,
+            "could not save the refreshed session tokens; the next start may need `pdfs login`"
+        );
    }
    // Dropping the runtime waits for every blocking task, however long; a call
    // still stuck on Drive would hold the stop until systemd kills it (B165).
@@ -3424,11 +3460,21 @@ fn cmd_diagnose() -> Result<()> {
        Ok(CtlResponse::Status {
            mountpoint,
            online,
+            session_expired,
+            tokens_unsaved,
            pending_uploads,
            pending_changes,
+            version,
            ..
        }) => {
            report.finding(DiagnoseLevel::Ok, "  daemon responding", "");
+            if daemon_outdated(&version) {
+                report.finding(
+                    DiagnoseLevel::Warn,
+                    "  daemon version",
+                    outdated_daemon_note(&version),
+                );
+            }
            let live_type = mounted_fs_type(Path::new(&mountpoint));
            let is_fuse = live_type
                .as_deref()
@@ -3445,19 +3491,38 @@ fn cmd_diagnose() -> Result<()> {
                    |kind| format!("{mountpoint} ({kind})"),
                ),
            );
-            report.finding(
-                if online {
-                    DiagnoseLevel::Ok
-                } else {
-                    DiagnoseLevel::Warn
-                },
-                "  network",
-                if online {
-                    "online"
-                } else {
-                    "offline; cached data remains available"
-                },
-            );
+            // The keyring check above read the blob, which still holds the
+            // tokens the daemon could not replace.
+            if tokens_unsaved {
+                report.finding(
+                    DiagnoseLevel::Warn,
+                    "  session tokens",
+                    "the keyring refuses the refreshed ones; unlock it, or a reboot needs `pdfs login`",
+                );
+            }
+            // A refused session reads as offline too, but no connection will
+            // bring it back, and the keyring check above cannot tell.
+            if session_expired {
+                report.finding(
+                    DiagnoseLevel::Fail,
+                    "  session",
+                    "Proton refused it (expired or revoked) — run `pdfs login`",
+                );
+            } else {
+                report.finding(
+                    if online {
+                        DiagnoseLevel::Ok
+                    } else {
+                        DiagnoseLevel::Warn
+                    },
+                    "  network",
+                    if online {
+                        "online"
+                    } else {
+                        "offline; cached data remains available"
+                    },
+                );
+            }
            let pending = pending_uploads + pending_changes;
            report.finding(
                if pending == 0 {
@@ -3730,6 +3795,7 @@ mod login_wait_tests {
            size: 1,
            modified: 0,
            pinned: false,
+            pinned_by_folder: false,
            cached: false,
            uid: "vol~link".into(),
            path: String::new(),
@@ -21,6 +21,9 @@
 //! such separation to protect and are stored, as they always were.

 use std::collections::BTreeMap;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::time::Duration;

 use base64::Engine as _;
 use base64::engine::general_purpose::STANDARD as BASE64;
@@ -31,6 +34,7 @@ use proton_sdk::api::{HumanVerification, HumanVerificationCredential};
 use proton_sdk::cache::EncryptedCacheRepository;
 use proton_sdk::config::ProtonClientConfiguration;
 use proton_sdk::error::ProtonError;
+use proton_sdk::http::Tokens;
 use proton_sdk::session::{PasswordMode, ProtonApiSession, ResumeParameters};
 use proton_sdk::telemetry::TracingTelemetry;
 use serde::{Deserialize, Serialize};
@@ -307,8 +311,8 @@ pub async fn login_verified(
        }
    };

-    register_refresh_handler(&session);
    let tokens = session.current_tokens().await;
+    register_refresh_handler(&session, tokens.refresh_token.clone());
    let stored = StoredSession {
        session_id: session.session_id().as_str().to_owned(),
        username: session.username().to_owned(),
@@ -360,11 +364,11 @@ fn keep_passphrases(
    let outcome = if remember {
        stored.key_passphrases = Some(encode(passphrases));
        // Best-effort: a system without a kernel keyring has nothing to clear.
-        let _ = kernelkey::clear();
+        let _ = kernelkey::PASSPHRASES.clear();
        Ok(())
    } else {
        stored.key_passphrases = None;
-        kernelkey::store(&encode_secret(passphrases)).map_err(|e| {
+        kernelkey::PASSPHRASES.store(&encode_secret(passphrases)).map_err(|e| {
            Error::Other(format!(
                "the kernel keyring is unavailable, so the unlock cannot be kept for this session: {e}"
            ))
@@ -465,7 +469,7 @@ fn find_passphrases(stored: &StoredSession) -> Result<Option<(KeyPassphrases, Ke
    if let Some(found) = stored.key_passphrases.as_ref().and_then(decode) {
        return Ok(Some((found, KeyState::Stored)));
    }
-    match kernelkey::load() {
+    match kernelkey::PASSPHRASES.load() {
        Ok(Some(secret)) => Ok(decode_secret(&secret).map(|p| (p, KeyState::Session))),
        Ok(None) => Ok(None),
        // No keyring on this system: nothing was ever kept there.
@@ -491,17 +495,18 @@ pub async fn unlock(mailbox: &str, remember: bool) -> Result<()> {
        return Err(Error::ReloginRequired);
    }
    let mailbox = Zeroizing::new(mailbox.to_owned());
-    let session = ProtonApiSession::resume(client_config(), stored.to_params())?;
-    register_refresh_handler(&session);
+    let session = resume_stored(&stored)?;
    let passphrases =
        derive_verified(&session, mailbox.as_bytes(), stored.key_salts.clone()).await?;
-    keep_passphrases(stored, &passphrases, remember)
+    // Read again: verifying may have rotated the tokens, and the copy read
+    // above would put the spent refresh token back.
+    keep_passphrases(load()?, &passphrases, remember)
 }

 /// Drop the passphrases held in kernel memory, so the account is locked again
 /// until [`unlock`]. With `forget`, also those in the keyring blob.
 pub fn lock(forget: bool) -> Result<()> {
-    kernelkey::clear()?;
+    kernelkey::PASSPHRASES.clear()?;
    if forget {
        let mut stored = load()?;
        if stored.key_passphrases.take().is_some() {
@@ -529,9 +534,10 @@ pub fn logout() -> Result<()> {
            let _ = std::fs::remove_file(format!("{}{suffix}", path.display()));
        }
    }
-    if let Err(e) = kernelkey::clear() {
+    if let Err(e) = kernelkey::PASSPHRASES.clear() {
        tracing::warn!(error = %e, "clearing the kernel-keyring unlock on logout failed");
    }
+    let _ = kernelkey::UNSAVED_TOKENS.clear();
    match keyring_entry()?.delete_credential() {
        Ok(()) | Err(keyring_core::Error::NoEntry) => Ok(()),
        Err(e) => Err(e.into()),
@@ -551,8 +557,7 @@ pub fn logout() -> Result<()> {
 /// a daemon starting offline can still mount from its cache.
 pub async fn resume_client() -> Result<(ProtonDriveClient, ProtonApiSession)> {
    let stored = load()?;
-    let session = ProtonApiSession::resume(client_config(), stored.to_params())?;
-    register_refresh_handler(&session);
+    let session = resume_stored(&stored)?;

    let passphrases = match find_passphrases(&stored)? {
        Some((passphrases, _)) => passphrases,
@@ -567,6 +572,48 @@ pub async fn resume_client() -> Result<(ProtonDriveClient, ProtonApiSession)> {
    Ok((client, session))
 }

+/// Resume `stored`, with the rotation the keyring refused last time put in
+/// first, if there is one: Proton has spent the stored refresh token then,
+/// and the kernel keyring holds the one that replaced it (B61).
+fn resume_stored(stored: &StoredSession) -> Result<ProtonApiSession> {
+    let unsaved = recover_unsaved(stored);
+    let mut resumed = stored.clone();
+    if let Some(tokens) = &unsaved {
+        tracing::info!("resuming with session tokens the keyring refused last time");
+        resumed.access_token = tokens.access_token.clone();
+        resumed.refresh_token = tokens.refresh_token.clone();
+    }
+    let session = ProtonApiSession::resume(client_config(), resumed.to_params())?;
+    let sink = register_refresh_handler(&session, stored.refresh_token.clone());
+    if let Some(tokens) = unsaved {
+        let _ = sink.rotated(tokens);
+    }
+    Ok(session)
+}
+
+/// The rotation the kernel keyring holds for `stored`, if it belongs there.
+/// One that does not is from an older login, or was written since, and is
+/// dropped.
+fn recover_unsaved(stored: &StoredSession) -> Option<Tokens> {
+    let kept = match kernelkey::UNSAVED_TOKENS.load() {
+        Ok(kept) => kept?,
+        Err(e) => {
+            tracing::debug!(error = %e, "kernel keyring unavailable; no unsaved tokens to recover");
+            return None;
+        }
+    };
+    match serde_json::from_slice::<UnsavedRotation>(&kept) {
+        Ok(unsaved) if unsaved.belongs_in(stored) => Some(Tokens {
+            access_token: unsaved.access_token,
+            refresh_token: unsaved.refresh_token,
+        }),
+        _ => {
+            let _ = kernelkey::UNSAVED_TOKENS.clear();
+            None
+        }
+    }
+}
+
 /// Turn a blob written by 3.0.x — which holds the mailbox password — into one
 /// that holds passphrases, so the password stops being stored.
 ///
@@ -597,11 +644,14 @@ async fn migrate_legacy(
        stored.key_salts.clone()
    };

-    let mut migrated = stored.clone();
+    let verified = derive_verified(session, legacy.as_bytes(), key_salts.clone()).await;
+    // Read again: the calls above may have rotated the tokens, and `stored`
+    // would put the spent refresh token back.
+    let mut migrated = load()?;
    migrated.mailbox_password = String::new();
-    migrated.key_salts = key_salts.clone();
+    migrated.key_salts = key_salts;

-    match derive_verified(session, legacy.as_bytes(), key_salts).await {
+    match verified {
        Ok(passphrases) => {
            migrated.key_passphrases = Some(encode(&passphrases));
            write_stored(&migrated)?;
@@ -659,39 +709,309 @@ fn tune(client: ProtonDriveClient, passphrases: &KeyPassphrases) -> ProtonDriveC
    }
 }

-/// Write the session's current tokens back to the keyring.
+/// Write any rotation of the session's tokens that has not reached the keyring
+/// yet. A best-effort last chance before the process exits.
 ///
-/// Everything else in the stored blob — salts, passphrases — is preserved, so
-/// this never undoes an [`unlock`] or [`lock`] made since the session started.
-/// Call whenever the session may have rotated its tokens so a later
-/// [`resume_client`] presents a live refresh token.
-pub async fn persist(session: &ProtonApiSession) -> Result<()> {
-    let tokens = session.current_tokens().await;
-    store_tokens(tokens.access_token, tokens.refresh_token)
+/// Rotations are written as they happen (see [`register_refresh_handler`]), so
+/// this usually has nothing to do. It never writes the session's current
+/// tokens for their own sake: the blob may by now belong to a newer login, or
+/// hold a newer rotation, and writing them would put a spent refresh token
+/// over a live one.
+pub fn persist(session: &ProtonApiSession) -> Result<()> {
+    let sink = TOKEN_SINKS
+        .lock()
+        .get(session.session_id().as_str())
+        .cloned();
+    match sink {
+        Some(sink) => sink.flush(),
+        None => Ok(()),
+    }
 }

-fn store_tokens(access_token: String, refresh_token: String) -> Result<()> {
-    let mut stored = load()?;
-    stored.access_token = access_token;
-    stored.refresh_token = refresh_token;
-    write_stored(&stored)
+/// Whether the keyring holds a session newer than any this process runs on:
+/// another login, or one of this process's sessions rotated by another
+/// process (`pdfs unlock` resumes the same login and may refresh it).
+///
+/// The refresh token this process holds is spent then, and Proton refuses it
+/// as if the session were gone. A daemon asks this before it reports the
+/// session expired, and resumes the stored one instead.
+pub fn stored_session_is_newer() -> bool {
+    // Nothing to compare with, and no keyring to wake up for it.
+    if TOKEN_SINKS.lock().is_empty() {
+        return false;
+    }
+    let Ok(stored) = load() else {
+        return false;
+    };
+    let sinks = TOKEN_SINKS.lock();
+    match sinks.get(&stored.session_id) {
+        Some(sink) => sink.state.lock().stored_refresh != stored.refresh_token,
+        None => !sinks.is_empty(),
+    }
+}
+
+/// Whether a session in this process holds refreshed tokens the keyring has
+/// not taken yet. They are retried and kept in the kernel keyring meanwhile,
+/// which a reboot clears, so the user is asked to unlock the keyring (B61).
+pub fn tokens_unsaved() -> bool {
+    TOKEN_SINKS
+        .lock()
+        .values()
+        .any(|sink| sink.state.lock().unsaved.is_some())
+}
+
+/// Where each live session in this process writes its rotated tokens, by
+/// session id, for [`persist`] to find.
+static TOKEN_SINKS: parking_lot::Mutex<BTreeMap<String, Arc<TokenSink>>> =
+    parking_lot::Mutex::new(BTreeMap::new());
+
+/// One session's rotated tokens on their way to the keyring.
+///
+/// Proton refresh tokens are single-use, so a rotation has to reach the
+/// keyring, and it must reach only the blob it belongs to. That is the blob of
+/// this session id that still holds the refresh token this session last knew
+/// it to hold. Anything else means the blob moved on without this session: a
+/// new login, or another session on the same login (`pdfs unlock`) that
+/// rotated first. Writing into it would replace a live refresh token with a
+/// spent one, and the next start fails with `InvalidRefreshToken` (issue #35).
+struct TokenSink {
+    session_id: String,
+    state: parking_lot::Mutex<SinkState>,
+    /// Whether a thread is retrying a write the keyring refused.
+    retrying: AtomicBool,
+}
+
+/// How long to wait before each new try at a write the keyring refused; the
+/// last delay repeats until it succeeds. A locked or restarting keyring
+/// usually comes back within seconds, and one that does not must not be asked
+/// in a tight loop.
+const KEYRING_RETRY: [Duration; 4] = [
+    Duration::from_secs(1),
+    Duration::from_secs(5),
+    Duration::from_secs(30),
+    Duration::from_secs(300),
+];
+
+struct SinkState {
+    /// The refresh token the blob holds for this session, as far as this
+    /// session knows: the one it started from, or the last one it wrote.
+    stored_refresh: String,
+    /// The latest rotation, until the keyring has taken it.
+    unsaved: Option<Tokens>,
+    /// Whether `unsaved` is also in [`kernelkey::UNSAVED_TOKENS`].
+    kept: bool,
+}
+
+/// A rotation the keyring refused, as kept in the kernel keyring until it is
+/// written: the tokens, and the blob they go into.
+#[derive(Serialize, Deserialize)]
+struct UnsavedRotation {
+    session_id: String,
+    /// The refresh token this rotation spent, which the blob still holds.
+    spent: String,
+    access_token: String,
+    refresh_token: String,
+}
+
+impl UnsavedRotation {
+    /// Whether `stored` is the blob this rotation was refused for, still
+    /// holding the refresh token it spent.
+    fn belongs_in(&self, stored: &StoredSession) -> bool {
+        self.session_id == stored.session_id && self.spent == stored.refresh_token
+    }
+}
+
+/// What became of a rotation offered to a stored blob.
+#[derive(Debug, PartialEq, Eq)]
+enum Rotation {
+    /// The blob is this session's and took the tokens.
+    Taken,
+    /// The blob moved on without this session; it is left alone.
+    MovedOn,
+}
+
+/// Put `tokens` into `stored` if it is still this session's blob: the same
+/// session id, holding the refresh token this session last left in it, or
+/// already holding this very rotation (another process wrote it first).
+fn take_rotation(
+    stored: &mut StoredSession,
+    session_id: &str,
+    stored_refresh: &str,
+    tokens: &Tokens,
+) -> Rotation {
+    if stored.session_id != session_id
+        || (stored.refresh_token != stored_refresh && stored.refresh_token != tokens.refresh_token)
+    {
+        return Rotation::MovedOn;
+    }
+    stored.access_token = tokens.access_token.clone();
+    stored.refresh_token = tokens.refresh_token.clone();
+    Rotation::Taken
+}
+
+impl TokenSink {
+    fn new(session_id: &str, stored_refresh: String) -> Self {
+        Self {
+            session_id: session_id.to_owned(),
+            state: parking_lot::Mutex::new(SinkState {
+                stored_refresh,
+                unsaved: None,
+                kept: false,
+            }),
+            retrying: AtomicBool::new(false),
+        }
+    }
+
+    /// Take a new rotation and try to write it. If the keyring refuses, keep
+    /// trying in the background: until then the only live refresh token is in
+    /// memory, and a stop that cannot write it either loses the session
+    /// (`docs/BUGS.md` B61).
+    fn rotated(self: &Arc<Self>, tokens: Tokens) -> Result<()> {
+        self.state.lock().unsaved = Some(tokens);
+        let written = self.flush();
+        if let Err(e) = &written {
+            tracing::error!(
+                error = %e,
+                "the keyring refused the refreshed session tokens; retrying"
+            );
+            self.keep_in_kernel();
+            self.retry_in_background();
+        }
+        written
+    }
+
+    /// Keep the unsaved rotation in the kernel keyring too, so a process that
+    /// dies before the retry lands does not take the only live refresh token
+    /// with it. The next resume puts it back (see [`resume_stored`]).
+    fn keep_in_kernel(&self) {
+        let mut state = self.state.lock();
+        let Some(tokens) = &state.unsaved else {
+            return;
+        };
+        let unsaved = UnsavedRotation {
+            session_id: self.session_id.clone(),
+            spent: state.stored_refresh.clone(),
+            access_token: tokens.access_token.clone(),
+            refresh_token: tokens.refresh_token.clone(),
+        };
+        let Ok(json) = serde_json::to_vec(&unsaved).map(Zeroizing::new) else {
+            return;
+        };
+        match kernelkey::UNSAVED_TOKENS.store(&json) {
+            Ok(()) => state.kept = true,
+            Err(e) => tracing::error!(
+                error = %e,
+                "the kernel keyring refused them too; if this process stops first, \
+                 the next start needs `pdfs login`"
+            ),
+        }
+    }
+
+    /// Retry the unsaved rotation on [`KEYRING_RETRY`] until it is written or
+    /// has nowhere left to go. One thread per sink; a newer rotation simply
+    /// replaces what it is retrying.
+    fn retry_in_background(self: &Arc<Self>) {
+        if self.retrying.swap(true, Ordering::SeqCst) {
+            return;
+        }
+        let sink = Arc::clone(self);
+        let spawned = std::thread::Builder::new()
+            .name("pdfs-keyring-retry".into())
+            .spawn(move || {
+                loop {
+                    let delays = KEYRING_RETRY
+                        .into_iter()
+                        .chain(std::iter::repeat(KEYRING_RETRY[KEYRING_RETRY.len() - 1]));
+                    for delay in delays {
+                        std::thread::sleep(delay);
+                        match sink.flush() {
+                            Ok(()) => break,
+                            Err(e) => tracing::debug!(error = %e, ?delay, "keyring still refuses"),
+                        }
+                    }
+                    sink.retrying.store(false, Ordering::SeqCst);
+                    // A rotation refused after the last try succeeded found
+                    // this thread still running, and started none of its own.
+                    if sink.state.lock().unsaved.is_none()
+                        || sink.retrying.swap(true, Ordering::SeqCst)
+                    {
+                        return;
+                    }
+                }
+            });
+        if let Err(e) = spawned {
+            self.retrying.store(false, Ordering::SeqCst);
+            tracing::error!(error = %e, "could not start retrying the keyring write");
+        }
+    }
+
+    /// Write the unsaved rotation, if there is one. A blob that moved on, or
+    /// is gone with a logout, drops it: there is nothing it may still go into.
+    fn flush(&self) -> Result<()> {
+        let mut state = self.state.lock();
+        let Some(tokens) = state.unsaved.clone() else {
+            return Ok(());
+        };
+        let mut stored = match load() {
+            Ok(stored) => stored,
+            Err(Error::NotLoggedIn) => {
+                state.settle();
+                return Ok(());
+            }
+            Err(e) => return Err(e),
+        };
+        match take_rotation(
+            &mut stored,
+            &self.session_id,
+            &state.stored_refresh,
+            &tokens,
+        ) {
+            Rotation::Taken => {
+                write_stored(&stored)?;
+                state.stored_refresh = tokens.refresh_token;
+                tracing::info!("successfully auto-persisted refreshed tokens in keyring");
+            }
+            Rotation::MovedOn => {
+                tracing::info!(
+                    "the stored session has moved on; not writing this session's tokens over it"
+                );
+            }
+        }
+        state.settle();
+        Ok(())
+    }
+}
+
+impl SinkState {
+    /// The unsaved rotation has gone where it can: drop it, and its copy in
+    /// the kernel keyring.
+    fn settle(&mut self) {
+        self.unsaved = None;
+        if std::mem::take(&mut self.kept) {
+            let _ = kernelkey::UNSAVED_TOKENS.clear();
+        }
+    }
 }

 /// Persist rotated tokens the moment the session obtains them.
 ///
-/// The handler re-reads the stored blob instead of capturing one, so it cannot
-/// write back a stale copy over a later unlock or lock — and cannot resurrect a
-/// session that was logged out while the daemon still ran.
-fn register_refresh_handler(session: &ProtonApiSession) {
+/// `stored_refresh` is the refresh token the keyring holds for this session
+/// now. The handler re-reads the stored blob instead of capturing one, so it
+/// cannot write back a stale copy over a later unlock or lock, and it writes
+/// only into a blob that is still this session's (see [`TokenSink`]), so it
+/// cannot resurrect a logged-out session or overwrite a newer login.
+fn register_refresh_handler(session: &ProtonApiSession, stored_refresh: String) -> Arc<TokenSink> {
+    let session_id = session.session_id().as_str();
+    let sink = Arc::new(TokenSink::new(session_id, stored_refresh));
+    TOKEN_SINKS
+        .lock()
+        .insert(session_id.to_owned(), Arc::clone(&sink));
+    let handler = Arc::clone(&sink);
    session.http().set_on_tokens_refreshed(move |tokens| {
-        match store_tokens(tokens.access_token, tokens.refresh_token) {
-            Ok(()) => tracing::info!("successfully auto-persisted refreshed tokens in keyring"),
-            Err(Error::NotLoggedIn) => {}
-            Err(e) => {
-                tracing::warn!(error = %e, "failed to auto-persist refreshed tokens in keyring")
-            }
-        }
+        // A refusal is logged and retried by the sink itself.
+        let _ = handler.rotated(tokens);
    });
+    sink
 }

 #[cfg(test)]
@@ -786,4 +1106,168 @@ mod tests {
        assert_eq!(origin, KeyState::Stored);
        assert_eq!(found, passphrases());
    }
+
+    fn tokens(access: &str, refresh: &str) -> Tokens {
+        Tokens {
+            access_token: access.into(),
+            refresh_token: refresh.into(),
+        }
+    }
+
+    #[test]
+    fn own_session_tokens_are_written() {
+        let mut stored: StoredSession = serde_json::from_str(&blob("")).unwrap();
+        assert_eq!(
+            take_rotation(&mut stored, "s", "r", &tokens("a2", "r2")),
+            Rotation::Taken
+        );
+        assert_eq!(stored.access_token, "a2");
+        assert_eq!(stored.refresh_token, "r2");
+    }
+
+    /// Issue #35: `pdfs login` stores a new session and restarts the daemon,
+    /// and the old daemon's stop wrote its spent tokens into the new blob.
+    #[test]
+    fn tokens_of_another_session_are_not_written() {
+        let mut stored: StoredSession = serde_json::from_str(&blob("")).unwrap();
+        assert_eq!(
+            take_rotation(&mut stored, "old", "r", &tokens("a2", "r2")),
+            Rotation::MovedOn
+        );
+        assert_eq!(stored.refresh_token, "r");
+    }
+
+    /// `pdfs unlock` resumes a second session on the same login. Once it has
+    /// rotated, the daemon's copy of the refresh token is spent.
+    #[test]
+    fn tokens_are_not_written_over_a_newer_rotation_of_the_same_session() {
+        let mut stored: StoredSession = serde_json::from_str(&blob("")).unwrap();
+        assert_eq!(
+            take_rotation(&mut stored, "s", "spent", &tokens("a2", "r2")),
+            Rotation::MovedOn
+        );
+        assert_eq!(stored.refresh_token, "r");
+    }
+
+    /// `pdfs unlock` wrote this very rotation first, from the same session.
+    #[test]
+    fn a_rotation_already_in_the_blob_is_taken() {
+        let mut stored = stored_with("r2");
+        assert_eq!(
+            take_rotation(&mut stored, "s", "r", &tokens("a2", "r2")),
+            Rotation::Taken
+        );
+    }
+
+    /// The keyring is one store per process, so the tests that use it,
+    /// through `keyring-core`'s in-memory store, take turns.
+    fn mock_keyring() -> parking_lot::MutexGuard<'static, ()> {
+        static KEYRING: parking_lot::Mutex<()> = parking_lot::Mutex::new(());
+        let turn = KEYRING.lock();
+        keyring_core::set_default_store(keyring_core::mock::Store::new().unwrap());
+        turn
+    }
+
+    fn stored_with(refresh: &str) -> StoredSession {
+        serde_json::from_str(&blob("").replace(r#""r""#, &format!("{refresh:?}"))).unwrap()
+    }
+
+    #[test]
+    fn a_sink_keeps_writing_its_own_rotations_and_stops_at_a_new_login() {
+        let _turn = mock_keyring();
+        write_stored(&stored_with("r")).unwrap();
+
+        let sink = Arc::new(TokenSink::new("s", "r".into()));
+        sink.rotated(tokens("a2", "r2")).unwrap();
+        sink.rotated(tokens("a3", "r3")).unwrap();
+        assert_eq!(load().unwrap().refresh_token, "r3");
+
+        // A new login replaces the blob; the old session's next rotation, and
+        // its stop, leave it alone.
+        let mut login = stored_with("fresh");
+        login.session_id = "new".into();
+        write_stored(&login).unwrap();
+        sink.rotated(tokens("a4", "r4")).unwrap();
+        sink.flush().unwrap();
+        let now = load().unwrap();
+        assert_eq!(now.session_id, "new");
+        assert_eq!(now.refresh_token, "fresh");
+    }
+
+    /// `pdfs unlock` rotated the daemon's session behind its back: the
+    /// daemon's refresh token is spent, and the keyring holds the live one.
+    #[test]
+    fn a_session_rotated_by_another_process_is_newer_in_the_keyring() {
+        let _turn = mock_keyring();
+        write_stored(&stored_with("r")).unwrap();
+        TOKEN_SINKS
+            .lock()
+            .insert("s".into(), Arc::new(TokenSink::new("s", "r".into())));
+        assert!(!stored_session_is_newer());
+
+        write_stored(&stored_with("r2")).unwrap();
+        assert!(stored_session_is_newer());
+
+        let mut login = stored_with("fresh");
+        login.session_id = "new".into();
+        write_stored(&login).unwrap();
+        assert!(stored_session_is_newer());
+        TOKEN_SINKS.lock().remove("s");
+    }
+
+    /// B61: a rotation the keyring refused lived only in memory.
+    #[test]
+    fn a_rotation_the_keyring_refused_is_written_once_it_takes_it() {
+        let _turn = mock_keyring();
+        write_stored(&stored_with("r")).unwrap();
+        let sink = Arc::new(TokenSink::new("s", "r".into()));
+
+        let entry = keyring_entry().unwrap();
+        let cred = entry
+            .as_any()
+            .downcast_ref::<keyring_core::mock::Cred>()
+            .unwrap();
+        cred.set_error(keyring_core::Error::NoStorageAccess(
+            std::io::Error::other("locked").into(),
+        ));
+        assert!(sink.rotated(tokens("a2", "r2")).is_err());
+        // Until it is written, a stop does not lose it: the next resume finds
+        // it in the kernel keyring, where one is offered.
+        let kept = sink.state.lock().kept;
+        if kept {
+            assert_eq!(
+                recover_unsaved(&stored_with("r")).unwrap().refresh_token,
+                "r2"
+            );
+        }
+
+        let deadline = std::time::Instant::now() + Duration::from_secs(5);
+        while load().unwrap().refresh_token != "r2" {
+            assert!(
+                std::time::Instant::now() < deadline,
+                "the retry never wrote the rotation"
+            );
+            std::thread::sleep(Duration::from_millis(50));
+        }
+        assert!(sink.state.lock().unsaved.is_none());
+        if kept {
+            assert!(kernelkey::UNSAVED_TOKENS.load().unwrap().is_none());
+        }
+    }
+
+    #[test]
+    fn an_unsaved_rotation_goes_only_into_the_blob_it_was_refused_for() {
+        let unsaved = UnsavedRotation {
+            session_id: "s".into(),
+            spent: "r".into(),
+            access_token: "a2".into(),
+            refresh_token: "r2".into(),
+        };
+        assert!(unsaved.belongs_in(&stored_with("r")));
+        // Written since, by a retry or another process.
+        assert!(!unsaved.belongs_in(&stored_with("r2")));
+        let mut login = stored_with("r");
+        login.session_id = "new".into();
+        assert!(!unsaved.belongs_in(&login));
+    }
 }
@@ -1260,8 +1260,15 @@ pub struct DirEntry {
    pub size: u64,
    /// Modification time, epoch seconds.
    pub modified: i64,
-    /// Whether the file is pinned to this device.
+    /// Whether the node is pinned to this device, on its own or through a
+    /// pinned folder above it.
    pub pinned: bool,
+    /// Whether the node is kept on this device because a folder above it is
+    /// pinned. Such a node cannot be unpinned on its own. Set in
+    /// [`Request::ListDir`] listings only. Defaulted for wire-compat with
+    /// daemons predating the field.
+    #[serde(default)]
+    pub pinned_by_folder: bool,
    /// Whether the file's full content is present in the local cache (a current,
    /// non-stale blob). Always false for folders. Defaulted for wire-compat with
    /// clients/daemons predating the field.
@@ -1850,6 +1857,27 @@ pub fn pending_summary(uploads: u64, changes: u64) -> Option<String> {
    }
 }

+/// Whether the daemon that reported `version` in a [`Response::Status`] is an
+/// older release than this build. Installing a package replaces the binaries
+/// but leaves the running user service on the old one, which keeps its bugs
+/// until it restarts, while the app and the CLI already describe the new
+/// release (#33). Empty means a daemon from before the field, so older too.
+///
+/// Only older counts. A newer daemon means this front-end is the one still
+/// running from before the upgrade, and restarting the service would not help.
+pub fn daemon_outdated(version: &str) -> bool {
+    fn parse(v: &str) -> Option<(u64, u64, u64)> {
+        let mut parts = v.split('.').map(|p| p.parse().ok());
+        let parsed = (parts.next()??, parts.next()??, parts.next()??);
+        parts.next().is_none().then_some(parsed)
+    }
+    match (parse(version), parse(env!("CARGO_PKG_VERSION"))) {
+        (Some(running), Some(this)) => running < this,
+        (None, _) => version.is_empty(),
+        (Some(_), None) => false,
+    }
+}
+
 /// One worker thread in a [`Diagnostics`] report.
 #[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct WorkerState {
@@ -1959,6 +1987,21 @@ pub enum Response {
        /// resumed, or not paused.
        #[serde(default)]
        paused_until: Option<i64>,
+        /// True when Proton refused the session itself (refresh token refused,
+        /// account deleted or disabled). `online` is false then too, but no
+        /// connection brings it back: only signing in again does.
+        #[serde(default)]
+        session_expired: bool,
+        /// True while the keyring refuses the session's refreshed tokens. The
+        /// daemon keeps retrying; until it succeeds, a reboot signs the user
+        /// out.
+        #[serde(default)]
+        tokens_unsaved: bool,
+        /// The release of the daemon that answered. A package upgrade does not
+        /// restart the user service, so it can be older than the front-end
+        /// asking; daemons before 3.3.0 omit it, which reads as empty.
+        #[serde(default)]
+        version: String,
    },
    /// A human-readable success message.
    Ok { message: String },
@@ -2602,6 +2645,27 @@ mod tests {
        );
    }

+    /// #33: a daemon left running over an upgrade is named as older, also when
+    /// it predates the version field, but a newer one is not, since restarting
+    /// the service cannot bring it closer to this build.
+    #[test]
+    fn only_an_older_daemon_is_outdated() {
+        assert!(!daemon_outdated(env!("CARGO_PKG_VERSION")));
+        assert!(daemon_outdated(""));
+        assert!(daemon_outdated("0.9.9"));
+        assert!(!daemon_outdated("999.0.0"));
+        assert!(!daemon_outdated("not-a-version"));
+        let old: Response = serde_json::from_str(
+            r#"{"Status":{"username":"u","mountpoint":"/m","pinned":0,
+                "used":0,"budget":0,"pins":[]}}"#,
+        )
+        .unwrap();
+        let Response::Status { version, .. } = old else {
+            panic!("not a status: {old:?}");
+        };
+        assert!(daemon_outdated(&version));
+    }
+
    /// The mutation requests must survive a line-delimited JSON round-trip, since
    /// that is exactly how they cross the control socket.
    #[test]
@@ -252,6 +252,25 @@ const UID_NOW: &str = "COALESCE((SELECT uid FROM nodes WHERE lid = pending_op.li
 const PARENT_NOW: &str =
    "COALESCE((SELECT uid FROM nodes WHERE lid = pending_op.parent_lid), parent_uid)";

+/// The `WHERE` terms for a row a drain worker may claim once it falls due: not
+/// claimed already, no other claimed op on the same node, and not under a
+/// folder that has yet to land.
+///
+/// One fragment for [`Db::claim_next_due_op`] and [`Db::earliest_due_at`]. A
+/// row the claim skips but the wait counts is due "now" for as long as it is
+/// held, and every idle worker spun on it (`docs/BUGS.md` B200).
+fn claimable() -> String {
+    format!(
+        "claimed_at = 0
+         AND (parent_uid IS NULL OR substr({PARENT_NOW}, 1, {n}) <> '{v}~')
+         AND uid NOT IN (SELECT uid FROM pending_op WHERE claimed_at <> 0)
+         AND (lid IS NULL OR lid NOT IN (
+           SELECT lid FROM pending_op WHERE claimed_at <> 0 AND lid IS NOT NULL))",
+        v = LOCAL_VOLUME,
+        n = LOCAL_VOLUME.len() + 1,
+    )
+}
+
 /// The volume id given to a node that exists only on this machine, so far. A
 /// real [`NodeUid`] is `{volume}~{link}`, so a placeholder is `local~<lid>` and
 /// round-trips through the same `Display`/parse path as any other uid.
@@ -1127,15 +1146,9 @@ impl Db {
                "SELECT id, kind, {UID_NOW}, {PARENT_NOW}, name, blob_path, meta_json, created_at,
                        attempts, last_error, next_attempt_at
                 FROM pending_op
-                 WHERE next_attempt_at <= ?1
-                   AND claimed_at = 0
-                   AND (parent_uid IS NULL OR substr({PARENT_NOW}, 1, {n}) <> '{v}~')
-                   AND uid NOT IN (SELECT uid FROM pending_op WHERE claimed_at <> 0)
-                   AND (lid IS NULL OR lid NOT IN (
-                     SELECT lid FROM pending_op WHERE claimed_at <> 0 AND lid IS NOT NULL))
+                 WHERE next_attempt_at <= ?1 AND {claimable}
                 ORDER BY id LIMIT 1",
-                v = LOCAL_VOLUME,
-                n = LOCAL_VOLUME.len() + 1,
+                claimable = claimable(),
            ))?;
            stmt.query_row(params![now], |r| {
                Ok(PendingOp {
@@ -1208,19 +1221,17 @@ impl Db {
    /// debounced or backed-off op becomes eligible rather than waiting the full
    /// idle-poll interval.
    ///
-    /// Claimed ops are excluded: another worker is already on them, so they are
-    /// not work this one is waiting for, and counting them would have an idle
-    /// worker spin on a row it cannot have.
+    /// Only rows [`claim_next_due_op`](Self::claim_next_due_op) could take
+    /// count. A claimed op, or one held behind a claimed op on the same node,
+    /// is not work this worker is waiting for, and counting it would have an
+    /// idle worker spin on a row it cannot have.
    pub fn earliest_due_at(&self) -> Result<Option<i64>> {
        let conn = self.read();
        let ts: Option<i64> = conn
            .query_row(
                &format!(
-                    "SELECT MIN(next_attempt_at) FROM pending_op \
-                     WHERE claimed_at = 0 \
-                       AND (parent_uid IS NULL OR substr({PARENT_NOW}, 1, {n}) <> '{v}~')",
-                    v = LOCAL_VOLUME,
-                    n = LOCAL_VOLUME.len() + 1,
+                    "SELECT MIN(next_attempt_at) FROM pending_op WHERE {claimable}",
+                    claimable = claimable(),
                ),
                [],
                |r| r.get(0),
@@ -1689,9 +1689,16 @@ fn writing_nodes_does_not_scale_with_the_size_of_the_index() {
            .collect();
        db.upsert_nodes(&batch).unwrap();

-        let t = Instant::now();
-        db.upsert_nodes(&batch).unwrap();
-        t.elapsed()
+        // The fastest of a few runs: the rest of the suite runs alongside, and
+        // one run that lost the CPU to it read as the regression.
+        (0..5)
+            .map(|_| {
+                let t = Instant::now();
+                db.upsert_nodes(&batch).unwrap();
+                t.elapsed()
+            })
+            .min()
+            .unwrap()
    }

    let small = cost_against_index_of(200);
@@ -6547,6 +6554,36 @@ fn an_idle_worker_does_not_wait_on_an_op_another_worker_has() {
    );
 }

+/// B200: a rename queued behind a long upload of the same node is due, but no
+/// worker may claim it until the upload retires. Counted as due, it had every
+/// idle worker wake at once, find nothing, and go round again.
+#[test]
+fn earliest_due_at_skips_an_op_held_behind_a_claimed_one() {
+    let db = Db::open_in_memory().unwrap();
+    let root = uid("root").to_string();
+    let mut revision = bulk_op(0, &root);
+    revision.parent_uid = None;
+    db.enqueue_op(&revision).unwrap();
+    db.enqueue_op(&PendingOp {
+        kind: OP_RENAME.to_string(),
+        parent_uid: Some(root.clone()),
+        blob_path: None,
+        meta_json: None,
+        ..bulk_op(0, &root)
+    })
+    .unwrap();
+
+    db.claim_next_due_op(10)
+        .unwrap()
+        .expect("the revision is due");
+    assert!(db.claim_next_due_op(10).unwrap().is_none());
+    assert_eq!(
+        db.earliest_due_at().unwrap(),
+        None,
+        "a row no worker can claim is not work an idle worker is waiting for"
+    );
+}
+
 /// Trashing a photo from the gallery must not leave it behind on an album page:
 /// the row goes, its album membership goes with it, and nothing else moves.
 #[test]
@@ -154,17 +154,17 @@ impl CoreError {
    /// through the boxes the drain deals in, where the concrete type survives
    /// but the static one does not.
    ///
-    /// A failure that is not an API response at all — a transport error, a
-    /// timeout, a TLS failure — is what being offline looks like from here, so
-    /// it classifies as [`ErrorKind::Offline`] rather than
-    /// [`ErrorKind::Remote`]: the request never reached Proton, and telling the
-    /// user their connection is down beats telling them the server refused.
+    /// A transport error, a timeout or a TLS failure is what being offline
+    /// looks like from here, so it classifies as [`ErrorKind::Offline`] rather
+    /// than [`ErrorKind::Remote`]: the request never reached Proton, and
+    /// telling the user their connection is down beats telling them the
+    /// server refused. The SDK's other failures say what went wrong instead
+    /// (see [`proton_kind`]).
    pub fn from_api(e: &(dyn std::error::Error + 'static), what: &str) -> Self {
        let kind = match e.downcast_ref::<proton_sdk::ProtonError>() {
-            Some(proton_sdk::ProtonError::Api(api)) => api_kind(api.code),
-            // A `ProtonError` that is not an `Api` variant never reached the
-            // API; so does anything that is not a `ProtonError` at all.
-            _ => ErrorKind::Offline,
+            Some(proton) => proton_kind(proton),
+            // Not the SDK's at all: a timeout around the call, or the socket.
+            None => ErrorKind::Offline,
        };
        Self::new(kind, format!("{what}: {e}"))
    }
@@ -214,15 +214,33 @@ impl From<Error> for CoreError {
            | Error::Locked
            | Error::WrongMailboxPassword
            | Error::HumanVerificationRequired(_) => ErrorKind::Denied,
-            Error::Proton(proton_sdk::ProtonError::Api(api)) => api_kind(api.code),
-            // A `ProtonError` that never reached the API is a transport failure.
-            Error::Proton(_) => ErrorKind::Offline,
+            Error::Proton(proton) => proton_kind(proton),
            _ => ErrorKind::Internal,
        };
        Self::new(kind, e.to_string())
    }
 }

+/// What a failed SDK call means to a front-end.
+///
+/// Only a transport failure is the connection. The rest happened on this
+/// machine, and calling them "offline" sent the user to check a network that
+/// worked (issue #38: a photo upload on an account without a photo library
+/// read "You're offline").
+fn proton_kind(e: &proton_sdk::ProtonError) -> ErrorKind {
+    use proton_sdk::ProtonError as P;
+    match e {
+        P::Api(api) => api_kind(api.code),
+        P::Transport(_) => ErrorKind::Offline,
+        // Proton answered, but not with anything this client can read.
+        P::Serialization(_) => ErrorKind::Remote,
+        // The SDK refused the call before sending it, such as an upload to a
+        // photo library the account does not have.
+        P::InvalidOperation(_) => ErrorKind::Invalid,
+        P::Crypto(_) | P::KeysLocked => ErrorKind::Internal,
+    }
+}
+
 /// What an API response code means to a front-end.
 ///
 /// The grouping is by *what the user can do about it*, which is what
@@ -278,6 +296,23 @@ fn api_kind(code: proton_sdk::api::ResponseCode) -> ErrorKind {
    }
 }

+/// Whether `e` says the session itself is gone: its refresh token was refused,
+/// or the account was deleted or disabled.
+///
+/// Nothing but a new login helps then, and no retry will ever succeed, so a
+/// caller must not take it for a lost connection and wait for it to come back
+/// (issue #35: a revoked session was shown as "offline" for good).
+pub fn session_revoked(e: &proton_sdk::ProtonError) -> bool {
+    use proton_sdk::api::ResponseCode as C;
+    match e {
+        proton_sdk::ProtonError::Api(api) => {
+            api.is_invalid_refresh_token()
+                || matches!(api.code, C::AccountDeleted | C::AccountDisabled)
+        }
+        _ => false,
+    }
+}
+
 /// The result every request-serving method in the daemon returns.
 pub type CoreResult<T> = std::result::Result<T, CoreError>;

@@ -309,6 +344,17 @@ mod tests {
        assert_eq!(api_kind(C::ProtonDriveUnknown), ErrorKind::Remote);
    }

+    #[test]
+    fn only_a_refused_refresh_or_a_closed_account_revokes_the_session() {
+        assert!(session_revoked(&api(C::InvalidRefreshToken)));
+        assert!(session_revoked(&api(C::AccountDeleted)));
+        assert!(session_revoked(&api(C::AccountDisabled)));
+        // One file the account may not touch says nothing about the session.
+        assert!(!session_revoked(&api(C::Forbidden)));
+        assert!(!session_revoked(&api(C::Timeout)));
+        assert!(!session_revoked(&ProtonError::KeysLocked));
+    }
+
    /// The regression this whole pass exists to prevent: before it, every SDK
    /// failure was hardcoded to `Remote`, so a 403 asked the user to retry a
    /// request that could never succeed.
@@ -339,6 +385,18 @@ mod tests {
        assert_eq!(CoreError::from_api(&io, "list").kind, ErrorKind::Offline);
    }

+    /// Issue #38: the SDK refused a photo upload before sending it, and the
+    /// app said "You're offline" while every other call went through.
+    #[test]
+    fn a_call_the_sdk_refuses_to_send_is_not_offline() {
+        let refused = ProtonError::invalid_operation("account has no photos volume");
+        let e = CoreError::from_api(&refused, "upload photo failed");
+        assert_eq!(e.kind, ErrorKind::Invalid);
+        assert!(e.message.ends_with("account has no photos volume"));
+        let e: CoreError = Error::Proton(ProtonError::KeysLocked).into();
+        assert_ne!(e.kind, ErrorKind::Offline);
+    }
+
    /// `Error` is the plumbing type; converting it must classify as sharply as
    /// the direct path, or the two disagree about the same failure.
    #[test]
@@ -5,6 +5,8 @@
 //! kept in kernel memory — not on disk, not in the Secret Service — and vanish
 //! when the user's last session ends or the machine reboots. Both the daemon and
 //! `pdfs unlock` reach the same entry because it hangs off the *user* keyring.
+//! It is also where session tokens wait while the Secret Service refuses them
+//! ([`UNSAVED_TOKENS`]), so they outlive the process that holds them.
 //!
 //! Kernel keys are not paged to swap, are invisible to other users, and are
 //! wiped by [`clear`] (`KEYCTL_REVOKE`), which makes them a better home than a
@@ -20,12 +22,34 @@ use std::io;

 use zeroize::Zeroizing;

-/// Key description. Namespaced so it cannot collide with another program's key.
+/// One secret in the user keyring, by its description. Descriptions are
+/// namespaced so they cannot collide with another program's keys.
+pub struct Key {
+    description: &'static [u8],
+}
+
+/// The account's key passphrases (see the module docs).
 #[cfg(not(test))]
-const DESCRIPTION: &[u8] = b"pdfs:key-passphrases\0";
+pub const PASSPHRASES: Key = Key {
+    description: b"pdfs:key-passphrases\0",
+};
 /// Tests must never touch a real unlock.
 #[cfg(test)]
-const DESCRIPTION: &[u8] = b"pdfs:key-passphrases:test\0";
+pub const PASSPHRASES: Key = Key {
+    description: b"pdfs:key-passphrases:test\0",
+};
+
+/// Session tokens the Secret Service refused to store, until it takes them.
+/// A refresh token held only in a process's memory dies with the process.
+#[cfg(not(test))]
+pub const UNSAVED_TOKENS: Key = Key {
+    description: b"pdfs:unsaved-tokens\0",
+};
+#[cfg(test)]
+pub const UNSAVED_TOKENS: Key = Key {
+    description: b"pdfs:unsaved-tokens:test\0",
+};
+
 const KEY_TYPE: &[u8] = b"user\0";

 const KEY_SPEC_USER_KEYRING: i32 = -4;
@@ -49,7 +73,7 @@ fn last_error<T>() -> io::Result<T> {
    Err(io::Error::last_os_error())
 }

-fn find() -> io::Result<Option<libc::c_long>> {
+fn find(description: &[u8]) -> io::Result<Option<libc::c_long>> {
    // SAFETY: both strings are NUL-terminated and outlive the call.
    let id = unsafe {
        libc::syscall(
@@ -57,7 +81,7 @@ fn find() -> io::Result<Option<libc::c_long>> {
            KEYCTL_SEARCH,
            KEY_SPEC_USER_KEYRING,
            KEY_TYPE.as_ptr(),
-            DESCRIPTION.as_ptr(),
+            description.as_ptr(),
            0,
        )
    };
@@ -83,100 +107,102 @@ pub fn forbid_dumps() {
    }
 }

-/// Store `secret`, replacing any earlier one.
-pub fn store(secret: &[u8]) -> io::Result<()> {
-    // SAFETY: strings are NUL-terminated; the payload pointer/length pair
-    // describes `secret`, which outlives the call.
-    let id = unsafe {
-        libc::syscall(
-            libc::SYS_add_key,
-            KEY_TYPE.as_ptr(),
-            DESCRIPTION.as_ptr(),
-            secret.as_ptr(),
-            secret.len(),
-            KEY_SPEC_USER_KEYRING,
-        )
-    };
-    if id < 0 {
-        return last_error();
-    }
-    // SAFETY: plain integer arguments.
-    let rc = unsafe {
-        libc::syscall(
-            libc::SYS_keyctl,
-            KEYCTL_SETPERM,
-            id,
-            PERM_OWNER_AND_POSSESSOR,
-        )
-    };
-    if rc < 0 {
-        // A key whose permissions are unknown is not one to leave behind.
-        let err = io::Error::last_os_error();
-        let _ = clear();
-        return Err(err);
-    }
-    Ok(())
-}
-
-/// Read the stored secret, or `None` when there is none.
-pub fn load() -> io::Result<Option<Zeroizing<Vec<u8>>>> {
-    let Some(id) = find()? else {
-        return Ok(None);
-    };
-    // Size first, then read; retry if the key was replaced in between.
-    for _ in 0..3 {
-        // SAFETY: a null buffer asks the kernel only for the payload length.
-        let len = unsafe {
+impl Key {
+    /// Store `secret`, replacing any earlier one.
+    pub fn store(&self, secret: &[u8]) -> io::Result<()> {
+        // SAFETY: strings are NUL-terminated; the payload pointer/length pair
+        // describes `secret`, which outlives the call.
+        let id = unsafe {
            libc::syscall(
-                libc::SYS_keyctl,
-                KEYCTL_READ,
-                id,
-                std::ptr::null_mut::<u8>(),
-                0usize,
+                libc::SYS_add_key,
+                KEY_TYPE.as_ptr(),
+                self.description.as_ptr(),
+                secret.as_ptr(),
+                secret.len(),
+                KEY_SPEC_USER_KEYRING,
            )
        };
-        if len < 0 {
+        if id < 0 {
+            return last_error();
+        }
+        // SAFETY: plain integer arguments.
+        let rc = unsafe {
+            libc::syscall(
+                libc::SYS_keyctl,
+                KEYCTL_SETPERM,
+                id,
+                PERM_OWNER_AND_POSSESSOR,
+            )
+        };
+        if rc < 0 {
+            // A key whose permissions are unknown is not one to leave behind.
+            let err = io::Error::last_os_error();
+            let _ = self.clear();
+            return Err(err);
+        }
+        Ok(())
+    }
+
+    /// Read the stored secret, or `None` when there is none.
+    pub fn load(&self) -> io::Result<Option<Zeroizing<Vec<u8>>>> {
+        let Some(id) = find(self.description)? else {
+            return Ok(None);
+        };
+        // Size first, then read; retry if the key was replaced in between.
+        for _ in 0..3 {
+            // SAFETY: a null buffer asks the kernel only for the payload length.
+            let len = unsafe {
+                libc::syscall(
+                    libc::SYS_keyctl,
+                    KEYCTL_READ,
+                    id,
+                    std::ptr::null_mut::<u8>(),
+                    0usize,
+                )
+            };
+            if len < 0 {
+                return match io::Error::last_os_error().raw_os_error() {
+                    Some(libc::ENOKEY | libc::EKEYREVOKED | libc::EKEYEXPIRED) => Ok(None),
+                    _ => last_error(),
+                };
+            }
+            let mut buf = Zeroizing::new(vec![0u8; len as usize]);
+            // SAFETY: `buf` is `len` writable bytes.
+            let read = unsafe {
+                libc::syscall(
+                    libc::SYS_keyctl,
+                    KEYCTL_READ,
+                    id,
+                    buf.as_mut_ptr(),
+                    buf.len(),
+                )
+            };
+            if read < 0 {
+                return last_error();
+            }
+            if read as usize <= buf.len() {
+                buf.truncate(read as usize);
+                return Ok(Some(buf));
+            }
+        }
+        Err(io::Error::other("the key changed while it was being read"))
+    }
+
+    /// Remove the stored secret. Succeeds when there is none.
+    pub fn clear(&self) -> io::Result<()> {
+        let Some(id) = find(self.description)? else {
+            return Ok(());
+        };
+        // SAFETY: plain integer arguments.
+        let rc = unsafe { libc::syscall(libc::SYS_keyctl, KEYCTL_REVOKE, id) };
+        if rc < 0 {
            return match io::Error::last_os_error().raw_os_error() {
-                Some(libc::ENOKEY | libc::EKEYREVOKED | libc::EKEYEXPIRED) => Ok(None),
+                Some(libc::ENOKEY | libc::EKEYREVOKED) => Ok(()),
                _ => last_error(),
            };
        }
-        let mut buf = Zeroizing::new(vec![0u8; len as usize]);
-        // SAFETY: `buf` is `len` writable bytes.
-        let read = unsafe {
-            libc::syscall(
-                libc::SYS_keyctl,
-                KEYCTL_READ,
-                id,
-                buf.as_mut_ptr(),
-                buf.len(),
-            )
-        };
-        if read < 0 {
-            return last_error();
-        }
-        if read as usize <= buf.len() {
-            buf.truncate(read as usize);
-            return Ok(Some(buf));
-        }
+        Ok(())
    }
-    Err(io::Error::other("the key changed while it was being read"))
-}
-
-/// Remove the stored secret. Succeeds when there is none.
-pub fn clear() -> io::Result<()> {
-    let Some(id) = find()? else {
-        return Ok(());
-    };
-    // SAFETY: plain integer arguments.
-    let rc = unsafe { libc::syscall(libc::SYS_keyctl, KEYCTL_REVOKE, id) };
-    if rc < 0 {
-        return match io::Error::last_os_error().raw_os_error() {
-            Some(libc::ENOKEY | libc::EKEYREVOKED) => Ok(()),
-            _ => last_error(),
-        };
-    }
-    Ok(())
 }

 #[cfg(test)]
@@ -187,18 +213,21 @@ mod tests {
    // so one test covers the whole round trip and skips when it is unavailable.
    #[test]
    fn stored_secret_round_trips_and_clears() {
-        if store(b"probe").is_err() {
+        if PASSPHRASES.store(b"probe").is_err() {
            eprintln!("kernel keyring unavailable; skipping");
            return;
        }
-        let saved = load().unwrap().expect("stored secret is readable");
+        let saved = PASSPHRASES
+            .load()
+            .unwrap()
+            .expect("stored secret is readable");
        assert_eq!(saved.as_slice(), b"probe");

-        store(b"replaced").unwrap();
-        assert_eq!(load().unwrap().unwrap().as_slice(), b"replaced");
+        PASSPHRASES.store(b"replaced").unwrap();
+        assert_eq!(PASSPHRASES.load().unwrap().unwrap().as_slice(), b"replaced");

-        clear().unwrap();
-        assert!(load().unwrap().is_none());
-        clear().unwrap();
+        PASSPHRASES.clear().unwrap();
+        assert!(PASSPHRASES.load().unwrap().is_none());
+        PASSPHRASES.clear().unwrap();
    }
 }
@@ -2,6 +2,7 @@

 use super::*;
 use crate::shutdown::Shutdown;
+use pdfs_core::error::session_revoked;

 /// Drop `uid` from one mount's tree and tell that mount's kernel session the
 /// entry is gone. Shared by the trash and delete paths, which differ only in
@@ -402,6 +403,12 @@ pub(super) async fn run_event_sync(
                        }
                        break Some(c.clone());
                    }
+                    // Refused for good: retrying would be refused the same way
+                    // for the life of the daemon. The next login restarts it.
+                    Err(e) if session_revoked(&e) => {
+                        core.mark_session_expired("seed event cursor", &e);
+                        return;
+                    }
                    Err(e) => {
                        warn!(error = %e, ?delay, "seed event cursor failed; retrying");
                        tokio::time::sleep(delay).await;
@@ -502,6 +509,10 @@ pub(super) async fn run_photos_event_sync(core: Core) {
                debug!("no photos volume; photo event sync not started");
                return;
            }
+            Err(error) if session_revoked(&error) => {
+                core.mark_session_expired("read the photos root", &error);
+                return;
+            }
            Err(error) => {
                warn!(%error, "reading the photos root failed; retrying");
                tokio::time::sleep(ONLINE_PROBE_MAX).await;
@@ -334,6 +334,9 @@ pub(crate) fn status_response(core: &Core, username: &str, mountpoint: &Path) ->
        budget: core.cache.budget(),
        pins,
        online: core.online.load(Ordering::Relaxed),
+        session_expired: core.session_expired(),
+        tokens_unsaved: pdfs_core::auth::tokens_unsaved(),
+        version: env!("CARGO_PKG_VERSION").to_string(),
        pending_uploads: queued.uploads.max(0) as u64 + landing,
        pending_changes: queued.changes.max(0) as u64,
    }
@@ -938,6 +941,9 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
                            }
                        }
                        Err(e) => {
+                            // The reply goes to the app's toast only; without
+                            // this the journal shows a failure and no reason.
+                            warn!(error = %e, "photo upload failed");
                            CtlResponse::error(CoreError::from_api(&e, "upload photo failed"))
                        }
                    }
@@ -157,7 +157,7 @@ impl Core {
    pub(crate) fn list_devices(&self) -> CoreResult<Vec<DeviceInfo>> {
        let devices = self
            .rt
-            .block_on(self.client.enumerate_devices())
+            .block_on(self.drive.enumerate_devices())
            .map_err(|e| CoreError::from_api(&e, "list devices"))?;
        // No cached device row yet means this machine syncs nothing, so none of
        // the listed devices is ours.
@@ -214,7 +214,7 @@ impl Core {
        };
        let remote = self
            .rt
-            .block_on(self.client.enumerate_devices())
+            .block_on(self.drive.enumerate_devices())
            .map_err(|e| CoreError::from_api(&e, "enumerate devices"))?;
        let dev = remote
            .into_iter()
@@ -257,7 +257,7 @@ impl Core {
        };
        let remote = self
            .rt
-            .block_on(self.client.enumerate_devices())
+            .block_on(self.drive.enumerate_devices())
            .map_err(|e| CoreError::from_api(&e, "enumerate devices"))?;
        let d = remote
            .into_iter()
@@ -395,7 +395,7 @@ impl Core {
        // any cached record, and recover an existing device by name.
        let remote = self
            .rt
-            .block_on(self.client.enumerate_devices())
+            .block_on(self.drive.enumerate_devices())
            .map_err(|e| CoreError::from_api(&e, "enumerate devices"))?;

        // An adopted uid is an explicit instruction, so it outranks everything
@@ -454,7 +454,7 @@ impl Core {
            None => {
                let d = self
                    .rt
-                    .block_on(self.client.create_device(&name, DeviceType::Linux))
+                    .block_on(self.drive.create_device(&name, DeviceType::Linux))
                    .map_err(|e| CoreError::from_api(&e, "create device"))?;
                StoredDevice {
                    uid: d.uid.to_string(),
@@ -347,17 +347,7 @@ impl Core {
                        // its writer has to be noticed.
                        self.sweep_parked_creates();
                    }
-                    // Paused, nothing due changes that: sleep until a resume
-                    // wakes the worker (or the idle poll notices a timed pause
-                    // ran out), not until the next op falls due — that is
-                    // "now" for everything already queued.
-                    if paused {
-                        self.wait_for_drain_work();
-                        continue;
-                    }
-                    // A debounced or backed-off op may be waiting: sleep only
-                    // until it becomes due rather than the full idle-poll.
-                    self.wait_for_drain_work_or_due();
+                    self.wait_for_drain_work_or_due(online && !paused);
                    continue;
                }
            };
@@ -732,14 +722,16 @@ impl Core {
    /// Like [`wait_for_drain_work`](Self::wait_for_drain_work), but first
    /// checks whether a debounced or backed-off op is due before the idle-poll
    /// ceiling. A 2-second debounce must not sleep 30 seconds.
-    fn wait_for_drain_work_or_due(&self) {
-        let timeout = match self.db.earliest_due_at() {
-            Ok(Some(ts)) => {
-                let remaining = (ts - now_millis()).max(0) as u64;
-                Duration::from_millis(remaining).min(DRAIN_IDLE_POLL)
-            }
-            _ => DRAIN_IDLE_POLL,
+    ///
+    /// `claiming` is false while the worker claims nothing (offline or
+    /// paused); see [`idle_wait`].
+    fn wait_for_drain_work_or_due(&self, claiming: bool) {
+        let earliest = if claiming {
+            self.db.earliest_due_at().ok().flatten()
+        } else {
+            None
        };
+        let timeout = idle_wait(claiming, earliest, now_millis());
        sleep_for_drain_work(&self.drain_wake, || self.shutdown.is_stopping(), timeout);
    }

@@ -2678,7 +2670,9 @@ fn proton_error<'e>(e: &'e (dyn std::error::Error + 'static)) -> Option<&'e Prot
 /// is, or `Some(None)` for a failure that is not a refusal.
 fn refusal(e: &(dyn std::error::Error + 'static)) -> Option<Option<SyncIssue>> {
    let proton = proton_error(e)?;
-    if is_network_error(proton) {
+    // A refused session refuses everything, so it says nothing about this
+    // op either; the mount is offline for it (`Core::lost_link`).
+    if is_network_error(proton) || pdfs_core::error::session_revoked(proton) {
        return None;
    }
    let ProtonError::Api(api) = proton else {
@@ -2833,6 +2827,23 @@ fn sleep_for_drain_work(
    *woken = false;
 }

+/// How long an idle drain worker sleeps: until the earliest queued op falls
+/// due, at most the idle poll.
+///
+/// A worker that claims nothing — offline or paused — sleeps the full idle
+/// poll whatever is due. Every op already queued is due "now" for it, so
+/// sleeping until then was a zero wait, and all the workers spun on the queue
+/// for as long as the outage lasted (`docs/BUGS.md` B200). A reconnect or a
+/// resume wakes the drain, so nothing waits the full poll for it.
+fn idle_wait(claiming: bool, earliest_due: Option<i64>, now: i64) -> Duration {
+    match earliest_due {
+        Some(ts) if claiming => {
+            Duration::from_millis((ts - now).max(0) as u64).min(DRAIN_IDLE_POLL)
+        }
+        _ => DRAIN_IDLE_POLL,
+    }
+}
+
 fn placed_in(st: &crate::state::State, uid: &NodeUid) -> Option<(String, Option<NodeUid>)> {
    let entry = st.by_uid.get(uid).and_then(|ino| st.entries.get(ino))?;
    Some((entry.node.name.clone(), entry.node.parent_uid.clone()))
@@ -2858,6 +2869,23 @@ mod tests {
        assert!(started.elapsed() < Duration::from_secs(1));
    }

+    #[test]
+    fn an_offline_worker_waits_the_idle_poll_for_a_past_due_op() {
+        // The op fell due long ago, and offline nobody attempts it, so it
+        // stays due: waiting for it was a zero wait, forever (B200).
+        assert_eq!(idle_wait(false, Some(0), 10_000), DRAIN_IDLE_POLL);
+    }
+
+    #[test]
+    fn a_claiming_worker_waits_only_until_the_next_op_falls_due() {
+        assert_eq!(
+            idle_wait(true, Some(12_000), 10_000),
+            Duration::from_secs(2)
+        );
+        assert_eq!(idle_wait(true, Some(0), 10_000), Duration::ZERO);
+        assert_eq!(idle_wait(true, None, 10_000), DRAIN_IDLE_POLL);
+    }
+
    fn pending(kind: &str) -> PendingOp {
        PendingOp {
            id: 0,
@@ -8,8 +8,10 @@
 //! real client implements it by forwarding, and the simulation tests implement
 //! it with an in-memory Drive that injects Drive's known faults.
 //!
-//! Sharing, Photos, devices, invitations and public links stay on the concrete
-//! client (`Core::client`) until a test needs them faked.
+//! Sharing, Photos, invitations, public links and the rest of the device calls
+//! stay on the concrete client (`Core::client`) until a test needs them faked.
+//! Listing and registering devices are here, so a simulated daemon can sync a
+//! local folder.
 //!
 //! The method names match the client's own, so a call site reads the same
 //! whichever it goes through. The client's generic methods (a reader or writer
@@ -26,7 +28,8 @@ use proton_drive_rs::proton_sdk::account::Quota;
 use proton_drive_rs::proton_sdk::error::Result;
 use proton_drive_rs::proton_sdk::ids::{DriveEventId, NodeUid};
 use proton_drive_rs::{
-    DriveEvent, DriveEventScopeId, Node, NodeMoveItem, ProtonDriveClient, RevisionReader, Thumbnail,
+    Device, DeviceType, DriveEvent, DriveEventScopeId, Node, NodeMoveItem, ProtonDriveClient,
+    RevisionReader, Thumbnail,
 };

 /// One outcome per node of a batch request; see [`ProtonDriveClient::trash_nodes`].
@@ -154,6 +157,12 @@ pub(crate) trait DriveApi: Send + Sync {
    /// The account's storage, across every Proton product.
    async fn quota(&self) -> Result<Quota>;

+    /// Every computer that backs up to the account.
+    async fn enumerate_devices(&self) -> Result<Vec<Device>>;
+
+    /// Register a computer, with a root folder of its own named `name`.
+    async fn create_device(&self, name: &str, device_type: DeviceType) -> Result<Device>;
+
    /// Called by the drain once it has let go of the blob of an upload to
    /// `uid` that landed, or retired the create that made `uid`, before the
    /// tree has the node, so a simulation can hold it there. Blocks the drain
@@ -470,4 +479,12 @@ impl DriveApi for ProtonDriveClient {
    async fn quota(&self) -> Result<Quota> {
        ProtonDriveClient::quota(self).await
    }
+
+    async fn enumerate_devices(&self) -> Result<Vec<Device>> {
+        ProtonDriveClient::enumerate_devices(self).await
+    }
+
+    async fn create_device(&self, name: &str, device_type: DeviceType) -> Result<Device> {
+        ProtonDriveClient::create_device(self, name, device_type).await
+    }
 }
@@ -235,6 +235,8 @@ fn status_keys(status: &CtlResponse) -> (String, String) {
        used,
        budget,
        online,
+        session_expired,
+        tokens_unsaved,
        pending_uploads,
        pending_changes,
        ..
@@ -247,7 +249,7 @@ fn status_keys(status: &CtlResponse) -> (String, String) {
    );
    let key = format!(
        "{queue}/{staged_bytes}/{paused}/{paused_until:?}/{username}/{mountpoint}/{pinned}/\
-         {used}/{budget}/{online}"
+         {used}/{budget}/{online}/{session_expired}/{tokens_unsaved}"
    );
    (key, queue)
 }
@@ -325,6 +327,9 @@ mod tests {
            budget: 0,
            pins: Vec::new(),
            online: true,
+            session_expired: false,
+            tokens_unsaved: false,
+            version: "3.3.0".into(),
            pending_uploads: 1,
            pending_changes: 0,
        };
@@ -1267,8 +1267,12 @@ impl ProtonFs {
        //
        // Complete pending blobs are the common case and can be copied without
        // any network access. An incomplete blob still has gaps referring to
-        // the remote base; stacking another write on it cannot be represented
-        // safely by WriteHandle, so fail the open rather than risk corruption.
+        // the remote base, and stacking another write on it cannot be
+        // represented by WriteHandle, so the copy's gaps are filled from that
+        // base first, as the drain fills them before an upload. Only when that
+        // fails (offline, or the base is gone) does the open fail: refusing
+        // every such open failed a create over a file whose partial edit had
+        // not drained yet (`docs/BUGS.md` B204).
        //
        // Reading that blob and installing the handle cannot be done under one
        // lock — the copy is the size of the file — so the base is re-checked at
@@ -1302,10 +1306,6 @@ impl ProtonFs {
                    }
                }
                let pending_base = self.core.pending.lock().get(&uid).cloned();
-                if pending_base.as_ref().is_some_and(|p| !p.meta.complete) {
-                    error!(%uid, "refusing write over incomplete queued revision");
-                    break 'install Err(Errno::EIO);
-                }
                let (file, path) = match self.core.cache.create_scratch() {
                    Ok(x) => x,
                    Err(e) => {
@@ -1325,6 +1325,25 @@ impl ProtonFs {
                            "copy queued revision into write scratch failed");
                        break 'install Err(Errno::EIO);
                    }
+                    if !pending.meta.complete {
+                        let mut authored = Intervals::default();
+                        for &(s, e) in &pending.meta.authored {
+                            authored.add(s, e);
+                        }
+                        if let Err(error) = self.core.fill_gaps(
+                            &uid,
+                            &file,
+                            pending.meta.len,
+                            pending.meta.base_mtime,
+                            pending.meta.base_size,
+                            &authored,
+                        ) {
+                            let _ = std::fs::remove_file(&path);
+                            error!(%uid, ?error, "cannot complete the queued revision a write open is based on");
+                            break 'install Err(error);
+                        }
+                        debug!(%uid, "write open completed an incomplete queued revision");
+                    }
                    initial_written.add(0, pending.meta.len);
                }
                // Sampled *before* the state lock, never under it: no site in
@@ -4227,8 +4227,10 @@ impl Core {
    }

    /// Pin the node at mountpoint-relative `rel`. A file downloads its full
-    /// plaintext into the content cache; a folder records a recursive pin and
-    /// downloads every descendant file (selective sync). Returns a human message.
+    /// plaintext into the content cache before this returns. A folder records a
+    /// recursive pin and downloads every descendant file on a background thread,
+    /// reported as a job: a big folder far outlasts the socket read timeout.
+    /// Returns a human message.
    fn pin(&self, rel: &Path) -> CoreResult<String> {
        let (ino, uid) = self.resolve(rel)?;
        let (name, is_folder, mtime, size) = {
@@ -4245,34 +4247,93 @@ impl Core {
            )
        };
        if is_folder {
+            // Offline, every download would fail and the folder would only look
+            // kept. Refuse instead, as a file pin does.
+            if !self.is_online() {
+                return Err(CoreError::offline());
+            }
            // Record the recursive pin first so every descendant is eviction-
            // exempt before we start filling the cache with the subtree.
            self.cache
                .add_pin(&uid, rel, true)
                .map_err(|e| CoreError::from_api(&e, "pin"))?;
-            let n = self.pin_subtree(ino)?;
-            return Ok(format!("{name} ({n} files)"));
+            let core = self.clone();
+            let folder = name.clone();
+            std::thread::Builder::new()
+                .name("pin-folder".into())
+                .spawn(move || core.pin_subtree(ino, &uid, &folder))
+                .map_err(|e| CoreError::internal(format!("spawn pin: {e}")))?;
+            return Ok(format!("{name}: downloading its files in the background"));
        }
-        let bytes = self
-            .download_file_tracked(&uid, &name, size)
-            .map_err(|e| CoreError::from_api(&e, "download"))?;
-        self.cache
-            .store(&uid, mtime, size, &bytes)
-            .map_err(|e| CoreError::internal(format!("cache store: {e}")))?;
+        self.fetch_content(&uid, &name, mtime, size)?;
        self.cache
            .add_pin(&uid, rel, false)
            .map_err(|e| CoreError::from_api(&e, "pin"))?;
        Ok(name)
    }

-    /// Download and cache every file in the subtree rooted at folder `ino`,
-    /// returning the count cached (already-fresh blobs counted, not re-fetched).
-    /// Walks the tree depth-first, enumerating each folder so a cold subtree is
-    /// fully discovered; the lock is dropped before each network download.
-    fn pin_subtree(&self, ino: u64) -> CoreResult<usize> {
+    /// Download and cache every file in the subtree rooted at the pinned folder
+    /// `ino` (`folder`, named `name`), as a job the front ends show. Walks the
+    /// tree depth-first, enumerating each folder so a cold subtree is fully
+    /// discovered; the lock is dropped before each network download. Stops when
+    /// the folder is unpinned or the daemon stops.
+    fn pin_subtree(&self, ino: u64, folder: &NodeUid, name: &str) {
+        let job = self
+            .transfers
+            .begin_job(format!("Making {name} available offline"));
+        match self.pin_subtree_files(ino) {
+            Ok(files) => {
+                job.set_total(files.len() as u64);
+                let mut failed = 0usize;
+                for (uid, file, mtime, size) in files {
+                    if self.shutdown.is_stopping() || !self.cache.is_pinned(folder) {
+                        return;
+                    }
+                    job.detail(file.clone());
+                    if let Err(e) = self.fetch_pinned(&uid, &file, mtime, size) {
+                        warn!(%uid, error = %e, "pin folder: download failed");
+                        failed += 1;
+                    }
+                    job.step();
+                }
+                info!(folder = %name, failed, "pin folder: done");
+            }
+            Err(e) => warn!(folder = %name, error = %e, "pin folder: enumerate failed"),
+        }
+    }
+
+    /// Cache the file `uid` for a folder pin. Its `mtime` and `size` were read
+    /// before the download, and a create landing or a remote edit can change
+    /// them while it runs. The blob is then stored under the old ones and reads
+    /// as stale, so the file is listed as kept but not available offline. Fetch
+    /// it again under the new ones, a few times at most.
+    fn fetch_pinned(&self, uid: &NodeUid, name: &str, mtime: i64, size: u64) -> CoreResult<()> {
+        let mut fetched = (mtime, size);
+        for _ in 0..3 {
+            self.fetch_content(uid, name, fetched.0, fetched.1)?;
+            let current = {
+                let st = self.state();
+                st.by_uid
+                    .get(uid)
+                    .and_then(|ino| st.entries.get(ino))
+                    .map(|e| (e.node.modification_time, node_size(&e.node)))
+            };
+            match current {
+                Some(now) if now != fetched => fetched = now,
+                _ => break,
+            }
+        }
+        Ok(())
+    }
+
+    /// Every file in the subtree rooted at folder `ino`.
+    fn pin_subtree_files(&self, ino: u64) -> CoreResult<Vec<(NodeUid, String, i64, u64)>> {
        let mut files: Vec<(NodeUid, String, i64, u64)> = Vec::new();
        let mut stack = vec![ino];
        while let Some(dir) = stack.pop() {
+            if self.shutdown.is_stopping() {
+                break;
+            }
            self.ensure_children(dir)
                .map_err(|e| self.errno_error(e, "enumerate"))?;
            let st = self.state();
@@ -4293,22 +4354,7 @@ impl Core {
                }
            }
        }
-        let mut count = 0;
-        for (uid, name, mtime, size) in files {
-            if self.cache.is_cached(&uid, mtime, size) {
-                count += 1;
-                continue;
-            }
-            match self.download_file_tracked(&uid, &name, size) {
-                Ok(bytes) => {
-                    if self.cache.store(&uid, mtime, size, &bytes).is_ok() {
-                        count += 1;
-                    }
-                }
-                Err(e) => warn!(%uid, error = %e, "pin subtree: download failed"),
-            }
-        }
-        Ok(count)
+        Ok(files)
    }

    /// Fetch a thumbnail of `ttype` for the file at `ino`, served from the cache
@@ -4354,6 +4400,8 @@ impl Core {

    /// Unpin the node at `rel`, evicting its cached content. For a folder, also
    /// evicts every descendant's cached blob (the subtree is no longer kept).
+    /// A node kept only because a folder above it is pinned is refused: there
+    /// is no pin of its own to remove, and it would stay kept all the same.
    fn unpin(&self, rel: &Path) -> CoreResult<String> {
        let (ino, uid) = self.resolve(rel)?;
        let (name, is_folder) = {
@@ -4363,14 +4411,24 @@ impl Core {
                .map(|e| (e.node.name.clone(), e.node.is_folder()))
                .unwrap_or_default()
        };
+        if self.pinned_by_folder(ino) {
+            return Err(CoreError::conflict(format!(
+                "{name} is kept offline because a folder above it is; unpin that folder instead"
+            )));
+        }
        self.cache
            .remove_pin(&uid)
            .map_err(|e| CoreError::from_api(&e, "unpin"))?;
        // A recursively-pinned folder's descendants were eviction-exempt; now
        // that the pin is gone, reclaim their blobs eagerly instead of waiting
-        // for budget pressure. Descendants come from the DB node tree.
+        // for budget pressure. Descendants come from the DB node tree. One
+        // pinned on its own, or under a pinned subfolder, is still kept.
        if is_folder && let Ok(uids) = self.db.descendants(&uid.to_string()) {
+            let still_pinned = self.pinned_set();
            for s in uids {
+                if still_pinned.contains(&s) {
+                    continue;
+                }
                if let Some(u) = parse_uid(&s) {
                    self.cache.evict(&u);
                    self.evict_reader(&u);
@@ -4380,6 +4438,20 @@ impl Core {
        Ok(name)
    }

+    /// Whether the node at `ino` is kept offline because a folder above it is
+    /// pinned, whether or not it is also pinned on its own.
+    fn pinned_by_folder(&self, ino: u64) -> bool {
+        let parent = {
+            let st = self.state();
+            st.entries
+                .get(&ino)
+                .filter(|e| e.parent != ino)
+                .and_then(|e| st.entries.get(&e.parent))
+                .map(|p| p.uid.clone())
+        };
+        parent.is_some_and(|uid| self.cache.is_pinned(&uid))
+    }
+
    /// A Photos API handle sharing this Core's Drive client and session, so it
    /// reuses the daemon's single authenticated session rather than logging in
    /// again (Proton refresh tokens are single-use). Cheap — the Drive client
@@ -4392,10 +4464,13 @@ impl Core {
    /// the same lazy remote enumeration `readdir` uses, projected into
    /// serializable [`DirEntry`]s (with per-file pin state).
    fn list_dir(&self, rel: &Path) -> CoreResult<Vec<DirEntry>> {
-        let (ino, _uid) = self.resolve(rel)?;
+        let (ino, uid) = self.resolve(rel)?;
        self.ensure_children(ino)
            .map_err(|e| self.errno_error(e, "enumerate"))?;
        self.settle_listing_sizes(ino);
+        // Every entry shares this folder as its parent, so one lookup says
+        // whether they are all kept through it.
+        let pinned_by_folder = self.cache.is_pinned(&uid);
        // Snapshot the listing, then drop the lock before touching the on-disk
        // pin registry so a slow disk read doesn't block FUSE metadata ops.
        let rows: Vec<(String, bool, u64, i64, NodeUid, u64)> = {
@@ -4427,7 +4502,8 @@ impl Core {
                is_dir,
                size,
                modified,
-                pinned: self.cache.is_pinned(&uid),
+                pinned: pinned_by_folder || self.cache.is_pinned(&uid),
+                pinned_by_folder,
                cached: !is_dir && self.cache.is_cached(&uid, modified, size),
                uid: uid.to_string(),
                // Listing entries live in the requested dir; the caller derives
@@ -5319,6 +5395,7 @@ impl Core {
                // A trashed node can't be pinned or served from the mount, so its
                // content is never current cache: report neither.
                pinned: false,
+                pinned_by_folder: false,
                cached: false,
                uid: item.uid,
                path: String::new(),
@@ -9,10 +9,11 @@
 //! queued path, and the probe thread here flips it back when Proton answers.

 use std::future::Future;
-use std::sync::atomic::Ordering;
+use std::sync::atomic::{AtomicBool, Ordering};
 use std::time::{Duration, Instant};

 use parking_lot::{Condvar, Mutex};
+use pdfs_core::error::session_revoked;
 use proton_drive_rs::proton_sdk::api::ResponseCode;
 use proton_drive_rs::proton_sdk::error::{ProtonApiError, ProtonError};
 use tracing::{debug, info, warn};
@@ -54,6 +55,26 @@ pub(crate) struct Link {
    changed: Condvar,
    /// Folders listed from the DB alone while offline, to relist once back.
    pub(crate) stale_listings: Mutex<std::collections::HashSet<u64>>,
+    /// Proton refused the session itself ([`session_revoked`]). The mount is
+    /// offline then, but no probe brings it back: only a new login does, and
+    /// that restarts the daemon. Read by front-ends through `Response::Status`,
+    /// so they can ask the user to sign in again rather than say "offline".
+    pub(crate) session_expired: AtomicBool,
+    /// Proton refused the session, but only because another process rotated
+    /// it (`pdfs unlock`): the keyring holds the live tokens. The mount loop
+    /// ends the mount for the daemon to mount again from the keyring.
+    pub(crate) resume_stored: AtomicBool,
+}
+
+impl Link {
+    /// The link of a mount that comes up with Proton refusing its session, or
+    /// not.
+    pub(crate) fn starting(session_expired: bool) -> Self {
+        Self {
+            session_expired: AtomicBool::new(session_expired),
+            ..Default::default()
+        }
+    }
 }

 /// Whether a failed call failed because Proton could not be reached, rather
@@ -161,10 +182,20 @@ impl Core {
        self.rt.block_on(bounded_by(limit, call))
    }

+    /// Whether Proton refused the session itself, so nothing reaches it until
+    /// the user signs in again.
+    pub(crate) fn session_expired(&self) -> bool {
+        self.link.session_expired.load(Ordering::Relaxed)
+    }
+
    /// Report a failed remote call. Returns whether it failed for want of a
-    /// network, in which case the mount is now offline and the caller should
-    /// take its queued path instead of failing.
+    /// network, or of a session, in which case the mount is now offline and the
+    /// caller should take its queued path instead of failing.
    pub(crate) fn lost_link(&self, e: &ProtonError, what: &str) -> bool {
+        if session_revoked(e) {
+            self.mark_session_expired(what, e);
+            return true;
+        }
        if !is_network_error(e) {
            return false;
        }
@@ -172,6 +203,29 @@ impl Core {
        true
    }

+    /// Flip the mount offline for good: Proton refused the session, and only a
+    /// new login brings it back. Changes stay queued for the daemon that login
+    /// starts. Only the first caller logs it.
+    ///
+    /// Unless the keyring holds a newer session than the refused one: then
+    /// the mount ends, for the daemon to mount again on that one.
+    pub(crate) fn mark_session_expired(&self, what: &str, error: &dyn std::fmt::Display) {
+        if self.link.resume_stored.load(Ordering::Relaxed) {
+            return self.mark_offline(what, error);
+        }
+        if pdfs_core::auth::stored_session_is_newer() {
+            info!(during = what, %error,
+                  "Proton refused a session another process has since refreshed; resuming it");
+            self.link.resume_stored.store(true, Ordering::Relaxed);
+            return self.mark_offline(what, error);
+        }
+        if !self.link.session_expired.swap(true, Ordering::Relaxed) {
+            warn!(during = what, %error,
+                  "Proton refused the session; run `pdfs login` to sign in again");
+        }
+        self.mark_offline(what, error);
+    }
+
    /// Flip the mount offline and wake the probe. Only the first caller of an
    /// outage logs it; the rest are the same outage.
    pub(crate) fn mark_offline(&self, what: &str, error: &dyn std::fmt::Display) {
@@ -276,6 +330,9 @@ impl Core {

    /// Probe until Proton answers, then flip the mount online. Returns `false`
    /// if the daemon is stopping.
+    ///
+    /// A refused session is not probed: every probe would be refused the same
+    /// way, forever (issue #35). The thread waits for the stop instead.
    fn probe_until_online(&self) -> bool {
        let started = self.link.lost_at.lock().unwrap_or_else(Instant::now);
        let mut delay = if started.elapsed() < YOUNG_OUTAGE {
@@ -287,6 +344,10 @@ impl Core {
            if !self.shutdown.sleep(delay) {
                return false;
            }
+            if self.session_expired() {
+                delay = ONLINE_PROBE_MAX;
+                continue;
+            }
            let probe = self.rt.block_on(async {
                match tokio::time::timeout(PROBE_TIMEOUT, self.drive.get_my_files_folder()).await {
                    Ok(result) => result,
@@ -308,6 +369,7 @@ impl Core {
                    self.mark_online();
                    return true;
                }
+                Err(e) if session_revoked(&e) => self.mark_session_expired("online probe", &e),
                Err(e) => {
                    debug!(error = %e, ?delay, "online probe failed; still offline");
                    delay = next_probe_delay(delay, started.elapsed());
@@ -12,6 +12,10 @@ pub enum MountOutcome {
    /// The kernel mount ended on its own (e.g. an external `fusermount -u`).
    /// The caller may want to remount.
    Unmounted,
+    /// Proton refused the session, and the keyring holds a newer one: another
+    /// process (`pdfs unlock`) refreshed it, or a new login replaced it. We
+    /// unmounted ourselves; the caller should mount again, which resumes it.
+    ResumeStored,
 }

 /// Whether `path` is a mountpoint whose FUSE connection is dead — the state a
@@ -210,30 +214,60 @@ fn fetch_or_recall_root(
    drive: &dyn DriveApi,
    rt: &tokio::runtime::Handle,
    db: &Db,
-) -> std::io::Result<(Node, bool)> {
+) -> std::io::Result<(Node, Start)> {
    let err = match rt.block_on(drive.get_my_files_folder()) {
        Ok(root) => {
            if let Err(e) = db.set_state_str(ROOT_UID_KEY, &root.uid.to_string()) {
                warn!(error = %e, "persist root uid failed");
            }
-            return Ok((root, true));
+            return Ok((root, Start::Online));
        }
        Err(e) => e,
    };
+    // Still mounted from the cache, so cached files stay readable and changes
+    // queue for the daemon the next login starts.
+    let start = if pdfs_core::error::session_revoked(&err) {
+        Start::SessionExpired
+    } else {
+        Start::Offline
+    };
+    if start == Start::SessionExpired && pdfs_core::auth::stored_session_is_newer() {
+        return Err(std::io::Error::other(format!(
+            "Proton refused a session another process has since refreshed ({err}); resuming it"
+        )));
+    }
    let cached = db
        .state_str(ROOT_UID_KEY)
        .ok()
        .flatten()
        .and_then(|uid| db.node_by_uid(&uid).ok().flatten());
    match cached {
+        Some(root) if start == Start::SessionExpired => {
+            warn!(error = %err,
+                  "Proton refused the session; mounting from cache until `pdfs login`");
+            Ok((root, start))
+        }
        Some(root) => {
            warn!(error = %err, "fetch My Files root failed; mounting from cache (offline)");
-            Ok((root, false))
+            Ok((root, start))
        }
+        None if start == Start::SessionExpired => Err(std::io::Error::other(format!(
+            "Proton refused the session ({err}); run `pdfs login`"
+        ))),
        None => Err(std::io::Error::other(format!("fetch My Files root: {err}"))),
    }
 }

+/// How a mount comes up, from what fetching its root said.
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Start {
+    Online,
+    /// Proton could not be reached: serve the cache and probe for the link.
+    Offline,
+    /// Proton refused the session: serve the cache until a new login.
+    SessionExpired,
+}
+
 /// Per-mount settings resolved from [`pdfs_core::config::AppConfig`] by the
 /// caller, so `mount` itself never reads config or the environment.
 pub struct MountOptions {
@@ -393,7 +427,8 @@ pub(crate) fn mount_with(
    // Start the uptime clock here rather than at the first `pdfs diagnostics`,
    // so the age it reports is the daemon's own.
    super::diagnostics::start_clock();
-    let (root, online) = fetch_or_recall_root(drive.as_ref(), &rt, &db)?;
+    let (root, start) = fetch_or_recall_root(drive.as_ref(), &rt, &db)?;
+    let online = start == Start::Online;
    let scope = root.tree_event_scope_id();
    db.mount_upsert_my_files(&mountpoint.to_string_lossy(), &root.uid.to_string(), None)
        .map_err(|error| std::io::Error::other(format!("project My Files mount: {error}")))?;
@@ -429,7 +464,7 @@ pub(crate) fn mount_with(
        shared_generation: Arc::new(AtomicU64::new(0)),
        shared_refresh_deadlines: Arc::new(Mutex::new(SharedRefreshDeadlines::default())),
        online: Arc::new(AtomicBool::new(online)),
-        link: Arc::new(Default::default()),
+        link: Arc::new(link::Link::starting(start == Start::SessionExpired)),
        sync_paused_until: Arc::new(AtomicI64::new(paused_until)),
        pending: Arc::new(Mutex::new(HashMap::new())),
        hidden: Arc::new(Mutex::new(HashSet::new())),
@@ -719,6 +754,18 @@ pub(crate) fn mount_with(
                }
                break MountOutcome::Shutdown;
            }
+            Err(std::sync::mpsc::RecvTimeoutError::Timeout)
+                if core.link.resume_stored.load(Ordering::Relaxed) =>
+            {
+                info!("unmounting to resume the stored session");
+                core.mounts.lock().close();
+                if let Err(e) = teardown_session(&core.session_live, || {
+                    umount_session_unblocked(bg, main_conn)
+                }) {
+                    warn!(error = %e, "umount_and_join failed");
+                }
+                break MountOutcome::ResumeStored;
+            }
            Err(std::sync::mpsc::RecvTimeoutError::Timeout) => {
                if bg.guard.is_finished() {
                    info!("mount ended externally");
@@ -25,6 +25,7 @@ use proton_drive_rs::NodeKind;
 use proton_drive_rs::proton_sdk::ids::NodeUid;
 use tracing::{info, warn};

+use super::state::State;
 use super::sync::mirror_subtree_unsynced;
 use super::{Core, is_local_uid, parse_uid};

@@ -130,6 +131,24 @@ fn rename_noreplace(from: &Path, to: &Path) -> std::io::Result<()> {
    }
 }

+/// Whether inode `ino` is `root` or lies under it in the tree. Bounded, so a
+/// parent cycle in corrupt data cannot hang the caller.
+fn ino_is_under(st: &State, mut ino: u64, root: u64) -> bool {
+    for _ in 0..MAX_TREE_DEPTH {
+        if ino == root {
+            return true;
+        }
+        match st.entries.get(&ino) {
+            Some(entry) if entry.parent != ino => ino = entry.parent,
+            _ => return false,
+        }
+    }
+    false
+}
+
+/// How deep [`ino_is_under`] walks before it gives up.
+const MAX_TREE_DEPTH: usize = 1024;
+
 /// Whether `uid` is `root` or lies under it, as far as the nodes table knows.
 fn under(core: &Core, root: &NodeUid, uid: &str) -> bool {
    let root = root.to_string();
@@ -336,7 +355,7 @@ impl Core {
                    core.require_uid_writable(authority)
                        .map_err(|e| core.errno_error(e, "move access"))?;
                }
-                if self.has_pending_work_under(&uid)? {
+                if self.has_pending_work_under(ino, &uid)? {
                    return Err(CoreError::conflict(
                        "it has changes that are not uploaded yet; wait for the upload to finish",
                    ));
@@ -410,10 +429,11 @@ impl Core {
        Ok(uid)
    }

-    /// Whether the queue owes Drive anything for `uid` or a node under it, or a
-    /// file under it is open for writing. Moving such a node away would strand
-    /// the pending change against a path that no longer leads to it.
-    fn has_pending_work_under(&self, uid: &NodeUid) -> CoreResult<bool> {
+    /// Whether the queue owes Drive anything for `uid` (inode `ino`) or a node
+    /// under it, or a file under it is open for writing. Moving such a node away
+    /// would strand the pending change against a path that no longer leads to
+    /// it.
+    fn has_pending_work_under(&self, ino: u64, uid: &NodeUid) -> CoreResult<bool> {
        let ops = self
            .db
            .pending_ops()
@@ -427,12 +447,18 @@ impl Core {
        }) {
            return Ok(true);
        }
-        // Collected first so no State lock is held across the nodes-table reads.
-        let mut writing = Vec::new();
+        // Open handles are placed in the tree by inode, not by uid in the nodes
+        // table. A file opened just after its create landed holds the
+        // placeholder uid until the tree catches up, and the nodes table no
+        // longer has that uid, so the move went ahead under an open write.
+        let mut writing = false;
        self.for_each_state(|st| {
-            writing.extend(st.active_writes.values().map(|w| w.uid.to_string()));
+            writing = st
+                .active_writes
+                .keys()
+                .any(|&open| ino_is_under(st, open, ino));
        });
-        Ok(writing.iter().any(|w| under(self, uid, w)))
+        Ok(writing)
    }

    /// Bring the source location level with a move Drive has made.
@@ -66,6 +66,7 @@ fn shared_entry_of(core: &Core, n: Node) -> DirEntry {
        size,
        modified: n.modification_time,
        pinned: false,
+        pinned_by_folder: false,
        cached: false,
        path: core.rel_path_for_uid(&n.uid).unwrap_or_default(),
        uid: n.uid.to_string(),
@@ -46,6 +46,7 @@ impl Daemon {
    /// cache and the database the last run left.
    pub(crate) fn start(dir: &Path, client: FakeClient) -> io::Result<Self> {
        log_to_test_output();
+        isolate_from_the_developer();
        let mountpoint = dir.join("mnt");
        let socket = dir.join("control.sock");
        std::fs::create_dir_all(&mountpoint)?;
@@ -138,6 +139,40 @@ impl Daemon {
        }
    }

+    /// Write the new file `path` under the mount, and let the drain send its
+    /// create only once the create holds the bytes. Otherwise a drain worker
+    /// still busy with the op before can claim the create before the release
+    /// attaches them, which the kernel sends after `close` returns. The file
+    /// then goes out empty, and the bytes follow as a revision, past a hook on
+    /// the next create.
+    pub(crate) fn write_new(&self, path: &Path, bytes: &[u8]) -> io::Result<()> {
+        let rel = path
+            .strip_prefix(&self.mountpoint)
+            .map_err(io::Error::other)?
+            .to_string_lossy()
+            .into_owned();
+        let paused = |paused| Request::SetSyncPaused {
+            paused,
+            until: None,
+        };
+        self.request(&paused(true))?;
+        std::fs::write(path, bytes)?;
+        let attached = wait_until(Duration::from_secs(30), || {
+            self.pending().is_ok_and(|items| {
+                items
+                    .iter()
+                    .any(|item| item.kind == "create" && item.path == rel && item.exportable)
+            })
+        });
+        self.request(&paused(false))?;
+        match attached {
+            true => Ok(()),
+            false => Err(io::Error::other(format!(
+                "{rel}: create never held the bytes"
+            ))),
+        }
+    }
+
    /// Stop the daemon and start it again on the same state and link.
    pub(crate) fn restart(mut self) -> io::Result<Self> {
        self.shut_down()?;
@@ -224,6 +259,33 @@ impl tracing::field::Visit for Message {
    }
 }

+/// Point the XDG directories of the whole test process at a scratch
+/// directory, once, before the first daemon starts.
+///
+/// The daemon reads `config.json` through `AppDirs` in a few places (the
+/// adopted device, the ignore rules, the profile), and those would otherwise
+/// be the developer's own: an adopted device of their real account made every
+/// sync folder fail to register against the fake Drive.
+fn isolate_from_the_developer() {
+    static ONCE: std::sync::Once = std::sync::Once::new();
+    ONCE.call_once(|| {
+        let home = scratch("xdg");
+        for (var, sub) in [
+            ("XDG_CONFIG_HOME", "config"),
+            ("XDG_STATE_HOME", "state"),
+            ("XDG_CACHE_HOME", "cache"),
+            ("XDG_DATA_HOME", "data"),
+        ] {
+            let path = home.join(sub);
+            std::fs::create_dir_all(&path).expect("create a simulation XDG directory");
+            // SAFETY: the simulations run one at a time (`--test-threads=1`,
+            // docs/TESTING.md), and this runs before the first of them starts a
+            // daemon, so no other thread reads the environment meanwhile.
+            unsafe { std::env::set_var(var, &path) };
+        }
+    });
+}
+
 /// A client for what `DriveApi` does not cover (sharing, Photos, devices),
 /// pointed at a closed local port so none of it leaves the machine.
 fn offline_client() -> ProtonDriveClient {
@@ -451,6 +513,36 @@ mod tests {
        let _ = std::fs::remove_dir_all(&dir);
    }

+    #[test]
+    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse sim:: -- --ignored`"]
+    fn a_partial_write_over_bytes_never_read_takes_another_write_at_once() {
+        // Nothing here ever read the file, so the release of a partial write
+        // had no cached base to fill its gaps from and queued an incomplete
+        // revision. The next write open on it failed with EIO (B204).
+        let drive = FakeDrive::new();
+        drive.device().write("f.txt", b"0123456789");
+        let dir = scratch("partial-write-unread-base");
+        let daemon = Daemon::start(&dir, drive.client(1, Faults::lan())).unwrap();
+        let path = daemon.mountpoint.join("f.txt");
+        let file = |bytes: &[u8]| Some(Entry::File(Arc::new(bytes.to_vec())));
+
+        write_at(&path, 2, b"ab").unwrap();
+        write_at(&path, 6, b"cd").unwrap();
+        assert!(
+            wait_until(Duration::from_secs(30), || {
+                daemon.pending().is_ok_and(|items| items.is_empty())
+                    && drive.tree().get("f.txt").cloned() == file(b"01ab45cd89")
+            }),
+            "{:?} {:?}",
+            daemon.pending(),
+            drive.tree()
+        );
+        assert_eq!(drive.tree().len(), 1, "{:?}", drive.tree());
+
+        assert!(matches!(daemon.stop(), Ok(MountOutcome::Shutdown)));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
    #[test]
    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse sim:: -- --ignored`"]
    fn a_file_deleted_offline_while_open_still_reads_and_takes_writes() {
@@ -729,7 +821,7 @@ mod tests {
        let path = daemon.mountpoint.join("c.bin");

        let create = daemon.client.hold_reply_to_next_create();
-        std::fs::write(&path, b"abc").unwrap();
+        daemon.write_new(&path, b"abc").unwrap();
        assert!(wait_until(Duration::from_secs(30), || create.reached()));
        let uid = drive.lookup("c.bin").unwrap();
        let landing = daemon.client.hold_next_landing(&uid);
@@ -775,7 +867,7 @@ mod tests {
        );

        let create = daemon.client.hold_reply_to_next_create();
-        std::fs::write(mnt.join("a.txt"), b"old").unwrap();
+        daemon.write_new(&mnt.join("a.txt"), b"old").unwrap();
        assert!(wait_until(Duration::from_secs(30), || create.reached()));
        let uid = drive.lookup("a.txt").unwrap();
        let landing = daemon.client.hold_next_landing(&uid);
@@ -813,7 +905,7 @@ mod tests {
        let daemon = Daemon::start(&dir, drive.client(1, Faults::lan())).unwrap();
        let mnt = daemon.mountpoint.clone();
        let create = daemon.client.hold_reply_to_next_create();
-        std::fs::write(mnt.join("a.txt"), b"old").unwrap();
+        daemon.write_new(&mnt.join("a.txt"), b"old").unwrap();
        assert!(wait_until(Duration::from_secs(30), || create.reached()));
        std::fs::write(mnt.join("a.txt"), b"newer").unwrap();
        let uid = drive.lookup("a.txt").unwrap();
@@ -996,7 +1088,7 @@ mod tests {
        );

        let create = daemon.client.hold_reply_to_next_create();
-        std::fs::write(mnt.join("x/c.bin"), b"abc").unwrap();
+        daemon.write_new(&mnt.join("x/c.bin"), b"abc").unwrap();
        assert!(wait_until(Duration::from_secs(30), || create.reached()));
        std::fs::rename(mnt.join("x/c.bin"), mnt.join("y/d")).unwrap();
        let uid = drive.lookup("x/c.bin").unwrap();
@@ -1074,7 +1166,7 @@ mod tests {
        take_logged();

        let create = daemon.client.hold_reply_to_next_create();
-        std::fs::write(mnt.join("x/c.bin"), b"abc").unwrap();
+        daemon.write_new(&mnt.join("x/c.bin"), b"abc").unwrap();
        assert!(wait_until(Duration::from_secs(30), || create.reached()));
        let uid = drive.lookup("x/c.bin").unwrap();
        // The read-back after the create, the one adopting it, and the size
@@ -1122,7 +1214,7 @@ mod tests {
        }));

        let create = daemon.client.hold_reply_to_next_create();
-        std::fs::write(mnt.join("x/c.bin"), b"abc").unwrap();
+        daemon.write_new(&mnt.join("x/c.bin"), b"abc").unwrap();
        assert!(wait_until(Duration::from_secs(30), || create.reached()));
        let uid = drive.lookup("x/c.bin").unwrap();
        let read_back = daemon.client.hold_next_read(&uid);
@@ -1165,7 +1257,7 @@ mod tests {
        }));

        let create = daemon.client.hold_reply_to_next_create();
-        std::fs::write(mnt.join("x/c.bin"), b"abc").unwrap();
+        daemon.write_new(&mnt.join("x/c.bin"), b"abc").unwrap();
        assert!(wait_until(Duration::from_secs(30), || create.reached()));
        // Long enough for the next event poll to bring the file's event, which
        // drops the folder's listing.
@@ -1290,7 +1382,9 @@ mod tests {
        let folder = drive.lookup("x").unwrap();

        let create = daemon.client.hold_next_create();
-        std::fs::write(mnt.join("x/removed-while-uploading"), b"abc").unwrap();
+        daemon
+            .write_new(&mnt.join("x/removed-while-uploading"), b"abc")
+            .unwrap();
        assert!(wait_until(Duration::from_secs(30), || create.reached()));
        std::fs::remove_file(mnt.join("x/removed-while-uploading")).unwrap();
        std::fs::remove_dir(mnt.join("x")).unwrap();
@@ -1535,7 +1629,9 @@ mod tests {
        let file = |bytes: &[u8]| Some(Entry::File(Arc::new(bytes.to_vec())));

        daemon.client.lose_reply_to_next_create();
-        std::fs::write(daemon.mountpoint.join("f.txt"), b"once").unwrap();
+        daemon
+            .write_new(&daemon.mountpoint.join("f.txt"), b"once")
+            .unwrap();
        assert!(
            wait_until(Duration::from_secs(30), || {
                daemon.pending().is_ok_and(|items| items.is_empty())
@@ -1565,7 +1661,7 @@ mod tests {

        let held = daemon.client.hold_reply_to_next_create();
        daemon.client.lose_reply_to_next_create();
-        std::fs::write(&path, b"first").unwrap();
+        daemon.write_new(&path, b"first").unwrap();
        assert!(wait_until(Duration::from_secs(30), || held.reached()));
        std::fs::write(&path, b"second").unwrap();
        drop(held);
@@ -1597,7 +1693,7 @@ mod tests {
        let path = daemon.mountpoint.join("f.txt");

        daemon.client.lose_reply_to_next_create();
-        std::fs::write(&path, b"gone").unwrap();
+        daemon.write_new(&path, b"gone").unwrap();
        assert!(wait_until(Duration::from_secs(30), || {
            drive.tree().contains_key("f.txt")
        }));
@@ -1630,7 +1726,7 @@ mod tests {

        let held = daemon.client.hold_reply_to_next_create();
        daemon.client.lose_reply_to_next_create();
-        std::fs::write(&path, b"first").unwrap();
+        daemon.write_new(&path, b"first").unwrap();
        assert!(wait_until(Duration::from_secs(30), || held.reached()));
        std::fs::write(&path, b"second").unwrap();
        drop(held);
@@ -1670,7 +1766,9 @@ mod tests {
        let file = |bytes: &[u8]| Some(Entry::File(Arc::new(bytes.to_vec())));

        daemon.client.lose_reply_to_next_create();
-        std::fs::write(daemon.mountpoint.join("f.txt"), b"first").unwrap();
+        daemon
+            .write_new(&daemon.mountpoint.join("f.txt"), b"first")
+            .unwrap();
        assert!(wait_until(Duration::from_secs(30), || {
            daemon
                .pending()
@@ -1709,7 +1807,9 @@ mod tests {
        let daemon = Daemon::start(&dir, drive.client(1, Faults::lan())).unwrap();

        daemon.client.lose_reply_to_next_create();
-        std::fs::write(daemon.mountpoint.join("f.txt"), b"first").unwrap();
+        daemon
+            .write_new(&daemon.mountpoint.join("f.txt"), b"first")
+            .unwrap();
        assert!(wait_until(Duration::from_secs(30), || {
            daemon
                .pending()
@@ -1803,7 +1903,7 @@ mod tests {
        let file = |bytes: &[u8]| Some(Entry::File(Arc::new(bytes.to_vec())));

        let held = daemon.client.hold_reply_to_next_create();
-        std::fs::write(mount.join("c.bin"), b"first").unwrap();
+        daemon.write_new(&mount.join("c.bin"), b"first").unwrap();
        assert!(wait_until(Duration::from_secs(30), || held.reached()));
        std::fs::rename(mount.join("c.bin"), mount.join("d")).unwrap();
        std::fs::write(mount.join("c.bin"), b"second").unwrap();
@@ -2069,4 +2169,245 @@ mod tests {
        assert!(matches!(daemon.stop(), Ok(MountOutcome::Shutdown)));
        let _ = std::fs::remove_dir_all(&dir);
    }
+
+    #[test]
+    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse sim:: -- --ignored`"]
+    fn a_pinned_folder_keeps_every_file_under_it_until_it_is_unpinned() {
+        let drive = FakeDrive::new();
+        let dir = scratch("pin-folder");
+        let daemon = Daemon::start(&dir, drive.client(1, Faults::lan())).unwrap();
+        std::fs::create_dir_all(daemon.mountpoint.join("Docs/sub")).unwrap();
+        std::fs::write(daemon.mountpoint.join("Docs/a.txt"), b"alpha").unwrap();
+        std::fs::write(daemon.mountpoint.join("Docs/sub/b.txt"), b"beta").unwrap();
+        assert!(wait_until(Duration::from_secs(30), || {
+            daemon.pending().is_ok_and(|items| items.is_empty())
+                && drive.lookup("Docs/sub/b.txt").is_some()
+        }));
+        daemon.request(&Request::PurgeCache).unwrap();
+        let entry = |folder: &str, name: &str| match daemon.request(&Request::ListDir {
+            path: folder.into(),
+        }) {
+            Ok(Response::Entries { entries }) => entries.into_iter().find(|e| e.name == name),
+            _ => None,
+        };
+        assert!(entry("Docs", "a.txt").is_some_and(|e| !e.cached && !e.pinned));
+
+        daemon
+            .request(&Request::Pin {
+                path: "Docs".into(),
+            })
+            .unwrap();
+        assert!(
+            wait_until(Duration::from_secs(30), || {
+                entry("Docs", "a.txt").is_some_and(|e| e.cached)
+                    && entry("Docs/sub", "b.txt").is_some_and(|e| e.cached)
+            }),
+            "the folder's files were downloaded in the background"
+        );
+        let a = entry("Docs", "a.txt").unwrap();
+        assert!(a.pinned && a.pinned_by_folder);
+        assert!(entry("", "Docs").is_some_and(|e| e.pinned && !e.pinned_by_folder));
+        assert!(
+            daemon
+                .request(&Request::Unpin {
+                    path: "Docs/a.txt".into(),
+                })
+                .is_err(),
+            "a file kept through its folder cannot be unpinned on its own"
+        );
+
+        daemon
+            .request(&Request::Unpin {
+                path: "Docs".into(),
+            })
+            .unwrap();
+        let a = entry("Docs", "a.txt").unwrap();
+        assert!(!a.pinned && !a.pinned_by_folder && !a.cached);
+
+        assert!(matches!(daemon.stop(), Ok(MountOutcome::Shutdown)));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse sim:: -- --ignored`"]
+    fn a_folder_pinned_while_a_create_in_it_lands_keeps_that_file() {
+        // The pin's download of a file started before the file's landing set
+        // its modification time from Drive, and ended after it: the blob was
+        // stored under the old time, and the file never read as cached (B208).
+        let drive = FakeDrive::new();
+        let dir = scratch("pin-folder-landing");
+        let daemon = Daemon::start(&dir, drive.client(1, Faults::lan())).unwrap();
+        std::fs::create_dir(daemon.mountpoint.join("Docs")).unwrap();
+        assert!(wait_until(Duration::from_secs(30), || {
+            daemon.pending().is_ok_and(|items| items.is_empty())
+        }));
+        let entry = || match daemon.request(&Request::ListDir {
+            path: "Docs".into(),
+        }) {
+            Ok(Response::Entries { entries }) => entries.into_iter().find(|e| e.name == "a.txt"),
+            _ => None,
+        };
+
+        // Drive stamps the file with the time it landed, a second after it
+        // was written, so the landing moves its modification time.
+        let paused = |paused| Request::SetSyncPaused {
+            paused,
+            until: None,
+        };
+        daemon.request(&paused(true)).unwrap();
+        std::fs::write(daemon.mountpoint.join("Docs/a.txt"), b"alpha").unwrap();
+        std::thread::sleep(Duration::from_millis(1100));
+        let landing = daemon.client.hold_next_landing_of_any();
+        daemon.request(&paused(false)).unwrap();
+        assert!(wait_until(Duration::from_secs(30), || landing.reached()));
+        let real = drive.lookup("Docs/a.txt").unwrap();
+        let read_back = daemon.client.hold_next_read(&real);
+        drop(landing);
+        assert!(wait_until(Duration::from_secs(30), || read_back.reached()));
+        let written = entry().unwrap().modified;
+
+        // Without the blob the landing kept, the pin downloads the file.
+        daemon.request(&Request::PurgeCache).unwrap();
+
+        let download = daemon.client.hold_next_download(&real);
+        take_logged();
+        daemon
+            .request(&Request::Pin {
+                path: "Docs".into(),
+            })
+            .unwrap();
+        assert!(wait_until(Duration::from_secs(30), || download.reached()));
+        drop(read_back);
+        assert!(wait_until(Duration::from_secs(30), || {
+            entry().is_some_and(|e| e.modified != written)
+        }));
+        drop(download);
+        let mut logged = Vec::new();
+        assert!(
+            wait_until(Duration::from_secs(30), || {
+                logged.extend(take_logged());
+                logged
+                    .iter()
+                    .any(|line| line.starts_with("pin folder: done"))
+            }),
+            "{logged:?}"
+        );
+
+        assert!(
+            entry().is_some_and(|e| e.cached),
+            "the file kept through its folder is available offline: {:?}",
+            entry()
+        );
+
+        assert!(matches!(daemon.stop(), Ok(MountOutcome::Shutdown)));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// Register `local` as a synced folder in `mode` and wait until the daemon
+    /// lists it that way, returning its id.
+    fn sync_folder(daemon: &Daemon, local: &Path, mode: &str) -> i64 {
+        std::fs::create_dir_all(local).unwrap();
+        let path = local.canonicalize().unwrap().to_string_lossy().into_owned();
+        daemon
+            .request(&Request::AddSyncFolder {
+                local_path: path.clone(),
+            })
+            .unwrap();
+        let listed = |mode: &str| match daemon.request(&Request::ListSyncFolders) {
+            Ok(Response::SyncFolders { items }) => items
+                .into_iter()
+                .find(|f| {
+                    f.local_path == path
+                        && f.mode == mode
+                        && f.pending_mode.is_none()
+                        && f.last_sync > 0
+                })
+                .map(|f| f.id),
+            _ => None,
+        };
+        assert!(
+            wait_until(Duration::from_secs(30), || listed("mirror").is_some()),
+            "{} was registered: {:?}",
+            local.display(),
+            daemon.request(&Request::ListSyncFolders)
+        );
+        let id = listed("mirror").unwrap();
+        // Reads lag behind creates, so the remote folder the first pass made
+        // is not readable at once; switching modes reads it.
+        std::thread::sleep(Duration::from_millis(200));
+        if mode != "mirror" {
+            daemon
+                .request(&Request::SetSyncFolderMode {
+                    id,
+                    mode: mode.into(),
+                })
+                .unwrap();
+            assert!(
+                wait_until(Duration::from_secs(30), || listed(mode).is_some()
+                    && is_mounted(local)),
+                "{} switched to {mode}: {:?}",
+                local.display(),
+                daemon.request(&Request::ListSyncFolders)
+            );
+        }
+        id
+    }
+
+    #[test]
+    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse sim:: -- --ignored`"]
+    fn a_move_out_of_an_on_demand_folder_refuses_a_file_still_open_for_writing() {
+        // The account run's "move refuses a file still being written" case let
+        // a move from an on-demand synced folder into a mirror folder go ahead
+        // while the file was open, so the write landed after the move.
+        let drive = FakeDrive::new();
+        let dir = scratch("move-open-out-of-ondemand");
+        let daemon = Daemon::start(&dir, drive.client(1, Faults::lan())).unwrap();
+        let ondemand = dir.join("ondemand");
+        let mirror = dir.join("mirror");
+        sync_folder(&daemon, &ondemand, "ondemand");
+        sync_folder(&daemon, &mirror, "mirror");
+
+        let source = ondemand.join("open");
+        std::fs::create_dir(&source).unwrap();
+        daemon.request(&Request::SyncNow { id: None }).unwrap();
+        assert!(wait_until(Duration::from_secs(30), || {
+            daemon.pending().is_ok_and(|items| items.is_empty())
+        }));
+        // The account run opened the file a moment after its create landed:
+        // the queue was already empty, and the tree still had the
+        // placeholder uid it gave the file.
+        let landing = daemon.client.hold_next_landing_of_any();
+        {
+            let mut file = std::fs::File::create(source.join("open.txt")).unwrap();
+            std::io::Write::write_all(&mut file, b"before").unwrap();
+            file.sync_all().unwrap();
+        }
+        assert!(wait_until(Duration::from_secs(30), || landing.reached()));
+
+        let mut file = std::fs::OpenOptions::new()
+            .append(true)
+            .open(source.join("open.txt"))
+            .unwrap();
+        std::io::Write::write_all(&mut file, b" and after").unwrap();
+        let moved = daemon.request(&Request::Move {
+            path: source.to_string_lossy().into_owned(),
+            new_parent: mirror
+                .canonicalize()
+                .unwrap()
+                .to_string_lossy()
+                .into_owned(),
+        });
+        drop(file);
+        drop(landing);
+        match moved {
+            Err(e) => assert!(
+                e.to_string().contains("not uploaded yet"),
+                "refused for another reason: {e}"
+            ),
+            Ok(answer) => panic!("the move went ahead: {answer:?}"),
+        }
+
+        assert!(matches!(daemon.stop(), Ok(MountOutcome::Shutdown)));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
 }
@@ -31,6 +31,9 @@
 //! - **A full account** ([`FakeDrive::set_quota`]) refusing uploads with
 //!   `InsufficientQuota`.
 //!
+//! It also holds the account's computers, each with a root folder outside My
+//! files, so a simulated daemon can register its own and sync a local folder.
+//!
 //! A test can also hold the next read of one node on its way to Drive
 //! ([`FakeClient::hold_next_read`]), to make a change while the daemon waits
 //! for the answer, or on its way back ([`FakeClient::hold_answer_to_next_read`]),
@@ -54,9 +57,12 @@ use parking_lot::Mutex;
 use proton_drive_rs::proton_sdk::account::Quota;
 use proton_drive_rs::proton_sdk::api::ResponseCode;
 use proton_drive_rs::proton_sdk::error::{ProtonApiError, ProtonError, Result};
-use proton_drive_rs::proton_sdk::ids::{DriveEventId, LinkId, NodeUid, VolumeId};
+use proton_drive_rs::proton_sdk::ids::{
+    DeviceUid, DriveEventId, LinkId, NodeUid, ShareId, VolumeId,
+};
 use proton_drive_rs::{
-    DriveEvent, DriveEventScopeId, Node, NodeKind, NodeMoveItem, RevisionState, Thumbnail,
+    Device as Computer, DeviceType, DriveEvent, DriveEventScopeId, Node, NodeKind, NodeMoveItem,
+    RevisionState, Thumbnail,
 };
 use sha1::{Digest as _, Sha1};

@@ -111,6 +117,9 @@ struct Server {
    block_pattern: Vec<u64>,
    /// The account's storage limit in bytes.
    max_space: i64,
+    /// The account's computers, oldest first, as `(name, type, root folder)`.
+    /// [`Computer`] is not `Clone`, so each answer builds them afresh.
+    devices: Vec<(String, DeviceType, NodeUid)>,
 }

 impl Server {
@@ -162,6 +171,20 @@ impl Server {
        false
    }

+    /// The `n`th computer of the account, as Drive lists it.
+    fn computer(&self, n: usize) -> Computer {
+        let (name, device_type, root) = &self.devices[n];
+        Computer {
+            uid: DeviceUid::new(format!("device{}", n + 1)),
+            device_type: *device_type,
+            name: Ok(name.clone()),
+            root_folder_uid: root.clone(),
+            creation_time: self.current(root).map_or(0, |remote| remote.created),
+            last_sync_time: None,
+            share_id: ShareId::new(format!("device-share{}", n + 1)),
+        }
+    }
+
    fn mint_uid(&mut self) -> NodeUid {
        self.next_link += 1;
        uid(&format!("L{}", self.next_link))
@@ -305,6 +328,7 @@ impl FakeDrive {
            events: Vec::new(),
            block_pattern: vec![pdfs_core::cache::BLOCK_SIZE],
            max_space: 1 << 40,
+            devices: Vec::new(),
        };
        let now = now_secs();
        server.nodes.insert(
@@ -338,6 +362,8 @@ impl FakeDrive {
            hold: Mutex::new(None),
            hold_answer: Mutex::new(None),
            hold_trash: Mutex::new(None),
+            hold_download: Mutex::new(None),
+            hold_any_landing: AtomicBool::new(false),
            hold_landing: Mutex::new(None),
            drop_after_create: AtomicBool::new(false),
            lose_create_reply: AtomicBool::new(false),
@@ -616,8 +642,13 @@ struct ClientInner {
    hold_answer: Mutex<Option<Arc<HoldState>>>,
    /// The trash [`FakeClient::hold_next_trash`] is waiting for.
    hold_trash: Mutex<Option<Arc<HoldState>>>,
+    /// The download [`FakeClient::hold_next_download`] is waiting for.
+    hold_download: Mutex<Option<Arc<HoldState>>>,
    /// The landing [`FakeClient::hold_next_landing`] is waiting for.
    hold_landing: Mutex<Option<Arc<HoldState>>>,
+    /// Set by [`FakeClient::hold_next_landing_of_any`]: hold whichever node
+    /// lands next.
+    hold_any_landing: AtomicBool,
    /// Set by [`FakeClient::drop_link_after_next_create`].
    drop_after_create: AtomicBool,
    /// Set by [`FakeClient::lose_reply_to_next_create`].
@@ -755,6 +786,18 @@ impl FakeClient {
        Held(state)
    }

+    /// Hold the next download of `uid`'s content once Drive has answered it,
+    /// before the bytes reach the daemon, until the answer is dropped.
+    pub(crate) fn hold_next_download(&self, uid: &NodeUid) -> Held {
+        let state = Arc::new(HoldState {
+            uid: uid.clone(),
+            reached: AtomicBool::new(false),
+            released: AtomicBool::new(false),
+        });
+        *self.0.hold_download.lock() = Some(state.clone());
+        Held(state)
+    }
+
    /// Hold the drain once the next upload to `uid` has landed and its blob
    /// is let go of, before the tree has the node (`DriveApi::landing`), until
    /// the answer is dropped.
@@ -768,6 +811,14 @@ impl FakeClient {
        Held(state)
    }

+    /// [`FakeClient::hold_next_landing`] for whichever node lands next, such
+    /// as a new file, whose uid Drive has not minted yet.
+    pub(crate) fn hold_next_landing_of_any(&self) -> Held {
+        let held = self.hold_next_landing(&uid("*"));
+        self.0.hold_any_landing.store(true, Ordering::SeqCst);
+        held
+    }
+
    /// Make the next file create on Drive, then hold its answer until the
    /// answer is dropped, as a slow link does.
    pub(crate) fn hold_reply_to_next_create(&self) -> Held {
@@ -1396,6 +1447,8 @@ impl DriveApi for FakeClient {
                    .ok_or_else(|| api(ResponseCode::DoesNotExist, "file not found"))
            })
            .await?;
+        self.wait_if_held(&self.0.hold_download, std::slice::from_ref(uid))
+            .await;
        output.write_all(&content).map_err(io_error)
    }

@@ -1484,8 +1537,12 @@ impl DriveApi for FakeClient {
    fn landing(&self, uid: &NodeUid) {
        let state = {
            let mut hold = self.0.hold_landing.lock();
+            let any = self.0.hold_any_landing.load(Ordering::SeqCst);
            match hold.as_ref() {
-                Some(state) if state.uid == *uid => hold.take(),
+                Some(state) if any || state.uid == *uid => {
+                    self.0.hold_any_landing.store(false, Ordering::SeqCst);
+                    hold.take()
+                }
                _ => None,
            }
        };
@@ -1506,6 +1563,42 @@ impl DriveApi for FakeClient {
        .await
    }

+    async fn enumerate_devices(&self) -> Result<Vec<Computer>> {
+        self.request(false, |server| {
+            Ok((0..server.devices.len())
+                .map(|n| server.computer(n))
+                .collect())
+        })
+        .await
+    }
+
+    async fn create_device(&self, name: &str, device_type: DeviceType) -> Result<Computer> {
+        self.request(true, |server| {
+            // A device root has no parent: like on Drive, it is not in My files.
+            // It is listed at once, as the My files root is: the listing lag is
+            // about children appearing, and the daemon lists the new root next.
+            let root = server.mint_uid();
+            let now = now_secs();
+            server.nodes.insert(
+                root.clone(),
+                vec![(
+                    Instant::now() - HISTORY,
+                    Some(Remote {
+                        parent: None,
+                        name: name.to_owned(),
+                        trashed: false,
+                        created: now,
+                        modified: now,
+                        file: None,
+                    }),
+                )],
+            );
+            server.devices.push((name.to_owned(), device_type, root));
+            Ok(server.computer(server.devices.len() - 1))
+        })
+        .await
+    }
+
    async fn enumerate_trash_node_uids(&self) -> Result<Vec<NodeUid>> {
        self.request(false, |server| {
            Ok(server
@@ -538,6 +538,7 @@ fn build_window(app: &adw::Application) {
            reload_pending: Cell::new(false),
            loading: Cell::new(false),
            has_more: Cell::new(false),
+            library: Cell::new(true),
            page_waiters: RefCell::new(Vec::new()),
            width: Cell::new(0),
            photo_tex: RefCell::new(HashMap::new()),
@@ -579,6 +580,8 @@ fn build_window(app: &adw::Application) {
                detail: locations_widgets.card_detail.clone(),
                pause: locations_widgets.pause.clone(),
                paused: Cell::new(false),
+                sign_in: locations_widgets.card_sign_in.clone(),
+                restart: locations_widgets.card_restart.clone(),
            },
            queue: QueueState {
                group: locations_widgets.queue_group.clone(),
@@ -1290,6 +1293,12 @@ fn install_launch_actions(ui: &Rc<Ui>, app: &adw::Application, window: &adw::App
        if ui_page.session.borrow().is_none() {
            return;
        }
+        // Signed in, but Proton refused the session (the tray's "Sign In
+        // Again…"): the login page, with the rest of the app still reachable.
+        if page == "login" {
+            show_login(&ui_page);
+            return;
+        }
        // Activity lives on as the Sync page's History view.
        if page == "activity" {
            ui_page.locations.views.set_visible_child_name("history");
@@ -520,9 +520,9 @@ pub(crate) fn clear_selection(ui: &Rc<Ui>) {
 }

 /// Reflect the current selection in the bulk bar: how many are selected, and
-/// which bulk actions apply to that mix. Offline state is a file-only notion, so
-/// a folder anywhere in the selection disables the two pin buttons rather than
-/// half-failing once pressed.
+/// which bulk actions apply to that mix. An entry kept offline through a pinned
+/// folder above it cannot be made online only on its own, so it does not count
+/// towards Make online only.
 pub(crate) fn sync_bulk_bar(ui: &Rc<Ui>) {
    let entries = selected_entries(ui);
    // One selected entry is the details pane's job; the bar is for a batch.
@@ -530,8 +530,7 @@ pub(crate) fn sync_bulk_bar(ui: &Rc<Ui>) {
        ui.browser.bulk.set_reveal_child(false);
        return;
    }
-    let files_only = entries.iter().all(|e| !e.is_dir);
-    let any_pinned = entries.iter().any(|e| e.pinned);
+    let any_pinned = entries.iter().any(|e| e.pinned && !e.pinned_by_folder);
    let any_unpinned = entries.iter().any(|e| !e.pinned);
    let mounted = *ui.mounted.borrow();
    ui.browser.bulk_label.set_label(&ngettext_f(
@@ -541,12 +540,8 @@ pub(crate) fn sync_bulk_bar(ui: &Rc<Ui>) {
        &[],
    ));
    ui.browser.bulk_trash.set_sensitive(mounted);
-    ui.browser
-        .bulk_pin
-        .set_sensitive(mounted && files_only && any_unpinned);
-    ui.browser
-        .bulk_unpin
-        .set_sensitive(mounted && files_only && any_pinned);
+    ui.browser.bulk_pin.set_sensitive(mounted && any_unpinned);
+    ui.browser.bulk_unpin.set_sensitive(mounted && any_pinned);
    ui.browser.bulk.set_reveal_child(true);
 }

@@ -652,16 +647,19 @@ pub(crate) fn restore_uids(ui: &Rc<Ui>, uids: Vec<String>, count: usize) {
    );
 }

-/// Pin or unpin every selected file, one request at a time.
+/// Pin or unpin every selected entry, one request at a time. A folder's files
+/// download in the background, so its request returns before they are there.
 pub(crate) fn run_bulk_pin(ui: &Rc<Ui>, entries: Vec<DirEntry>, pin: bool) {
    let socket = ui.dirs.control_socket();
    // Only the entries that need changing: re-pinning an already-pinned file is
-    // a wasted round-trip, and it would inflate the count the toast reports.
-    let paths: Vec<String> = entries
+    // a wasted round-trip, and it would inflate the count the toast reports. One
+    // kept through a pinned folder above it has no pin of its own to remove.
+    let changing: Vec<&DirEntry> = entries
        .iter()
-        .filter(|e| !e.is_dir && e.pinned != pin)
-        .map(|e| entry_rel(ui, e))
+        .filter(|e| !e.pinned_by_folder && e.pinned != pin)
        .collect();
+    let any_folder = changing.iter().any(|e| e.is_dir);
+    let paths: Vec<String> = changing.iter().map(|e| entry_rel(ui, e)).collect();
    if paths.is_empty() {
        return;
    }
@@ -698,13 +696,27 @@ pub(crate) fn run_bulk_pin(ui: &Rc<Ui>, entries: Vec<DirEntry>, pin: bool) {
            (0, None) => {}
            (n, _) => toast(
                &ui,
-                &if pin {
+                &if pin && any_folder {
+                    ngettext_f(
+                        "Making {n} item available offline…",
+                        "Making {n} items available offline…",
+                        n as u64,
+                        &[],
+                    )
+                } else if pin {
                    ngettext_f(
                        "{n} file is now available offline",
                        "{n} files are now available offline",
                        n as u64,
                        &[],
                    )
+                } else if any_folder {
+                    ngettext_f(
+                        "{n} item is now online only",
+                        "{n} items are now online only",
+                        n as u64,
+                        &[],
+                    )
                } else {
                    ngettext_f(
                        "{n} file is now online only",
@@ -860,13 +872,17 @@ pub(crate) fn entry_context_menu(ui: &Rc<Ui>, entry: &DirEntry) -> ActionMenu {
    }
    menu.section();

-    if !entry.is_dir {
+    // Kept through a pinned folder above it, the entry has no pin of its own
+    // to remove: the check shows that state without offering to change it.
+    if entry.pinned_by_folder {
+        menu.locked_toggle(&gettext("Available offline"), true);
+    } else {
        let (ui_c, entry_c) = (ui.clone(), entry.clone());
        menu.toggle(&gettext("Available offline"), entry.pinned, move |_| {
            toggle_pin(&ui_c, &entry_c)
        });
-        menu.section();
    }
+    menu.section();

    let (ui_c, entry_c) = (ui.clone(), entry.clone());
    menu.item(&gettext("Share…"), move || {
@@ -908,9 +924,8 @@ pub(crate) fn entry_context_menu(ui: &Rc<Ui>, entry: &DirEntry) -> ActionMenu {
 /// simply absent here rather than offered and then refused.
 pub(crate) fn bulk_context_menu(ui: &Rc<Ui>, entries: Vec<DirEntry>) -> ActionMenu {
    let mut menu = ActionMenu::new();
-    // Offline state is a file-only notion; the check shows whether the whole
-    // batch already is.
-    if entries.iter().all(|e| !e.is_dir) {
+    // The check shows whether the whole batch already is offline.
+    {
        let (ui_c, batch) = (ui.clone(), entries.clone());
        let all_pinned = entries.iter().all(|e| e.pinned);
        menu.toggle(&gettext("Available offline"), all_pinned, move |pin| {
@@ -1147,6 +1162,7 @@ pub(crate) fn toggle_pin(ui: &Rc<Ui>, entry: &DirEntry) {
    let rx = spawn_request(ui.dirs.control_socket(), req);
    let name = entry.name.clone();
    let pinned = entry.pinned;
+    let is_dir = entry.is_dir;
    let ui = ui.clone();
    glib::spawn_future_local(async move {
        match rx.recv().await {
@@ -1166,6 +1182,9 @@ pub(crate) fn toggle_pin(ui: &Rc<Ui>, entry: &DirEntry) {
                    &ui,
                    &if pinned {
                        gettext_f("“{name}” is now online only", &[("name", &name)])
+                    } else if is_dir {
+                        // The daemon downloads a folder's files in the background.
+                        gettext_f("Making “{name}” available offline…", &[("name", &name)])
                    } else {
                        gettext_f("“{name}” is now available offline", &[("name", &name)])
                    },
@@ -2487,16 +2506,19 @@ pub(crate) fn start_upload(ui: &Rc<Ui>, sources: Vec<String>) {
    });
 }

-/// The sync-state badge for an entry: `(icon, css-class)`, or `None` for folders
-/// (which carry no per-file cache state). A sync issue ranks first, on folders
-/// too: the change waits for the user. Pinned (kept offline) ranks above merely
-/// cached (downloaded, evictable); everything else is online-only.
+/// The sync-state badge for an entry: `(icon, css-class)`. A folder carries no
+/// cache state of its own, so it has one only when kept offline. A sync issue
+/// ranks first, on folders too: the change waits for the user. Pinned (kept
+/// offline) ranks above merely cached (downloaded, evictable); everything else
+/// is online-only.
 pub(crate) fn badge_for(entry: &DirEntry) -> Option<(&'static str, &'static str)> {
    if entry.issue.is_some() {
        return Some(("dialog-warning-symbolic", "badge-issue"));
    }
    if entry.is_dir {
-        return None;
+        return entry
+            .pinned
+            .then_some(("pdfs-offline-symbolic", "badge-pinned"));
    }
    Some(if entry.pinned {
        ("pdfs-offline-symbolic", "badge-pinned")
@@ -2905,6 +2927,7 @@ pub(crate) fn repaint_search(ui: &Rc<Ui>, hits: &[SearchHit]) {
            size: h.size,
            modified: h.modified,
            pinned: h.pinned,
+            pinned_by_folder: false,
            cached: h.cached,
            uid: h.uid.clone(),
            path: h.path.clone(),
@@ -2965,6 +2988,7 @@ mod tests {
            size,
            modified,
            pinned: false,
+            pinned_by_folder: false,
            cached: false,
            uid: String::new(),
            path: String::new(),
@@ -2992,6 +3016,8 @@ mod tests {

        let mut folder = entry("d", true, 0, 0);
        assert_eq!(badge_for(&folder), None);
+        folder.pinned = true;
+        assert_eq!(badge_for(&folder).unwrap().1, "badge-pinned");
        folder.issue = Some(SyncIssue::Missing);
        assert_eq!(badge_for(&folder).unwrap().1, "badge-issue");
    }
@@ -46,6 +46,10 @@ pub(crate) struct SyncCard {
    pub(crate) pause: adw::SplitButton,
    /// Whether the last status said paused, so the button knows which way to go.
    pub(crate) paused: Cell<bool>,
+    /// Shown only while Proton refuses the session; opens the sign-in page.
+    pub(crate) sign_in: gtk4::Button,
+    /// Shown only while the daemon is older than the app; restarts it.
+    pub(crate) restart: gtk4::Button,
 }

 /// What a folder row's controls are built from. The subtitle and progress bar
@@ -108,6 +112,8 @@ pub(crate) struct LocationsWidgets {
    pub(crate) card_icon: gtk4::Image,
    pub(crate) card_title: gtk4::Label,
    pub(crate) card_detail: gtk4::Label,
+    pub(crate) card_sign_in: gtk4::Button,
+    pub(crate) card_restart: gtk4::Button,
    pub(crate) pause: adw::SplitButton,
    pub(crate) queue_group: adw::PreferencesGroup,
    pub(crate) retry_all: gtk4::Button,
@@ -134,7 +140,7 @@ pub(crate) fn build_locations_page(history: &gtk4::Widget) -> (gtk4::Widget, Loc
        .build();
    add_folder.add_css_class("flat");
    let transfers_group = build_transfers_group();
-    let (card, card_icon, card_title, card_detail) = build_sync_card();
+    let (card, card_icon, card_title, card_detail, card_sign_in, card_restart) = build_sync_card();
    let pause = build_pause_button();
    let (queue_group, retry_all) = build_queue_group();
    let conflicts_group = adw::PreferencesGroup::builder()
@@ -253,6 +259,8 @@ pub(crate) fn build_locations_page(history: &gtk4::Widget) -> (gtk4::Widget, Loc
        card_icon,
        card_title,
        card_detail,
+        card_sign_in,
+        card_restart,
        pause,
        queue_group,
        retry_all,
@@ -290,6 +298,16 @@ pub(crate) fn wire_locations(ui: &Rc<Ui>, retry: &gtk4::Button, add_folder: &gtk
    let ui_add = ui.clone();
    add_folder.connect_clicked(move |_| prompt_add_sync_folder(&ui_add));
    wire_pause(ui);
+    let ui_sign_in = ui.clone();
+    ui.locations
+        .card
+        .sign_in
+        .connect_clicked(move |_| show_login(&ui_sign_in));
+    let ui_restart = ui.clone();
+    ui.locations
+        .card
+        .restart
+        .connect_clicked(move |_| restart_service_then(&ui_restart, |_| {}));
    let ui_retry = ui.clone();
    ui.locations
        .queue
@@ -379,9 +397,16 @@ pub(crate) fn paint_sync_banner(ui: &Rc<Ui>) {
    state.banner.set_revealed(away && title.is_some());
 }

-/// The status hero: a large state icon, the state in words, and what it
-/// means.
-fn build_sync_card() -> (gtk4::Box, gtk4::Image, gtk4::Label, gtk4::Label) {
+/// The status hero: a large state icon, the state in words, what it means,
+/// and the way out when there is one only the user can take.
+fn build_sync_card() -> (
+    gtk4::Box,
+    gtk4::Image,
+    gtk4::Label,
+    gtk4::Label,
+    gtk4::Button,
+    gtk4::Button,
+) {
    let icon = gtk4::Image::builder()
        .icon_name("pdfs-sync-symbolic")
        .pixel_size(48)
@@ -408,9 +433,25 @@ fn build_sync_card() -> (gtk4::Box, gtk4::Image, gtk4::Label, gtk4::Label) {
    let card = gtk4::Box::new(gtk4::Orientation::Horizontal, 18);
    card.add_css_class("card");
    card.add_css_class("sync-card");
+    let sign_in = gtk4::Button::builder()
+        .label(gettext("Sign In Again"))
+        .valign(gtk4::Align::Center)
+        .visible(false)
+        .build();
+    sign_in.add_css_class("pill");
+    sign_in.add_css_class("suggested-action");
+    let restart = gtk4::Button::builder()
+        .label(gettext("Restart"))
+        .valign(gtk4::Align::Center)
+        .visible(false)
+        .build();
+    restart.add_css_class("pill");
+    restart.add_css_class("suggested-action");
    card.append(&icon);
    card.append(&text);
-    (card, icon, title, detail)
+    card.append(&sign_in);
+    card.append(&restart);
+    (card, icon, title, detail, sign_in, restart)
 }

 /// Pause/Resume, with timed pauses in its menu.
@@ -140,6 +140,9 @@ pub(crate) struct GalleryState {
    pub(crate) loading: Cell<bool>,
    /// Whether the last page came back full, so there may be more to load.
    pub(crate) has_more: Cell<bool>,
+    /// Whether the account has a photo library. Until the daemon says it has
+    /// none, assume it does, so Upload is not greyed out while the page loads.
+    pub(crate) library: Cell<bool>,
    /// Run once the page in flight has landed in [`Self::model`] — how the
    /// lightbox steps past the last loaded photo.
    pub(crate) page_waiters: RefCell<Vec<Box<dyn FnOnce()>>>,
@@ -3341,6 +3344,12 @@ pub(crate) fn load_gallery(ui: &Rc<Ui>, append: bool) {
                items,
                counts,
            })) => {
+                // Nothing can go into a library the account does not have; the
+                // SDK refuses the upload before sending it (issue #38).
+                ui.gallery.library.set(available);
+                ui.gallery
+                    .upload
+                    .set_sensitive(available && *ui.mounted.borrow());
                if !available {
                    gallery_status(
                        &ui,
@@ -622,6 +622,7 @@ pub(crate) fn shared_item_as_entry(item: &SharedItem) -> DirEntry {
        size: 0,
        modified: item.modified,
        pinned: false,
+        pinned_by_folder: false,
        cached: false,
        uid: item.uid.clone(),
        path: item.path.clone(),
@@ -836,6 +836,13 @@ pub(crate) fn wire_retry(ui: &Rc<Ui>) {
        .connect_clicked(move |_| restart_service_then(&ui_trash, load_trash));
 }

+/// Show the sign-in page while a session is still stored, because Proton has
+/// refused it. The sidebar stays, so the user can go back to cached files; a
+/// login moves on to the files as from any sign-in ([`refresh`]).
+pub(crate) fn show_login(ui: &Rc<Ui>) {
+    ui.stack.set_visible_child_name("login");
+}
+
 /// Repaint the window from the cached login identity, then ask the daemon for
 /// its status and transfers. Runs at startup, after a login and after a service
 /// restart; the daemon's event feed keeps both current in between. The identity
@@ -951,7 +958,9 @@ fn quota_display(max_space: i64, used_space: i64) -> (f64, String) {
 pub(crate) fn set_mounted(ui: &Rc<Ui>, mounted: bool) {
    *ui.mounted.borrow_mut() = mounted;
    sync_mounted_actions(ui, mounted);
-    ui.gallery.upload.set_sensitive(mounted);
+    ui.gallery
+        .upload
+        .set_sensitive(mounted && ui.gallery.library.get());
    ui.details.details.pin_row.set_sensitive(mounted);
    ui.details.details.rename_button.set_sensitive(mounted);
    ui.details.details.trash_button.set_sensitive(mounted);
@@ -1221,6 +1230,9 @@ pub(crate) fn paint_status(ui: &Rc<Ui>, status: Response) {
        failing_error,
        paused,
        paused_until,
+        session_expired,
+        tokens_unsaved,
+        version,
        ..
    } = status
    else {
@@ -1231,7 +1243,13 @@ pub(crate) fn paint_status(ui: &Rc<Ui>, status: Response) {
    // in it: it is why a file that looks saved is not on the remote
    // yet, and offline is usually the reason it is still queued.
    let queued = i18n::pending_summary(pending_uploads, pending_changes);
-    let state = if paused {
+    let state = if session_expired {
+        SyncState::SessionExpired { queued }
+    } else if tokens_unsaved {
+        SyncState::TokensUnsaved
+    } else if pdfs_core::control::daemon_outdated(&version) {
+        SyncState::Outdated { running: version }
+    } else if paused {
        SyncState::Paused {
            until: paused_until,
            queued,
@@ -1294,6 +1312,20 @@ pub(crate) fn paint_disconnected(ui: &Rc<Ui>) {

 /// What the sidebar's status strip reports, most urgent first.
 pub(crate) enum SyncState {
+    /// Proton refused the session: nothing reaches it until the user signs in
+    /// again. Outranks a pause, which it makes moot.
+    SessionExpired {
+        queued: Option<String>,
+    },
+    /// The keyring refuses the session's refreshed tokens. Sync goes on, but
+    /// a reboot before the keyring takes them signs the user out.
+    TokensUnsaved,
+    /// The daemon is an older release than this window: an upgrade replaced
+    /// the files but left the service running, with the old release's bugs,
+    /// until it restarts (#33). `running` is empty when it is too old to say.
+    Outdated {
+        running: String,
+    },
    /// The user paused syncing; nothing goes up until it resumes. Outranks
    /// everything else, because it is the reason for everything else.
    Paused {
@@ -1328,7 +1360,44 @@ pub(crate) enum SyncState {
 fn paint_sync_status(ui: &Rc<Ui>, state: SyncState) {
    let paused = matches!(state, SyncState::Paused { .. });
    let connected = !matches!(state, SyncState::Disconnected | SyncState::NotResponding);
+    let expired = matches!(state, SyncState::SessionExpired { .. });
+    let outdated = matches!(state, SyncState::Outdated { .. });
    let (icon, class, title, detail) = match state {
+        SyncState::SessionExpired { queued } => (
+            "dialog-password-symbolic",
+            Some("error"),
+            gettext("Session expired"),
+            Some(match queued {
+                // Translators: {queued} says what is waiting, such as "3 uploads
+                // queued".
+                Some(queued) => {
+                    gettext_f("{queued} · sign in again to sync", &[("queued", &queued)])
+                }
+                None => gettext("Sign in again to sync"),
+            }),
+        ),
+        SyncState::TokensUnsaved => (
+            "dialog-warning-symbolic",
+            Some("warning"),
+            gettext("Sign-in not saved"),
+            Some(gettext(
+                "Unlock your keyring, or the next reboot signs you out",
+            )),
+        ),
+        SyncState::Outdated { running } => (
+            "dialog-warning-symbolic",
+            Some("warning"),
+            gettext("Restart to finish updating"),
+            Some(if running.is_empty() {
+                gettext("An older version of Proton Drive is still running")
+            } else {
+                // Translators: {version} is a release number such as "3.2.0".
+                gettext_f(
+                    "Proton Drive {version} is still running",
+                    &[("version", &running)],
+                )
+            }),
+        ),
        SyncState::Paused { until, queued } => (
            "media-playback-pause-symbolic",
            Some("warning"),
@@ -1399,6 +1468,8 @@ fn paint_sync_status(ui: &Rc<Ui>, state: SyncState) {
    if let Some(class) = class {
        image.add_css_class(class);
    }
+    ui.locations.card.sign_in.set_visible(expired);
+    ui.locations.card.restart.set_visible(outdated);
    ui.status.status_title.set_label(&title);
    ui.status.status_detail.set_visible(detail.is_some());
    ui.status
@@ -1467,7 +1538,7 @@ pub(crate) fn repaint_pins(ui: &Rc<Ui>, pins: &[pdfs_core::cache::Pin], mounted:
        let row = adw::ActionRow::builder()
            .title(gettext("No files kept offline"))
            .subtitle(gettext(
-                "Right-click a file and choose “Make available offline”.",
+                "Right-click a file or folder and choose “Available offline”.",
            ))
            .build();
        ui.status.pins_group.add(&row);
@@ -524,6 +524,7 @@ mod tests {
            size: 0,
            modified,
            pinned: false,
+            pinned_by_folder: false,
            cached: false,
            uid: name.into(),
            path: String::new(),
@@ -384,11 +384,20 @@ pub(crate) fn show_details(ui: &Rc<Ui>, entry: &DirEntry) {
    } else {
        parent.to_string()
    });
-    // Pinning is per file: the context menu and the selection bar offer it for
-    // files only, so the pane must not offer it for folders either.
+    // Kept through a pinned folder above it, the entry has no pin of its own
+    // to remove, so the switch shows that state without offering to change it.
    d.pin_row.set_active(entry.pinned);
-    d.pin_row.set_visible(!entry.is_dir);
-    d.pin_row.set_sensitive(*ui.mounted.borrow());
+    d.pin_row.set_subtitle(&if entry.pinned_by_folder {
+        gettext("Kept on this computer because a folder it is in is available offline.")
+    } else if entry.is_dir {
+        gettext(
+            "Keep a copy of everything in this folder on this computer, even without a connection.",
+        )
+    } else {
+        gettext("Keep a copy on this computer, even without a connection.")
+    });
+    d.pin_row
+        .set_sensitive(*ui.mounted.borrow() && !entry.pinned_by_folder);
    d.open_button.set_label(&if entry.is_dir {
        gettext("Open folder")
    } else {
@@ -61,6 +61,18 @@ impl ActionMenu {
        self
    }

+    /// A greyed-out check item showing `active`, for a state the user cannot
+    /// change from here.
+    pub(crate) fn locked_toggle(&mut self, label: &str, active: bool) -> &mut Self {
+        let name = self.next_action();
+        let action = gio::SimpleAction::new_stateful(&name, None, &active.to_variant());
+        action.set_enabled(false);
+        self.group.add_action(&action);
+        self.section
+            .append(Some(label), Some(&format!("menu.{name}")));
+        self
+    }
+
    /// Close the current section; the next item starts a new one below a
    /// separator. An empty section is skipped, so callers can end a group of
    /// conditional items unconditionally.
@@ -77,13 +77,16 @@ pub(crate) fn icon_for(name: &str, is_dir: bool) -> gio::Icon {
 }

 /// The sync badge of a Drive file, as in the app's browser: pinned, cached,
-/// or online only. Folders and local files have none.
+/// or online only. A folder has one only when kept offline; local files have
+/// none.
 pub(crate) fn badge_for(hit: &Hit) -> Option<(&'static str, &'static str)> {
    let Hit::Drive(drive) = hit else {
        return None;
    };
    if drive.is_dir {
-        return None;
+        return drive
+            .pinned
+            .then_some(("pdfs-offline-symbolic", "badge-pinned"));
    }
    Some(if drive.pinned {
        ("pdfs-offline-symbolic", "badge-pinned")
@@ -22,7 +22,8 @@ use ksni::{MenuItem, Status, ToolTip, Tray};
 use pdfs_core::auth;
 use pdfs_core::config::AppDirs;
 use pdfs_core::control::{
-    Event, Feed, JobItem, Request, Response, TransferDirection, TransferItem, follow, send,
+    Event, Feed, JobItem, Request, Response, TransferDirection, TransferItem, daemon_outdated,
+    follow, send,
 };
 use pdfs_core::service;

@@ -45,6 +46,8 @@ enum Phase {
    Offline,
    /// Changes keep failing; the user has to look.
    Attention,
+    /// Mounted, but Proton refused the session: only signing in again helps.
+    SessionExpired,
    /// Signed in, but no mount daemon is running.
    Disconnected,
    SignedOut,
@@ -60,6 +63,7 @@ impl Phase {
            Phase::Paused => "media-playback-pause-symbolic",
            Phase::Offline => "network-offline-symbolic",
            Phase::Attention => "dialog-warning-symbolic",
+            Phase::SessionExpired => "dialog-password-symbolic",
            Phase::Disconnected | Phase::SignedOut => "network-offline-symbolic",
        }
    }
@@ -83,6 +87,9 @@ struct DriveState {
    paused: bool,
    /// Queued changes that keep failing, for the "N issues" item.
    failing: u64,
+    /// Whether the daemon is an older release than the tray, left running by
+    /// an upgrade; offers the restart that finishes it.
+    outdated: bool,
 }

 /// Summarise a work snapshot into one menu line, or empty when idle. A single
@@ -163,6 +170,7 @@ fn poll_state(socket: &Path, default_mountpoint: &Path) -> DriveState {
            sync: String::new(),
            paused: false,
            failing: 0,
+            outdated: false,
        },
        // No daemon: describe login state instead so the menu is still useful.
        Err(_) => {
@@ -199,6 +207,7 @@ fn poll_state(socket: &Path, default_mountpoint: &Path) -> DriveState {
                sync: String::new(),
                paused: false,
                failing: 0,
+                outdated: false,
            }
        }
    }
@@ -215,6 +224,7 @@ fn unexpected_reply(default_mountpoint: &Path) -> DriveState {
        sync: String::new(),
        paused: false,
        failing: 0,
+        outdated: false,
    }
 }

@@ -234,6 +244,9 @@ fn status_state(
        pending_changes,
        failing_ops,
        paused,
+        session_expired,
+        tokens_unsaved,
+        version,
        ..
    } = status
    else {
@@ -241,14 +254,29 @@ fn status_state(
    };
    let (pinned, online, failing_ops, paused) = (*pinned, *online, *failing_ops, *paused);
    let queued = i18n::pending_summary(*pending_uploads, *pending_changes);
-    let phase = phase_of(
-        paused,
-        failing_ops,
-        online,
-        queued.is_some() || busy(items, jobs),
-    );
+    let outdated = daemon_outdated(version);
+    let phase = if *session_expired {
+        Phase::SessionExpired
+    } else if *tokens_unsaved || outdated {
+        Phase::Attention
+    } else {
+        phase_of(
+            paused,
+            failing_ops,
+            online,
+            queued.is_some() || busy(items, jobs),
+        )
+    };
    DriveState {
        line: match (online, queued) {
+            // Outranks everything: it is why nothing else moves, and the one
+            // thing that fixes it is the user's to do.
+            _ if *session_expired => gettext("Session expired — sign in again"),
+            // Sync goes on meanwhile, but a reboot ends it until the next login.
+            _ if *tokens_unsaved => gettext("Sign-in not saved — unlock your keyring"),
+            // An upgrade replaced the files but not the running service, which
+            // keeps the old release's bugs until it restarts.
+            _ if outdated => gettext("Update not finished — restart Proton Drive"),
            _ if paused => gettext("Sync paused"),
            _ if failing_ops > 0 => ngettext_f(
                "{n} change needs attention",
@@ -286,6 +314,7 @@ fn status_state(
        mountpoint: PathBuf::from(mountpoint),
        sync: sync_line(items, jobs),
        failing: failing_ops,
+        outdated,
    }
 }

@@ -365,7 +394,7 @@ impl Tray for DriveTray {

    fn status(&self) -> Status {
        match self.state.phase {
-            Phase::Attention => Status::NeedsAttention,
+            Phase::Attention | Phase::SessionExpired => Status::NeedsAttention,
            _ => Status::Active,
        }
    }
@@ -423,9 +452,19 @@ impl Tray for DriveTray {
            // Nothing to mount without a session; the app's sign-in page is the
            // way in.
            Phase::SignedOut => items.push(item(&gettext("Sign In…"), |_| open_manager(&[]))),
+            Phase::SessionExpired => items.push(item(&gettext("Sign In Again…"), |_| {
+                open_manager(&["--page", "login"])
+            })),
            _ => items.push(item(&gettext("Open Proton Drive"), |_| open_manager(&[]))),
        }

+        if self.state.outdated {
+            items.push(item(&gettext("Restart Proton Drive"), |this| {
+                service::restart();
+                this.state.line = gettext("Connecting…");
+            }));
+        }
+
        if self.state.mounted {
            items.push(
                StandardItem {
@@ -606,6 +645,62 @@ mod tests {
        assert_eq!(phase_of(false, 0, true, false), Phase::Synced);
    }

+    fn status(extra: &str) -> Response {
+        status_from(env!("CARGO_PKG_VERSION"), extra)
+    }
+
+    fn status_from(version: &str, extra: &str) -> Response {
+        serde_json::from_str(&format!(
+            r#"{{"Status":{{"username":"u","mountpoint":"/m","pinned":0,"used":0,"budget":0,
+                "pins":[],"online":false,"pending_uploads":3,"failing_ops":2,"paused":true,
+                "version":"{version}"{extra}}}}}"#
+        ))
+        .unwrap()
+    }
+
+    /// Issue #35: a refused session read as "Offline — 3 uploads queued" for
+    /// good, and nothing said that signing in again was the way out.
+    #[test]
+    fn a_refused_session_outranks_everything_else() {
+        let state = status_state(
+            &status(r#","session_expired":true"#),
+            &[],
+            &[],
+            Path::new("/m"),
+        );
+        assert_eq!(state.phase, Phase::SessionExpired);
+        assert_eq!(state.line, "Session expired — sign in again");
+    }
+
+    /// B61: the keyring refusing the refreshed tokens was only in the log.
+    #[test]
+    fn a_sign_in_the_keyring_refused_needs_attention() {
+        let state = status_state(
+            &status(r#","tokens_unsaved":true"#),
+            &[],
+            &[],
+            Path::new("/m"),
+        );
+        assert_eq!(state.phase, Phase::Attention);
+        assert_eq!(state.line, "Sign-in not saved — unlock your keyring");
+    }
+
+    /// #33: a daemon an upgrade left running on the old release is named,
+    /// above a pause, and the menu offers the restart that finishes it.
+    #[test]
+    fn a_daemon_older_than_the_tray_needs_a_restart() {
+        let state = status_state(&status_from("0.1.0", ""), &[], &[], Path::new("/m"));
+        assert_eq!(state.phase, Phase::Attention);
+        assert_eq!(state.line, "Update not finished — restart Proton Drive");
+        assert!(state.outdated);
+    }
+
+    #[test]
+    fn a_daemon_that_does_not_say_has_a_live_session() {
+        let state = status_state(&status(""), &[], &[], Path::new("/m"));
+        assert_eq!(state.phase, Phase::Paused);
+    }
+
    fn job(title: &str, background: bool) -> JobItem {
        JobItem {
            title: title.to_string(),
@@ -28,6 +28,7 @@ const STOCK: &[&str] = &[
    "checkbox-symbolic",
    "computer-symbolic",
    "dialog-error-symbolic",
+    "dialog-password-symbolic",
    "dialog-warning-symbolic",
    "document-edit-symbolic",
    "document-open-recent-symbolic",
@@ -73,7 +73,6 @@ original wording.
 | [B67](#b67--fresh-state-restore-can-silently-select-a-new-device-high-22) | Fresh-state restore can silently select a new device (HIGH-22) | An ambiguous device after a loss of local state is not asked about |
 | [B66](#b66--local-only-pending-data-is-not-protected-at-shutdown-high-21) | Local-only pending data is not protected at shutdown (HIGH-21) | No shutdown protection and no `pdfs sync flush` |
 | [B65](#b65--release-artifacts-lack-supply-chain-verification-med-11) | Release artifacts lack supply-chain verification (MED-11) | No SBOM, provenance or checksums |
-| [B61](#b61--rotated-single-use-credentials-can-be-lost-high-18) | Rotated single-use credentials can be lost (HIGH-18) | Keyring write failures are only logged |
 | [B15](#b15--an-empty-but-listed-folder-and-duplicated-folder-uids) | An empty-but-`listed` folder, and duplicated folder uids | Cause not attributed |
 | [B10](#b10--glib-critical-when-the-launcher-closes-over-an-in-flight-open) | GLib critical when the launcher closes over an in-flight open |  |

@@ -101,6 +100,15 @@ a live account since.

 | Entry | Title |
 |---|---|
+| [B208](#b208--a-file-landing-while-its-folder-is-pinned-is-kept-but-not-available-offline) | A file landing while its folder is pinned is kept but not available offline |
+| [B207](#b207--a-move-between-locations-goes-ahead-under-a-file-opened-just-after-its-create-landed) | A move between locations goes ahead under a file opened just after its create landed |
+| [B206](#b206--an-upgrade-leaves-the-old-daemon-running-and-nothing-says-so) | An upgrade leaves the old daemon running, and nothing says so |
+| [B205](#b205--a-photo-upload-the-sdk-refuses-says-youre-offline) | A photo upload the SDK refuses says "You're offline" |
+| [B204](#b204--a-write-over-a-partial-edit-whose-base-was-never-read-fails-with-eio) | A write over a partial edit whose base was never read fails with `EIO` |
+| [B203](#b203--pdfs-unlock-leaves-a-running-daemon-a-spent-refresh-token) | `pdfs unlock` leaves a running daemon a spent refresh token |
+| [B202](#b202--a-refused-session-shows-as-offline-forever-and-nothing-says-to-sign-in-again) | A refused session shows as offline forever, and nothing says to sign in again |
+| [B201](#b201--after-signing-in-again-the-old-daemon-puts-its-spent-tokens-back) | After signing in again, the old daemon puts its spent tokens back |
+| [B200](#b200--offline-with-changes-queued-the-daemon-keeps-several-cores-busy) | Offline with changes queued, the daemon keeps several cores busy |
 | [B198](#b198--switching-to-online-only-deletes-local-files-that-never-reached-drive) | Switching to online-only deletes local files that never reached Drive |
 | [B197](#b197--switching-to-online-only-trashes-synced-files-that-became-ignored) | Switching to online-only trashes synced files that became ignored |
 | [B196](#b196--one-unreadable-folder-stops-the-whole-synced-folder-from-syncing) | One unreadable folder stops the whole synced folder from syncing |
@@ -189,6 +197,7 @@ a live account since.
 | [B81](#b81--prompt-labels-every-drive-hit-my-files-including-device-folders) | Prompt labels every Drive hit "My files", including device folders |
 | [B80](#b80--29-of-the-account-is-absent-from-the-search-index) | 29% of the account is absent from the search index |
 | [B62](#b62--debian-artifact-omits-required-service-and-autostart-units-high-19) | Debian artifact omits required service and autostart units (HIGH-19) |
+| [B61](#b61--rotated-single-use-credentials-can-be-lost-high-18) | Rotated single-use credentials can be lost (HIGH-18) |
 | [B60](#b60--config-writes-are-non-atomic-and-parse-errors-are-overwritten-high-17) | Config writes are non-atomic and parse errors are overwritten (HIGH-17) |
 | [B59](#b59--private-state-permission-enforcement-fails-open-high-16) | Private state permission enforcement fails open (HIGH-16) |
 | [B58](#b58--control-socket-has-unbounded-frames-and-connections-high-15) | Control socket has unbounded frames and connections (HIGH-15) |
@@ -302,6 +311,274 @@ a live account since.

 Newest first.

+### B208 — A file landing while its folder is pinned is kept but not available offline
+
+**Status:** Fixed, not verified live
+**Found:** 2026-10-11, CI simulation run of `3e4886f`.
+`sim::daemon::tests::a_pinned_folder_keeps_every_file_under_it_until_it_is_unpinned` waited
+30 s for `Docs/sub/b.txt` to read as cached and gave up. It failed about once in 25 runs under load
+and never alone.
+**Where:** `Core::pin_subtree` in `crates/pdfs-fuse/src/lib.rs`
+
+**Repro:** Pin a folder while a create in it lands, after the drain has repointed the tree at
+the real uid and before it has read the node back. The file's cached blob must be gone, as after
+`pdfs cache clear`, so the pin downloads it.
+
+**Cause.** The pin walks the folder first and downloads each file under the modification time
+and size it read then. The landing's read-back then sets the time Drive gave the file, and keeps
+the uploaded bytes under it. The pin's download ended after that and stored the blob again under
+the old time. The cache records one time per blob, so the file read as stale: shown as kept
+offline, but downloaded again on the next read, and unreadable offline.
+
+**Fix.** After each download the pin compares the file's time and size with the tree's. If they
+moved, it fetches the file again under the new ones, at most three times.
+
+**Test:** `sim::daemon::tests::a_folder_pinned_while_a_create_in_it_lands_keeps_that_file` holds
+the read-back and the pin's download with `FakeClient::hold_next_download`, new for this, and
+lets them go in that order.
+
+---
+
+### B207 — A move between locations goes ahead under a file opened just after its create landed
+
+**Status:** Fixed, not verified live
+**Found:** 2026-10-11, account acceptance run of 3.3.0, case "move refuses a file still being
+written" on the on-demand → mirror pairing. `pdfs move` moved the folder while `open.txt` in it
+was open for writing, and the write landed after the move.
+**Where:** `Core::has_pending_work_under` in `crates/pdfs-fuse/src/relocate.rs`; `retire_create`
+in `crates/pdfs-fuse/src/drain.rs`
+
+**Repro:** Create a file in a mount, and open it for writing right after its create lands, before
+the drain has repointed the tree at the real uid. Then `pdfs move` its folder to another
+location. The account run did this by chance: it opened the file about a second after the
+create landed.
+
+**Cause.** `retire_create` takes the create out of the queue and re-keys its `nodes` row to the
+real uid first, then repoints the in-memory tree and the open write handles. A file opened in
+between gets a write handle that holds the placeholder uid. `has_pending_work_under` placed each
+open handle by looking its uid up in the `nodes` table, which no longer has the placeholder, so it
+found nothing open under the folder. The queue was already empty, and the move went ahead.
+
+**Fix.** Open handles are placed in the in-memory tree by inode, which does not change when a
+create lands.
+
+**Test:** `sim::daemon::tests::a_move_out_of_an_on_demand_folder_refuses_a_file_still_open_for_writing`
+holds the drain at that point with `FakeClient::hold_next_landing_of_any`. The simulation can now
+sync local folders: the fake Drive lists and registers devices, and the simulated daemons no longer
+read the developer's own `config.json`.
+
+---
+
+### B206 — An upgrade leaves the old daemon running, and nothing says so
+
+**Status:** Fixed, not verified live
+**Found:** 2026-10-11, issue [#33](https://github.com/narrrl/proton-drive-linux/issues/33). On
+3.2.0 the reporter still saw `Couldn't sync Documents: Read …/snapshots/37: Permission denied`,
+the B196 failure 3.2.0 fixed. Since 3.2.0 the scan leaves an unreadable subfolder out and
+`walk_local_dir` can only fail the pass on the sync root, so that message comes from a daemon
+older than 3.2.0.
+**Where:** `Response::Status` and `daemon_outdated` in `crates/pdfs-core/src/control.rs`;
+`status_response` in `crates/pdfs-fuse/src/control.rs`; the tray in `crates/pdfs-gui/src/main.rs`;
+the sync card in `crates/pdfs-gui/src/app/pages/status.rs`; `pdfs status` and `pdfs diagnose`
+
+**Repro:** With the service running, install a newer package, then open the app.
+
+**Cause.** A package upgrade replaces the binaries but does not restart the user service, so the
+running daemon keeps the old release and its bugs until the next login or a manual restart. The
+app, the tray and the CLI start from the new binaries and could not tell, so they described the
+new release while the old one did the work.
+
+**Fix.** The daemon reports its release in `Status`. A daemon from before the field omits it,
+which reads as older. When the daemon is older than the front-end, the tray says "Update not
+finished — restart Proton Drive" with a Restart Proton Drive item, the sync card says "Restart to
+finish updating" with a Restart button, and `pdfs status` and `pdfs diagnose` print the
+`systemctl --user restart proton-drive` command. A newer daemon is not flagged: then the
+front-end is the stale one, and restarting the service would not help.
+
+**Test:** `control::tests::only_an_older_daemon_is_outdated`;
+`tests::a_daemon_older_than_the_tray_needs_a_restart` in `pdfs-tray`.
+
+---
+
+### B205 — A photo upload the SDK refuses says "You're offline"
+
+**Status:** Fixed, not verified live
+**Found:** 2026-10-11, issue #38: uploading an image from the Photos page showed "You're offline"
+while other uploads went through. Each `upload_photo` failed about 5 µs after it started, with no
+request sent, and the journal gave no reason.
+**Where:** `CoreError::from_api` and `From<Error> for CoreError` in `crates/pdfs-core/src/error.rs`;
+the `UploadPhoto` handler in `crates/pdfs-fuse/src/control.rs`; the Photos page in
+`crates/pdfs-gui/src/app/pages/photos.rs`
+
+**Repro:** On an account without a photo library, open Photos and upload an image.
+
+**Cause.** Every `ProtonError` other than `Api` was classified as `ErrorKind::Offline`, on the
+reasoning that it never reached Proton. That holds for `Transport` only. `InvalidOperation`,
+`Crypto`, `KeysLocked` and `Serialization` happen on this machine or after Proton answered. A
+failure that fast is most likely the SDK's "account has no photos volume", which it returns from
+its cache without sending a request. The app turns `Offline` into "You're offline", and the
+daemon only sent the error back, so the journal did not say what it was.
+
+**Fix.** `proton_kind` classifies by variant: `Transport` is `Offline`, `InvalidOperation` is
+`Invalid`, `Serialization` is `Remote`, and `Crypto` and `KeysLocked` are `Internal`. The app then
+shows "Couldn't upload photo" with the daemon's reason. The daemon logs a failed photo upload. The
+Photos page greys out Upload when the daemon reports no photo library.
+
+**Test:** `error::tests::a_call_the_sdk_refuses_to_send_is_not_offline`.
+
+---
+
+### B204 — A write over a partial edit whose base was never read fails with `EIO`
+
+**Status:** Fixed, not verified live
+**Found:** 2026-10-09, by CI on 2a86830 (`one_client_on_a_good_link`, seed 1, which did not replay
+locally). A partial write to `x/f.txt`, a file renamed twice before, was renamed over `z/d`. A
+create over `z/d` a moment later failed with `EIO`, and the daemon logged "refusing write over
+incomplete queued revision".
+**Where:** `ProtonFs::serve_open` in `crates/pdfs-fuse/src/filesystem.rs`
+
+**Repro:** Write at an offset into a file this client never read, then open it for writing again
+before the drain uploads the first write.
+
+**Cause.** The release of a partial write fills its gaps from the content cache only. When the
+cache does not hold the base, the queued revision stays incomplete until the drain fills it from
+Drive, and a write open over an incomplete revision was refused. B123, B157, B169 and B170 each
+closed one way the cache could miss the base. Any other miss, such as a file never read here,
+still failed the next write open for the length of the drain debounce.
+
+**Fix.** A write open over an incomplete queued revision copies the blob and fills its gaps from
+the remote base with `Core::fill_gaps`, as the drain does before an upload. The open fails only
+when that fill fails, for example offline.
+
+**Test:** `a_partial_write_over_bytes_never_read_takes_another_write_at_once` in `sim/daemon.rs`.
+Without the fix the second write fails with `EIO`.
+
+---
+
+### B203 — `pdfs unlock` leaves a running daemon a spent refresh token
+
+**Status:** Fixed, not verified live
+**Found:** 2026-10-09, reading the code for issue #35 after the B201 fix
+**Where:** `crates/pdfs-core/src/auth.rs`, `stored_session_is_newer`; `crates/pdfs-fuse/src/link.rs`,
+`Core::mark_session_expired`; `crates/pdfs-fuse/src/mount.rs`; `crates/pdfs-cli/src/main.rs`,
+`cmd_daemon`
+
+**Repro:** With the daemon running, run `pdfs unlock` while the stored access token has expired.
+Unlock resumes the same session, refreshes it and stores the new tokens. The daemon still holds
+the old refresh token. If it refreshes before unlock restarts it, Proton refuses the spent token,
+and since B202 the mount reports the session expired, although the keyring holds a live one.
+
+**Cause.** Two processes ran the same session, and only one of them could hold its live refresh
+token. B201 stopped the daemon from writing its spent token over the live one, but nothing made the
+daemon pick up the live one.
+
+**Fix.** Before a refused session counts as expired, `auth::stored_session_is_newer` compares the
+keyring with what this process last stored. When the keyring holds a newer rotation of the same
+session, or another login, the mount ends with `MountOutcome::ResumeStored`, and the daemon mounts
+again at once from the keyring. At startup the same check turns the refusal into a mount error,
+which the daemon retries. A rotation that another process already wrote into the blob is now
+taken as this session's, so the daemon keeps writing its later rotations.
+
+**Test:** `auth::tests::a_session_rotated_by_another_process_is_newer_in_the_keyring` and
+`auth::tests::a_rotation_already_in_the_blob_is_taken`.
+
+---
+
+### B202 — A refused session shows as offline forever, and nothing says to sign in again
+
+**Status:** Fixed, not verified live
+**Found:** 2026-10-09, issue #35: the tray and `pdfs diagnose` said "offline, 3 queued", and
+diagnose also said "keyring session: ok", while every call in the log failed with
+`InvalidRefreshToken (http 400)`. `pdfs sync now` and restarting the service changed nothing.
+**Where:** `crates/pdfs-fuse/src/link.rs`, `Core::lost_link` and `Core::probe_until_online`;
+`crates/pdfs-fuse/src/mount.rs`, `fetch_or_recall_root`; `crates/pdfs-fuse/src/background.rs`;
+`crates/pdfs-core/src/control.rs`, `Response::Status`; the tray, the app's status, `pdfs status`
+and `pdfs diagnose`
+
+**Repro:** Make the stored refresh token invalid (B201 is one way), then start the daemon. It
+mounts from the cache and says offline; the probe retries every 30 s, then every 5 minutes, and
+logs the refusal only at debug. A daemon that started online and loses its session later does not
+even go offline: its failures show up as EIO and drain backoff.
+
+**Cause.** Every failure to fetch the root at startup counted as offline, and nothing told a
+refused session apart from a lost connection. No status field could carry it, so no front end
+could say it.
+
+**Fix.** `pdfs_core::error::session_revoked` names the errors only a new login fixes:
+`InvalidRefreshToken`, `AccountDeleted`, `AccountDisabled`. When the root fetch, the probe, the
+drain, an event poll, the event seed or the photos root sees one, the mount goes offline with
+`session_expired` set, logs one warning naming `pdfs login`, and stops probing and retrying.
+Cached files stay readable and changes stay queued for the daemon the next login starts.
+`Response::Status` carries `session_expired`. The tray shows "Session expired — sign in again"
+with **Sign In Again…**, which opens the app's sign-in page; the app's status and Sync card say the
+same, with a **Sign In Again** button. `pdfs status` and `pdfs diagnose` report it, the latter as
+a FAIL. A refused session is not recorded as a sync issue of the op that ran into it.
+
+**Test:** `error::tests::only_a_refused_refresh_or_a_closed_account_revokes_the_session`, the
+tray's `tests::a_refused_session_outranks_everything_else` and
+`tests::a_daemon_that_does_not_say_has_a_live_session`.
+
+---
+
+### B201 — After signing in again, the old daemon puts its spent tokens back
+
+**Status:** Fixed, not verified live
+**Found:** 2026-10-09, reading the code for issue #35, where every call failed with
+`InvalidRefreshToken` and signing in again did not obviously help.
+**Where:** `crates/pdfs-core/src/auth.rs`, `persist`, `register_refresh_handler`, `unlock` and
+`migrate_legacy`; `crates/pdfs-cli/src/main.rs`, `cmd_daemon`
+
+**Repro:** With the daemon running, run `pdfs login`. It stores the new session and restarts the
+unit. The old daemon's stop runs `auth::persist`, which wrote its own access and refresh tokens
+into the blob, now the new session's. The new daemon starts with a refresh token of another
+session, and the first refresh fails with `InvalidRefreshToken`. `pdfs unlock` had the same
+shape: its session could rotate the tokens, and the restarted daemon's stop put the spent refresh
+token back. `unlock` and `migrate_legacy` could do it themselves, writing a copy of the blob read
+before verifying the mailbox password, which may have rotated the tokens.
+
+**Cause.** Proton refresh tokens are single-use. `store_tokens` loaded whatever blob was stored
+and replaced its tokens, without checking that the blob was still this session's.
+
+**Fix.** Each session writes its rotations through a `TokenSink`. It writes only into a blob with
+its session id that still holds the refresh token the session last left there; a blob that moved
+on, to a new login or to another session's rotation, is left alone. The stop no longer writes the
+session's tokens, only a rotation the keyring refused when it happened. `unlock` and
+`migrate_legacy` read the blob again after verifying. A failed final write is an error in the log,
+not a debug line claiming there was nothing to save.
+
+**Test:** `auth::tests::tokens_of_another_session_are_not_written`,
+`auth::tests::tokens_are_not_written_over_a_newer_rotation_of_the_same_session`,
+`auth::tests::a_sink_keeps_writing_its_own_rotations_and_stops_at_a_new_login`.
+
+---
+
+### B200 — Offline with changes queued, the daemon keeps several cores busy
+
+**Status:** Fixed, not verified live
+**Found:** 2026-10-09, issue #35: "offline, 3 queued", and systemd counted 17 minutes of CPU in
+2 m 16 s of wall time, 10 hours over a longer run.
+**Where:** `crates/pdfs-fuse/src/drain.rs`, `Core::run_pending_drain` and `idle_wait`;
+`crates/pdfs-core/src/db/ops.rs`, `Db::earliest_due_at`
+
+**Repro:** Queue a write, then cut the link (`nmcli networking off`). `pidstat -t -p $(pgrep -x
+pdfs) 5` shows the drain threads using most of several cores for as long as the outage lasts.
+
+**Cause.** Offline, a drain worker claims nothing, and then sleeps until the earliest queued op
+falls due. Every queued op was due already, and with no attempts nothing moves its
+`next_attempt_at`, so the sleep was zero. All 16 workers ran a query on every pass, the primary
+one its idle chores as well. The same spin happened online when a due op sat behind a claimed op
+on the same node, such as a rename queued behind a long upload: `earliest_due_at` counted it,
+`claim_next_due_op` skipped it.
+
+**Fix.** A worker that claims nothing, offline or paused, sleeps the full idle poll; a reconnect
+or a resume wakes it. `earliest_due_at` now uses the claim's own exclusions, one SQL fragment for
+both.
+
+**Test:** `drain::tests::an_offline_worker_waits_the_idle_poll_for_a_past_due_op`,
+`db::tests::earliest_due_at_skips_an_op_held_behind_a_claimed_one`.
+
+---
+
 ### B199 — A stopped share stays on the Shared by me page for minutes

 **Status:** Partly fixed. The share itself is still not deleted.
@@ -4823,7 +5100,7 @@ daemon/tray/FUSE, upgrade, rollback, and uninstall without deleting user state.

 ### B61 — Rotated single-use credentials can be lost (HIGH-18)

-**Status:** Open — 1.0 authentication/recovery blocker
+**Status:** Fixed, not verified live
 **Found:** 2026-07-22, 1.0 authentication audit
 **Where:** `crates/pdfs-core/src/auth.rs`, refresh callback

@@ -4835,6 +5112,26 @@ keyring retains an invalid single-use refresh token, so restart loses login.
 notify the user, and define a safe re-login/shutdown path. Test locked/full/
 unavailable keyrings, callback races, repeated rotations, death, and restart.

+**Fix (2026-10-09, issue #35).** A rotation the keyring refuses is kept as unsaved and retried
+in the background after 1 s, 5 s, 30 s and then every 5 minutes, until it is written or the blob
+has moved on (B201). The refusal is an error in the log naming `pdfs login`, and the daemon's stop
+writes a rotation still unsaved, logging an error if that fails too. The re-login path is B201's:
+an old session never writes into a newer login.
+
+Until it is written, the rotation also waits in the kernel keyring (`kernelkey::UNSAVED_TOKENS`),
+so a crash or SIGKILL before a retry lands no longer loses it. The next resume, by the daemon or
+`pdfs unlock`, puts it back in when the blob still holds the refresh token it spent, and writes
+it. One that belongs to an older login is dropped. The kernel keyring lasts until the user's last
+session ends, so a refused write followed by a crash and a logout still loses the rotation.
+
+While a rotation waits, `Response::Status` carries `tokens_unsaved`. The tray says "Sign-in not
+saved — unlock your keyring" and needs attention, the app's status says the same, `pdfs status`
+prints a `Keyring` line and `pdfs diagnose` warns.
+
+**Test:** `auth::tests::a_rotation_the_keyring_refused_is_written_once_it_takes_it` and
+`auth::tests::an_unsaved_rotation_goes_only_into_the_blob_it_was_refused_for`, and the tray's
+`tests::a_sign_in_the_keyring_refused_needs_attention`.
+
 ---

 ### B60 — Config writes are non-atomic and parse errors are overwritten (HIGH-17)
@@ -11,11 +11,85 @@ scratch (user data in `staging/` and `recovery/` is never touched by this).

 ## [Unreleased]

+## [3.4.0] — 2026-10-12
+
+Schema: **42**, unchanged.
+
+### Added
+- **A binary cache for the Nix flake.** Every release and every build of `main` is uploaded to
+  `proton-drive-linux.cachix.org`, so NixOS installs download the client instead of compiling
+  it. See [Install → Binary cache](INSTALL.md#binary-cache).
+  ([#37](https://github.com/narrrl/proton-drive-linux/issues/37))
+- **Folders can be made available offline in the app.** The context menu, the details pane and
+  the selection bar now offer it for folders too. Every file in the folder and its subfolders
+  downloads in the background with its progress in the tray and the app, and pinned folders carry
+  the offline badge. A file kept through its folder shows as available offline but cannot be
+  made online only on its own. `pdfs pin` on a folder now returns at once instead of timing out
+  on a large folder, and pinned files download to disk instead of into memory.
+
 ### Fixed
+- **Removing the package left the drive mounted, and deletes there still reached Proton Drive.**
+  The service kept running from the removed program, so deleting `~/ProtonDrive` afterwards moved
+  its files to the Proton Drive trash. The .deb, .rpm and Arch packages now stop the service of
+  every logged-in user before they are removed. Upgrades are not affected.
+- **`pdfs move` between two locations could move a folder with a file open for writing in it**,
+  when the file had been opened just after it first reached Proton Drive. The write then landed
+  after the move. Such a move is refused now, as it always was meant to be (B207).
+- **The Fedora package installed KDE packages on GNOME.** Its recommendation of KWallet is now
+  only for Plasma, the GNOME keyring only for desktops other than Plasma, and the AppIndicator
+  extension only for GNOME.
+
+## [3.3.0] — 2026-10-11
+
+Schema: **42**, unchanged.
+
+### Added
+- **A Nix flake for NixOS.** `nix build github:narrrl/proton-drive-linux` builds the client, and
+  the flake's NixOS module installs it and runs the mount in every graphical session. Pin the
+  input to a release tag such as `github:narrrl/proton-drive-linux/v3.3.0` to stay on releases.
+  See [Install → NixOS](INSTALL.md#nixos-flake).
+  ([#37](https://github.com/narrrl/proton-drive-linux/issues/37))
+
+### Fixed
+- **A failed photo upload said "You're offline" while everything else worked.** Only a failed
+  connection now reads as offline. Other failures show what went wrong, and Upload is greyed out
+  on an account without a photo library.
+  ([#38](https://github.com/narrrl/proton-drive-linux/issues/38))
+- **After an upgrade, the old version kept running in the background, and nothing said so.**
+  Installing a package does not restart the service, so fixed bugs, such as an unreadable folder
+  stopping a synced folder, came back until the next login. The tray, the app, `pdfs status` and
+  `pdfs diagnose` now say when the service is older than the app, and the tray and the app offer
+  to restart it. ([#33](https://github.com/narrrl/proton-drive-linux/issues/33))
+
+## [3.2.1] — 2026-10-11
+
+Schema: **42**, unchanged.
+
+### Fixed
+- **Writing to a file again soon after a partial write could fail with an I/O error.** When the
+  first write changed only part of a file this client had not read, a second write, or saving
+  over the file, failed until the first one reached Drive. It now fetches the rest of the file
+  and goes ahead.
 - **A CAPTCHA could not be solved on hardened systems.** When the verification page cannot open in
  the app, as on secureblue, the app now offers it in your browser and continues the sign-in
  once you are done. `pdfs login` now handles a CAPTCHA the same way instead of failing.
  ([#29](https://github.com/narrrl/proton-drive-linux/issues/29))
+- **The daemon kept several CPU cores busy while offline with changes queued.** Its upload
+  workers checked the queue in a tight loop for as long as the outage lasted. They now sleep
+  until the connection comes back. ([#35](https://github.com/narrrl/proton-drive-linux/issues/35))
+- **An expired sign-in was shown as "offline" for good.** When Proton refuses the session, the
+  tray now says "Session expired — sign in again" with a Sign In Again… item, the app shows the
+  same with a button, and `pdfs status` and `pdfs diagnose` tell you to run `pdfs login`. Cached
+  files stay readable and changes stay queued until you sign in.
+  ([#35](https://github.com/narrrl/proton-drive-linux/issues/35))
+- **The sign-in could be lost after `pdfs login`, `pdfs unlock` or a slow network.** The old
+  daemon wrote its spent tokens over a new sign-in when it stopped, a timeout could drop a token
+  refresh halfway, and a refresh was retried with a token Proton had already used. Each process
+  now writes only into its own session, a refresh always finishes, and it is never repeated.
+  ([#35](https://github.com/narrrl/proton-drive-linux/issues/35))
+- **A sign-in refreshed while the keyring was locked was lost on the next restart.** The client
+  now keeps retrying, holds the new tokens in the kernel keyring meanwhile, and the tray says
+  "Sign-in not saved — unlock your keyring" until it is written.

 ## [3.2.0] — 2026-10-08

@@ -1712,6 +1786,10 @@ First stable release: FUSE files-on-demand mount, sync daemon under `proton-driv
 - The outstanding FUSE defects tracked in `docs/BUGS.md`, plus a truncate defect, validated
  by a new POSIX compliance suite for the filesystem.

+[3.4.0]: https://github.com/narrrl/proton-drive-linux/releases/tag/v3.4.0
+[3.3.0]: https://github.com/narrrl/proton-drive-linux/releases/tag/v3.3.0
+[3.2.1]: https://github.com/narrrl/proton-drive-linux/releases/tag/v3.2.1
+
 [3.2.0]: https://github.com/narrrl/proton-drive-linux/releases/tag/v3.2.0

 [3.1.2]: https://github.com/narrrl/proton-drive-linux/releases/tag/v3.1.2
@@ -65,9 +65,9 @@ commands are for scripts and for cases where the mount is not available.

 | Command | Description |
 |---|---|
-| `pdfs pin PATH` | Download a file completely and keep it on this computer. |
-| `pdfs unpin PATH` | Release it back to online only. |
-| `pdfs pins` | List files kept available offline. |
+| `pdfs pin PATH` | Download a file completely and keep it on this computer. For a folder, its files download in the background (`pdfs transfers` shows the progress). |
+| `pdfs unpin PATH` | Release it back to online only. A file inside a folder kept offline cannot be released on its own. |
+| `pdfs pins` | List files and folders kept available offline. |

 ## Synced folders

@@ -153,15 +153,19 @@ Releases are cut from `main` by pushing a `v*` tag. `.github/workflows/release.y
 1. checks that the tag, the workspace version in `Cargo.toml` and `pkgver` in
   `packaging/PKGBUILD` agree;
 2. runs the quality gates;
-3. builds the release binaries and packages a `.tar.gz`, a `.deb` and a GPG-signed `.rpm`;
-4. publishes them as a GitHub release;
+3. builds the release binaries and packages a `.tar.gz`, a `.deb` and a GPG-signed `.rpm`, and
+   builds the Nix flake at the tag, which is what a flake input pinned to `vX.Y.Z` gets, and
+   pushes it to the `proton-drive-linux` Cachix cache (secret `CACHIX_AUTH_TOKEN`);
+4. publishes them as a GitHub release, with the version's section of `docs/CHANGELOG.md` as the
+   notes;
 5. calls `.github/workflows/aur.yml`, which updates and pushes the AUR recipes and commits them
   back to `main`.

 To prepare a release:

 ```bash
-# 1. Bump the version in Cargo.toml and packaging/PKGBUILD, then refresh the lock file.
+# 1. Bump the version in Cargo.toml, packaging/PKGBUILD, po/pdfs.pot and the pinned flake
+#    URL in docs/INSTALL.md, then refresh the lock file.
 cargo update --workspace
 # 2. Move the [Unreleased] notes in docs/CHANGELOG.md under the new version.
 # 3. Commit, tag and push.
@@ -82,6 +82,68 @@ paru -S proton-drive-for-linux     # or yay, or any other AUR helper

 The recipes live in [`packaging/aur/`](../packaging/aur/README.md).

+### NixOS (flake)
+
+The repository is a flake. Add it as an input and enable the module, which installs the package,
+links the user service into every graphical session and turns on the `fusermount3` wrapper and
+GNOME Keyring for you:
+
+```nix
+{
+  inputs.proton-drive-linux.url = "github:narrrl/proton-drive-linux";
+
+  outputs = { nixpkgs, proton-drive-linux, ... }: {
+    nixosConfigurations.<host> = nixpkgs.lib.nixosSystem {
+      modules = [
+        proton-drive-linux.nixosModules.default
+        { services.proton-drive-linux.enable = true; }
+      ];
+    };
+  };
+}
+```
+
+That URL follows `main`. To stay on releases, pin the input to a release tag instead, and change
+the tag to update:
+
+```nix
+inputs.proton-drive-linux.url = "github:narrrl/proton-drive-linux/v3.3.0";
+```
+
+Each release tag is built with Nix before the release is published.
+
+#### Binary cache
+
+CI uploads every build of `main` and of each release tag to a Cachix binary cache, so Nix can
+download the client instead of compiling it. A system build does not read a flake input's cache
+settings, so add the cache to your NixOS configuration once:
+
+```nix
+nix.settings = {
+  substituters = [ "https://proton-drive-linux.cachix.org" ];
+  trusted-public-keys = [
+    "proton-drive-linux.cachix.org-1:w1+3pXVXyTlqkFGn3dWpUhlaJtyGhSm3X0mFwfa++AA="
+  ];
+};
+```
+
+The cache holds the build against the `nixpkgs` this flake locks. Setting
+`inputs.proton-drive-linux.inputs.nixpkgs.follows = "nixpkgs"` builds against yours instead, which
+the cache does not have, so Nix compiles it. `nix run` and `nix shell` ask whether to use the
+cache the first time; answer yes, or run `cachix use proton-drive-linux`.
+
+To try it without changing your system, run the app straight from the flake:
+
+```bash
+nix run github:narrrl/proton-drive-linux#proton-drive-linux -- --help   # the CLI
+nix shell github:narrrl/proton-drive-linux -c pdfs-app                   # the desktop app
+```
+
+The mount itself needs the setuid `fusermount3` from NixOS (`programs.fuse.enable`, on by default
+with the module) and a Secret Service such as GNOME Keyring or KWallet. To leave out ffmpeg and
+with it video thumbnails, override the package with `withFfmpeg = false`. The recipe lives in
+[`packaging/nix/`](../packaging/nix/).
+
 ### Other distributions

 Unpack the `.tar.gz` into a directory on your `PATH`, then install the service unit as shown in
@@ -240,8 +302,15 @@ pdfs logout                                       # removes the session from the
 ```

 Then remove the package (`sudo apt remove proton-drive-linux`, `sudo dnf remove
-proton-drive-linux`, or `sudo pacman -R proton-drive-for-linux`), and, if you want no trace left,
-the local data:
+proton-drive-linux`, or `sudo pacman -R proton-drive-for-linux`). Removing the package also stops
+the service of every logged-in user, in case a step above was skipped.
+
+> [!CAUTION]
+> Do not delete `~/ProtonDrive` while it is mounted. It is your Proton Drive, not a copy: every
+> file deleted there is moved to the Proton Drive trash. Once the service is stopped the folder is
+> an empty mount point, and removing it is safe.
+
+If you want no trace left, remove the local data as well:

 ```bash
 rm -rf ~/.config/proton-drive-linux ~/.local/state/proton-drive-linux ~/.cache/proton-drive-linux
@@ -10,6 +10,7 @@
 | [Configuration](CONFIGURATION.md) | `config.json`, environment variables, file locations, the systemd service |
 | [Troubleshooting](TROUBLESHOOTING.md) | Diagnosing problems, common symptoms, starting over, reporting a bug |
 | [Recovering on a new computer](RECOVERY.md) | What survives a lost machine and how to restore your synced folders |
+| [Security model](SECURITY_MODEL.md) | What protects your files, what is kept on this computer, what the client connects to |
 | [Changelog](CHANGELOG.md) | What changed in each release |

 ## For contributors
@@ -0,0 +1,83 @@
+# Security model
+
+This page explains what protects your files and account when you use this client, what it keeps
+on your computer, and what it does not protect against. It is a summary for users. The details,
+with references to the code, are in the
+[threat model](ARCHITECTURE.md#10-threat-model-what-this-client-writes-to-disk-in-plaintext). To
+report a vulnerability, see [SECURITY.md](../SECURITY.md).
+
+This is an unofficial hobby project, not a Proton product. It has had no independent security
+audit. The source is open under the MIT license, so you can read and build all of it yourself.
+
+## Encryption
+
+Proton Drive is end-to-end encrypted, and this client does not change that:
+
+- **Files are encrypted on this computer before they are uploaded,** and decrypted on this
+  computer after they are downloaded. Proton never receives your keys or the content of your
+  files.
+- **The cryptography comes from the SDK, not from this client.** The client uses
+  [`proton-sdk` and `proton-drive-rs`](https://github.com/narrrl/proton-sdk-rs), a Rust port of
+  Proton's official C# and TypeScript Drive SDKs. OpenPGP is done by the
+  [rPGP](https://github.com/rpgp/rpgp) library. The client itself does not implement any
+  encryption.
+- **Your password is not sent to Proton.** Sign-in uses Proton's SRP protocol, which proves that
+  you know the password without sending it.
+
+## What is kept on this computer
+
+| What | Where | Protected by |
+|---|---|---|
+| Session tokens and the key passphrases | The system keyring (Secret Service: GNOME Keyring, KWallet, KeePassXC) | The keyring's own encryption and your login |
+| Your password | Nowhere | — |
+| Cached files, thumbnails and changes waiting to upload | `~/.cache/proton-drive-linux/content/` | File modes only: **not encrypted** |
+| File and folder names, the folder tree, the activity log | `~/.local/state/proton-drive-linux/cache.db` | File modes only: **not encrypted** |
+| The SDK's metadata cache | `~/.local/state/proton-drive-linux/sdk_cache.db` | Encrypted with a key derived from your mailbox password |
+| Settings | `~/.config/proton-drive-linux/config.json` | No secrets are stored here |
+
+The cache holds decrypted content so that files open fast and work offline. **The client assumes
+that your disk is encrypted** (LUKS, or an encrypted home directory). On an unencrypted disk,
+someone who has the powered-off computer can read the cached files and the names in your Drive.
+
+Accounts with a separate mailbox password (two-password mode) are locked by default. Their key
+passphrases are kept in the kernel keyring for your login session only, and you unlock again
+after each login. Storing them in the system keyring is an opt-in.
+
+## Who can use the client
+
+- The state, cache and config directories must belong to you and have mode `0700`. The daemon
+  checks this at every start and refuses to run otherwise.
+- The control socket that the app, tray and `pdfs` use has mode `0600`. Only your user account
+  can connect to it.
+- Any program that runs as your user can read, change and delete files in `~/ProtonDrive`, the same
+  as in any other folder you own. It is your Proton Drive, not a copy: a deleted file is moved to
+  the Proton Drive trash, where you can restore it.
+
+## Network connections
+
+The client connects only to:
+
+- **Proton**, for the Drive and account API, and for the CAPTCHA page when Proton asks for one.
+- **OpenFreeMap**, for the street map of Places in Photos, only if you turn it on in Preferences. It is off by default, because the tile server learns which parts of the
+  world you look at. The default map is drawn from data shipped with the app.
+
+There is no telemetry, no analytics and no update check. The SDK can report timings of its own
+operations, and the client only writes them to its local log.
+
+## What this client does not protect against
+
+- **Malware running as your user.** It can read the cache, connect to the control socket, and use
+  your Drive through the mount, as it can with any data you have access to.
+- **Swap.** Keys and decrypted data are in ordinary memory and can be written to swap. Use
+  encrypted swap.
+- **The kernel page cache.** File content read through the mount is cached by the kernel like any
+  other file.
+
+## Packages
+
+- The `.rpm` is signed with GPG.
+- The `.deb` and the `.tar.gz` are built by GitHub Actions from the tagged source, and are not
+  signed.
+- The AUR packages build from the tagged source or from `main`, or install the release binaries
+  checked against their SHA-256 sums.
+- The Nix flake builds from source. The binary cache on Cachix holds builds made by CI.
@@ -44,7 +44,7 @@ The app uses these words consistently, and so does this guide:
 | **My files** | The root of your Drive |
 | **Proton Drive folder** | Where My files appears on disk, `~/ProtonDrive` by default |
 | **Online only** | A file or folder whose content downloads when opened |
-| **Available offline** | A single file kept on this computer |
+| **Available offline** | A file, or a folder with everything in it, kept on this computer |
 | **Synced folder** | A local folder with a full copy on this computer, backed up to Proton Drive |
 | **Proton Drive service** | The background service (`proton-drive.service`) |

@@ -75,11 +75,14 @@ try to create them get a clean error, not a hang or `EIO`.

 ## Keeping files on this computer

-Turn on **Make available offline** for a file in My files, or run `pdfs pin <path>`. The file is
-downloaded completely and never evicted from the cache. `pdfs pins` lists these files, and
-**Preferences → Storage → Available offline** shows them in the app.
+Turn on **Available offline** for a file or folder in My files, or run `pdfs pin <path>`. A file
+is downloaded completely and never evicted from the cache. For a folder, every file in it and in
+its subfolders downloads in the background, and the tray and the app show the progress.
+`pdfs pins` lists what is kept, and **Preferences → Storage → Available offline** shows it in the
+app.

-Turning it off (`pdfs unpin <path>`) frees the space. The file stays on Proton Drive.
+Turning it off (`pdfs unpin <path>`) frees the space. The files stay on Proton Drive. A file inside
+a folder kept offline stays with its folder: turn the folder off instead.

 ## Syncing local folders

@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1791456040,
+        "narHash": "sha256-H83yz/do+hjOO0uujHyH8RgtIQP2v7Mw+cLwcZK/xKc=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "e7439b6b14ad3cc35d05608ebca9bce01a25f5f8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
@@ -0,0 +1,51 @@
+{
+  description = "Unofficial Proton Drive client for Linux: files-on-demand FUSE mount, CLI, GTK4 app and tray";
+
+  # CI pushes every build of `main` and of each release tag here, so installing
+  # downloads the client instead of compiling it. Nix asks before it uses a
+  # flake's caches unless the user trusts them (docs/INSTALL.md).
+  nixConfig = {
+    extra-substituters = [ "https://proton-drive-linux.cachix.org" ];
+    extra-trusted-public-keys = [
+      "proton-drive-linux.cachix.org-1:w1+3pXVXyTlqkFGn3dWpUhlaJtyGhSm3X0mFwfa++AA="
+    ];
+  };
+
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+
+  outputs =
+    { self, nixpkgs }:
+    let
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
+      ];
+      forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
+    in
+    {
+      packages = forAllSystems (pkgs: rec {
+        proton-drive-linux = pkgs.callPackage ./packaging/nix/package.nix { };
+        default = proton-drive-linux;
+      });
+
+      overlays.default = final: _: {
+        proton-drive-linux = final.callPackage ./packaging/nix/package.nix { };
+      };
+
+      nixosModules.default = import ./packaging/nix/module.nix self;
+
+      devShells = forAllSystems (pkgs: {
+        default = pkgs.mkShell {
+          inputsFrom = [ self.packages.${pkgs.stdenv.hostPlatform.system}.proton-drive-linux ];
+          packages = with pkgs; [
+            cargo
+            clippy
+            rustfmt
+            rust-analyzer
+          ];
+        };
+      });
+
+      formatter = forAllSystems (pkgs: pkgs.nixfmt);
+    };
+}
@@ -9,7 +9,7 @@
 # Build + install:   cd packaging && makepkg -fi

 pkgname=proton-drive-linux
-pkgver=3.2.0
+pkgver=3.4.0
 pkgrel=1
 pkgdesc="Unofficial Proton Drive client for Linux: files-on-demand FUSE mount, CLI, GTK4 app + tray"
 arch=('x86_64')
@@ -26,6 +26,8 @@ optdepends=('gnome-keyring: credential storage via Secret Service'
            'fzf: live search-as-you-type launcher (pdfs-prompt --fzf)'
            'foot: terminal for pdfs-prompt --fzf started from a keybinding')
 options=('!lto' '!debug')
+# Stops the running daemon before removal, so the mount stops mirroring deletes.
+install=proton-drive.install

 # Built in place from the checkout; nothing to fetch or checksum.
 source=()
@@ -13,7 +13,8 @@ The three packages conflict with each other and with the in-tree
 `packaging/PKGBUILD` package (`proton-drive-linux`), and every one of them
 `provides` `proton-drive-for-linux`, `proton-drive-linux`, and `pdfs`.

-Each directory tracks only `PKGBUILD`, `.SRCINFO`, `.gitignore`, and `LICENSE`
+Each directory tracks only `PKGBUILD`, `.SRCINFO`, `.gitignore`, `LICENSE` and
+`proton-drive.install` (a link to `packaging/proton-drive.install`, copied as a file on push)
 (the 0BSD license of the packaging sources, per
 [RFC40](https://rfc.archlinux.page/0040-license-package-sources/)); the
 `.gitignore` ignores everything else so downloaded sources, `src/`, `pkg/`, and
@@ -1,8 +1,9 @@
 pkgbase = proton-drive-for-linux-bin
 	pkgdesc = Unofficial Proton Drive client: FUSE files-on-demand mount, CLI, GTK4 app, tray (binaries)
-	pkgver = 3.1.2
+	pkgver = 3.3.0
 	pkgrel = 1
 	url = https://proton-drive.narl.io
+	install = proton-drive.install
 	arch = x86_64
 	license = MIT
 	depends = fuse3
@@ -21,21 +22,21 @@ pkgbase = proton-drive-for-linux-bin
 	optdepends = xdg-utils: "Open folder" action in the tray menu
 	optdepends = fzf: search-as-you-type launcher (pdfs-prompt --fzf)
 	optdepends = foot: terminal that hosts pdfs-prompt --fzf when started from a keybinding
-	provides = proton-drive-for-linux=3.1.2
-	provides = proton-drive-linux=3.1.2
+	provides = proton-drive-for-linux=3.3.0
+	provides = proton-drive-linux=3.3.0
 	provides = pdfs
 	conflicts = proton-drive-linux
 	conflicts = proton-drive-for-linux
 	conflicts = proton-drive-for-linux-git
 	options = !strip
 	options = !debug
-	source = proton-drive-linux-3.1.2-x86_64.tar.gz::https://github.com/narrrl/proton-drive-linux/releases/download/v3.1.2/proton-drive-linux-3.1.2-x86_64.tar.gz
-	source = io.narl.proton-drive-linux-3.1.2.desktop::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.1.2/packaging/io.narl.proton-drive-linux.desktop
-	source = io.narl.proton-drive-linux-tray-3.1.2.desktop::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.1.2/packaging/io.narl.proton-drive-linux-tray.desktop
-	source = io.narl.proton-drive-linux-3.1.2.svg::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.1.2/packaging/io.narl.proton-drive-linux.svg
-	source = proton-drive-3.1.2.service::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.1.2/packaging/proton-drive.service
-	source = LICENSE-3.1.2::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.1.2/LICENSE
-	sha256sums = 71fc50775cbd795717ed17c4a3994d8fdfb5ab30a223dcbc7f0e313f9ab615f7
+	source = proton-drive-linux-3.3.0-x86_64.tar.gz::https://github.com/narrrl/proton-drive-linux/releases/download/v3.3.0/proton-drive-linux-3.3.0-x86_64.tar.gz
+	source = io.narl.proton-drive-linux-3.3.0.desktop::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.3.0/packaging/io.narl.proton-drive-linux.desktop
+	source = io.narl.proton-drive-linux-tray-3.3.0.desktop::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.3.0/packaging/io.narl.proton-drive-linux-tray.desktop
+	source = io.narl.proton-drive-linux-3.3.0.svg::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.3.0/packaging/io.narl.proton-drive-linux.svg
+	source = proton-drive-3.3.0.service::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.3.0/packaging/proton-drive.service
+	source = LICENSE-3.3.0::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.3.0/LICENSE
+	sha256sums = 2e4a8ee660f1d1d683a03afd7d3c1262be87cebeb53893cae55f5e1b44199a04
 	sha256sums = d190d6771fff0b975271fb62fd3fb0fa8bbf17d7278c10853c18557855b0c123
 	sha256sums = 1d95e250370220e3bb6aead6ce34d1d6cc759f42c4803b75f1667e78ff47c6c0
 	sha256sums = e598a93c2715c3a9fdc7fb937902083d4a1135e8fbdfe6fe7e37f0383ebbd828
@@ -5,3 +5,4 @@
 !.SRCINFO
 !LICENSE
 !PKGBUILD
+!proton-drive.install
@@ -1,7 +1,7 @@
 # Maintainer: Nils Pukropp <contact@narl.io>

 pkgname=proton-drive-for-linux-bin
-pkgver=3.1.2
+pkgver=3.3.0
 pkgrel=1
 pkgdesc="Unofficial Proton Drive client: FUSE files-on-demand mount, CLI, GTK4 app, tray (binaries)"
 arch=('x86_64')
@@ -22,6 +22,8 @@ provides=("${pkgname%-bin}=$pkgver" "proton-drive-linux=$pkgver" 'pdfs')
 conflicts=('proton-drive-linux' 'proton-drive-for-linux' 'proton-drive-for-linux-git')
 # Upstream ships the binaries already built on Ubuntu 24.04; do not rewrite them.
 options=('!strip' '!debug')
+# Stops the running daemon before removal, so the mount stops mirroring deletes.
+install=proton-drive.install
 _tag="v$pkgver"
 _raw="https://raw.githubusercontent.com/narrrl/proton-drive-linux/$_tag"
 # The release tarball holds the four binaries only, so the desktop integration
@@ -34,7 +36,7 @@ source=("proton-drive-linux-$pkgver-x86_64.tar.gz::$_repo/releases/download/$_ta
        "io.narl.proton-drive-linux-$pkgver.svg::$_raw/packaging/io.narl.proton-drive-linux.svg"
        "proton-drive-$pkgver.service::$_raw/packaging/proton-drive.service"
        "LICENSE-$pkgver::$_raw/LICENSE")
-sha256sums=('71fc50775cbd795717ed17c4a3994d8fdfb5ab30a223dcbc7f0e313f9ab615f7'
+sha256sums=('2e4a8ee660f1d1d683a03afd7d3c1262be87cebeb53893cae55f5e1b44199a04'
            'd190d6771fff0b975271fb62fd3fb0fa8bbf17d7278c10853c18557855b0c123'
            '1d95e250370220e3bb6aead6ce34d1d6cc759f42c4803b75f1667e78ff47c6c0'
            'e598a93c2715c3a9fdc7fb937902083d4a1135e8fbdfe6fe7e37f0383ebbd828'
@@ -0,0 +1 @@
+../../proton-drive.install
@@ -1,8 +1,9 @@
 pkgbase = proton-drive-for-linux-git
 	pkgdesc = Unofficial Proton Drive client: FUSE files-on-demand mount, CLI, GTK4 app, tray (git)
-	pkgver = 3.1.2.r0.g07c9b67
+	pkgver = 3.3.0.r0.g160626b
 	pkgrel = 1
 	url = https://proton-drive.narl.io
+	install = proton-drive.install
 	arch = x86_64
 	license = MIT
 	makedepends = cargo
@@ -24,8 +25,8 @@ pkgbase = proton-drive-for-linux-git
 	optdepends = xdg-utils: "Open folder" action in the tray menu
 	optdepends = fzf: search-as-you-type launcher (pdfs-prompt --fzf)
 	optdepends = foot: terminal that hosts pdfs-prompt --fzf when started from a keybinding
-	provides = proton-drive-for-linux=3.1.2.r0.g07c9b67
-	provides = proton-drive-linux=3.1.2.r0.g07c9b67
+	provides = proton-drive-for-linux=3.3.0.r0.g160626b
+	provides = proton-drive-linux=3.3.0.r0.g160626b
 	provides = pdfs
 	conflicts = proton-drive-linux
 	conflicts = proton-drive-for-linux
@@ -5,3 +5,4 @@
 !.SRCINFO
 !LICENSE
 !PKGBUILD
+!proton-drive.install
@@ -1,7 +1,7 @@
 # Maintainer: Nils Pukropp <contact@narl.io>

 pkgname=proton-drive-for-linux-git
-pkgver=3.1.2.r0.g07c9b67
+pkgver=3.3.0.r0.g160626b
 pkgrel=1
 pkgdesc="Unofficial Proton Drive client: FUSE files-on-demand mount, CLI, GTK4 app, tray (git)"
 arch=('x86_64')
@@ -23,6 +23,8 @@ provides=("${pkgname%-git}=$pkgver" "proton-drive-linux=$pkgver" 'pdfs')
 conflicts=('proton-drive-linux' 'proton-drive-for-linux' 'proton-drive-for-linux-bin')
 # LTO has broken GTK/Rust links for this workspace; the release profile keeps it off.
 options=('!lto')
+# Stops the running daemon before removal, so the mount stops mirroring deletes.
+install=proton-drive.install
 source=("$pkgname::git+$_repo.git")
 sha256sums=('SKIP')

@@ -0,0 +1 @@
+../../proton-drive.install
@@ -1,8 +1,9 @@
 pkgbase = proton-drive-for-linux
 	pkgdesc = Unofficial Proton Drive client: files-on-demand FUSE mount, CLI, GTK4 app and tray
-	pkgver = 3.1.2
+	pkgver = 3.3.0
 	pkgrel = 1
 	url = https://proton-drive.narl.io
+	install = proton-drive.install
 	arch = x86_64
 	license = MIT
 	makedepends = cargo
@@ -23,13 +24,13 @@ pkgbase = proton-drive-for-linux
 	optdepends = xdg-utils: "Open folder" action in the tray menu
 	optdepends = fzf: search-as-you-type launcher (pdfs-prompt --fzf)
 	optdepends = foot: terminal that hosts pdfs-prompt --fzf when started from a keybinding
-	provides = proton-drive-linux=3.1.2
+	provides = proton-drive-linux=3.3.0
 	provides = pdfs
 	conflicts = proton-drive-linux
 	conflicts = proton-drive-for-linux-bin
 	conflicts = proton-drive-for-linux-git
 	options = !lto
-	source = proton-drive-for-linux-3.1.2.tar.gz::https://github.com/narrrl/proton-drive-linux/archive/refs/tags/v3.1.2.tar.gz
-	sha256sums = 260ed05c8b041cf38c5904f7543780de0d0cb06d9695a427a98250d2a9ec0eb1
+	source = proton-drive-for-linux-3.3.0.tar.gz::https://github.com/narrrl/proton-drive-linux/archive/refs/tags/v3.3.0.tar.gz
+	sha256sums = ef58e96e64697917168f111958aaadf01c8eaac9fb482d0f6e70dfdc8ed4f167

 pkgname = proton-drive-for-linux
@@ -5,3 +5,4 @@
 !.SRCINFO
 !LICENSE
 !PKGBUILD
+!proton-drive.install
@@ -1,7 +1,7 @@
 # Maintainer: Nils Pukropp <contact@narl.io>

 pkgname=proton-drive-for-linux
-pkgver=3.1.2
+pkgver=3.3.0
 pkgrel=1
 pkgdesc="Unofficial Proton Drive client: files-on-demand FUSE mount, CLI, GTK4 app and tray"
 arch=('x86_64')
@@ -23,8 +23,10 @@ provides=("proton-drive-linux=$pkgver" 'pdfs')
 conflicts=('proton-drive-linux' 'proton-drive-for-linux-bin' 'proton-drive-for-linux-git')
 # LTO has broken GTK/Rust links for this workspace; the release profile keeps it off.
 options=('!lto')
+# Stops the running daemon before removal, so the mount stops mirroring deletes.
+install=proton-drive.install
 source=("$pkgname-$pkgver.tar.gz::$_repo/archive/refs/tags/v$pkgver.tar.gz")
-sha256sums=('260ed05c8b041cf38c5904f7543780de0d0cb06d9695a427a98250d2a9ec0eb1')
+sha256sums=('ef58e96e64697917168f111958aaadf01c8eaac9fb482d0f6e70dfdc8ed4f167')

 _srcname="proton-drive-linux-$pkgver"

@@ -0,0 +1 @@
+../../proton-drive.install
@@ -21,9 +21,11 @@ for pkg in "${packages[@]}"; do
  # A fresh clone every time: the AUR repository, not this checkout, is what the
  # commit history has to build on.
  git -c init.defaultBranch=master clone -q "ssh://aur@aur.archlinux.org/$pkg.git" "$workdir/$pkg"
-  install -m644 "$pkg/PKGBUILD" "$pkg/.SRCINFO" "$pkg/.gitignore" "$pkg/LICENSE" "$workdir/$pkg/"
+  # proton-drive.install is a link into packaging/; install copies its content.
+  install -m644 "$pkg/PKGBUILD" "$pkg/.SRCINFO" "$pkg/.gitignore" "$pkg/LICENSE" \
+    "$pkg/proton-drive.install" "$workdir/$pkg/"

-  git -C "$workdir/$pkg" add -f PKGBUILD .SRCINFO .gitignore LICENSE
+  git -C "$workdir/$pkg" add -f PKGBUILD .SRCINFO .gitignore LICENSE proton-drive.install
  if git -C "$workdir/$pkg" diff --cached --quiet; then
    echo "$pkg: no changes"
    continue
@@ -0,0 +1,22 @@
+#!/bin/sh
+# Removing the package does not stop a running daemon: it keeps serving the
+# mount from the deleted binary, so files deleted under the mount afterwards,
+# `rm -rf ~/ProtonDrive` included, are still deleted on Proton Drive. Stop every
+# logged-in user's service first; anything still queued stays on disk for the
+# next install. Same loop as packaging/proton-drive.install.
+set -e
+
+case "$1" in
+  remove) ;;
+  *) exit 0 ;;
+esac
+
+for dir in /run/user/*; do
+  user=$(id -nu "${dir##*/}" 2>/dev/null) || continue
+  if runuser -u "$user" -- env XDG_RUNTIME_DIR="$dir" \
+    systemctl --user --quiet is-active proton-drive.service 2>/dev/null; then
+    echo "Stopping Proton Drive for $user, which unmounts its drive."
+    runuser -u "$user" -- env XDG_RUNTIME_DIR="$dir" \
+      systemctl --user stop proton-drive.service 2>/dev/null || :
+  fi
+done
@@ -0,0 +1,42 @@
+# NixOS module: installs the package and runs the mount daemon in every
+# graphical session, as the other packages' user service does.
+#
+#   services.proton-drive-linux.enable = true;
+self:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.proton-drive-linux;
+in
+{
+  options.services.proton-drive-linux = {
+    enable = lib.mkEnableOption "the Proton Drive for Linux mount daemon, app and tray";
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = self.packages.${pkgs.stdenv.hostPlatform.system}.proton-drive-linux;
+      defaultText = lib.literalExpression "proton-drive-linux.packages.\${system}.proton-drive-linux";
+      description = "The package to use.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    # The unit ships in the package; this links it and pulls it into the
+    # graphical session, which is what `systemctl --user enable` would do.
+    systemd.packages = [ cfg.package ];
+    systemd.user.services.proton-drive = {
+      wantedBy = [ "graphical-session.target" ];
+      # The mount runs fusermount3 from PATH, and it has to be the setuid
+      # wrapper; the PATH NixOS gives a unit does not include it.
+      path = [ "/run/wrappers" ];
+    };
+    programs.fuse.enable = lib.mkDefault true;
+    # Session tokens are kept in the Secret Service.
+    services.gnome.gnome-keyring.enable = lib.mkDefault true;
+  };
+}
@@ -0,0 +1,127 @@
+# Nix package for the workspace, built from the checkout this file lives in.
+# The flake at the repository root exposes it; `nix build` builds it.
+{
+  lib,
+  rustPlatform,
+  adwaita-icon-theme,
+  pkg-config,
+  gettext,
+  glib,
+  wrapGAppsHook4,
+  fuse3,
+  glib-networking,
+  gtk4,
+  libadwaita,
+  webkitgtk_6_0,
+  libsecret,
+  dbus,
+  exiftool,
+  ffmpeg-headless,
+  withFfmpeg ? true,
+}:
+
+let
+  cargoToml = lib.importTOML ../../Cargo.toml;
+in
+rustPlatform.buildRustPackage {
+  pname = "proton-drive-linux";
+  inherit (cargoToml.workspace.package) version;
+
+  # Only what the build reads, so editing docs or CI does not rebuild.
+  src = lib.fileset.toSource {
+    root = ../..;
+    fileset = lib.fileset.unions [
+      ../../Cargo.toml
+      ../../Cargo.lock
+      ../../crates
+      ../../po
+      ../../LICENSE
+      ../proton-drive.service
+      ../io.narl.proton-drive-linux.desktop
+      ../io.narl.proton-drive-linux-tray.desktop
+      ../io.narl.proton-drive-linux.svg
+    ];
+  };
+
+  cargoLock.lockFile = ../../Cargo.lock;
+
+  cargoBuildFlags = [
+    "--bin"
+    "pdfs"
+    "--bin"
+    "pdfs-tray"
+    "--bin"
+    "pdfs-app"
+    "--bin"
+    "pdfs-prompt"
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    gettext # msgfmt, for po/build.sh
+    glib # glib-compile-resources, for the GUI's build.rs
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    fuse3
+    # TLS for WebKitGTK's GIO: without it the CAPTCHA page fails with "TLS
+    # support is not available". wrapGAppsHook4 adds it to GIO_EXTRA_MODULES.
+    glib-networking
+    # The stock icons the app asks for, such as the Photos and Computers
+    # sidebar entries. GTK ships only a few itself, and a session without
+    # Adwaita installed showed the rest as missing. wrapGAppsHook4 adds it to
+    # XDG_DATA_DIRS.
+    adwaita-icon-theme
+    gtk4
+    libadwaita
+    webkitgtk_6_0
+    libsecret
+    dbus
+  ];
+
+  # The app looks for its catalogs here instead of /usr/share/locale.
+  env.PDFS_LOCALEDIR = "${placeholder "out"}/share/locale";
+
+  # The suite mounts FUSE, talks to D-Bus and the kernel keyring, and checks
+  # permissions a build sandbox does not have; CI runs it on every push.
+  doCheck = false;
+
+  postInstall = ''
+    install -Dm644 packaging/io.narl.proton-drive-linux.desktop \
+      $out/share/applications/io.narl.proton-drive-linux.desktop
+    install -Dm644 packaging/io.narl.proton-drive-linux-tray.desktop \
+      $out/etc/xdg/autostart/io.narl.proton-drive-linux-tray.desktop
+    install -Dm644 packaging/io.narl.proton-drive-linux.svg \
+      $out/share/icons/hicolor/scalable/apps/io.narl.proton-drive-linux.svg
+    substituteInPlace $out/share/applications/io.narl.proton-drive-linux.desktop \
+      --replace-fail "Exec=pdfs-app" "Exec=$out/bin/pdfs-app"
+    substituteInPlace $out/etc/xdg/autostart/io.narl.proton-drive-linux-tray.desktop \
+      --replace-fail "Exec=pdfs-tray" "Exec=$out/bin/pdfs-tray"
+
+    install -Dm644 packaging/proton-drive.service \
+      $out/lib/systemd/user/proton-drive.service
+    substituteInPlace $out/lib/systemd/user/proton-drive.service \
+      --replace-fail "ExecStart=/usr/bin/pdfs" "ExecStart=$out/bin/pdfs"
+
+    patchShebangs po/build.sh
+    po/build.sh $out/share/locale
+  '';
+
+  # Thumbnails shell out to exiftool, and to ffmpeg for video. Suffixed, so a
+  # user's own builds on PATH win. fusermount3 comes from the system: on NixOS
+  # it is the setuid wrapper in /run/wrappers/bin.
+  preFixup = ''
+    gappsWrapperArgs+=(--suffix PATH : ${
+      lib.makeBinPath ([ exiftool ] ++ lib.optional withFfmpeg ffmpeg-headless)
+    })
+  '';
+
+  meta = {
+    description = "Unofficial Proton Drive client for Linux: files-on-demand FUSE mount, CLI, GTK4 app and tray";
+    homepage = "https://proton-drive.narl.io";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    mainProgram = "pdfs";
+  };
+}
@@ -37,11 +37,13 @@ Requires:       webkitgtk6.0
 Requires:       perl-Image-ExifTool
 Requires:       xdg-utils

-# DE-specific; do not Require a single desktop environment.
-Recommends:     gnome-keyring
+# DE-specific; do not Require a single desktop environment. dnf installs weak
+# dependencies by default, so each is conditional on its own desktop: a plain
+# `Recommends: kwallet` pulled KDE Frameworks onto GNOME installs.
+Recommends:     (gnome-keyring or plasma-workspace)
 Recommends:     iso-codes
-Recommends:     gnome-shell-extension-appindicator
-Recommends:     kwallet
+Recommends:     (gnome-shell-extension-appindicator if gnome-shell)
+Recommends:     (kwallet if plasma-workspace)

 # Only for `pdfs-prompt --fzf`; every other front end works without them.
 Suggests:       fzf
@@ -90,6 +92,25 @@ install -D -m0644 %{git_dir}/packaging/proton-drive.service \
  %{buildroot}/usr/lib/systemd/user/proton-drive.service
 %{git_dir}/po/build.sh %{buildroot}%{_datadir}/locale

+# Removing the package does not stop a running daemon: it keeps serving the
+# mount from the deleted binary, so files deleted under the mount afterwards,
+# `rm -rf ~/ProtonDrive` included, are still deleted on Proton Drive. Stop every
+# logged-in user's service first; anything still queued stays on disk for the
+# next install. $1 is 0 on an erase and 1 on an upgrade. Same loop as
+# packaging/proton-drive.install.
+%preun
+if [ "$1" -eq 0 ]; then
+  for dir in /run/user/*; do
+    user=$(id -nu "${dir##*/}" 2>/dev/null) || continue
+    if runuser -u "$user" -- env XDG_RUNTIME_DIR="$dir" \
+      systemctl --user --quiet is-active proton-drive.service 2>/dev/null; then
+      echo "Stopping Proton Drive for $user, which unmounts its drive."
+      runuser -u "$user" -- env XDG_RUNTIME_DIR="$dir" \
+        systemctl --user stop proton-drive.service 2>/dev/null || :
+    fi
+  done
+fi
+
 %files
 %license LICENSE
 %{_bindir}/pdfs
@@ -0,0 +1,19 @@
+# pacman install script, shared by packaging/PKGBUILD and the three AUR packages
+# (each links it). The same loop is in packaging/deb/prerm and the RPM %preun.
+
+# Removing the package does not stop a running daemon: it keeps serving the
+# mount from the deleted binary, so files deleted under the mount afterwards,
+# `rm -rf ~/ProtonDrive` included, are still deleted on Proton Drive. Stop every
+# logged-in user's service first; anything still queued stays on disk for the
+# next install. Upgrades call pre_upgrade, not this.
+pre_remove() {
+  for dir in /run/user/*; do
+    user=$(id -nu "${dir##*/}" 2>/dev/null) || continue
+    if runuser -u "$user" -- env XDG_RUNTIME_DIR="$dir" \
+      systemctl --user --quiet is-active proton-drive.service 2>/dev/null; then
+      echo "Stopping Proton Drive for $user, which unmounts its drive."
+      runuser -u "$user" -- env XDG_RUNTIME_DIR="$dir" \
+        systemctl --user stop proton-drive.service 2>/dev/null || :
+    fi
+  done
+}
@@ -4388,6 +4388,21 @@ def test_move_refuses_a_mirror_copy_drive_lacks(mc: MoveContext) -> None:
    # Sync skips symlinks, so Drive never gets this one: removing the local
    # copy after a move would lose it.
    os.symlink("data.txt", source.root / name / "link")
+    try:
+        _move_keeps_what_drive_lacks(mc, source, dest, name, files)
+    finally:
+        # The link stays local-only wherever it ended up, and a mirror folder
+        # holding one refuses the switch to on-demand that the next mode
+        # pairing makes.
+        for location in (source, dest):
+            link = location.root / name / "link"
+            if os.path.lexists(link):
+                os.unlink(link)
+
+
+def _move_keeps_what_drive_lacks(
+    mc: MoveContext, source: Location, dest: Location, name: str, files: dict[Path, bytes]
+) -> None:
    source.settle()
    if dest.mode == "mirror" and os.stat(source.folder).st_dev == os.stat(dest.folder).st_dev:
        # Between two mirrors on one filesystem the local copy is renamed
Author	SHA1	Message	Date
nvrl	b46abfc07c	chore(release): 3.4.0	2026-10-12 18:12:00 +02:00
nvrl	fd78f088ec	test(fuse): let a held create carry its bytes in the simulation FUSE delivers `release` after `close()` returns, and the release is what attaches the written bytes to the queued create. A drain worker that is free can claim the create first and send the file empty, with the bytes following as a revision. Tests that hold a create, its reply, or lose its reply then act on the empty create, and their assertions about the file's content race the revision. CI saw this as an occasional failure of a_listing_taken_before_a_create_commits_keeps_the_landed_file. Add Daemon::write_new, which pauses sync, writes the file, waits until the pending create carries the bytes, and resumes. Use it for every write that directly follows a create hold.	2026-10-12 18:05:45 +02:00
nvrl	005f7ded1f	fix(fuse): a file landing while its folder is pinned stays available offline (B208) A folder pin reads each file's modification time and size before it downloads the file. If the file's create landed during the download, the landing set Drive's time, and the pin then stored the blob under the old time. The file showed as kept offline but read as stale. After each download, the pin now compares the file's time and size with the tree's. If they changed, it downloads the file again under the new values, at most three times. The simulation gains FakeClient::hold_next_download to force that order.	2026-10-12 15:40:56 +02:00
nvrl	3e4886f965	fix(fuse): refuse a move between locations under a just-opened file (B207) The account run of 3.3.0 failed "move refuses a file still being written" on the on-demand to mirror pairing: pdfs move moved the folder while open.txt in it was open for writing, and the write landed after the move. retire_create re-keys a landed create's nodes row to the real uid first and repoints the tree and the open write handles after. A file opened in between holds a handle with the placeholder uid. has_pending_work_under placed each open handle by looking its uid up in the nodes table, which no longer has the placeholder, so it saw nothing open under the folder, and with the queue already empty the move went ahead. Open handles are now placed in the in-memory tree by inode, which a landing create does not change. The simulation test holds the drain at that point with the new FakeClient::hold_next_landing_of_any, and fails without the fix.	2026-10-12 00:57:10 +02:00
nvrl	aac53e3139	test(fuse): let the simulation sync local folders A simulated daemon could not add a synced folder, so nothing that moves between a mount, an on-demand folder and a mirror folder could be tested without a real account. Listing and registering devices now go through DriveApi, and the fake Drive keeps the account's computers, each with a root folder outside My files. The simulated daemons also read their config.json from a scratch XDG directory instead of the developer's own: an adopted device of the real account made every sync folder fail to register against the fake Drive.	2026-10-12 00:57:04 +02:00
nvrl	c2bf87596f	test(acceptance): remove the local-only symlink the mirror-copy case leaves "move never loses a mirror copy Drive lacks" puts a symlink in a mirror folder to prove a move does not lose what sync never uploads, and left it there. The next mode pairing switches that folder to on-demand, which the daemon refuses because the link exists only on this computer, so the account run stopped after pairing 2 of 4. The case now removes the link wherever the move left it, whether it passes or fails.	2026-10-12 00:24:40 +02:00
nvrl	69d4feaa07	docs: add a security model page for users Readers asked whether the client can be trusted with their files. The threat model in ARCHITECTURE.md is written for contributors, so docs/SECURITY_MODEL.md summarises it for users: encryption comes from the SDK and rPGP, sign-in uses SRP, what is stored where and how it is protected, who can reach the daemon, every network connection, what the client does not protect against, and how each package is built and signed. It says that there has been no independent audit. It is linked from the README, the documentation index and SECURITY.md.	2026-10-12 00:07:18 +02:00
nvrl	d481dcc15c	feat(fuse,core,cli,gui): make folders available offline from the app The daemon has kept recursive folder pins for a long time, but the app offered "Available offline" for files only. The context menu, the details pane and the selection bar now offer it for folders too, and a pinned folder carries the offline badge in the browser and the launcher. A folder pin used to download the whole subtree inside the control request, so a large folder outlasted the client's 120 s read timeout, and every pinned file was read into memory before it was cached. The daemon now records the pin, answers at once and downloads on a background thread as a job the tray and the app show, stopping when the folder is unpinned or the daemon stops. Pins of files and folders both go through fetch_content, which streams to disk and skips fresh blobs. A folder pin is refused while offline instead of looking kept. A file kept only because a folder above it is pinned has no pin of its own, and unpinning it silently did nothing. ListDir now reports pinned_by_folder; the app shows such an entry as available offline with the toggle greyed out, and the daemon refuses the unpin with a message naming the folder. Unpinning a folder no longer evicts files that are pinned on their own. Requested on Reddit.	2026-10-12 00:07:18 +02:00
nvrl	e0442c56b9	fix(packaging): stop the service before the package is removed Removing the package left the user service running from the deleted binary, with ~/ProtonDrive still mounted. A user who then deleted the folder to clean up had every file in it moved to the Proton Drive trash, as any delete through the mount is. The .deb (prerm on remove), the .rpm (%preun on erase) and the Arch packages (pre_remove) now stop proton-drive.service for every user with a running user manager, through runuser with that user's XDG_RUNTIME_DIR, so no systemd-machined is needed. Upgrades are left alone. Queued writes stay in the state directory for a later install. The pacman install script lives once in packaging/ and the AUR directories link it; push.sh copies its content into each AUR repository. The uninstall guide now warns not to delete the mount point while the service runs. Reported on Reddit by a user who restored the files from the trash.	2026-10-12 00:07:07 +02:00
nvrl	ee76f4ac60	fix(packaging): recommend each keyring only on its own desktop The RPM recommended both gnome-keyring and kwallet unconditionally, and dnf installs weak dependencies by default, so a GNOME install on Fedora pulled in KWallet and KDE Frameworks with it. The recommendations are now rich dependencies: KWallet only with plasma-workspace, GNOME Keyring only without it, and the AppIndicator extension only with gnome-shell. RPM does not accept `unless` in a weak dependency, so the keyring uses the equivalent `(gnome-keyring or plasma-workspace)`. Reported on Reddit by a Fedora GNOME user.	2026-10-12 00:06:51 +02:00
nvrl	f6c651b06b	ci(nix): push Nix builds to a Cachix binary cache Every Nix build of main and of each release tag now goes to proton-drive-linux.cachix.org, so installing the flake downloads the client instead of compiling it. The flake names the cache in nixConfig for nix run and nix shell, and the install guide shows the nix.settings a NixOS system build needs, since it does not read an input's nixConfig. A fork's pull request has no token and only pulls.	2026-10-11 23:02:22 +02:00
Nils Pukropp	8b7d7ae87f	chore(aur): update packages to 3.3.0	2026-10-11 20:08:31 +00:00
nvrl	160626b29d	chore(release): 3.3.0	2026-10-11 21:53:52 +02:00
nvrl	f1f1f8ad4d	ci(release): build the Nix flake at every release tag A flake input pinned to vX.Y.Z is the Nix release, so the release workflow now builds the flake at the tag and checks its version before the GitHub release is published. The install guide shows how to pin the input to a release tag, and the release checklist names the files that carry the version.	2026-10-11 21:53:52 +02:00
nvrl	bb28a18f49	Merge branch 'feat/issue-37-nix'	2026-10-11 21:48:28 +02:00
nvrl	a3c0c9ee9b	ci(release): take the release notes from the changelog The release workflow created each GitHub release without a body, so 3.1.2, 3.2.0 and 3.2.1 shipped with empty notes. It now copies the version's section of docs/CHANGELOG.md into the release, and fails when the section is missing.	2026-10-11 21:24:39 +02:00
nvrl	91fa1614ed	fix(core,fuse,cli,gui): say when an upgrade left the old daemon running A package upgrade replaces the binaries but does not restart the user service, so the daemon keeps the old release and its bugs until the next login. On 3.2.0 the reporter of #33 still saw "Couldn't sync Documents: read .../snapshots/37: Permission denied", which only a daemon older than 3.2.0 can produce: since then the scan leaves an unreadable subfolder out and only an unreadable sync root fails the pass (B206). The daemon now reports its release in Status; one from before the field omits it, which reads as older. When the daemon is older than the front-end, the tray says "Update not finished - restart Proton Drive" and offers a restart, the sync card shows "Restart to finish updating" with a Restart button, and pdfs status and pdfs diagnose print the systemctl command. A newer daemon is not flagged, since then the front-end is the stale one. Refs #33	2026-10-11 21:20:51 +02:00
nvrl	87361a4573	fix(core,fuse,gui): a photo upload the SDK refuses no longer says offline Every SDK error that was not an API reply was classified as Offline. Only a transport failure is. An upload on an account without a photo library fails in the SDK before any request, and the app said "You're offline" while every other call worked (issue #38). Classify by variant: Transport is Offline, InvalidOperation is Invalid, Serialization is Remote, Crypto and KeysLocked are Internal. The daemon logs a failed photo upload, and the Photos page greys out Upload when the account has no photo library. docs/BUGS.md B205.	2026-10-11 19:26:53 +02:00
Nils Pukropp	6d0b6ad553	chore(aur): update packages to 3.2.1	2026-10-11 17:24:37 +00:00
nvrl	170c3f01ff	chore(release): 3.2.1	2026-10-11 19:19:36 +02:00
nvrl	976ad2aa04	docs(changelog): list the issue #35 fixes under Unreleased The CPU spin while offline, the expired session shown as offline, the lost refresh tokens and the keyring-refused rotation were fixed without a changelog entry.	2026-10-11 18:56:55 +02:00
nvrl	b73cd087aa	test(core): time the B12 index write as the best of five runs A single timed run lost the CPU to the rest of the suite running alongside it and read as the full-scan regression (171 ms against 701 ms). The fastest of five runs still catches the 6x scaling of the old path.	2026-10-11 18:56:55 +02:00
nvrl	e402981708	fix(packaging): ship the Adwaita icons with the Nix package GTK ships only a few stock icons itself. On a NixOS session without Adwaita installed, such as Hyprland, the Photos and Computers sidebar entries and about twenty other icons showed as missing (#37). adwaita-icon-theme in buildInputs puts it on the wrapper's XDG_DATA_DIRS.	2026-10-11 18:55:00 +02:00
Claude	453c439b74	fix(packaging): give the Nix package TLS for WebKitGTK On NixOS the CAPTCHA window failed with "TLS support is not available": WebKitGTK's GIO had no TLS backend. With glib-networking in buildInputs, wrapGAppsHook4 puts its GIO modules on GIO_EXTRA_MODULES in every wrapper. Refs #37 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EuyxByBpK3fSWtyPkugeHz	2026-10-10 08:23:21 +00:00
Claude	ceba0f5849	feat(packaging): add a Nix flake and NixOS module Builds the four binaries with rustPlatform.buildRustPackage from Cargo.lock, installs the desktop entries, icon, user service and translations as the other packages do, and wraps the binaries with exiftool and ffmpeg on PATH. The NixOS module installs the package, pulls proton-drive.service into the graphical session with the fusermount3 wrapper on its PATH, and enables FUSE and GNOME Keyring. A Nix workflow builds the flake when its recipe, the lock files or the code change. Refs #37 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EuyxByBpK3fSWtyPkugeHz	2026-10-09 22:07:20 +00:00
Claude	3e0db8cf46	fix(fuse): fill an incomplete queued revision's gaps on a write open A partial write whose base was not in the content cache queued an incomplete revision, and every write open over it was refused with EIO until the drain uploaded it. CI's one-client-lan simulation hit this on seed 1: a create over a file whose partial edit had not drained yet. The write open now copies the blob and fills its gaps from the remote base with Core::fill_gaps, as the drain does, and fails only when that fill fails (B204). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EuyxByBpK3fSWtyPkugeHz	2026-10-09 11:36:46 +00:00
nvrl	2a86830e72	Merge branch 'fix/issue-35-dead-session' Issue #35: a refused session showed as offline forever, the drain workers spun while offline, and refreshed tokens could be lost or overwritten (B200-B203, B61). Needs proton-sdk 0.8.2.	2026-10-09 12:34:38 +02:00
nvrl	43031ecf99	chore(deps) updated sdk to 0.8.2	2026-10-09 12:34:02 +02:00
nvrl	2b6c37f543	fix(fuse,core,cli,gui): say when the keyring refuses the refreshed sign-in A rotation the keyring refused was retried and kept in the kernel keyring, but only the log said so, and a reboot before the keyring took it still signed the user out. `Response::Status` carries `tokens_unsaved` while one waits. The tray says "Sign-in not saved — unlock your keyring" and needs attention, the app's status says the same, `pdfs status` prints a Keyring line and `pdfs diagnose` warns. New strings are translated in every catalog (B61).	2026-10-09 12:22:02 +02:00
nvrl	3458e2e72d	fix(core): keep refused token rotations in the kernel keyring A rotation the Secret Service refused lived only in the daemon's memory, so a crash or SIGKILL before the retry landed lost the only live refresh token. Keep it in the kernel keyring as well until it is written. The next resume, by the daemon or `pdfs unlock`, puts it back in when the stored blob still holds the refresh token it spent, and writes it; one left over from an older login is dropped. `kernelkey` now holds named keys, the passphrases and the unsaved tokens (B61).	2026-10-09 12:14:25 +02:00
nvrl	0ac5928138	fix(fuse,core,cli): resume a session another process refreshed `pdfs unlock` resumes the daemon's session and may refresh it. The daemon then holds a spent refresh token, and since B202 a refusal of it read as an expired session although the keyring held a live one. Before calling a refused session expired, compare the keyring with what this process last stored. When it holds a newer rotation or another login, end the mount with `MountOutcome::ResumeStored` and mount again from the keyring. A rotation another process already wrote counts as this session's, so the daemon keeps writing its later ones (B203).	2026-10-09 12:08:17 +02:00
nvrl	beb3b2e4e4	fix(core): retry rotated tokens the keyring refused A failed keyring write after a refresh was only a warning, and the one live refresh token then lived in memory only (B61). The sink now keeps the rotation as unsaved and retries it in the background after 1 s, 5 s, 30 s and then every 5 minutes, until it is written or the blob has moved on. The refusal is logged as an error naming `pdfs login`. docs/BUGS.md B61.	2026-10-09 11:29:31 +02:00
nvrl	bf43476e88	fix(fuse,core,cli,gui): show a refused session as expired, not offline A refresh token Proton refused, or a deleted or disabled account, was treated as a lost connection: the mount came up "offline", the probe retried forever and logged only at debug, and nothing told the user that only signing in again helps (issue #35). session_revoked() names those errors. The root fetch, probe, drain, event poll, event seed and photos root now set session_expired, log one warning naming `pdfs login`, and stop retrying. Cached files stay readable and changes stay queued. Response::Status carries session_expired (serde default false). The tray shows "Session expired — sign in again" with a Sign In Again… item that opens the app's sign-in page; the app's status and Sync card say the same with a button. `pdfs status` and `pdfs diagnose` report it. New strings are translated in every catalog. docs/BUGS.md B202.	2026-10-09 11:27:09 +02:00
nvrl	6363125fec	fix(core,cli): write rotated tokens only into their own session's blob Proton refresh tokens are single-use. store_tokens replaced the tokens of whatever blob was stored, so after `pdfs login` restarted the daemon, the old daemon's shutdown persist wrote its spent tokens into the new session's blob, and the new daemon failed with InvalidRefreshToken (issue #35). `pdfs unlock` and the legacy migration had the same shape. Each session now writes through a TokenSink that only touches a blob with its session id that still holds the refresh token it last left there. Shutdown only flushes a rotation the keyring refused. unlock and migrate_legacy re-read the blob after verifying. docs/BUGS.md B201.	2026-10-09 11:08:40 +02:00
nvrl	51d114a8da	fix(fuse,core): idle drain workers no longer spin while offline Offline or paused, a drain worker claims nothing and then slept until the earliest queued op fell due. Every queued op was already due and nothing attempted it, so the wait was zero and all 16 workers spun on the queue for the whole outage (issue #35: 17 min of CPU in 2 min 16 s). A worker that claims nothing now sleeps the full idle poll; a reconnect or resume wakes it. earliest_due_at also uses the claim's exclusions, so an op held behind a claimed op on the same node no longer counts as due. docs/BUGS.md B200.	2026-10-09 11:05:12 +02:00
Nils Pukropp	31be27f30e	chore(aur): update packages to 3.2.0	2026-10-09 01:14:52 +00:00