docs: publish docs/ to the GitHub wiki and reorganise the user guide

- scripts/publish-wiki.sh publishes every page listed in SECTIONS, copies images, writes a sectioned sidebar and footer, and removes stale pages. --check fails on links to missing files or headings and on docs pages that are neither published nor excluded. - New wiki.yml runs the check on pull requests and pushes to main, and publishes when release.yml calls it or when started by hand. - Split USER_GUIDE.md into topic pages (files, synced folders, photos, sharing, computers, launcher and tray); add Getting started and FAQ. - Make the COPR repository the main Fedora path, with update and uninstall steps for every package type. - Fix the stale CAPTCHA note in CLI.md, document pdfs unlock and lock, and drop the broken AGENTS.md link from CONTRIBUTING.md.
Merge pull request #44 from narrrl/automate-updates
2026-11-04 08:56:59 +01:00 · 2026-10-17 13:57:55 +02:00 · 2026-10-17 13:13:49 +02:00 · 2026-10-17 12:38:09 +02:00 · 2026-10-17 11:45:09 +02:00 · 2026-10-17 11:44:33 +02:00
118 changed files with 18495 additions and 10239 deletions
@@ -3,6 +3,9 @@ contact_links:
  - name: Security vulnerability
    url: https://github.com/narrrl/proton-drive-linux/security/advisories/new
    about: Report privately — never in a public issue.
+  - name: Troubleshooting and FAQ
+    url: https://github.com/narrrl/proton-drive-linux/wiki/Troubleshooting
+    about: Fixes for common problems, and what to include in a bug report.
  - name: Known issues
    url: https://github.com/narrrl/proton-drive-linux/blob/main/docs/BUGS.md
    about: The authoritative ledger of tracked bugs and their status.
@@ -21,6 +21,7 @@ cargo test --workspace --locked
 - [ ] Touches recovery, staging, or anything that can be the only copy of user data
 - [ ] Changes packaging, the systemd unit, or desktop entries
 - [ ] Changes the control protocol (daemon and front ends updated together)
+- [ ] Adds or renames a page in `docs/` (listed in `SECTIONS` in `scripts/publish-wiki.sh`, which publishes it to the wiki)
 - [ ] None of the above

 <!-- Screenshots for GTK changes. -->
@@ -45,7 +45,7 @@ jobs:
        run: cargo fmt --all -- --check

      - name: Lints
-        run: cargo clippy --workspace --all-targets -- -D warnings
+        run: cargo clippy --workspace --all-targets --locked -- -D warnings

      - name: Unit tests
        run: cargo test --workspace --locked
@@ -66,8 +66,9 @@ jobs:

  # The seeded simulation runs (docs/TESTING.md): real FUSE
  # daemons against an in-memory Drive, so they need /dev/fuse but no account.
+  # They run on pull requests too: most data-loss fixes are only exercised
+  # here, and a change that breaks one should not reach main first.
  simulation:
-    if: github.event_name != 'pull_request'
    runs-on: ubuntu-24.04
    timeout-minutes: 30

@@ -0,0 +1,66 @@
+name: COPR
+
+on:
+  # Called by release.yml once the GitHub release and its assets exist: COPR
+  # downloads the tag archive and the vendored crates from the release.
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
+    secrets:
+      COPR_CONFIG:
+        required: true
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Release to build, such as 3.5.0. It must already have its vendor tarball.'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: copr
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build in COPR
+    runs-on: ubuntu-24.04
+    container: fedora:latest
+    env:
+      VERSION: ${{ inputs.version }}
+      COPR_PROJECT: narl-rs/proton-drive-linux
+
+    steps:
+      - name: Install packaging tools
+        run: dnf -y install copr-cli rpm-build rpmdevtools
+
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Configure COPR access
+        env:
+          COPR_CONFIG: ${{ secrets.COPR_CONFIG }}
+        run: |
+          install -d -m700 ~/.config
+          printf '%s\n' "$COPR_CONFIG" > ~/.config/copr
+          chmod 600 ~/.config/copr
+
+      # COPR rebuilds the source package without our --define, so the version
+      # has to be written into the spec itself.
+      - name: Build the source package
+        run: |
+          version="${VERSION#v}"
+          spec=packaging/proton-drive-linux.spec
+          sed -i -E "s/^(%\{!\?version: %global version )[^}]*\}/\1${version}}/" "$spec"
+          grep -qF "%global version ${version}}" "$spec"
+          mkdir -p rpmbuild/SOURCES
+          spectool -g -C rpmbuild/SOURCES "$spec"
+          rpmbuild -bs --define "_topdir $PWD/rpmbuild" "$spec"
+
+      # Waits for the build, so a failed COPR build fails this job.
+      - name: Submit to COPR
+        run: copr-cli build "$COPR_PROJECT" rpmbuild/SRPMS/*.src.rpm
@@ -52,8 +52,10 @@ jobs:
          tag_version="${GITHUB_REF_NAME#v}"
          manifest_version="$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -n1)"
          pkgbuild_version="$(sed -n 's/^pkgver=//p' packaging/PKGBUILD | head -n1)"
+          spec_version="$(sed -n 's/^%{!?version: %global version \([^}]*\)}/\1/p' packaging/proton-drive-linux.spec)"
          test "$tag_version" = "$manifest_version"
          test "$tag_version" = "$pkgbuild_version"
+          test "$tag_version" = "$spec_version"

      - name: Release quality gates
        run: |
@@ -129,6 +131,12 @@ jobs:
          # Create tarball
          tar -czf proton-drive-linux-${{ env.VERSION }}-x86_64.tar.gz -C dist/binaries .

+      # Every crate the build needs, so COPR can build the spec without network.
+      - name: Package vendored crates (.tar.xz)
+        run: |
+          cargo vendor --locked dist/vendor > /dev/null
+          tar -cJf proton-drive-linux-vendor-${{ env.VERSION }}.tar.xz -C dist vendor
+
      - name: Package Debian package (.deb)
        run: |
          mkdir -p deb/DEBIAN
@@ -230,6 +238,7 @@ jobs:
          path: |
            *.deb
            *.tar.gz
+            *.tar.xz
            *.rpm
          if-no-files-found: error

@@ -297,6 +306,7 @@ jobs:
          files: |
            *.deb
            *.tar.gz
+            *.tar.xz
            *.rpm
          draft: false
          prerelease: false
@@ -312,3 +322,21 @@ jobs:
      version: ${{ github.ref_name }}
    secrets:
      AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+
+  copr:
+    name: Build COPR packages
+    needs: publish
+    if: startsWith(github.ref, 'refs/tags/')
+    uses: ./.github/workflows/copr.yml
+    with:
+      version: ${{ github.ref_name }}
+    secrets:
+      COPR_CONFIG: ${{ secrets.COPR_CONFIG }}
+
+  wiki:
+    name: Publish the wiki
+    needs: publish
+    if: startsWith(github.ref, 'refs/tags/')
+    uses: ./.github/workflows/wiki.yml
+    with:
+      ref: ${{ github.ref_name }}
@@ -0,0 +1,77 @@
+name: Wiki
+
+# docs/ is the source of the GitHub wiki (docs/DEVELOPMENT.md#common-changes).
+# Every change to the documentation checks its links; release.yml calls this
+# once the release is published, so the wiki documents the latest release. Run
+# it from the Actions tab to publish main in between.
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'docs/**'
+      - 'images/**'
+      - 'README.md'
+      - 'CONTRIBUTING.md'
+      - 'SECURITY.md'
+      - 'scripts/publish-wiki.sh'
+      - '.github/workflows/wiki.yml'
+  pull_request:
+    paths:
+      - 'docs/**'
+      - 'images/**'
+      - 'README.md'
+      - 'CONTRIBUTING.md'
+      - 'SECURITY.md'
+      - 'scripts/publish-wiki.sh'
+      - '.github/workflows/wiki.yml'
+  workflow_call:
+    inputs:
+      ref:
+        description: 'Tag or branch to publish'
+        required: true
+        type: string
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Tag or branch to publish'
+        required: false
+        default: 'main'
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    name: Check documentation links
+    if: inputs.ref == ''
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Check links
+        run: scripts/publish-wiki.sh --check "$RUNNER_TEMP"
+
+  publish:
+    name: Publish to the wiki
+    # Set only by release.yml and the Actions tab, so pushes and pull requests
+    # never publish.
+    if: inputs.ref != ''
+    runs-on: ubuntu-24.04
+    concurrency:
+      group: wiki-publish
+      cancel-in-progress: false
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref }}
+
+      - name: Publish
+        env:
+          WIKI_REMOTE: https://x-access-token:${{ github.token }}@github.com/${{ github.repository }}.wiki.git
+        run: |
+          git config --global user.name 'github-actions[bot]'
+          git config --global user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          scripts/publish-wiki.sh --push "$RUNNER_TEMP"
@@ -6,10 +6,10 @@ deliberately high — everything else is ordinary Rust review.

 ## Before you start

- Read [`AGENTS.md`](AGENTS.md) for repository conventions,
-  [`docs/DEVELOPMENT.md`](docs/DEVELOPMENT.md) for building, running and debugging from source,
-  and [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for how the daemon, front ends, and SDK fit
-  together. [`docs/README.md`](docs/README.md) indexes the rest.
+- Read [`docs/DEVELOPMENT.md`](docs/DEVELOPMENT.md) for building, running and debugging from
+  source, and [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for how the daemon, front ends, and
+  SDK fit together. [`docs/README.md`](docs/README.md) indexes the rest. The same pages are on
+  the [wiki](https://github.com/narrrl/proton-drive-linux/wiki).
 - Check [`docs/BUGS.md`](docs/BUGS.md) — it is the authoritative issue ledger, and your problem may
  already be tracked there with context.
 - For anything larger than a fix, open an issue first so the design can be discussed before you
@@ -58,8 +58,10 @@ runs are destructive: use a dedicated test account, never one holding data you c
  catalog in `po/LINGUAS` in the same change. See [`docs/TRANSLATING.md`](docs/TRANSLATING.md).
  The CLI and daemon messages stay in English.
 - **Document what users see.** A new command, setting or behaviour belongs in the matching page
-  under `docs/` (user guide, CLI reference or configuration) and in the `[Unreleased]` section of
-  [`docs/CHANGELOG.md`](docs/CHANGELOG.md).
+  under `docs/` (a user guide topic, the CLI reference or configuration) and in the `[Unreleased]`
+  section of [`docs/CHANGELOG.md`](docs/CHANGELOG.md). Each release publishes `docs/` to the
+  wiki. A new page goes into `SECTIONS` in `scripts/publish-wiki.sh`, and
+  `scripts/publish-wiki.sh --check` must pass. CI runs it on every change to `docs/`.

 ## Commits and pull requests

@@ -3474,7 +3474,7 @@ checksum = "2ee67f1008b1ba2321834326597b8e186293b049a023cdef258527550b9935b4"

 [[package]]
 name = "pdfs-cli"
-version = "3.4.0"
+version = "3.5.0"
 dependencies = [
 "anyhow",
 "clap",
@@ -3490,13 +3490,14 @@ dependencies = [

 [[package]]
 name = "pdfs-core"
-version = "3.4.0"
+version = "3.5.0"
 dependencies = [
 "async-trait",
 "base64 0.23.1",
 "dbus-secret-service-keyring-store",
 "directories",
 "ignore",
+ "kamadak-exif",
 "keyring-core",
 "libc",
 "parking_lot",
@@ -3516,7 +3517,7 @@ dependencies = [

 [[package]]
 name = "pdfs-fuse"
-version = "3.4.0"
+version = "3.5.0"
 dependencies = [
 "async-trait",
 "base64 0.23.1",
@@ -3538,7 +3539,7 @@ dependencies = [

 [[package]]
 name = "pdfs-gui"
-version = "3.4.0"
+version = "3.5.0"
 dependencies = [
 "anyhow",
 "async-channel",
@@ -3778,9 +3779,9 @@ dependencies = [

 [[package]]
 name = "proton-drive-rs"
-version = "0.8.2"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e789cab811c5e73e47fd97810b78a513cb254f4dd763b4eb3cad680d6dd31da"
+checksum = "9e6b87f78711e8fc72737c8eb24ebda156079308d79ab37ca2b1b32de6812880"
 dependencies = [
 "async-trait",
 "base64 0.23.1",
@@ -3805,9 +3806,9 @@ dependencies = [

 [[package]]
 name = "proton-sdk"
-version = "0.8.2"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ace260acbf88c26f5bd4aef8c8c9898c322163c56620bdef3b6dd7742bec7619"
+checksum = "19f1936755c603b98de1c82a5b343c6232e9fea8adaa77139f7cb8fcddcda697"
 dependencies = [
 "aes-gcm 0.11.1",
 "async-trait",
@@ -3,7 +3,7 @@ resolver = "2"
 members = ["crates/pdfs-core", "crates/pdfs-fuse", "crates/pdfs-cli", "crates/pdfs-gui"]

 [workspace.package]
-version = "3.4.0"
+version = "3.5.0"
 edition = "2024"
 license = "MIT"
 authors = ["Nils Pukropp <contact@narl.io>"]
@@ -15,8 +15,8 @@ keywords = ["proton", "drive", "fuse", "sync", "linux"]
 categories = ["filesystem", "command-line-utilities"]

 [workspace.dependencies]
-proton-sdk = { version = "0.8.2" }
-proton-drive-rs = { version = "0.8.2" }
+proton-sdk = { version = "0.9.1" }
+proton-drive-rs = { version = "0.9.1" }

 # Internal crates.
 pdfs-core = { path = "crates/pdfs-core" }
@@ -61,3 +61,15 @@ async-trait = "0.1"
 futures = "0.3"
 fuser = "0.18"
 libc = "0.2"
+
+[profile.release]
+# No package ships a separate debug package (the PKGBUILD sets `!debug`, the
+# RPM spec sets `debug_package` to nil), and the unstripped binaries weighed
+# 43 MB (`pdfs`), 24 MB (`pdfs-app`) and 12 MB (`pdfs-tray`).
+strip = "symbols"
+# Off on purpose: LTO has broken GTK links for this workspace, which is why
+# the packages turn it off as well.
+lto = false
+# `Workers` and the thumbnail build catch panics to keep the daemon alive, so
+# unwinding must stay on.
+panic = "unwind"
@@ -73,16 +73,30 @@ scriptable CLI.

 | Distribution | Package |
 |---|---|
-| Debian, Ubuntu 24.04 or newer | `.deb` from the [latest release](https://github.com/narrrl/proton-drive-linux/releases/latest) |
-| Fedora 44 or newer | `.rpm` from the [latest release](https://github.com/narrrl/proton-drive-linux/releases/latest) |
+| Fedora 44 or newer | [`narl-rs/proton-drive-linux`](https://copr.fedorainfracloud.org/coprs/narl-rs/proton-drive-linux/) in COPR, updated with `dnf upgrade` |
 | Arch Linux | [`proton-drive-for-linux`](https://aur.archlinux.org/packages/proton-drive-for-linux) (also `-bin` and `-git`) in the AUR |
-| NixOS | The flake in this repository: see [Install → NixOS](docs/INSTALL.md#nixos-flake) |
+| Debian, Ubuntu 24.04 or newer | `.deb` from the [latest release](https://github.com/narrrl/proton-drive-linux/releases/latest) |
+| NixOS | The flake in this repository: see [Installation → NixOS](docs/INSTALL.md#nixos-flake) |
 | Anything else | [Build from source](docs/INSTALL.md#build-from-source) |

+**Fedora**
+
 ```bash
-sudo apt install ./proton-drive-linux_*.deb        # Debian, Ubuntu
-sudo dnf install ./proton-drive-linux-*.rpm        # Fedora
-paru -S proton-drive-for-linux                     # Arch
+sudo dnf copr enable narl-rs/proton-drive-linux
+sudo dnf install proton-drive-linux
+```
+
+**Arch Linux**
+
+```bash
+paru -S proton-drive-for-linux
+```
+
+**Debian and Ubuntu:** download the `.deb` from the
+[latest release](https://github.com/narrrl/proton-drive-linux/releases/latest), then:
+
+```bash
+sudo apt install ./proton-drive-linux_*_amd64.deb
 ```

 Then open **Proton Drive** from your applications menu and sign in. The app starts the background
@@ -97,14 +111,20 @@ systemctl --user enable --now proton-drive.service
 pdfs status
 ```

-[docs/INSTALL.md](docs/INSTALL.md) has the requirements, optional extras (tray on GNOME, RAW and
-video thumbnails), headless use and uninstalling.
+New to the client? [Getting started](docs/GETTING_STARTED.md) walks through the first steps.
+[Installation](docs/INSTALL.md) has the optional extras (tray on GNOME, RAW and video
+thumbnails), updating, headless use and uninstalling.

 ## Documentation

+The documentation is in [`docs/`](docs/README.md) and on the
+[wiki](https://github.com/narrrl/proton-drive-linux/wiki).
+
 | | |
 |---|---|
+| [Getting started](docs/GETTING_STARTED.md) | From installing to your first synced folder |
 | [User guide](docs/USER_GUIDE.md) | Everything the app, tray and launcher do |
+| [FAQ](docs/FAQ.md) | Short answers to common questions |
 | [Command-line reference](docs/CLI.md) | Every `pdfs` command and scripting with `--json` |
 | [Configuration](docs/CONFIGURATION.md) | `config.json`, file locations, environment variables, the service |
 | [Troubleshooting](docs/TROUBLESHOOTING.md) | Diagnosing problems and fixing common ones |
@@ -151,7 +171,8 @@ keys before it leaves the machine, through a Rust implementation of Proton's Dri

 Files you open are decrypted into a local cache so programs can read them. What that means for
 the security of the machine is spelled out in the
-[threat model](docs/ARCHITECTURE.md#10-threat-model-what-this-client-writes-to-disk-in-plaintext).
+[security model](docs/SECURITY_MODEL.md#what-is-kept-on-this-computer), and in full detail in
+the [threat model](docs/ARCHITECTURE.md#10-threat-model-what-this-client-writes-to-disk-in-plaintext).

 ## Contributing

@@ -630,6 +630,16 @@ enum DeviceCmd {
        #[arg(long, conflicts_with = "uid")]
        clear: bool,
    },
+    /// Sync the same folders as another computer: this machine continues that
+    /// computer's device alongside it, and its folders are offered for syncing
+    /// here. Both computers keep them in step.
+    Join {
+        /// Device uid (from `devices list`).
+        uid: String,
+        /// Skip the confirmation and accept every proposed local path.
+        #[arg(long)]
+        yes: bool,
+    },
    /// Move another computer's folders into this computer's backup and sync
    /// them here. The other computer stays registered, without those folders.
    Migrate {
@@ -831,6 +841,20 @@ fn main() -> Result<()> {

    let cli = Cli::parse();
    JSON_OUTPUT.store(cli.json, std::sync::atomic::Ordering::Relaxed);
+    // The commands that hold the password, the key passphrases or the session
+    // tokens in memory: keep them out of core dumps and away from same-user
+    // ptrace. Only the daemon did, though `mount` holds the same keys for as
+    // long as it runs.
+    if matches!(
+        cli.command,
+        Command::Login { .. }
+            | Command::Unlock { .. }
+            | Command::Logout
+            | Command::Mount { .. }
+            | Command::Daemon { .. }
+    ) {
+        pdfs_core::kernelkey::forbid_dumps();
+    }
    match cli.command {
        Command::Login { username, remember } => cmd_login(username, remember),
        Command::Unlock { remember } => cmd_unlock(remember),
@@ -978,6 +1002,26 @@ fn cmd_devices(action: DeviceCmd) -> Result<()> {
            let uid = if clear { None } else { uid };
            ok_or_bail(control_request(CtlRequest::AdoptDevice { uid })?)?
        }
+        DeviceCmd::Join { uid, yes } => {
+            if !yes {
+                println!(
+                    "This computer syncs into that device alongside it. Its folders are kept\n\
+                     in step on both computers: an edit or a deletion on one reaches the other.\n\
+                     New synced folders here go under that device too. Folders already synced\n\
+                     here stay where they are."
+                );
+                confirm("Sync with it?")?;
+            }
+            let response = control_request(CtlRequest::AdoptDevice { uid: Some(uid) })?;
+            // A script gets the one reply and runs `sync restore` itself.
+            if emit_json(&response)? {
+                return Ok(());
+            }
+            ok_or_bail(response)?;
+            // The device is this machine's now, so the plain restore offers its
+            // folders.
+            cmd_sync_restore(yes, None)?
+        }
        DeviceCmd::Migrate { uid, yes } => {
            if !yes {
                println!(
@@ -1867,7 +1911,22 @@ fn cmd_login(username: Option<String>, remember: bool) -> Result<()> {
        get_mailbox,
        get_hv,
    ))
-    .context("login failed")?;
+    .map_err(|e| {
+        // Proton words this block as "update the app", which the user can't
+        // act on: the release is current and only waiting helps.
+        let blocked =
+            matches!(&e, pdfs_core::Error::Proton(p) if pdfs_core::error::sign_in_blocked(p));
+        let e = anyhow::Error::new(e).context("login failed");
+        if blocked {
+            e.context(
+                "Proton is temporarily refusing sign-in from this device (code 2028). \
+                 Your version is not the problem. Wait several hours, up to a day, \
+                 without trying again, then sign in.",
+            )
+        } else {
+            e
+        }
+    })?;

    // A daemon that is already up is parked in `wait_for_session`, sleeping
    // between keyring checks; restart it so the mount appears now instead of
@@ -1962,8 +2021,14 @@ fn key_state_name() -> &'static str {
 }

 fn cmd_logout() -> Result<()> {
-    auth::logout()?;
-    println!("Stored session cleared.");
+    if auth::logout()? {
+        println!("Signed out: the session is ended on Proton and cleared here.");
+    } else {
+        println!(
+            "Stored session cleared. Proton could not be reached to end the session; \
+             it stays valid until it expires or is signed out in your account's security settings."
+        );
+    }
    Ok(())
 }

@@ -2206,9 +2271,6 @@ where
 /// an external unmount triggers a remount; errors back off and retry. This is
 /// the entry point for the systemd user service.
 fn cmd_daemon(mountpoint: Option<PathBuf>) -> Result<()> {
-    // The daemon holds the account's key passphrases in memory; keep them out
-    // of core dumps and away from same-user ptrace.
-    pdfs_core::kernelkey::forbid_dumps();
    loop {
        // Wait until a session is stored. The GUI enables this service on login,
        // but the service may also start at boot before the user has logged in.
@@ -2577,7 +2639,10 @@ fn cmd_import_google_photos(archives: Vec<PathBuf>, dry_run: bool, wait: bool) -
            } => continue,
            CtlResponse::ImportStatus { summary, .. } => {
                print_import_summary(summary.as_ref());
-                return Ok(());
+                return finished_run(
+                    "the import",
+                    summary.map(|s| (s.failed, s.cancelled, s.error)),
+                );
            }
            CtlResponse::Error { message, kind } => bail!("{}", cli_error(kind, &message)),
            other => bail!("unexpected response: {other:?}"),
@@ -2620,7 +2685,10 @@ fn cmd_redate_photos(
            CtlResponse::RedateStatus { running: true, .. } => continue,
            CtlResponse::RedateStatus { summary, .. } => {
                print_redate_summary(summary.as_ref());
-                return Ok(());
+                return finished_run(
+                    "the re-date",
+                    summary.map(|s| (s.failed, s.cancelled, s.error)),
+                );
            }
            CtlResponse::Error { message, kind } => bail!("{}", cli_error(kind, &message)),
            other => bail!("unexpected response: {other:?}"),
@@ -2628,6 +2696,22 @@ fn cmd_redate_photos(
    }
 }

+/// How a run `--wait` followed ended, as the exit status: an error when it
+/// failed, was cancelled, or left photos failed, so a script can tell.
+/// `outcome` is `(failed, cancelled, error)`; `None` when the daemon has no
+/// result, which happens when it restarted during the run.
+fn finished_run(what: &str, outcome: Option<(usize, bool, Option<String>)>) -> Result<()> {
+    match outcome {
+        None => bail!("{what} ended without a result; the service may have restarted"),
+        Some((_, _, Some(error))) => bail!("{what} failed: {error}"),
+        Some((_, true, None)) => bail!("{what} was cancelled"),
+        Some((failed, false, None)) if failed > 0 => {
+            bail!("{what} finished, but {failed} photo(s) failed")
+        }
+        Some(_) => Ok(()),
+    }
+}
+
 /// A `YYYY-MM-DD` day as epoch seconds at UTC midnight. Reuses the Takeout
 /// scanner's date reader, which already accepts exactly this spelling.
 fn parse_day(day: &str) -> Result<i64> {
@@ -2663,6 +2747,10 @@ fn print_redate_summary(summary: Option<&pdfs_core::control::RedateSummary>) {
        println!("No re-date has run yet.");
        return;
    };
+    if let Some(error) = &summary.error {
+        println!("Failed           : {error}");
+        return;
+    }
    println!("Photos examined  : {}", summary.examined);
    println!("Mis-dated        : {}", summary.candidates);
    if summary.dry_run {
@@ -2722,6 +2810,10 @@ fn print_import_summary(summary: Option<&pdfs_core::control::ImportSummary>) {
        println!("No import has run yet.");
        return;
    };
+    if let Some(error) = &summary.error {
+        println!("Failed           : {error}");
+        return;
+    }
    println!("Photos in export : {}", summary.found);
    println!("Uploaded         : {}", summary.uploaded);
    println!("Already on Proton: {}", summary.duplicates);
@@ -3396,12 +3488,25 @@ fn cmd_diagnose() -> Result<()> {
    }

    let db_path = dirs.db_path();
-    let db_size = std::fs::metadata(&db_path).map(|m| m.len()).unwrap_or(0);
-    report.check(
-        "  database",
-        db_path.is_file(),
-        format!("{} ({})", db_path.display(), human_bytes(db_size)),
-    );
+    if db_path.exists() {
+        let db_size = std::fs::metadata(&db_path).map(|m| m.len()).unwrap_or(0);
+        report.check(
+            "  database",
+            db_path.is_file(),
+            format!("{} ({})", db_path.display(), human_bytes(db_size)),
+        );
+    } else {
+        // The daemon creates it on its first start, which waits for a sign-in,
+        // so a fresh install has none yet (issue #39 read this as the fault).
+        report.finding(
+            DiagnoseLevel::Warn,
+            "  database",
+            format!(
+                "{} not created yet (the daemon creates it on first start)",
+                db_path.display()
+            ),
+        );
+    }

    println!("\nFUSE");
    let fuse = Path::new("/dev/fuse");
@@ -3723,6 +3828,28 @@ mod login_wait_tests {
        assert_eq!(login_poll_delay(u32::MAX), Duration::from_secs(15));
    }

+    /// The file-manager script passes each selected path after `--`, so a
+    /// file named like an option is still the path.
+    #[test]
+    fn a_path_after_a_double_dash_is_a_path_even_when_it_looks_like_a_flag() {
+        let cli = Cli::try_parse_from(["pdfs", "pin", "--", "--json"]).unwrap();
+        assert!(!cli.json);
+        match cli.command {
+            Command::Pin { path } => assert_eq!(path, PathBuf::from("--json")),
+            _ => panic!("not a pin"),
+        }
+    }
+
+    #[test]
+    fn a_waited_for_run_that_did_not_fully_succeed_exits_with_an_error() {
+        assert!(finished_run("the import", Some((0, false, None))).is_ok());
+        assert!(finished_run("the import", Some((3, false, None))).is_err());
+        assert!(finished_run("the import", Some((0, true, None))).is_err());
+        let failed = finished_run("the import", Some((0, false, Some("not a zip".into()))));
+        assert!(failed.unwrap_err().to_string().contains("not a zip"));
+        assert!(finished_run("the import", None).is_err());
+    }
+
    #[test]
    fn waiting_for_a_session_stops_hammering_the_keyring() {
        let mut checks_left = 20;
@@ -30,3 +30,4 @@ async-trait.workspace = true
 libc.workspace = true
 zeroize.workspace = true
 base64.workspace = true
+exif = { version = "0.6", package = "kamadak-exif" }
@@ -516,8 +516,59 @@ pub fn lock(forget: bool) -> Result<()> {
    Ok(())
 }

-/// Forget the persisted session (best-effort; absent entry is not an error).
-pub fn logout() -> Result<()> {
+/// How long [`logout`] waits for Proton to end the session before it signs
+/// out locally without.
+const END_SESSION_TIMEOUT: Duration = Duration::from_secs(10);
+
+/// End the stored session on Proton's side (`DELETE auth/v4`). Returns false
+/// when there is none or Proton could not be reached in time.
+///
+/// Runs on a thread of its own, so it works the same whether the caller is
+/// inside a tokio runtime or not.
+fn end_server_session() -> bool {
+    let Ok(stored) = load() else {
+        return false;
+    };
+    let ended = std::thread::scope(|scope| {
+        scope
+            .spawn(|| -> std::result::Result<(), String> {
+                let rt = tokio::runtime::Builder::new_current_thread()
+                    .enable_all()
+                    .build()
+                    .map_err(|e| e.to_string())?;
+                rt.block_on(async {
+                    let session = resume_stored(&stored).map_err(|e| e.to_string())?;
+                    match tokio::time::timeout(END_SESSION_TIMEOUT, session.end()).await {
+                        Ok(result) => result.map_err(|e| e.to_string()),
+                        Err(_) => Err(format!(
+                            "no answer within {}s",
+                            END_SESSION_TIMEOUT.as_secs()
+                        )),
+                    }
+                })
+            })
+            .join()
+            .unwrap_or_else(|_| Err("the sign-out thread panicked".into()))
+    });
+    match ended {
+        Ok(()) => true,
+        Err(error) => {
+            tracing::warn!(%error, "ending the session on Proton failed; signing out locally");
+            false
+        }
+    }
+}
+
+/// End the session on Proton, then forget it here. Returns whether Proton
+/// ended it: offline, the session stays valid on Proton's side until it
+/// expires or is signed out from the account's security settings.
+///
+/// Before this, signing out only deleted the keyring entry. The tokens stayed
+/// valid on Proton, so a copy of them taken from this machine still worked.
+///
+/// The local half is best effort; an absent entry is not an error.
+pub fn logout() -> Result<bool> {
+    let ended = end_server_session();
    // The persisted entity cache describes the account being logged out of. It
    // is encrypted under a key derived from that account's passphrases, but
    // leaving it behind would also mean the next account inherits a store it can
@@ -539,7 +590,7 @@ pub fn logout() -> Result<()> {
    }
    let _ = kernelkey::UNSAVED_TOKENS.clear();
    match keyring_entry()?.delete_credential() {
-        Ok(()) | Err(keyring_core::Error::NoEntry) => Ok(()),
+        Ok(()) | Err(keyring_core::Error::NoEntry) => Ok(ended),
        Err(e) => Err(e.into()),
    }
 }
@@ -163,6 +163,10 @@ pub struct AppConfig {
    /// Defaulted for configs predating the field.
    #[serde(default)]
    pub files_view: FilesView,
+    /// The desktop app's main window size, remembered between runs. Defaulted
+    /// for configs predating the field.
+    #[serde(default)]
+    pub window: WindowState,
    /// The user hid the tray icon from its own menu. The tray exits at start
    /// while this is set, and the app does not spawn it; Preferences turns it
    /// back on. Defaulted for configs predating the field.
@@ -186,6 +190,24 @@ pub struct AppConfig {
    /// the field.
    #[serde(default)]
    pub local_first: Option<bool>,
+    /// Ask GitHub once a day whether a newer release is out, and say so in the
+    /// desktop app. Off by default: GitHub then sees the address and version
+    /// asking. Never used where a package manager installs updates (see
+    /// [`crate::update::updates_managed`]). Defaulted for configs predating the
+    /// field.
+    #[serde(default)]
+    pub update_check: bool,
+    /// When the update check last asked GitHub, in Unix seconds, so a restart
+    /// does not ask again within [`crate::update::CHECK_INTERVAL`]. Defaulted
+    /// for configs predating the field.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub update_last_checked: Option<i64>,
+    /// The latest release that check found, such as `3.6.0`, so the app can
+    /// say so again after a restart without asking. Older than or equal to the
+    /// running version once the update is installed. Defaulted for configs
+    /// predating the field.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub update_latest: Option<String>,
 }

 /// The My Files page's view choices, remembered between runs.
@@ -211,6 +233,44 @@ impl Default for FilesView {
    }
 }

+/// The desktop app's main window, as it was when it last closed.
+#[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq)]
+#[serde(default)]
+pub struct WindowState {
+    /// The unmaximised size, in logical pixels.
+    pub width: i32,
+    pub height: i32,
+    pub maximized: bool,
+}
+
+impl WindowState {
+    /// Below this the saved size is taken for damage and the default is used.
+    pub const MIN_WIDTH: i32 = 480;
+    pub const MIN_HEIGHT: i32 = 400;
+
+    /// This state, with a size too small to use replaced by the default.
+    pub fn usable(self) -> Self {
+        if self.width < Self::MIN_WIDTH || self.height < Self::MIN_HEIGHT {
+            Self {
+                maximized: self.maximized,
+                ..Self::default()
+            }
+        } else {
+            self
+        }
+    }
+}
+
+impl Default for WindowState {
+    fn default() -> Self {
+        Self {
+            width: 980,
+            height: 680,
+            maximized: false,
+        }
+    }
+}
+
 /// The key a My Files listing is ordered by.
 #[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq, Default)]
 #[serde(rename_all = "lowercase")]
@@ -310,6 +370,22 @@ impl AppConfig {
    }
 }

+/// Fail when the config file at `path` exists but does not parse, so that
+/// [`AppDirs::save_config`] never writes over settings it could not read.
+fn refuse_to_replace_unreadable(path: &Path) -> Result<()> {
+    match std::fs::read_to_string(path) {
+        Ok(content) => match serde_json::from_str::<AppConfig>(&content) {
+            Ok(_) => Ok(()),
+            Err(e) => Err(Error::Other(format!(
+                "{} cannot be read ({e}); fix it or move it aside before changing settings",
+                path.display()
+            ))),
+        },
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        Err(e) => Err(e.into()),
+    }
+}
+
 /// Resolved XDG locations for state, cache, and the default mountpoint.
 pub struct AppDirs {
    dirs: ProjectDirs,
@@ -341,6 +417,7 @@ impl AppDirs {
                    // Preserve the original bytes for diagnosis/recovery.  In
                    // particular, never replace a truncated config with defaults
                    // and silently lose mount, device, or ignore settings.
+                    // `save_config` refuses to write over it for the same reason.
                    tracing::error!(path = %path.display(), error = %e, "config is unreadable; using in-memory defaults without overwriting it");
                    return AppConfig::default();
                }
@@ -348,9 +425,8 @@ impl AppDirs {
        }

        let default_config = AppConfig::default();
-        if let Ok(content) = serde_json::to_string_pretty(&default_config) {
-            let _ = std::fs::create_dir_all(self.dirs.config_dir());
-            let _ = std::fs::write(&path, content);
+        if let Err(e) = self.save_config(&default_config) {
+            tracing::warn!(path = %path.display(), error = %e, "could not write the default config");
        }
        default_config
    }
@@ -358,8 +434,15 @@ impl AppDirs {
    /// Persist `config` to [`config_path`](Self::config_path), creating the
    /// config dir if missing. The Settings page calls this after editing the
    /// cache budget or mountpoint; the daemon re-reads the file on its next mount.
+    ///
+    /// Refuses while the file on disk does not parse. Every caller loads,
+    /// changes one field and saves, and [`load_config`](Self::load_config)
+    /// gives defaults for a file it cannot read, so the first change after
+    /// the file was damaged wrote defaults over the mountpoint, the device and
+    /// the ignore rules the user had (`docs/BUGS.md` B223).
    pub fn save_config(&self, config: &AppConfig) -> Result<()> {
        let path = self.config_path();
+        refuse_to_replace_unreadable(&path)?;
        let parent = path
            .parent()
            .ok_or_else(|| Error::Other("configuration path has no parent".into()))?;
@@ -383,6 +466,46 @@ impl AppDirs {
        Ok(())
    }

+    /// This machine's id (e.g. ~/.config/proton-drive-linux/machine-id). See
+    /// [`machine_id`](Self::machine_id).
+    pub fn machine_id_path(&self) -> PathBuf {
+        self.dirs.config_dir().join("machine-id")
+    }
+
+    /// A random id for this machine, made on first use and kept in
+    /// [`machine_id_path`](Self::machine_id_path).
+    ///
+    /// It names this machine's profile in a device it may share with other
+    /// computers. Random rather than `/etc/machine-id`, so nothing that
+    /// identifies the host goes to Drive. In a file of its own rather than
+    /// `config.json`, because the app saves the config from a copy it loaded
+    /// earlier, and that would drop an id the daemon had just added.
+    pub fn machine_id(&self) -> Result<String> {
+        let path = self.machine_id_path();
+        match std::fs::read_to_string(&path) {
+            Ok(id) if is_machine_id(id.trim()) => return Ok(id.trim().to_string()),
+            Ok(_) => {
+                tracing::warn!(path = %path.display(), "machine id is unusable; making a new one");
+            }
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+            Err(e) => return Err(e.into()),
+        }
+        let mut bytes = [0u8; 16];
+        use std::io::Read as _;
+        std::fs::File::open("/dev/urandom")?.read_exact(&mut bytes)?;
+        let id: String = bytes.iter().map(|b| format!("{b:02x}")).collect();
+        let parent = path
+            .parent()
+            .ok_or_else(|| Error::Other("machine id path has no parent".into()))?;
+        std::fs::create_dir_all(parent)?;
+        let tmp = path.with_extension(format!("tmp-{}", std::process::id()));
+        std::fs::write(&tmp, format!("{id}\n"))?;
+        std::fs::File::open(&tmp)?.sync_all()?;
+        std::fs::rename(&tmp, &path)?;
+        std::fs::File::open(parent)?.sync_all()?;
+        Ok(id)
+    }
+
    /// Persistent state: inode map / cache index DB lives here.
    pub fn state_dir(&self) -> PathBuf {
        // `state_dir` is Linux-only in `directories`; fall back to data dir.
@@ -471,6 +594,12 @@ impl AppDirs {
    }
 }

+/// Whether `id` is what [`AppDirs::machine_id`] writes: 32 lowercase hex
+/// digits.
+fn is_machine_id(id: &str) -> bool {
+    id.len() == 32 && id.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f'))
+}
+
 /// Make `dir` owner-only (`0700`). These directories contain decrypted bytes,
 /// plaintext names, and an authenticated control socket, so failure is fatal.
 fn restrict_dir(dir: &Path) -> Result<()> {
@@ -526,6 +655,28 @@ mod tests {
        std::fs::metadata(p).unwrap().permissions().mode() & 0o777
    }

+    /// A damaged config must not be replaced by defaults the next time a
+    /// setting changes (`docs/BUGS.md` B223).
+    #[test]
+    fn an_unreadable_config_is_never_written_over() {
+        let dir = std::env::temp_dir().join(format!(
+            "pdfs-cfg-guard-{}-{:?}",
+            std::process::id(),
+            std::thread::current().id()
+        ));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("config.json");
+
+        assert!(refuse_to_replace_unreadable(&path).is_ok(), "no file yet");
+        std::fs::write(&path, serde_json::to_vec(&AppConfig::default()).unwrap()).unwrap();
+        assert!(refuse_to_replace_unreadable(&path).is_ok());
+        std::fs::write(&path, br#"{"mountpoint": "/home/me/Pro"#).unwrap();
+        assert!(refuse_to_replace_unreadable(&path).is_err(), "truncated");
+
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
    /// `docs/BUGS.md` B6. A permissive mode here is not a cosmetic problem: these
    /// directories hold decrypted content, a plaintext index of every node name,
    /// and the control socket that commands the daemon's session.
@@ -611,10 +762,18 @@ mod tests {
                descending: true,
                folders_first: false,
            },
+            window: WindowState {
+                width: 1200,
+                height: 800,
+                maximized: true,
+            },
            tray_hidden: true,
            language: Some("de".to_string()),
            online_map: true,
            local_first: Some(false),
+            update_check: true,
+            update_last_checked: Some(1_760_000_000),
+            update_latest: Some("3.6.0".to_string()),
        };
        let json = serde_json::to_string(&config).unwrap();
        let decoded: AppConfig = serde_json::from_str(&json).unwrap();
@@ -626,10 +785,46 @@ mod tests {
        assert_eq!(decoded.proton_theme, Some(true));
        assert!(decoded.tray_hidden);
        assert!(decoded.online_map);
+        assert!(decoded.update_check);
+        assert_eq!(decoded.update_last_checked, Some(1_760_000_000));
+        assert_eq!(decoded.update_latest.as_deref(), Some("3.6.0"));
        assert_eq!(decoded.language.as_deref(), Some("de"));
        assert_eq!(decoded.upload_limit, Some(500_000));
        assert_eq!(decoded.download_limit, None);
        assert_eq!(decoded.files_view, config.files_view);
+        assert_eq!(decoded.window, config.window);
+    }
+
+    #[test]
+    fn a_config_without_a_window_opens_at_the_default_size() {
+        let decoded: AppConfig =
+            serde_json::from_str(r#"{"app_version":"a","user_agent":"b"}"#).unwrap();
+        assert_eq!(decoded.window, WindowState::default());
+        let partial: WindowState = serde_json::from_str(r#"{"maximized":true}"#).unwrap();
+        assert_eq!((partial.width, partial.height), (980, 680));
+        assert!(partial.maximized);
+    }
+
+    #[test]
+    fn a_window_saved_too_small_opens_at_the_default_size() {
+        let tiny = WindowState {
+            width: 0,
+            height: 500,
+            maximized: true,
+        };
+        assert_eq!(
+            tiny.usable(),
+            WindowState {
+                maximized: true,
+                ..WindowState::default()
+            }
+        );
+        let fine = WindowState {
+            width: 640,
+            height: 480,
+            maximized: false,
+        };
+        assert_eq!(fine.usable(), fine);
    }

    #[test]
@@ -760,6 +955,15 @@ mod tests {
        assert_eq!(decoded.conflict_sweep, Some(SweepMode::Enforce));
    }

+    #[test]
+    fn a_machine_id_is_32_lowercase_hex_digits() {
+        assert!(is_machine_id("0123456789abcdef0123456789abcdef"));
+        assert!(!is_machine_id("0123456789ABCDEF0123456789ABCDEF"));
+        assert!(!is_machine_id("0123456789abcdef"));
+        assert!(!is_machine_id("../../../../etc/passwd/0123456789"));
+        assert!(!is_machine_id(""));
+    }
+
    #[test]
    fn a_config_predating_ignore_patterns_still_loads() {
        // Every installed config on disk looks like this; the field must not be
@@ -1591,6 +1591,10 @@ pub struct RedateSummary {
    /// name implies)` — what a dry run is read for.
    #[serde(default)]
    pub samples: Vec<(String, i64, i64)>,
+    /// Why the run as a whole failed, when it did. The counts are then
+    /// empty: the run never got to the photos.
+    #[serde(default)]
+    pub error: Option<String>,
 }

 /// How a Google Photos Takeout import is going, or how the last one ended
@@ -1620,6 +1624,10 @@ pub struct ImportSummary {
    pub bytes: u64,
    /// True when the run stopped early because it was cancelled.
    pub cancelled: bool,
+    /// Why the run as a whole failed, when it did, such as an archive that
+    /// is not a zip. The counts are then empty.
+    #[serde(default)]
+    pub error: Option<String>,
 }

 /// One album in a [`Response::Albums`] listing.
@@ -111,9 +111,80 @@ impl Db {
        )?;
        let count: i64 = tx.query_row("SELECT COUNT(*) FROM local_files", [], |r| r.get(0))?;
        tx.commit()?;
+        drop(conn);
+        self.compact_search_indexes_if_due(finished_at)?;
        Ok(count)
    }

+    /// Close a scan that did not see everything: it stopped at the entry cap,
+    /// or a batch failed to write. Nothing is pruned, since a path it missed is
+    /// not a path that is gone; the next complete scan prunes. Returns the
+    /// number of indexed entries.
+    ///
+    /// Pruning after such a scan dropped every entry it had not reached, and
+    /// the next scan put them back. That churn is most of what grew
+    /// `local_fts` to 16 times its size (`docs/BUGS.md` B217).
+    pub fn local_finish_partial_scan(&self, finished_at: i64) -> Result<i64> {
+        let conn = self.conn.lock();
+        conn.execute(
+            "INSERT INTO sync_state (key, value) VALUES ('local_indexed_at', ?1)
+             ON CONFLICT(key) DO UPDATE SET value = excluded.value",
+            [finished_at.to_string()],
+        )?;
+        let count: i64 = conn.query_row("SELECT COUNT(*) FROM local_files", [], |r| r.get(0))?;
+        Ok(count)
+    }
+
+    /// Compact both full-text indexes, at most once a day.
+    ///
+    /// FTS5 keeps a deleted entry's data until the segments holding it are
+    /// merged, and with the few large segments these indexes settle into that
+    /// is close to never. Every file the local scan sees disappear or appear
+    /// leaves some behind, and every node row the tree replaces does too: on
+    /// one machine `local_fts` held 317 MiB for 40,000 paths, against 20 MiB
+    /// rebuilt, and a search took four times as long (`docs/BUGS.md` B217).
+    ///
+    /// `local_fts` is rebuilt from `local_files`, which also drops anything
+    /// left over, and `nodes_fts`, which has no content table to rebuild from,
+    /// is merged into one segment. Each runs in its own transaction on the
+    /// write connection, about half a second on an index that size; once a
+    /// day keeps the leftovers small without paying that at every scan.
+    pub fn compact_search_indexes_if_due(&self, now: i64) -> Result<()> {
+        const EVERY_SECS: i64 = 24 * 60 * 60;
+        let last: i64 = self
+            .read()
+            .query_row(
+                "SELECT value FROM sync_state WHERE key = 'fts_compacted_at'",
+                [],
+                |row| row.get::<_, String>(0),
+            )
+            .optional()?
+            .and_then(|v| v.parse().ok())
+            .unwrap_or(0);
+        if now - last < EVERY_SECS {
+            return Ok(());
+        }
+        let started = std::time::Instant::now();
+        {
+            let conn = self.conn.lock();
+            conn.execute("INSERT INTO local_fts(local_fts) VALUES('rebuild')", [])?;
+        }
+        {
+            let conn = self.conn.lock();
+            conn.execute("INSERT INTO nodes_fts(nodes_fts) VALUES('optimize')", [])?;
+            conn.execute(
+                "INSERT INTO sync_state (key, value) VALUES ('fts_compacted_at', ?1)
+                 ON CONFLICT(key) DO UPDATE SET value = excluded.value",
+                [now.to_string()],
+            )?;
+        }
+        tracing::info!(
+            elapsed_ms = started.elapsed().as_millis() as u64,
+            "compacted the search indexes"
+        );
+        Ok(())
+    }
+
    /// When the last local scan completed (epoch seconds), or `None` if the index
    /// has never been built. The daemon uses this to decide whether a fresh mount
    /// needs an immediate rescan or can serve the existing index.
@@ -91,8 +91,13 @@ impl Db {
    /// Returns an empty vector when the database is sound; otherwise each entry
    /// is one problem SQLite found. Read-only and safe against a live daemon,
    /// though it reads every page, so it is not free on a large file.
+    ///
+    /// Runs on a read connection: it reads every page, which took 34 s on a
+    /// 567 MiB file, and on the write connection every write in the daemon
+    /// waited that long behind it (`docs/BUGS.md` B218). WAL lets it read a
+    /// consistent snapshot while the writer goes on.
    pub fn integrity_check(&self) -> Result<Vec<String>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
        let mut stmt = conn.prepare("PRAGMA integrity_check")?;
        let rows = stmt.query_map([], |r| r.get::<_, String>(0))?;
        let mut problems = Vec::new();
@@ -107,9 +112,11 @@ impl Db {
        Ok(problems)
    }

-    /// Size and row-count snapshot for `pdfs cache inspect`.
+    /// Size and row-count snapshot for `pdfs cache inspect`. On a read
+    /// connection, for the reason [`integrity_check`](Self::integrity_check)
+    /// gives: counting the rows of every table reads most of the file.
    pub fn stats(&self) -> Result<DbStats> {
-        let conn = self.conn.lock();
+        let conn = self.read();
        let page_count: i64 = conn.query_row("PRAGMA page_count", [], |r| r.get(0))?;
        let free_pages: i64 = conn.query_row("PRAGMA freelist_count", [], |r| r.get(0))?;
        let page_size: i64 = conn.query_row("PRAGMA page_size", [], |r| r.get(0))?;
@@ -218,6 +225,40 @@ mod tests {
        assert!(db.integrity_check().unwrap().is_empty());
    }

+    /// `pdfs diagnose` and `pdfs cache inspect` read the whole file. Behind the
+    /// write lock they froze every write in the daemon for as long as that
+    /// took (`docs/BUGS.md` B218).
+    #[test]
+    fn the_integrity_check_and_stats_do_not_wait_for_the_writer() {
+        let path = std::env::temp_dir().join(format!(
+            "pdfs-check-{}-{}.db",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        let db = std::sync::Arc::new(Db::open(&path).unwrap());
+        let writer = db.conn.lock();
+        let (tx, rx) = std::sync::mpsc::channel();
+        let reader = std::sync::Arc::clone(&db);
+        std::thread::spawn(move || {
+            let checked = reader.integrity_check().map(|p| p.is_empty());
+            let counted = reader.stats().map(|s| s.page_count > 0);
+            let _ = tx.send((checked.ok(), counted.ok()));
+        });
+        let answer = rx.recv_timeout(std::time::Duration::from_secs(10));
+        drop(writer);
+        assert_eq!(answer.ok(), Some((Some(true), Some(true))));
+        drop(db);
+        for suffix in ["", "-wal", "-shm"] {
+            let mut file = path.as_os_str().to_owned();
+            file.push(suffix);
+            let _ = std::fs::remove_file(std::path::PathBuf::from(file));
+        }
+        let _ = std::fs::remove_file(path.with_extension("db.lock"));
+    }
+
    #[test]
    fn stats_report_the_schema_and_the_known_tables() {
        let db = Db::open_in_memory().unwrap();
@@ -11,7 +11,7 @@ use super::Db;
 use crate::Result;

 /// Current schema version. Bump on every forward migration added below.
-pub(super) const SCHEMA_VERSION: i64 = 42;
+pub(super) const SCHEMA_VERSION: i64 = 44;

 impl Db {
    pub(super) fn migrate(&self) -> Result<()> {
@@ -440,6 +440,33 @@ impl Db {
                tx.execute_batch(MIGRATION_V42)?;
            }
        }
+        if current < 43 {
+            let has_ops: bool = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'pending_op'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            if has_ops {
+                tx.execute_batch(MIGRATION_V43)?;
+            }
+        }
+        if current < 44 {
+            // Same guards as V26-V42.
+            let has_column: bool = tx.query_row(
+                "SELECT COUNT(*) FROM pragma_table_info('sync_entry') \
+                 WHERE name = 'remote_revision_id'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            let has_entries: bool = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'sync_entry'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            if has_entries && !has_column {
+                tx.execute_batch(MIGRATION_V44)?;
+            }
+        }
        tx.execute(
            "INSERT INTO sync_state (key, value) VALUES ('schema_version', ?1)
             ON CONFLICT(key) DO UPDATE SET value = excluded.value",
@@ -1330,3 +1357,28 @@ const MIGRATION_V42: &str = "
 ALTER TABLE pending_op ADD COLUMN sent_sha1 TEXT;
 ALTER TABLE pending_op ADD COLUMN sent_to TEXT;
 ";
+
+/// Schema v43: queued ops by kind and name.
+///
+/// Before each create, rename and trash the drain asks whether a queued trash
+/// or rename holds the name it wants, and a released name wakes the ops
+/// waiting for it. Each of those scanned the whole queue, so a large offline
+/// batch made draining it quadratic. The kind leads, so a lookup of every
+/// queued rename uses the index too.
+const MIGRATION_V43: &str = "
+CREATE INDEX IF NOT EXISTS pending_op_kind_name ON pending_op(kind, name);
+";
+
+/// Schema v44: a synced file's baseline remembers the revision it was synced
+/// at.
+///
+/// A mirrored file edited here is uploaded as a new revision of whatever is
+/// current on Drive, and another computer syncing the same folder may have
+/// committed one since this pass looked. The revision id is what the upload
+/// checks first, so that edit becomes a conflict copy instead of being
+/// replaced (B249). `NULL` means "this row predates the column", and the check
+/// falls back to the modification time and size; each row gains a real value
+/// the next time its path is synced.
+const MIGRATION_V44: &str = "
+ALTER TABLE sync_entry ADD COLUMN remote_revision_id TEXT;
+";
@@ -179,6 +179,45 @@ impl Drop for Reader<'_> {
    }
 }

+/// The write connection with `synchronous=FULL`, back to NORMAL on drop.
+///
+/// NORMAL in WAL mode keeps a commit across a crash of the process but not
+/// across a power loss: the WAL is synced only at checkpoints. That is fine for
+/// metadata the next listing re-fetches, and not for the queue. A staged blob
+/// is synced before its op is queued, and the op row is what makes it
+/// reachable; losing that row loses a write `close()` already reported as
+/// done. A FULL commit syncs the WAL, which covers every NORMAL commit before
+/// it as well.
+pub(super) struct Durable<'a>(parking_lot::MutexGuard<'a, Connection>);
+
+impl<'a> Durable<'a> {
+    pub(super) fn new(conn: parking_lot::MutexGuard<'a, Connection>) -> Result<Self> {
+        conn.pragma_update(None, "synchronous", "FULL")?;
+        Ok(Self(conn))
+    }
+}
+
+impl std::ops::Deref for Durable<'_> {
+    type Target = Connection;
+
+    fn deref(&self) -> &Connection {
+        &self.0
+    }
+}
+
+impl std::ops::DerefMut for Durable<'_> {
+    fn deref_mut(&mut self) -> &mut Connection {
+        &mut self.0
+    }
+}
+
+impl Drop for Durable<'_> {
+    fn drop(&mut self) {
+        // A failure leaves the writer at FULL: slower, never less safe.
+        let _ = self.0.pragma_update(None, "synchronous", "NORMAL");
+    }
+}
+
 /// Open a second connection to the same file for reads only.
 ///
 /// `SQLITE_OPEN_READ_ONLY` plus `query_only` is belt and braces: the flag stops
@@ -216,18 +255,34 @@ impl Db {
        let conn = match Self::open_configured(path) {
            Ok(conn) => conn,
            Err(e) if is_corrupt(&e) => {
-                // Every byte in here is derived from the account or from the
-                // content cache directory, so the recovery is to start over —
-                // loudly, and keeping the damaged file for a post-mortem rather
-                // than deleting evidence.
+                // Most of what is in here is derived from the account and is
+                // fetched again. The queue is not: it holds writes accepted
+                // here that Drive does not have yet, and the mirror baselines
+                // and pins are this machine's alone. So the damaged file is
+                // moved aside, kept as evidence, and those tables are copied
+                // out of it into the new one as far as SQLite can still read
+                // them (`docs/BUGS.md` B216).
                tracing::error!(
                    db = %path.display(),
                    error = %e,
-                    "cache database is corrupt — moving it aside and rebuilding \
-                     (metadata will be re-fetched; no user data is stored here)"
+                    "cache database is corrupt; moving it aside, rebuilding, and \
+                     copying the upload queue, sync baselines and pins out of it"
                );
-                quarantine_corrupt_db(path)?;
-                Self::open_configured(path)?
+                let damaged = quarantine_corrupt_db(path)?;
+                let conn = Self::open_configured(path)?;
+                for (table, result) in salvage(&conn, &damaged) {
+                    match result {
+                        Ok(rows) => {
+                            tracing::warn!(table, rows, "salvaged from the damaged database")
+                        }
+                        Err(error) => tracing::error!(
+                            table,
+                            %error,
+                            "could not salvage from the damaged database"
+                        ),
+                    }
+                }
+                conn
            }
            Err(e) => return Err(e),
        };
@@ -254,6 +309,12 @@ impl Db {
        Ok(db)
    }

+    /// The write connection for a commit that accepts a user's change into
+    /// the queue. See [`Durable`].
+    pub(super) fn durable(&self) -> Result<Durable<'_>> {
+        Durable::new(self.conn.lock())
+    }
+
    /// A connection for a `SELECT`-only method.
    ///
    /// Reads see the last committed state, which is the same thing they saw
@@ -281,7 +342,8 @@ impl Db {
    fn open_configured(path: &Path) -> Result<Connection> {
        let conn = Connection::open(path)?;
        // WAL: readers never block the single writer. NORMAL sync is the
-        // standard durability/throughput tradeoff for WAL.
+        // standard durability/throughput tradeoff for WAL; the queue commits
+        // that need more raise it to FULL for themselves (`Durable`).
        conn.pragma_update(None, "journal_mode", "WAL")?;
        conn.pragma_update(None, "synchronous", "NORMAL")?;
        conn.pragma_update(None, "foreign_keys", "ON")?;
@@ -428,12 +490,96 @@ fn is_corrupt(e: &Error) -> bool {
    )
 }

-/// Move a damaged database (and its WAL sidecars) out of the way so the next
-/// open starts from empty.
+/// The tables [`salvage`] copies out of a damaged database, in order, each
+/// with the rows it keeps.
 ///
-/// Renamed rather than deleted: this is a cache, but it is also the only
-/// evidence of what went wrong, and it costs one file the user can remove.
-fn quarantine_corrupt_db(path: &Path) -> Result<()> {
+/// The queue goes with the node rows it names by local id: a create made here
+/// has no other record of its node, and a real node keeps its local id when its
+/// folder is listed again. Those rows come back unlisted, so their folders are
+/// fetched again rather than trusted. Claims are cleared by [`Db::open`] as
+/// after any other crash.
+const SALVAGE: &[(&str, &str)] = &[
+    (
+        "nodes",
+        "lid IN (SELECT lid FROM old.pending_op WHERE lid IS NOT NULL
+                 UNION SELECT parent_lid FROM old.pending_op WHERE parent_lid IS NOT NULL)
+         OR uid LIKE 'local~%'",
+    ),
+    ("pending_op", "1"),
+    ("sync_folder", "1"),
+    ("sync_entry", "1"),
+    ("pins", "1"),
+    ("own_sealed_rev", "1"),
+];
+
+/// Copy what only this machine has out of the damaged database at `damaged`
+/// into the fresh one `conn` just created. Returns how each table went.
+///
+/// Each table is copied in its own transaction, so a table SQLite cannot read
+/// to the end is left out whole rather than half copied, and does not stop
+/// the others. Only the columns both files have are copied, which covers a
+/// file that broke in the middle of an upgrade. The damaged file is opened read
+/// only and left as it was.
+fn salvage(conn: &Connection, damaged: &Path) -> Vec<(&'static str, Result<usize>)> {
+    let uri = format!(
+        "file:{}?mode=ro",
+        damaged
+            .to_string_lossy()
+            .replace('%', "%25")
+            .replace('?', "%3f")
+            .replace('#', "%23")
+    );
+    if let Err(e) = conn.execute("ATTACH DATABASE ?1 AS old", [&uri]) {
+        let e = Error::Db(e);
+        tracing::error!(error = %e, "could not open the damaged database to salvage it");
+        return Vec::new();
+    }
+    let results = SALVAGE
+        .iter()
+        .map(|&(table, rows)| (table, salvage_table(conn, table, rows)))
+        .collect();
+    let _ = conn.execute("UPDATE nodes SET listed = 0", []);
+    if let Err(e) = conn.execute("DETACH DATABASE old", []) {
+        tracing::warn!(error = %e, "could not detach the damaged database");
+    }
+    results
+}
+
+fn salvage_table(conn: &Connection, table: &str, rows: &str) -> Result<usize> {
+    let columns = |schema: &str| -> Result<Vec<String>> {
+        let mut stmt = conn.prepare(&format!("PRAGMA {schema}.table_info({table})"))?;
+        let names = stmt
+            .query_map([], |r| r.get::<_, String>(1))?
+            .collect::<rusqlite::Result<Vec<_>>>()?;
+        Ok(names)
+    };
+    let new = columns("main")?;
+    let shared: Vec<String> = columns("old")?
+        .into_iter()
+        .filter(|c| new.contains(c))
+        .map(|c| format!("\"{c}\""))
+        .collect();
+    if shared.is_empty() {
+        return Ok(0);
+    }
+    let shared = shared.join(", ");
+    let tx = conn.unchecked_transaction()?;
+    let copied = tx.execute(
+        &format!(
+            "INSERT OR IGNORE INTO main.{table} ({shared}) SELECT {shared} FROM old.{table} WHERE {rows}"
+        ),
+        [],
+    )?;
+    tx.commit()?;
+    Ok(copied)
+}
+
+/// Move a damaged database (and its WAL sidecars) out of the way so the next
+/// open starts from empty. Returns where the database itself went.
+///
+/// Renamed rather than deleted: it is the only evidence of what went wrong,
+/// and [`salvage`] reads what only this machine has back out of it.
+fn quarantine_corrupt_db(path: &Path) -> Result<PathBuf> {
    let stamp = std::time::SystemTime::now()
        .duration_since(std::time::UNIX_EPOCH)
        .map(|d| d.as_secs())
@@ -457,7 +603,9 @@ fn quarantine_corrupt_db(path: &Path) -> Result<()> {
            Err(e) => tracing::warn!(file = %from.display(), error = %e, "could not quarantine"),
        }
    }
-    Ok(())
+    let mut kept = path.as_os_str().to_owned();
+    kept.push(format!(".corrupt-{stamp}"));
+    Ok(PathBuf::from(kept))
 }

 #[cfg(test)]
@@ -279,6 +279,45 @@ fn claimable() -> String {
 /// drain replaces it with the uid the server assigns.
 pub const LOCAL_VOLUME: &str = "local";

+/// One place a queued create was sent, with when it first was.
+struct SentTarget {
+    parent: String,
+    name: String,
+    at_ms: Option<i64>,
+}
+
+/// The `sent_to` column: `[[parent, name, at_ms], …]`, or `[[parent, name], …]`
+/// as written before the time was kept. `None` when it does not parse.
+fn parse_sent_to(json: Option<&str>) -> Option<Vec<SentTarget>> {
+    #[derive(Deserialize)]
+    #[serde(untagged)]
+    enum Entry {
+        At(String, String, i64),
+        Bare(String, String),
+    }
+    let Some(json) = json else {
+        return Some(Vec::new());
+    };
+    let entries: Vec<Entry> = serde_json::from_str(json).ok()?;
+    Some(
+        entries
+            .into_iter()
+            .map(|entry| match entry {
+                Entry::At(parent, name, at) => SentTarget {
+                    parent,
+                    name,
+                    at_ms: Some(at),
+                },
+                Entry::Bare(parent, name) => SentTarget {
+                    parent,
+                    name,
+                    at_ms: None,
+                },
+            })
+            .collect(),
+    )
+}
+
 /// The uid a node made on this machine goes by until Drive gives it one: its
 /// row's local id under [`LOCAL_VOLUME`].
 ///
@@ -541,7 +580,7 @@ impl Db {
    /// land in the order they were made (`docs/BUGS.md` B141). Should it fail,
    /// [`Db::record_op_failure`] or [`Db::release_op_claim`] drops it.
    pub fn enqueue_op(&self, op: &PendingOp) -> Result<(i64, Option<String>)> {
-        let mut conn = self.conn.lock();
+        let mut conn = self.durable()?;
        let tx = conn.transaction()?;
        let superseded: Option<String> = if op_supersedes(&op.kind) {
            let lid = node_lid(&tx, &op.uid)?;
@@ -598,7 +637,7 @@ impl Db {
        name: &str,
        created_at: i64,
    ) -> Result<(i64, Vec<String>)> {
-        let mut conn = self.conn.lock();
+        let mut conn = self.durable()?;
        let tx = conn.transaction()?;
        let blobs = drop_doomed_ops(&tx, uid)?;
        tx.execute(
@@ -628,7 +667,7 @@ impl Db {
        blob_path: &str,
        meta_json: &str,
    ) -> Result<Option<AttachedBlob>> {
-        let conn = self.conn.lock();
+        let conn = self.durable()?;
        let lid = node_lid(&conn, uid)?;
        let existing: Option<(i64, Option<String>)> = conn
            .query_row(
@@ -691,7 +730,7 @@ impl Db {
        rewrite: impl FnOnce(&str) -> Option<String>,
    ) -> Result<CreateRetired> {
        let (local, real) = (landing.local, landing.real);
-        let mut conn = self.conn.lock();
+        let mut conn = self.durable()?;
        let tx = conn.transaction()?;
        let row: Option<CreateRow> = tx
            .query_row(
@@ -808,12 +847,19 @@ impl Db {
        Ok(())
    }

-    /// Record that queued create `id` is being sent to `parent` under `name`.
+    /// Record that queued create `id` is being sent to `parent` under `name`
+    /// at `at_ms`.
    ///
    /// A rename while the op waits rewrites its target, but the file a lost
    /// answer left stays where it was sent. The retry and the trash look
-    /// there too (`docs/BUGS.md` B184).
-    pub fn note_create_target(&self, id: i64, parent: &str, name: &str) -> Result<()> {
+    /// there too (`docs/BUGS.md` B184). A target sent before keeps its first
+    /// time.
+    ///
+    /// A record that does not parse is left as it is rather than replaced
+    /// with this one target: the earlier ones are what the duplicate checks
+    /// look for. Without them a lost answer forks a conflict copy, which
+    /// loses nothing.
+    pub fn note_create_target(&self, id: i64, parent: &str, name: &str, at_ms: i64) -> Result<()> {
        let mut conn = self.conn.lock();
        let tx = conn.transaction()?;
        let sent: Option<String> = tx
@@ -822,15 +868,26 @@ impl Db {
            })
            .optional()?
            .flatten();
-        let mut targets: Vec<(String, String)> = sent
-            .and_then(|json| serde_json::from_str(&json).ok())
-            .unwrap_or_default();
-        let target = (parent.to_string(), name.to_string());
-        if !targets.contains(&target) {
-            targets.push(target);
+        let Some(mut targets) = parse_sent_to(sent.as_deref()) else {
+            tracing::warn!(
+                id,
+                "a queued create's send record does not parse; keeping it"
+            );
+            return Ok(());
+        };
+        if !targets.iter().any(|t| t.parent == parent && t.name == name) {
+            targets.push(SentTarget {
+                parent: parent.to_string(),
+                name: name.to_string(),
+                at_ms: Some(at_ms),
+            });
+            let json: Vec<(&str, &str, i64)> = targets
+                .iter()
+                .map(|t| (t.parent.as_str(), t.name.as_str(), t.at_ms.unwrap_or(0)))
+                .collect();
            tx.execute(
                "UPDATE pending_op SET sent_to = ?2 WHERE id = ?1",
-                params![id, serde_json::to_string(&targets)?],
+                params![id, serde_json::to_string(&json)?],
            )?;
        }
        tx.commit()?;
@@ -840,6 +897,24 @@ impl Db {
    /// The parent and name queued op `id` was sent under as a create, in the
    /// order it was ([`Db::note_create_target`]).
    pub fn create_targets(&self, id: i64) -> Result<Vec<(String, String)>> {
+        Ok(self
+            .sent_targets(id)?
+            .into_iter()
+            .map(|t| (t.parent, t.name))
+            .collect())
+    }
+
+    /// When queued create `id` was first sent, if that was recorded. Rows
+    /// written before the time was kept have none.
+    pub fn create_first_sent(&self, id: i64) -> Result<Option<i64>> {
+        Ok(self
+            .sent_targets(id)?
+            .into_iter()
+            .filter_map(|t| t.at_ms.filter(|&at| at > 0))
+            .min())
+    }
+
+    fn sent_targets(&self, id: i64) -> Result<Vec<SentTarget>> {
        let sent: Option<String> = self
            .conn
            .lock()
@@ -848,9 +923,7 @@ impl Db {
            })
            .optional()?
            .flatten();
-        Ok(sent
-            .and_then(|json| serde_json::from_str(&json).ok())
-            .unwrap_or_default())
+        Ok(parse_sent_to(sent.as_deref()).unwrap_or_default())
    }

    /// The SHA-1 of each blob queued op `id` sent as a create
@@ -898,6 +971,27 @@ impl Db {
        Ok(n > 0)
    }

+    /// Replace the sidecar of op `id`, but only while it still holds the blob
+    /// at `blob_path`.
+    ///
+    /// The drain fills an incomplete blob in place and then records it as
+    /// whole, so a retry after a lost answer can recognise its own bytes on the
+    /// server. A write that closed meanwhile has pointed the row at a newer
+    /// blob with its own sidecar; that one must not be overwritten. Returns
+    /// false when the row is gone or holds another blob.
+    pub fn update_op_meta_for_blob(
+        &self,
+        id: i64,
+        blob_path: &str,
+        meta_json: &str,
+    ) -> Result<bool> {
+        let n = self.conn.lock().execute(
+            "UPDATE pending_op SET meta_json = ?3 WHERE id = ?1 AND blob_path = ?2",
+            params![id, blob_path, meta_json],
+        )?;
+        Ok(n > 0)
+    }
+
    /// Point a queued create at a new parent and name, for a node renamed or
    /// moved before it ever reached the server.
    ///
@@ -911,7 +1005,7 @@ impl Db {
    /// name it no longer wants, such as one held by a queued change. A parked
    /// create stays parked.
    pub fn rewrite_op_target(&self, uid: &str, parent_uid: &str, name: &str) -> Result<bool> {
-        let conn = self.conn.lock();
+        let conn = self.durable()?;
        let lid = node_lid(&conn, uid)?;
        let parent_lid = node_lid(&conn, parent_uid)?;
        let n = conn.execute(
@@ -1389,12 +1483,26 @@ impl Db {
    }

    /// [`retry_op_now`](Self::retry_op_now) for every op that has failed at
-    /// least once. Returns how many rows changed.
+    /// least once, for the user's "Retry all". Returns how many rows changed.
    pub fn retry_failed_ops_now(&self, now: i64) -> Result<usize> {
+        self.retry_ops_now(now, "")
+    }
+
+    /// [`retry_failed_ops_now`](Self::retry_failed_ops_now) for the ops Drive
+    /// did not refuse, for a reconnect. A link coming back changes nothing
+    /// about a full quota or a missing permission, so those keep their backoff
+    /// instead of all being sent again at once.
+    pub fn retry_unrefused_ops_now(&self, now: i64) -> Result<usize> {
+        self.retry_ops_now(now, "AND issue IS NULL")
+    }
+
+    fn retry_ops_now(&self, now: i64, filter: &str) -> Result<usize> {
        let conn = self.conn.lock();
        let changed = conn.execute(
-            "UPDATE pending_op SET next_attempt_at = ?1
-             WHERE attempts > 0 AND next_attempt_at > ?1 AND next_attempt_at < ?2",
+            &format!(
+                "UPDATE pending_op SET next_attempt_at = ?1
+                 WHERE attempts > 0 AND next_attempt_at > ?1 AND next_attempt_at < ?2 {filter}"
+            ),
            params![now, PARK_UNTIL],
        )?;
        Ok(changed)
@@ -45,6 +45,12 @@ pub struct StoredSyncEntry {
    pub local_mtime_ns: Option<i64>,
    pub remote_rev: Option<String>,
    pub remote_hash: Option<String>,
+    /// The id of the remote revision this row was synced at. A mirror upload
+    /// checks it before it supersedes what Drive holds, because another client
+    /// may have committed a revision since (`docs/BUGS.md` B249). `None` on a
+    /// row written before schema 44, or by a pass that did not learn it; the
+    /// check then falls back to `remote_rev` and `remote_hash`.
+    pub remote_revision_id: Option<String>,
 }

 impl Db {
@@ -188,7 +194,7 @@ impl Db {
        let conn = self.read();
        let mut stmt = conn.prepare(
            "SELECT rel_path, remote_uid, local_mtime, local_size, remote_rev, remote_hash,
-                    local_mtime_ns
+                    local_mtime_ns, remote_revision_id
             FROM sync_entry WHERE folder_id = ?1",
        )?;
        let rows = stmt.query_map(params![folder_id], |r| {
@@ -200,6 +206,7 @@ impl Db {
                remote_rev: r.get(4)?,
                remote_hash: r.get(5)?,
                local_mtime_ns: r.get(6)?,
+                remote_revision_id: r.get(7)?,
            })
        })?;
        let mut map = HashMap::new();
@@ -238,15 +245,16 @@ impl Db {
        conn.execute(
            "INSERT INTO sync_entry
               (folder_id, rel_path, remote_uid, local_mtime, local_size, remote_rev,
-                remote_hash, local_mtime_ns)
-             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)
+                remote_hash, local_mtime_ns, remote_revision_id)
+             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)
             ON CONFLICT(folder_id, rel_path) DO UPDATE SET
-               remote_uid     = excluded.remote_uid,
-               local_mtime    = excluded.local_mtime,
-               local_size     = excluded.local_size,
-               remote_rev     = excluded.remote_rev,
-               remote_hash    = excluded.remote_hash,
-               local_mtime_ns = excluded.local_mtime_ns",
+               remote_uid         = excluded.remote_uid,
+               local_mtime        = excluded.local_mtime,
+               local_size         = excluded.local_size,
+               remote_rev         = excluded.remote_rev,
+               remote_hash        = excluded.remote_hash,
+               local_mtime_ns     = excluded.local_mtime_ns,
+               remote_revision_id = excluded.remote_revision_id",
            params![
                folder_id,
                e.rel_path,
@@ -256,6 +264,7 @@ impl Db {
                e.remote_rev,
                e.remote_hash,
                e.local_mtime_ns,
+                e.remote_revision_id,
            ],
        )?;
        Ok(())
@@ -306,7 +315,7 @@ impl Db {
        {
            let mut select = tx.prepare(
                "SELECT rel_path, remote_uid, local_mtime, local_size, remote_rev, remote_hash,
-                        local_mtime_ns
+                        local_mtime_ns, remote_revision_id
                   FROM sync_entry
                  WHERE folder_id = ?1
                    AND (rel_path = ?2 OR substr(rel_path, 1, length(?2) + 1) = ?2 || '/')",
@@ -321,6 +330,7 @@ impl Db {
                        remote_rev: r.get(4)?,
                        remote_hash: r.get(5)?,
                        local_mtime_ns: r.get(6)?,
+                        remote_revision_id: r.get(7)?,
                    })
                })?
                .collect::<rusqlite::Result<Vec<_>>>()?;
@@ -332,8 +342,8 @@ impl Db {
            let mut insert = tx.prepare(
                "INSERT OR REPLACE INTO sync_entry
                   (folder_id, rel_path, remote_uid, local_mtime, local_size, remote_rev,
-                    remote_hash, local_mtime_ns)
-                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)",
+                    remote_hash, local_mtime_ns, remote_revision_id)
+                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)",
            )?;
            for row in rows {
                let rel = format!("{to_rel}{}", &row.rel_path[from_rel.len()..]);
@@ -346,6 +356,7 @@ impl Db {
                    row.remote_rev,
                    row.remote_hash,
                    row.local_mtime_ns,
+                    row.remote_revision_id,
                ])?;
            }
        }
@@ -1283,6 +1283,90 @@ fn a_corrupt_database_is_moved_aside_and_rebuilt() {
    let _ = std::fs::remove_file(path.with_extension("db.lock"));
 }

+/// A rebuilt database must not lose what only this machine has: writes Drive
+/// has not received, the mirror baselines and the pins (`docs/BUGS.md` B216).
+#[test]
+fn a_rebuild_keeps_the_queue_baselines_and_pins_of_the_damaged_file() {
+    let id = now_test_id();
+    let damaged =
+        std::env::temp_dir().join(format!("pdfs-salvage-old-{}-{id}.db", std::process::id()));
+    let fresh =
+        std::env::temp_dir().join(format!("pdfs-salvage-new-{}-{id}.db", std::process::id()));
+
+    let db = Db::open(&damaged).unwrap();
+    db.upsert_node(&folder("root", None, "My Files")).unwrap();
+    db.upsert_node(&file("listed", "root", "listed.txt", 1))
+        .unwrap();
+    db.upsert_node(&file("queued", "root", "queued.txt", 2))
+        .unwrap();
+    db.set_listed(&uid("root"), true).unwrap();
+    db.enqueue_op(&PendingOp {
+        id: 0,
+        kind: OP_REVISION.to_string(),
+        uid: uid("queued").to_string(),
+        parent_uid: None,
+        name: None,
+        blob_path: Some("/staging/queued".into()),
+        meta_json: None,
+        created_at: 1,
+        attempts: 3,
+        last_error: None,
+        next_attempt_at: 0,
+    })
+    .unwrap();
+    let folder_id = db
+        .sync_folder_add("/home/me/Docs", "vol~docs", "share")
+        .unwrap();
+    db.sync_entry_upsert(
+        folder_id,
+        &StoredSyncEntry {
+            rel_path: "a.txt".into(),
+            remote_uid: Some("vol~a".into()),
+            local_mtime: 5,
+            local_mtime_ns: None,
+            local_size: 6,
+            remote_rev: Some("7".into()),
+            remote_hash: Some("8".into()),
+            remote_revision_id: None,
+        },
+    )
+    .unwrap();
+    db.pin_add("vol~pinned", "/pinned", true).unwrap();
+    drop(db);
+
+    let db = Db::open(&fresh).unwrap();
+    let results = salvage(&db.conn.lock(), &damaged);
+    assert!(results.iter().all(|(_, r)| r.is_ok()), "{results:?}");
+
+    let ops = db.pending_ops().unwrap();
+    assert_eq!(ops.len(), 1);
+    assert_eq!(ops[0].uid, uid("queued").to_string());
+    assert_eq!(ops[0].blob_path.as_deref(), Some("/staging/queued"));
+    // The op's node came with it; the rest of the tree is fetched again.
+    assert!(
+        db.node_by_uid(&uid("queued").to_string())
+            .unwrap()
+            .is_some()
+    );
+    assert!(
+        db.node_by_uid(&uid("listed").to_string())
+            .unwrap()
+            .is_none()
+    );
+    assert_eq!(db.sync_entries(folder_id).unwrap().len(), 1);
+    assert!(db.is_pinned("vol~pinned").unwrap());
+    drop(db);
+
+    for path in [&damaged, &fresh] {
+        for suffix in ["", "-wal", "-shm"] {
+            let mut file = path.as_os_str().to_owned();
+            file.push(suffix);
+            let _ = std::fs::remove_file(std::path::PathBuf::from(file));
+        }
+        let _ = std::fs::remove_file(path.with_extension("db.lock"));
+    }
+}
+
 fn local(path: &str, name: &str, is_dir: bool) -> LocalEntry {
    LocalEntry {
        path: path.into(),
@@ -1346,6 +1430,77 @@ fn rescanning_an_unchanged_file_keeps_exactly_one_index_entry() {
    }
 }

+/// A scan that stopped early or lost a batch did not see every file, so it
+/// must not prune the ones it missed (`docs/BUGS.md` B217).
+#[test]
+fn a_partial_local_scan_prunes_nothing() {
+    let db = Db::open_in_memory().unwrap();
+    let g = db.local_begin_scan().unwrap();
+    db.local_upsert_batch(
+        g,
+        &[
+            local("/home/u/a.txt", "a.txt", false),
+            local("/home/u/b.txt", "b.txt", false),
+        ],
+    )
+    .unwrap();
+    assert_eq!(db.local_finish_scan(g, 1).unwrap(), 2);
+
+    let g = db.local_begin_scan().unwrap();
+    db.local_upsert_batch(g, &[local("/home/u/a.txt", "a.txt", false)])
+        .unwrap();
+    assert_eq!(db.local_finish_partial_scan(2).unwrap(), 2);
+    assert_eq!(db.search_local("b.txt", 10).unwrap().len(), 1);
+    assert_eq!(db.local_indexed_at().unwrap(), Some(2));
+}
+
+/// Deleted entries pile up in an FTS5 index until it is compacted. The daily
+/// compaction must leave both indexes whole and searchable, and must not run
+/// again the same day (`docs/BUGS.md` B217).
+#[test]
+fn compacting_the_search_indexes_keeps_them_whole_and_runs_once_a_day() {
+    let db = Db::open_in_memory().unwrap();
+    db.upsert_node(&folder("root", None, "My Files")).unwrap();
+    db.upsert_node(&file("f1", "root", "quarterly-report.pdf", 1))
+        .unwrap();
+    for round in 0..20 {
+        let g = db.local_begin_scan().unwrap();
+        let name = format!("churn-{round}.txt");
+        db.local_upsert_batch(
+            g,
+            &[
+                local("/home/u/keep.txt", "keep.txt", false),
+                local(&format!("/home/u/{name}"), &name, false),
+            ],
+        )
+        .unwrap();
+        // Far in the past, so no scan compacts on its own.
+        db.local_finish_scan(g, 0).unwrap();
+    }
+
+    let day = 24 * 60 * 60;
+    db.compact_search_indexes_if_due(day).unwrap();
+    {
+        let conn = db.conn.lock();
+        for table in ["local_fts", "nodes_fts"] {
+            conn.execute(
+                &format!("INSERT INTO {table}({table}) VALUES('integrity-check')"),
+                [],
+            )
+            .unwrap();
+        }
+    }
+    assert_eq!(db.search_local("keep", 10).unwrap().len(), 1);
+    assert_eq!(db.search_local("churn-19", 10).unwrap().len(), 1);
+    assert!(db.search_local("churn-3.txt", 10).unwrap().is_empty());
+    assert_eq!(db.search("quarterly", 10).unwrap().len(), 1);
+    let stamp = |db: &Db| db.state_str("fts_compacted_at").unwrap();
+    assert_eq!(stamp(&db).as_deref(), Some(day.to_string().as_str()));
+
+    db.compact_search_indexes_if_due(day + 60).unwrap();
+    assert_eq!(stamp(&db).as_deref(), Some(day.to_string().as_str()));
+}
+
 /// Queries below the trigram minimum still match, via the `LIKE` fallback.
 #[test]
 fn local_search_short_query_like_fallback() {
@@ -2198,6 +2353,100 @@ fn refuses_a_schema_newer_than_the_running_build() {
    let _ = std::fs::remove_file(path);
 }

+/// Queueing a write syncs it to disk, and leaves the writer at NORMAL after.
+///
+/// The op row is what makes a staged blob reachable once `close()` has
+/// reported success, so its commit must survive a power loss. Everything else
+/// the writer commits is metadata the next listing re-fetches, and pays only
+/// NORMAL's cost.
+#[test]
+fn queueing_a_write_commits_at_full_sync_and_restores_normal() {
+    let path = std::env::temp_dir().join(format!("pdfs-db-sync-{}.db", std::process::id()));
+    let _ = std::fs::remove_file(&path);
+    let db = Db::open(&path).unwrap();
+    let level = |db: &Db| -> i64 {
+        db.conn
+            .lock()
+            .query_row("PRAGMA synchronous", [], |r| r.get(0))
+            .unwrap()
+    };
+    // 1 = NORMAL, 2 = FULL.
+    assert_eq!(level(&db), 1);
+    {
+        let durable = db.durable().unwrap();
+        let during: i64 = durable
+            .query_row("PRAGMA synchronous", [], |r| r.get(0))
+            .unwrap();
+        assert_eq!(during, 2);
+    }
+    assert_eq!(level(&db), 1);
+
+    db.enqueue_op(&PendingOp {
+        id: 0,
+        kind: OP_TRASH.to_string(),
+        uid: uid("a").to_string(),
+        parent_uid: None,
+        name: Some("a".to_string()),
+        blob_path: None,
+        meta_json: None,
+        created_at: 1,
+        attempts: 0,
+        last_error: None,
+        next_attempt_at: 0,
+    })
+    .unwrap();
+    assert_eq!(level(&db), 1);
+    assert_eq!(db.pending_ops().unwrap().len(), 1);
+    drop(db);
+    for suffix in ["", "-wal", "-shm"] {
+        let _ = std::fs::remove_file(format!("{}{suffix}", path.display()));
+    }
+}
+
+/// A gap-filled blob is recorded as whole only while the op still holds it.
+///
+/// A write that closes during the drain points the row at a newer blob with
+/// its own sidecar. Overwriting that sidecar with the older blob's would
+/// describe bytes the row no longer holds.
+#[test]
+fn marking_a_blob_whole_leaves_a_newer_blob_alone() {
+    let db = Db::open_in_memory().unwrap();
+    let op = PendingOp {
+        id: 0,
+        kind: OP_REVISION.to_string(),
+        uid: uid("a").to_string(),
+        parent_uid: None,
+        name: None,
+        blob_path: Some("/staging/first".to_string()),
+        meta_json: Some(r#"{"complete":false}"#.to_string()),
+        created_at: 1,
+        attempts: 0,
+        last_error: None,
+        next_attempt_at: 0,
+    };
+    db.enqueue_op(&op).unwrap();
+    let id = db.pending_ops().unwrap()[0].id;
+
+    assert!(
+        db.update_op_meta_for_blob(id, "/staging/first", r#"{"complete":true}"#)
+            .unwrap()
+    );
+    assert_eq!(
+        db.pending_ops().unwrap()[0].meta_json.as_deref(),
+        Some(r#"{"complete":true}"#)
+    );
+
+    assert!(
+        !db.update_op_meta_for_blob(id, "/staging/older", r#"{"stale":true}"#)
+            .unwrap(),
+        "the row holds another blob"
+    );
+    assert_eq!(
+        db.pending_ops().unwrap()[0].meta_json.as_deref(),
+        Some(r#"{"complete":true}"#)
+    );
+}
+
 /// A queued write whose baseline is restamped must keep everything else.
 ///
 /// The restamp happens after our *own* upload seals a new revision under a
@@ -3927,15 +4176,15 @@ fn what_a_create_sent_outlives_a_newer_blob_its_trash_and_a_restart() {
            .unwrap();
        assert!(db.create_sent(id).unwrap().is_empty());
        assert!(db.create_targets(id).unwrap().is_empty());
-        db.note_create_target(id, &parent, "c").unwrap();
-        db.note_create_target(id, &parent, "c").unwrap();
+        db.note_create_target(id, &parent, "c", 10).unwrap();
+        db.note_create_target(id, &parent, "c", 20).unwrap();
        db.note_create_sent(id, "aaaa").unwrap();
        db.note_create_sent(id, "aaaa").unwrap();
        db.record_op_failure(id, "no answer", 0).unwrap();
        db.attach_blob_to_create("local~sent", "/staging/second", "{}")
            .unwrap()
            .expect("the create is still queued");
-        db.note_create_target(id, &parent, "d").unwrap();
+        db.note_create_target(id, &parent, "d", 30).unwrap();
        db.note_create_sent(id, "bbbb").unwrap();
        db.record_op_failure(id, "no answer", 0).unwrap();
        db.delete_ops_for_uid("local~sent").unwrap();
@@ -3958,6 +4207,73 @@ fn what_a_create_sent_outlives_a_newer_blob_its_trash_and_a_restart() {
    let _ = std::fs::remove_file(path);
 }

+/// A queued create knows when it first went out, which is where the window
+/// for adopting a node its lost answer left starts. Records written before
+/// the time was kept still list their targets, and one that does not parse is
+/// not replaced by the next target.
+#[test]
+fn a_create_remembers_when_it_was_first_sent() {
+    let db = Db::open_in_memory().unwrap();
+    let parent = uid("parent").to_string();
+    let (id, _) = db
+        .enqueue_op(&PendingOp {
+            id: 0,
+            kind: OP_CREATE.to_string(),
+            uid: "local~first".to_string(),
+            parent_uid: Some(parent.clone()),
+            name: Some("a.txt".to_string()),
+            blob_path: None,
+            meta_json: None,
+            created_at: 1,
+            attempts: 0,
+            last_error: None,
+            next_attempt_at: 0,
+        })
+        .unwrap();
+    assert_eq!(db.create_first_sent(id).unwrap(), None, "never sent");
+    db.note_create_target(id, &parent, "a.txt", 500).unwrap();
+    db.note_create_target(id, &parent, "a.txt", 900).unwrap();
+    db.note_create_target(id, &parent, "b.txt", 700).unwrap();
+    assert_eq!(db.create_first_sent(id).unwrap(), Some(500));
+
+    let set = |json: &str| {
+        db.conn
+            .lock()
+            .execute(
+                "UPDATE pending_op SET sent_to = ?2 WHERE id = ?1",
+                rusqlite::params![id, json],
+            )
+            .unwrap();
+    };
+    set(&format!(r#"[["{parent}","old.txt"]]"#));
+    assert_eq!(
+        db.create_targets(id).unwrap(),
+        vec![(parent.clone(), "old.txt".to_string())]
+    );
+    assert_eq!(db.create_first_sent(id).unwrap(), None);
+    db.note_create_target(id, &parent, "a.txt", 900).unwrap();
+    assert_eq!(
+        db.create_targets(id).unwrap().len(),
+        2,
+        "the old target stays"
+    );
+    assert_eq!(db.create_first_sent(id).unwrap(), Some(900));
+
+    set("not json");
+    db.note_create_target(id, &parent, "c.txt", 1000).unwrap();
+    let raw: String = db
+        .conn
+        .lock()
+        .query_row("SELECT sent_to FROM pending_op WHERE id = ?1", [id], |r| {
+            r.get(0)
+        })
+        .unwrap();
+    assert_eq!(
+        raw, "not json",
+        "an unreadable record is kept, not replaced"
+    );
+}
+
 /// A write after a create failed clears its attempts, so the next try goes
 /// out at once. The create was still sent: deleting the file then left no
 /// trash, and the file a lost answer made stayed on Drive under the name it
@@ -3981,7 +4297,7 @@ fn a_create_rewritten_after_it_failed_still_leaves_a_trash_when_deleted() {
            next_attempt_at: 0,
        })
        .unwrap();
-    db.note_create_target(id, &parent, "a.txt").unwrap();
+    db.note_create_target(id, &parent, "a.txt", 10).unwrap();
    db.note_create_sent(id, "aaaa").unwrap();
    db.record_op_failure(id, "no answer", 0).unwrap();
    db.attach_blob_to_create("local~sent", "/staging/second", "{}")
@@ -5028,6 +5344,7 @@ fn baseline_row(rel: &str) -> StoredSyncEntry {
        local_size: 7,
        remote_rev: Some("1700000000".into()),
        remote_hash: Some("7".into()),
+        remote_revision_id: None,
    }
 }

@@ -5122,6 +5439,7 @@ fn mirror_uid_lookup_covers_the_root_and_synced_descendants_only() {
            local_size: 2,
            remote_rev: Some("3".into()),
            remote_hash: Some("2".into()),
+            remote_revision_id: None,
            local_mtime_ns: None,
        },
    )
@@ -5139,6 +5457,7 @@ fn mirror_uid_lookup_covers_the_root_and_synced_descendants_only() {
            local_size: 2,
            remote_rev: Some("3".into()),
            remote_hash: Some("2".into()),
+            remote_revision_id: None,
            local_mtime_ns: None,
        },
    )
@@ -6316,6 +6635,71 @@ fn migration_v27_adds_the_access_deferral_column_to_a_v26_queue() {
    let _ = std::fs::remove_file(format!("{}.lock", path.display()));
 }

+/// V44 adds the remote revision a baseline row was synced at. A row carried
+/// over from V43 has none, and the mirror then compares the modification time
+/// and size as before, so upgrading changes nothing about what is in step
+/// (`docs/BUGS.md` B249).
+#[test]
+fn migration_v44_adds_the_synced_revision_without_disturbing_a_v43_baseline() {
+    let path = std::env::temp_dir().join(format!(
+        "pdfs-db-v43-fixture-{}-{}.db",
+        std::process::id(),
+        std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap()
+            .as_nanos()
+    ));
+    let row = StoredSyncEntry {
+        rel_path: "notes.txt".into(),
+        remote_uid: Some("vol~notes".into()),
+        local_mtime: 1_700_000_000,
+        local_mtime_ns: Some(1_700_000_000_123_456_789),
+        local_size: 42,
+        remote_rev: Some("1700000000".into()),
+        remote_hash: Some("42".into()),
+        remote_revision_id: Some("rev-1".into()),
+    };
+    {
+        let db = Db::open(&path).unwrap();
+        let folder = db
+            .sync_folder_add("/home/me/Mirror", "vol~root", "share")
+            .unwrap();
+        db.sync_entry_upsert(folder, &row).unwrap();
+    }
+    {
+        // Put the file back in the state a released V43 database was in.
+        let conn = rusqlite::Connection::open(&path).unwrap();
+        conn.execute_batch(
+            "ALTER TABLE sync_entry DROP COLUMN remote_revision_id;
+             UPDATE sync_state SET value = '43' WHERE key = 'schema_version';",
+        )
+        .unwrap();
+    }
+
+    let db = Db::open(&path).unwrap();
+    let entries = db.sync_entries(1).unwrap();
+    let entry = entries.get("notes.txt").expect("the baseline row survives");
+    assert_eq!(
+        entry,
+        &StoredSyncEntry {
+            remote_revision_id: None,
+            ..row.clone()
+        }
+    );
+
+    // And the column is live, including through a move of the row.
+    db.sync_entry_upsert(1, &row).unwrap();
+    db.sync_entries_move(1, "notes.txt", 1, "moved.txt")
+        .unwrap();
+    let entries = db.sync_entries(1).unwrap();
+    assert_eq!(
+        entries["moved.txt"].remote_revision_id.as_deref(),
+        Some("rev-1")
+    );
+    drop(db);
+    let _ = std::fs::remove_file(&path);
+}
+
 /// A mirror baseline carried over from V27 keeps its rows, and each one reads
 /// back with no nanosecond time. That `None` is the whole point: it makes the
 /// comparison fall back to whole seconds for rows written before the column
@@ -6346,6 +6730,7 @@ fn migration_v28_adds_sub_second_local_times_without_disturbing_a_v27_baseline()
                local_size: 42,
                remote_rev: Some("1700000000".into()),
                remote_hash: Some("42".into()),
+                remote_revision_id: None,
            },
        )
        .unwrap();
@@ -7216,6 +7601,56 @@ fn a_refused_change_names_its_node_by_local_id() {
    );
 }

+/// The name checks the drain makes before each op look the name up in an
+/// index. Scanning the queue instead made a large offline batch quadratic.
+#[test]
+fn queue_name_checks_use_an_index() {
+    let db = Db::open_in_memory().unwrap();
+    let conn = db.conn.lock();
+    let plan = |sql: &str| -> String {
+        let mut stmt = conn.prepare(&format!("EXPLAIN QUERY PLAN {sql}")).unwrap();
+        stmt.query_map([], |r| r.get::<_, String>(3))
+            .unwrap()
+            .map(|row| row.unwrap())
+            .collect::<Vec<_>>()
+            .join("; ")
+    };
+    for sql in [
+        "SELECT 1 FROM pending_op WHERE kind = 'trash' AND name = 'a'",
+        "SELECT 1 FROM pending_op WHERE name = 'a' AND kind IN ('create', 'mkdir', 'rename')",
+        "SELECT 1 FROM pending_op WHERE kind = 'rename'",
+    ] {
+        let plan = plan(sql);
+        assert!(plan.contains("pending_op_kind_name"), "{sql}: {plan}");
+    }
+}
+
+/// A reconnect moves up the ops that failed for want of a link. One Drive
+/// refused, for quota or access, keeps its backoff: the link coming back
+/// changes nothing about it. "Retry all" still moves both.
+#[test]
+fn a_reconnect_leaves_refused_ops_to_their_backoff() {
+    let db = Db::open_in_memory().unwrap();
+    let offline = queued_op(&db, "vol~a", 2, 90_000);
+    let refused = queued_op(&db, "vol~b", 2, 90_000);
+    db.set_op_issue(refused, Some("quota")).unwrap();
+
+    assert_eq!(db.retry_unrefused_ops_now(5_000).unwrap(), 1);
+    let due = |id: i64| {
+        db.pending_ops()
+            .unwrap()
+            .into_iter()
+            .find(|op| op.id == id)
+            .unwrap()
+            .next_attempt_at
+    };
+    assert_eq!(due(offline), 5_000);
+    assert_eq!(due(refused), 90_000);
+
+    assert_eq!(db.retry_failed_ops_now(5_000).unwrap(), 1);
+    assert_eq!(due(refused), 5_000);
+}
+
 #[test]
 fn retry_all_touches_only_ops_that_have_failed() {
    let db = Db::open_in_memory().unwrap();
@@ -313,6 +313,15 @@ pub fn session_revoked(e: &proton_sdk::ProtonError) -> bool {
    }
 }

+/// Whether `e` is Proton's temporary block on a sign-in (code 2028).
+///
+/// Its message says the app version is no longer supported, which is not what
+/// happened: the release is current and only waiting helps (issues #28, #39).
+/// A front-end must say that instead of passing the message through.
+pub fn sign_in_blocked(e: &proton_sdk::ProtonError) -> bool {
+    matches!(e, proton_sdk::ProtonError::Api(api) if api.code == proton_sdk::api::ResponseCode::Blocked)
+}
+
 /// The result every request-serving method in the daemon returns.
 pub type CoreResult<T> = std::result::Result<T, CoreError>;

@@ -355,6 +364,14 @@ mod tests {
        assert!(!session_revoked(&ProtonError::KeysLocked));
    }

+    #[test]
+    fn only_code_2028_is_a_blocked_sign_in() {
+        assert!(sign_in_blocked(&api(C::Blocked)));
+        assert!(!sign_in_blocked(&api(C::OutdatedApp)));
+        assert!(!sign_in_blocked(&api(C::TooManyRequests)));
+        assert!(!sign_in_blocked(&ProtonError::KeysLocked));
+    }
+
    /// The regression this whole pass exists to prevent: before it, every SDK
    /// failure was hardcoded to `Remote`, so a 403 asked the user to retry a
    /// request that could never succeed.
@@ -0,0 +1,133 @@
+//! When a photo was taken, as its own EXIF tags say.
+//!
+//! The fallback for a photo nothing else dates: a Takeout photo without a
+//! sidecar or a date in its name, and a photo uploaded from the app. Without
+//! it the first was filed under the moment of the import and the second under
+//! the file's modification time, which a copy resets.
+
+use std::io::{BufRead, Seek};
+use std::path::Path;
+
+use crate::takeout::days_from_civil;
+
+/// The capture time in the EXIF of the file at `path`, in epoch seconds.
+pub fn capture_time_of(path: &Path) -> Option<i64> {
+    let file = std::fs::File::open(path).ok()?;
+    capture_time(&mut std::io::BufReader::new(file))
+}
+
+/// The capture time in the EXIF `reader` holds: `DateTimeOriginal`, then
+/// `DateTimeDigitized`, each adjusted by its `OffsetTime…` tag when the camera
+/// wrote one. Without an offset the time is read as UTC, as a date in a file
+/// name is (`takeout::capture_time_from_name`).
+pub fn capture_time(reader: &mut (impl BufRead + Seek)) -> Option<i64> {
+    let exif = exif::Reader::new().read_from_container(reader).ok()?;
+    let ascii = |tag: exif::Tag| -> Option<String> {
+        let field = exif.get_field(tag, exif::In::PRIMARY)?;
+        match &field.value {
+            exif::Value::Ascii(parts) => parts.first().map(|part| {
+                String::from_utf8_lossy(part)
+                    .trim_matches('\0')
+                    .trim()
+                    .to_string()
+            }),
+            _ => None,
+        }
+    };
+    [
+        (exif::Tag::DateTimeOriginal, exif::Tag::OffsetTimeOriginal),
+        (exif::Tag::DateTimeDigitized, exif::Tag::OffsetTimeDigitized),
+    ]
+    .into_iter()
+    .find_map(|(time, offset)| {
+        let local = parse_exif_time(&ascii(time)?)?;
+        let offset = ascii(offset).and_then(|o| parse_offset(&o)).unwrap_or(0);
+        Some(local - offset)
+    })
+}
+
+/// `YYYY:MM:DD HH:MM:SS` as epoch seconds, read as UTC. `None` for the
+/// all-zero or blank value cameras write when they do not know.
+fn parse_exif_time(text: &str) -> Option<i64> {
+    let bytes = text.as_bytes();
+    if bytes.len() < 19 || bytes[4] != b':' || bytes[7] != b':' || bytes[13] != b':' {
+        return None;
+    }
+    let number = |range: std::ops::Range<usize>| text.get(range)?.parse::<i64>().ok();
+    let (year, month, day) = (number(0..4)?, number(5..7)?, number(8..10)?);
+    let (hour, minute, second) = (number(11..13)?, number(14..16)?, number(17..19)?);
+    if !(1800..=9999).contains(&year)
+        || !(1..=12).contains(&month)
+        || !(1..=31).contains(&day)
+        || hour > 23
+        || minute > 59
+        || second > 60
+    {
+        return None;
+    }
+    Some(days_from_civil(year, month, day) * 86_400 + hour * 3600 + minute * 60 + second)
+}
+
+/// `+HH:MM` or `-HH:MM` as seconds east of UTC.
+fn parse_offset(text: &str) -> Option<i64> {
+    let sign = match text.as_bytes().first()? {
+        b'+' => 1,
+        b'-' => -1,
+        _ => return None,
+    };
+    let (hours, minutes) = text.get(1..)?.split_once(':')?;
+    let (hours, minutes) = (hours.parse::<i64>().ok()?, minutes.parse::<i64>().ok()?);
+    (hours <= 14 && minutes < 60).then_some(sign * (hours * 3600 + minutes * 60))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn an_exif_time_reads_as_utc_and_its_offset_moves_it() {
+        // 2023-06-01 12:00:00 UTC.
+        let noon = 1_685_620_800;
+        assert_eq!(parse_exif_time("2023:06:01 12:00:00"), Some(noon));
+        assert_eq!(parse_offset("+02:00"), Some(7200));
+        assert_eq!(parse_offset("-05:30"), Some(-19_800));
+        assert_eq!(
+            parse_exif_time("2023:06:01 14:00:00").map(|t| t - parse_offset("+02:00").unwrap()),
+            Some(noon)
+        );
+    }
+
+    #[test]
+    fn an_unknown_exif_time_is_no_time() {
+        assert_eq!(parse_exif_time("0000:00:00 00:00:00"), None);
+        assert_eq!(parse_exif_time("    :  :     :  :  "), None);
+        assert_eq!(parse_exif_time(""), None);
+        assert_eq!(parse_offset("02:00"), None);
+    }
+
+    #[test]
+    fn a_photo_is_dated_by_its_original_time_and_offset() {
+        let ascii = |tag, text: &str| exif::Field {
+            tag,
+            ifd_num: exif::In::PRIMARY,
+            value: exif::Value::Ascii(vec![text.as_bytes().to_vec()]),
+        };
+        let taken = ascii(exif::Tag::DateTimeOriginal, "2023:06:01 14:00:00");
+        let offset = ascii(exif::Tag::OffsetTimeOriginal, "+02:00");
+        let digitized = ascii(exif::Tag::DateTimeDigitized, "2024:01:01 00:00:00");
+        let mut writer = exif::experimental::Writer::new();
+        writer.push_field(&taken);
+        writer.push_field(&offset);
+        writer.push_field(&digitized);
+        let mut tiff = std::io::Cursor::new(Vec::new());
+        writer.write(&mut tiff, false).unwrap();
+        tiff.set_position(0);
+        assert_eq!(capture_time(&mut tiff), Some(1_685_620_800));
+    }
+
+    #[test]
+    fn a_file_without_exif_has_no_capture_time() {
+        let mut png = std::io::Cursor::new(b"\x89PNG\r\n\x1a\n".to_vec());
+        assert_eq!(capture_time(&mut png), None);
+    }
+}
@@ -10,6 +10,7 @@ pub mod config;
 pub mod control;
 pub mod db;
 pub mod error;
+pub mod exiftime;
 pub mod kernelkey;
 pub mod localindex;
 pub mod menu;
@@ -23,8 +24,10 @@ pub mod service;
 pub mod shell;
 pub mod similar;
 pub mod syncignore;
+pub mod syncroot;
 pub mod takeout;
 pub mod tray;
+pub mod update;

 pub use access::{Access, access_for, perm_bits};
 pub use error::{CoreError, CoreResult, Error, Result};
@@ -42,7 +42,7 @@ const SKIP_PATH_SUFFIXES: &[&str] = &["go/pkg/mod"];

 /// Hard cap on indexed entries, so a pathological home directory cannot grow the
 /// database without bound. Reaching it stops the walk early.
-const MAX_ENTRIES: usize = 400_000;
+pub const MAX_ENTRIES: usize = 400_000;

 /// Rows handed to the sink at a time. Large enough that the per-transaction cost
 /// amortises, small enough that the writer lock is released often (FUSE
@@ -189,11 +189,21 @@ fn spawn(argv: &[String], path: &Path) {
        .stderr(Stdio::null())
        .process_group(0)
        .spawn();
-    if let Err(e) = spawned {
-        tracing::error!(command = ?argv, "open failed: {e}");
+    match spawned {
+        Ok(child) => reap(child),
+        Err(e) => tracing::error!(command = ?argv, "open failed: {e}"),
    }
 }

+/// Wait for `child` on a thread of its own. A child nobody waits for stays a
+/// zombie for as long as its parent lives, which for the app and the tray is
+/// the whole session.
+pub fn reap(mut child: std::process::Child) {
+    std::thread::spawn(move || {
+        let _ = child.wait();
+    });
+}
+
 /// [`open`] with the policy from the user's `config.json`, read once per
 /// process. For callers that open the occasional path and have no reason to
 /// carry a policy around; long-lived windows should hold their own copy.
@@ -472,6 +482,21 @@ fn glob_match(pattern: &str, name: &str) -> bool {
 mod tests {
    use super::*;

+    #[test]
+    fn a_reaped_child_does_not_stay_a_zombie() {
+        let child = std::process::Command::new("true").spawn().unwrap();
+        let proc_entry = std::path::PathBuf::from(format!("/proc/{}", child.id()));
+        reap(child);
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+        while proc_entry.exists() && std::time::Instant::now() < deadline {
+            std::thread::sleep(std::time::Duration::from_millis(10));
+        }
+        assert!(
+            !proc_entry.exists(),
+            "the child is still in the process table"
+        );
+    }
+
    fn rule(patterns: &[&str], command: &[&str], terminal: bool) -> OpenRule {
        OpenRule {
            patterns: patterns.iter().map(|p| (*p).to_string()).collect(),
@@ -19,9 +19,31 @@ use serde::{Deserialize, Serialize};

 use crate::mounts::MountMode;

-/// File name of the profile.
+/// File name of the profile clients before 3.5.0 wrote, one per device.
+///
+/// Read, never written: two computers sharing a device each overwrote the
+/// other's. See [`profile_file_name`].
 pub const PROFILE_FILE_NAME: &str = "profile.json";

+/// File name of one machine's profile: `profile-<machine id>.json`.
+///
+/// One per machine, because several computers may sync into one device, and
+/// each describes its own arrangement. A single shared file went to whichever
+/// computer saved last.
+pub fn profile_file_name(machine_id: &str) -> String {
+    format!("profile-{machine_id}.json")
+}
+
+/// Whether `name` is a profile: [`PROFILE_FILE_NAME`] or one machine's
+/// [`profile_file_name`].
+pub fn is_profile_file_name(name: &str) -> bool {
+    name == PROFILE_FILE_NAME
+        || name
+            .strip_prefix("profile-")
+            .and_then(|rest| rest.strip_suffix(".json"))
+            .is_some_and(|id| !id.is_empty() && id.bytes().all(|b| b.is_ascii_alphanumeric()))
+}
+
 /// Folder, directly under the device root, that holds the profile.
 ///
 /// The API refuses `Cannot create file at the root of a device` (HTTP 422), so
@@ -74,6 +96,10 @@ pub struct Profile {
    /// Hostname of the machine that wrote it, so a restore prompt can say
    /// *"restore settings from laptop-xyz?"* rather than quoting a uid.
    pub hostname: String,
+    /// The writing machine's id, as in its [`profile_file_name`]. `None` in a
+    /// profile written before 3.5.0.
+    #[serde(default)]
+    pub machine_id: Option<String>,
    /// When it was written, epoch seconds.
    pub saved_at: i64,
    #[serde(default)]
@@ -92,6 +118,25 @@ pub struct Profile {
    pub mountpoint: Option<String>,
 }

+/// The saved arrangement of the folder with uid `remote_uid`, from the
+/// profiles of every computer that syncs the device.
+///
+/// The profile of the machine named `hostname` wins, since it describes this
+/// computer; otherwise the most recently saved one that has the folder.
+pub fn saved_folder<'a>(
+    profiles: &'a [Profile],
+    remote_uid: &str,
+    hostname: &str,
+) -> Option<&'a ProfileFolder> {
+    let holding = |p: &&'a Profile| p.folders.iter().any(|f| f.remote_uid == remote_uid);
+    let profile = profiles
+        .iter()
+        .filter(holding)
+        .find(|p| p.hostname == hostname)
+        .or_else(|| profiles.iter().filter(holding).max_by_key(|p| p.saved_at))?;
+    profile.folders.iter().find(|f| f.remote_uid == remote_uid)
+}
+
 impl Profile {
    /// Parse a profile document, refusing one written by a newer client.
    pub fn parse(bytes: &[u8]) -> Result<Self, String> {
@@ -122,6 +167,7 @@ mod tests {
            version: PROFILE_VERSION,
            device_uid: "dev-1".to_string(),
            hostname: "laptop-xyz".to_string(),
+            machine_id: Some("0123456789abcdef0123456789abcdef".to_string()),
            saved_at: 1_700_000_000,
            folders: vec![ProfileFolder {
                remote_uid: "vol~link".to_string(),
@@ -219,6 +265,52 @@ mod tests {
        assert!(p.ignore_patterns.is_none());
    }

+    #[test]
+    fn a_profile_name_is_the_legacy_one_or_one_per_machine() {
+        assert!(is_profile_file_name(PROFILE_FILE_NAME));
+        let name = profile_file_name("0123456789abcdef0123456789abcdef");
+        assert_eq!(name, "profile-0123456789abcdef0123456789abcdef.json");
+        assert!(is_profile_file_name(&name));
+        assert!(!is_profile_file_name("profile-.json"));
+        assert!(!is_profile_file_name("profile-a/b.json"));
+        assert!(!is_profile_file_name("profile (1).json"));
+        assert!(!is_profile_file_name("notes.json"));
+    }
+
+    /// A profile written before 3.5.0 has no machine id and still parses.
+    #[test]
+    fn a_profile_without_a_machine_id_parses() {
+        let json = br#"{"version":1,"device_uid":"d","hostname":"h","saved_at":0}"#;
+        assert_eq!(Profile::parse(json).unwrap().machine_id, None);
+    }
+
+    /// Several computers sync one device, each with its own profile. This
+    /// computer's own wins, then the newest that has the folder.
+    #[test]
+    fn the_saved_folder_comes_from_this_computer_then_the_newest_profile() {
+        let profile = |hostname: &str, saved_at: i64, path: &str| Profile {
+            hostname: hostname.to_string(),
+            saved_at,
+            folders: vec![ProfileFolder {
+                remote_uid: "vol~docs".to_string(),
+                local_path: path.to_string(),
+                mode: MountMode::Mirror,
+            }],
+            ..sample()
+        };
+        let profiles = vec![
+            profile("desktop", 10, "/home/a/Docs"),
+            profile("laptop", 5, "/home/b/Docs"),
+            profile("old", 1, "/home/c/Docs"),
+        ];
+        let path =
+            |host: &str| saved_folder(&profiles, "vol~docs", host).map(|f| f.local_path.as_str());
+        assert_eq!(path("laptop"), Some("/home/b/Docs"));
+        assert_eq!(path("new-machine"), Some("/home/a/Docs"));
+        assert_eq!(saved_folder(&profiles, "vol~other", "laptop"), None);
+        assert_eq!(saved_folder(&[], "vol~docs", "laptop"), None);
+    }
+
    #[test]
    fn future_version_is_refused() {
        let mut p = sample();
@@ -23,6 +23,11 @@ const SCRIPTS: [(&str, &str); 2] = [
 /// `NAUTILUS_SCRIPT_SELECTED_FILE_PATHS`; the positional args carry the same
 /// selection when the script runs on a local (non-URI) folder, so we prefer the
 /// environment and fall back to `"$@"` for the Nemo/Caja variants.
+///
+/// The `--` keeps a file named like an option, such as `--json`, a path. A
+/// name with a newline in it still arrives split in two from Nautilus, whose
+/// list is newline-separated; `pdfs` then fails on both halves, which touches
+/// nothing.
 fn script_body(subcommand: &str) -> String {
    format!(
        "#!/bin/sh\n\
@@ -41,7 +46,7 @@ fn script_body(subcommand: &str) -> String {
         \n\
         printf '%s' \"$paths\" | while IFS= read -r path; do\n\
         \x20   [ -n \"$path\" ] || continue\n\
-         \x20   pdfs {subcommand} \"$path\" || exit 1\n\
+         \x20   pdfs {subcommand} -- \"$path\" || exit 1\n\
         done\n"
    )
 }
@@ -95,3 +100,13 @@ fn write_scripts(dir: &PathBuf) -> io::Result<()> {
    tracing::debug!("installed file-manager scripts in {dir:?}");
    Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::script_body;
+
+    #[test]
+    fn the_script_ends_options_before_each_path() {
+        assert!(script_body("pin").contains(r#"pdfs pin -- "$path""#));
+    }
+}
@@ -0,0 +1,209 @@
+//! Which local folders may become a sync root.
+//!
+//! A mirror uploads everything under its root and deletes what Drive deleted,
+//! so a root that holds more than the user meant is dangerous. `$HOME` takes
+//! the decrypted content cache, `cache.db` and `~/.ssh` up to Drive, and walks
+//! into the mount, which downloads the whole Drive only to upload it again.
+//! Every place a root is added or restored goes through [`problem`].
+
+use std::path::{Component, Path, PathBuf};
+
+use crate::config::{AppConfig, AppDirs};
+
+/// The paths a sync root must stay clear of.
+#[derive(Debug, Clone, Default)]
+pub struct Reserved {
+    /// The user's home folder. A root may sit inside it, not be it or above it.
+    pub home: Option<PathBuf>,
+    /// The Proton Drive mount.
+    pub mountpoint: Option<PathBuf>,
+    /// This app's own configuration, state and cache folders.
+    pub app_dirs: Vec<PathBuf>,
+}
+
+impl Reserved {
+    /// The reserved paths of this user and `config`, resolved like a root.
+    pub fn current(config: &AppConfig) -> Self {
+        let Ok(dirs) = AppDirs::new() else {
+            return Self::default();
+        };
+        let resolved = |path: PathBuf| resolve(&path).unwrap_or(path);
+        let mut app_dirs = vec![dirs.state_dir(), dirs.cache_dir()];
+        if let Some(config_dir) = dirs.config_path().parent() {
+            app_dirs.push(config_dir.to_path_buf());
+        }
+        Self {
+            home: dirs.home_dir().map(resolved),
+            mountpoint: Some(resolved(dirs.resolved_mountpoint(config))),
+            app_dirs: app_dirs.into_iter().map(resolved).collect(),
+        }
+    }
+}
+
+/// `path` as a root is compared: absolute, with symlinks resolved as far as the
+/// path exists. A folder a restore is about to create does not exist yet, so
+/// the part past the deepest existing folder is kept as written.
+///
+/// A `..` is refused rather than resolved: before a symlink it means something
+/// else than after it, and a path recorded on another machine has no business
+/// holding one.
+pub fn resolve(path: &Path) -> Result<PathBuf, String> {
+    if !path.is_absolute() {
+        return Err(format!("{} is not an absolute path", path.display()));
+    }
+    if path.components().any(|c| c == Component::ParentDir) {
+        return Err(format!("{} goes up with `..`", path.display()));
+    }
+    let mut existing = path.to_path_buf();
+    let mut rest = Vec::new();
+    loop {
+        match existing.canonicalize() {
+            Ok(canonical) => {
+                return Ok(rest
+                    .into_iter()
+                    .rev()
+                    .fold(canonical, |path: PathBuf, part| path.join(part)));
+            }
+            Err(_) => {
+                let Some(name) = existing.file_name().map(|n| n.to_os_string()) else {
+                    return Ok(path.to_path_buf());
+                };
+                rest.push(name);
+                if !existing.pop() {
+                    return Ok(path.to_path_buf());
+                }
+            }
+        }
+    }
+}
+
+/// Why `root` cannot be synced, or `None` when it can. `root` is resolved
+/// ([`resolve`]); `others` are the roots already synced.
+pub fn problem(root: &Path, others: &[PathBuf], reserved: &Reserved) -> Option<String> {
+    let shown = root.display();
+    if root.parent().is_none() {
+        return Some(format!("{shown} is the root of the file system"));
+    }
+    if let Some(home) = &reserved.home {
+        if root == home {
+            return Some(format!(
+                "{shown} is your home folder; pick a folder inside it"
+            ));
+        }
+        if home.starts_with(root) {
+            return Some(format!("{shown} holds your home folder"));
+        }
+    }
+    if let Some(mountpoint) = &reserved.mountpoint
+        && overlaps(root, mountpoint)
+    {
+        return Some(format!(
+            "{shown} overlaps the Proton Drive folder {}",
+            mountpoint.display()
+        ));
+    }
+    if let Some(dir) = reserved.app_dirs.iter().find(|dir| overlaps(root, dir)) {
+        return Some(format!(
+            "{shown} overlaps this app's own data in {}",
+            dir.display()
+        ));
+    }
+    if others.iter().any(|other| other == root) {
+        return Some(format!("{shown} is already synced"));
+    }
+    if let Some(other) = others.iter().find(|other| overlaps(root, other)) {
+        return Some(format!(
+            "{shown} overlaps the synced folder {}",
+            other.display()
+        ));
+    }
+    None
+}
+
+/// Whether one of `a` and `b` is the other or inside it.
+fn overlaps(a: &Path, b: &Path) -> bool {
+    a.starts_with(b) || b.starts_with(a)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn reserved() -> Reserved {
+        Reserved {
+            home: Some("/home/u".into()),
+            mountpoint: Some("/home/u/ProtonDrive".into()),
+            app_dirs: vec![
+                "/home/u/.local/state/proton-drive-linux".into(),
+                "/home/u/.cache/proton-drive-linux".into(),
+                "/home/u/.config/proton-drive-linux".into(),
+            ],
+        }
+    }
+
+    fn refused(root: &str, others: &[&str]) -> bool {
+        let others: Vec<PathBuf> = others.iter().map(PathBuf::from).collect();
+        problem(Path::new(root), &others, &reserved()).is_some()
+    }
+
+    #[test]
+    fn a_folder_inside_home_can_be_synced() {
+        assert!(!refused("/home/u/Documents", &[]));
+        assert!(!refused("/home/u/Pictures", &["/home/u/Documents"]));
+        assert!(!refused("/mnt/data/photos", &[]));
+    }
+
+    #[test]
+    fn the_file_system_root_home_and_its_parents_are_refused() {
+        assert!(refused("/", &[]));
+        assert!(refused("/home/u", &[]));
+        assert!(refused("/home", &[]));
+    }
+
+    #[test]
+    fn the_mount_and_the_apps_own_data_are_refused_either_way_round() {
+        assert!(refused("/home/u/ProtonDrive", &[]));
+        assert!(refused("/home/u/ProtonDrive/Documents", &[]));
+        assert!(refused("/home/u/.cache", &[]));
+        assert!(refused(
+            "/home/u/.local/state/proton-drive-linux/staging",
+            &[]
+        ));
+        assert!(refused("/home/u/.config", &[]));
+    }
+
+    #[test]
+    fn a_root_inside_or_around_another_root_is_refused() {
+        assert!(refused("/home/u/Documents", &["/home/u/Documents"]));
+        assert!(refused("/home/u/Documents/Work", &["/home/u/Documents"]));
+        assert!(refused("/home/u/stuff", &["/home/u/stuff/Documents"]));
+        // A shared prefix of characters is not a shared folder.
+        assert!(!refused("/home/u/Documents2", &["/home/u/Documents"]));
+    }
+
+    #[test]
+    fn a_path_that_goes_up_or_is_relative_does_not_resolve() {
+        assert!(resolve(Path::new("/home/u/../../etc")).is_err());
+        assert!(resolve(Path::new("Documents")).is_err());
+    }
+
+    #[test]
+    fn a_folder_still_to_be_created_resolves_under_its_existing_parent() {
+        let base = std::env::temp_dir().join(format!("pdfs-syncroot-{}", std::process::id()));
+        std::fs::create_dir_all(&base).unwrap();
+        let canonical = base.canonicalize().unwrap();
+        assert_eq!(
+            resolve(&base.join("new/inner")).unwrap(),
+            canonical.join("new/inner")
+        );
+        let link = base.join("link");
+        let _ = std::fs::remove_file(&link);
+        std::os::unix::fs::symlink(&canonical, &link).unwrap();
+        assert_eq!(
+            resolve(&link.join("later")).unwrap(),
+            canonical.join("later"),
+            "a symlink is followed to where it points"
+        );
+        std::fs::remove_dir_all(&base).unwrap();
+    }
+}
@@ -346,6 +346,11 @@ fn assemble(entries: Vec<RawEntry>, sidecars: &HashMap<String, Vec<u8>>) -> Take
            .insert(file.to_string(), body);
    }

+    let indexes: HashMap<&str, SidecarIndex<'_>> = per_folder_sidecars
+        .iter()
+        .map(|(folder, in_folder)| (folder.as_str(), SidecarIndex::new(in_folder)))
+        .collect();
+
    let mut scan = TakeoutScan::default();
    let mut seen_albums: HashMap<String, ()> = HashMap::new();

@@ -364,9 +369,13 @@ fn assemble(entries: Vec<RawEntry>, sidecars: &HashMap<String, Vec<u8>>) -> Take
            continue;
        };

-        let sidecar = per_folder_sidecars
-            .get(&folder)
-            .and_then(|in_folder| find_sidecar(&file_name, in_folder))
+        let found = indexes
+            .get(folder.as_str())
+            .and_then(|index| find_sidecar(&file_name, index));
+        // An edited copy keeps its own name: the title is its original's.
+        let title_is_ours = found.is_some_and(|((rule, _), _)| rule != EDITED_COPY);
+        let sidecar = found
+            .map(|(_, body)| body)
            .and_then(|body| serde_json::from_slice::<PhotoSidecar>(body).ok())
            .unwrap_or_default();

@@ -388,6 +397,7 @@ fn assemble(entries: Vec<RawEntry>, sidecars: &HashMap<String, Vec<u8>>) -> Take
        let name = sidecar
            .title
            .as_deref()
+            .filter(|_| title_is_ours)
            .map(str::trim)
            .filter(|title| !title.is_empty() && same_extension(title, &file_name))
            .unwrap_or(&file_name)
@@ -598,7 +608,7 @@ pub fn capture_time_from_name(name: &str) -> Option<i64> {

 /// Days between 1970-01-01 and a proleptic-Gregorian date (Howard Hinnant's
 /// `days_from_civil`). Avoids pulling a date crate in for one conversion.
-fn days_from_civil(year: i64, month: i64, day: i64) -> i64 {
+pub(crate) fn days_from_civil(year: i64, month: i64, day: i64) -> i64 {
    let year = year - i64::from(month <= 2);
    let era = if year >= 0 { year } else { year - 399 } / 400;
    let year_of_era = year - era * 400;
@@ -627,17 +637,106 @@ fn swap_duplicate_marker(file_name: &str) -> Option<String> {
    Some(format!("{}{}{}", &file_name[..marker_start], tail, marker))
 }

-/// Find the sidecar belonging to `file_name` among the JSON files of its folder.
+/// How long Google lets a sidecar's file name get, `.json` included. A longer
+/// one is cut, into its suffix first and then into the photo name.
+const SIDECAR_NAME_CAP: usize = 51;
+
+/// The rank [`sidecar_rank`] gives an edited copy that shares its original's
+/// sidecar. Its date is the original's, but its name is its own.
+const EDITED_COPY: u8 = 4;
+
+/// The sidecars of one folder by their `.json`-stripped stem, so a photo is
+/// ranked only against those that can match it.
+///
+/// Every rule in [`sidecar_rank`] needs the stem to start with a prefix of the
+/// photo name that the name itself determines, and a sorted map finds the
+/// stems with a given prefix as one range. Ranking every photo against every
+/// sidecar instead took 27 s for a folder of 10,000 photos.
+struct SidecarIndex<'a> {
+    by_stem: BTreeMap<&'a str, Vec<(&'a str, &'a Vec<u8>)>>,
+}
+
+impl<'a> SidecarIndex<'a> {
+    fn new(in_folder: &'a BTreeMap<String, &'a Vec<u8>>) -> Self {
+        let mut by_stem: BTreeMap<&'a str, Vec<(&'a str, &'a Vec<u8>)>> = BTreeMap::new();
+        for (name, body) in in_folder {
+            by_stem
+                .entry(strip_json_suffix(name))
+                .or_default()
+                .push((name.as_str(), *body));
+        }
+        Self { by_stem }
+    }
+
+    /// Add every sidecar whose stem starts with `prefix` to `out`.
+    fn starting_with(&self, prefix: &str, out: &mut BTreeMap<&'a str, &'a Vec<u8>>) {
+        let from = (
+            std::ops::Bound::Included(prefix),
+            std::ops::Bound::Unbounded,
+        );
+        for (stem, sidecars) in self.by_stem.range::<str, _>(from) {
+            if !stem.starts_with(prefix) {
+                break;
+            }
+            out.extend(sidecars.iter().copied());
+        }
+    }
+
+    /// Add every sidecar whose stem is `head`, or starts with `head` and a `.`:
+    /// those that have `head` as a boundary ([`suffix_boundaries`]).
+    fn bounded_by(&self, head: &str, out: &mut BTreeMap<&'a str, &'a Vec<u8>>) {
+        if let Some(sidecars) = self.by_stem.get(head) {
+            out.extend(sidecars.iter().copied());
+        }
+        self.starting_with(&format!("{head}."), out);
+    }
+
+    /// Every sidecar [`sidecar_rank`] could match `file_name` to, by name. A
+    /// superset: each one is still ranked.
+    fn candidates(&self, file_name: &str) -> BTreeMap<&'a str, &'a Vec<u8>> {
+        let mut out = BTreeMap::new();
+        // Rules 0 and 2: the stem starts with the name, or with its swapped form.
+        self.starting_with(file_name, &mut out);
+        if let Some(swapped) = swap_duplicate_marker(file_name) {
+            self.starting_with(&swapped, &mut out);
+        }
+        // Rule 1: the stem of `A(N).B` starts with `A.B(N)`, so with `A.`.
+        for (paren, _) in file_name.match_indices('(') {
+            self.starting_with(&format!("{}.", &file_name[..paren]), &mut out);
+        }
+        // Rule 3: a boundary of the stem is a prefix of the name.
+        for end in file_name
+            .char_indices()
+            .map(|(index, _)| index)
+            .skip(1)
+            .chain([file_name.len()])
+        {
+            self.bounded_by(&file_name[..end], &mut out);
+        }
+        // Rule 4: `<original>-<word>.<ext>` has `<original>.<ext>` as a boundary.
+        if let Some((_, extension)) = file_name.rsplit_once('.') {
+            for (dash, _) in file_name.match_indices('-') {
+                self.bounded_by(&format!("{}.{extension}", &file_name[..dash]), &mut out);
+            }
+        }
+        out
+    }
+}
+
+/// Find the sidecar belonging to `file_name` among the JSON files of its folder,
+/// with the rank it matched at.
 ///
 /// Tried in order of confidence: the exact name, the `(N)`-swapped name, an
-/// unknown trailing suffix, then a prefix match for the case where truncation
-/// cut into the photo name itself. The best-ranked candidate in the folder wins.
+/// unknown trailing suffix, a prefix match for the case where truncation cut
+/// into the photo name itself, and last an edited copy's original. The
+/// best-ranked candidate in the folder wins; of equal ranks, the first by
+/// sidecar name.
 fn find_sidecar<'a>(
    file_name: &str,
-    in_folder: &BTreeMap<String, &'a Vec<u8>>,
-) -> Option<&'a Vec<u8>> {
+    index: &SidecarIndex<'a>,
+) -> Option<((u8, usize), &'a Vec<u8>)> {
    let mut best: Option<((u8, usize), &'a Vec<u8>)> = None;
-    for (sidecar_name, body) in in_folder {
+    for (sidecar_name, body) in index.candidates(file_name) {
        let Some(rank) = sidecar_rank(strip_json_suffix(sidecar_name), file_name) else {
            continue;
        };
@@ -645,7 +744,7 @@ fn find_sidecar<'a>(
            best = Some((rank, body));
        }
    }
-    best.map(|(_, body)| body)
+    best
 }

 /// How well a sidecar's `.json`-stripped `stem` matches `file_name`, as a sort
@@ -683,19 +782,44 @@ fn sidecar_rank(stem: &str, file_name: &str) -> Option<(u8, usize)> {
    }
    // 3 — truncation ate into the photo name itself, leaving only a prefix of
    // it. Every suffix boundary in the stem is tried, so this holds for a
-    // localized suffix too; the longest surviving prefix wins, because a folder
-    // with `IMG_1.jpg` and `IMG_12.jpg` must not let the shorter stem claim the
-    // longer photo.
-    let mut longest: Option<usize> = None;
-    for head in suffix_boundaries(stem) {
-        if !head.is_empty()
-            && file_name.starts_with(head)
-            && longest.is_none_or(|len| head.len() > len)
-        {
-            longest = Some(head.len());
+    // localized suffix too; the longest surviving prefix wins.
+    //
+    // Only for a sidecar whose name is as long as Google lets one get: a name
+    // that short of the cap was not cut, so a prefix of it is the name of a
+    // different photo. Without this, `IMG_1.jpg`'s sidecar gave its name and
+    // date to an `IMG_12.jpg` that had none (`docs/BUGS.md` B225).
+    if stem.chars().count() + ".json".len() >= SIDECAR_NAME_CAP - 4 {
+        let mut longest: Option<usize> = None;
+        for head in suffix_boundaries(stem) {
+            if !head.is_empty()
+                && file_name.starts_with(head)
+                && longest.is_none_or(|len| head.len() > len)
+            {
+                longest = Some(head.len());
+            }
+        }
+        if let Some(len) = longest {
+            return Some((3, usize::MAX - len));
        }
    }
-    longest.map(|len| (3, usize::MAX - len))
+    // 4 — an edited copy, `IMG_1-edited.jpg` (the word is localized), which
+    // Google exports without a sidecar of its own next to `IMG_1.jpg`'s.
+    suffix_boundaries(stem)
+        .filter_map(|head| head.rsplit_once('.'))
+        .any(|(original, extension)| is_edited_copy_of(file_name, original, extension))
+        .then_some((EDITED_COPY, 0))
+}
+
+/// Whether `file_name` is `<original>-<word>.<extension>`, the name Google
+/// gives an edited copy of `<original>.<extension>`.
+fn is_edited_copy_of(file_name: &str, original: &str, extension: &str) -> bool {
+    !original.is_empty()
+        && file_name
+            .strip_prefix(original)
+            .and_then(|rest| rest.strip_prefix('-'))
+            .and_then(|rest| rest.strip_suffix(extension))
+            .and_then(|rest| rest.strip_suffix('.'))
+            .is_some_and(|word| !word.is_empty() && word.chars().all(char::is_alphabetic))
 }

 /// The stem plus each of its prefixes ending before a `.`, longest first — the
@@ -994,21 +1118,25 @@ mod tests {

    #[test]
    fn longest_prefix_wins_when_the_photo_name_itself_was_truncated() {
+        // Both sidecar names are at Google's cap, so both were cut into the
+        // photo name; the longer surviving prefix is the better claim.
+        let short = "Takeout/Google Photos/Photos from 2019/PXL_20190101_120000000.PORTRAIT_ORIGINAL_E.json";
+        let long = "Takeout/Google Photos/Photos from 2019/PXL_20190101_120000000.PORTRAIT_ORIGINAL_EXPO.json";
        let mut sidecars = HashMap::new();
        sidecar(
            &mut sidecars,
-            "Takeout/Google Photos/Photos from 2019/IMG_1.json",
+            short,
            r#"{"photoTakenTime":{"timestamp":"1"}}"#,
        );
        sidecar(
            &mut sidecars,
-            "Takeout/Google Photos/Photos from 2019/IMG_12.json",
+            long,
            r#"{"photoTakenTime":{"timestamp":"2"}}"#,
        );
        let scan = assemble(
            vec![entry(
                0,
-                "Takeout/Google Photos/Photos from 2019/IMG_12345.jpg",
+                "Takeout/Google Photos/Photos from 2019/PXL_20190101_120000000.PORTRAIT_ORIGINAL_EXPOSURE.jpg",
                10,
            )],
            &sidecars,
@@ -1017,6 +1145,104 @@ mod tests {
        assert_eq!(scan.photos[0].capture_time, Some(2));
    }

+    /// A short sidecar name was not cut, so a prefix of it names another photo:
+    /// `IMG_1.jpg`'s sidecar gave its title and date to `IMG_12.jpg`
+    /// (`docs/BUGS.md` B225).
+    #[test]
+    fn a_photo_without_a_sidecar_does_not_take_a_shorter_named_siblings() {
+        let mut sidecars = HashMap::new();
+        sidecar(
+            &mut sidecars,
+            "Takeout/Google Photos/Photos from 2019/IMG_1.jpg.supplemental-metadata.json",
+            r#"{"title":"IMG_1.jpg","photoTakenTime":{"timestamp":"1"}}"#,
+        );
+        let scan = assemble(
+            vec![
+                entry(0, "Takeout/Google Photos/Photos from 2019/IMG_1.jpg", 10),
+                entry(0, "Takeout/Google Photos/Photos from 2019/IMG_12.jpg", 10),
+            ],
+            &sidecars,
+        );
+
+        assert_eq!(scan.photos[0].capture_time, Some(1));
+        assert_eq!(scan.photos[1].name, "IMG_12.jpg");
+        assert_eq!(scan.photos[1].capture_time, None);
+    }
+
+    /// An edited copy has no sidecar of its own. It takes its original's date,
+    /// but keeps its own name rather than the original's title.
+    #[test]
+    fn an_edited_copy_takes_its_originals_date_and_keeps_its_name() {
+        let mut sidecars = HashMap::new();
+        sidecar(
+            &mut sidecars,
+            "Takeout/Google Fotos/Urlaub/IMG_2.jpg.ergänzende-Metadaten.json",
+            r#"{"title":"Holiday.jpg","photoTakenTime":{"timestamp":"7"}}"#,
+        );
+        let scan = assemble(
+            vec![
+                entry(0, "Takeout/Google Fotos/Urlaub/IMG_2.jpg", 10),
+                entry(0, "Takeout/Google Fotos/Urlaub/IMG_2-bearbeitet.jpg", 10),
+            ],
+            &sidecars,
+        );
+
+        assert_eq!(scan.photos[0].name, "Holiday.jpg");
+        assert_eq!(scan.photos[1].name, "IMG_2-bearbeitet.jpg");
+        assert_eq!(scan.photos[1].capture_time, Some(7));
+    }
+
+    /// The index looks only at the sidecars that can match, and must find the
+    /// same one that ranking every sidecar in the folder finds.
+    #[test]
+    fn the_sidecar_index_finds_what_ranking_every_sidecar_finds() {
+        let long = "A_very_long_holiday_photo_name_from_the_beach_2019";
+        let names = [
+            "IMG_1.jpg".to_string(),
+            "IMG_12.jpg".to_string(),
+            "IMG_1(1).jpg".to_string(),
+            "IMG_1-edited.jpg".to_string(),
+            "IMG_1-bearbeitet.jpg".to_string(),
+            "my.photo(2).jpg".to_string(),
+            "x(1).jpg".to_string(),
+            "Ölbild.png".to_string(),
+            "PXL_20230101_101010.mp4".to_string(),
+            format!("{long}.jpg"),
+            format!("{long}_2.jpg"),
+            "nothing.heic".to_string(),
+        ];
+        let sidecar_names = [
+            "IMG_1.jpg.supplemental-metadata.json".to_string(),
+            "IMG_1.jpg(1).supplemental-metadata.json".to_string(),
+            "IMG_12.jpg.ergänzende-Metadaten.json".to_string(),
+            "my.photo.jpg(2).json".to_string(),
+            "x.jpg(1).json".to_string(),
+            "Ölbild.png.suppl.json".to_string(),
+            "PXL_20230101_101010.mp4.JSON".to_string(),
+            format!("{}.json", &long[..44]),
+            format!("{long}.jp.json"),
+            "IMG.json".to_string(),
+            "unrelated.json".to_string(),
+        ];
+        let bodies: Vec<Vec<u8>> = (0..sidecar_names.len())
+            .map(|i| i.to_string().into_bytes())
+            .collect();
+        let in_folder: BTreeMap<String, &Vec<u8>> =
+            sidecar_names.iter().cloned().zip(bodies.iter()).collect();
+        let index = SidecarIndex::new(&in_folder);
+        for name in &names {
+            let mut every: Option<((u8, usize), &Vec<u8>)> = None;
+            for (sidecar_name, body) in &in_folder {
+                if let Some(rank) = sidecar_rank(strip_json_suffix(sidecar_name), name)
+                    && every.as_ref().is_none_or(|(current, _)| rank < *current)
+                {
+                    every = Some((rank, *body));
+                }
+            }
+            assert_eq!(find_sidecar(name, &index), every, "{name}");
+        }
+    }
+
    #[test]
    fn sidecar_title_replaces_a_mangled_on_disk_name() {
        let mut sidecars = HashMap::new();
@@ -0,0 +1,178 @@
+//! The opt-in check for a newer release ([`crate::config::AppConfig::update_check`]).
+//!
+//! Only the decisions live here: what GitHub's answer says, which version is
+//! newer, when to ask again, and whether a package manager already owns
+//! updates. The desktop app does the request itself.
+
+use std::path::Path;
+use std::time::Duration;
+
+/// GitHub's latest published release. Drafts and pre-releases never show up
+/// here, so a tagged release candidate does not reach anyone.
+pub const RELEASES_LATEST_API: &str =
+    "https://api.github.com/repos/narrrl/proton-drive-linux/releases/latest";
+
+/// How often the app asks, across restarts.
+pub const CHECK_INTERVAL: Duration = Duration::from_secs(24 * 60 * 60);
+
+/// Installed next to the binaries' `share/` by packages whose package manager
+/// brings new releases (COPR, the AUR, Nix). The release `.deb`, `.rpm` and
+/// `.tar.gz` do not ship it, since nothing updates them.
+pub const MANAGED_MARKER: &str = "share/proton-drive-linux/managed-updates";
+
+/// The version of the release in a `/releases/latest` answer, without the
+/// tag's `v`. `None` for an answer that does not parse or a tag that is not
+/// `X.Y.Z`, so a changed API can never claim an update.
+pub fn latest_version(body: &[u8]) -> Option<String> {
+    let json: serde_json::Value = serde_json::from_slice(body).ok()?;
+    let tag = json.get("tag_name")?.as_str()?;
+    let version = tag.strip_prefix('v').unwrap_or(tag);
+    parse(version).map(|_| version.to_owned())
+}
+
+/// Whether `version` is a later release than `current`. Anything that is not
+/// `X.Y.Z` on either side is not.
+pub fn is_newer(version: &str, current: &str) -> bool {
+    matches!((parse(version), parse(current)), (Some(v), Some(c)) if v > c)
+}
+
+/// The release page of `version` on GitHub.
+pub fn release_url(version: &str) -> String {
+    format!("https://github.com/narrrl/proton-drive-linux/releases/tag/v{version}")
+}
+
+/// `X.Y.Z` as numbers, so `3.10.0` sorts after `3.9.0`.
+fn parse(version: &str) -> Option<(u64, u64, u64)> {
+    let mut parts = version.split('.').map(|p| p.parse::<u64>().ok());
+    let triple = (parts.next()??, parts.next()??, parts.next()??);
+    parts.next().is_none().then_some(triple)
+}
+
+/// How long until the next check is due, given the last one in Unix seconds.
+/// Zero when it is due now. A clock set back past the last check counts as
+/// due, so a wrong clock cannot stop checks.
+pub fn next_check_in(last_checked: Option<i64>, now: i64) -> Duration {
+    let interval = CHECK_INTERVAL.as_secs() as i64;
+    match last_checked {
+        Some(last) if (0..interval).contains(&(now - last)) => {
+            Duration::from_secs((interval - (now - last)) as u64)
+        }
+        _ => Duration::ZERO,
+    }
+}
+
+/// Whether the binary at `exe` was installed by a package manager that updates
+/// it, which [`MANAGED_MARKER`] next to its `bin/` says.
+pub fn updates_managed(exe: &Path) -> bool {
+    exe.parent()
+        .and_then(Path::parent)
+        .is_some_and(|prefix| prefix.join(MANAGED_MARKER).exists())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn latest(tag: &str) -> Vec<u8> {
+        format!(
+            r#"{{"tag_name":"{tag}","html_url":"https://github.com/narrrl/proton-drive-linux/releases/tag/{tag}","draft":false}}"#
+        )
+        .into_bytes()
+    }
+
+    #[test]
+    fn the_latest_release_is_read_without_its_v() {
+        assert_eq!(latest_version(&latest("v3.6.0")).as_deref(), Some("3.6.0"));
+        assert_eq!(latest_version(&latest("3.6.0")).as_deref(), Some("3.6.0"));
+    }
+
+    #[test]
+    fn an_answer_that_does_not_parse_has_no_version() {
+        assert_eq!(latest_version(b"not json"), None);
+        assert_eq!(latest_version(b"{}"), None);
+        assert_eq!(latest_version(br#"{"tag_name":7}"#), None);
+        assert_eq!(latest_version(&latest("nightly")), None);
+        assert_eq!(latest_version(&latest("v4.0.0-rc1")), None);
+        assert_eq!(latest_version(&latest("v4.0")), None);
+        assert_eq!(latest_version(&latest("v4.0.0.1")), None);
+    }
+
+    #[test]
+    fn only_a_later_release_is_newer() {
+        assert!(is_newer("3.6.0", "3.5.0"));
+        assert!(!is_newer("3.5.0", "3.5.0"));
+        assert!(!is_newer("3.4.1", "3.5.0"));
+        assert!(!is_newer("2.99.99", "3.0.0"));
+    }
+
+    #[test]
+    fn versions_compare_as_numbers() {
+        assert!(is_newer("3.10.0", "3.9.0"));
+        assert!(is_newer("3.5.10", "3.5.9"));
+        assert!(is_newer("4.0.0", "3.99.99"));
+    }
+
+    #[test]
+    fn a_version_that_is_not_x_y_z_is_never_newer() {
+        assert!(!is_newer("4.0.0", "3.5.0-dev"));
+        assert!(!is_newer("garbage", "3.5.0"));
+    }
+
+    #[test]
+    fn the_release_page_uses_the_tag() {
+        assert_eq!(
+            release_url("3.6.0"),
+            "https://github.com/narrrl/proton-drive-linux/releases/tag/v3.6.0"
+        );
+    }
+
+    #[test]
+    fn a_check_is_due_once_a_day() {
+        let day = CHECK_INTERVAL.as_secs() as i64;
+        assert_eq!(next_check_in(None, 1_000), Duration::ZERO);
+        assert_eq!(next_check_in(Some(1_000), 1_000), CHECK_INTERVAL);
+        assert_eq!(
+            next_check_in(Some(1_000), 1_000 + day - 1),
+            Duration::from_secs(1)
+        );
+        assert_eq!(next_check_in(Some(1_000), 1_000 + day), Duration::ZERO);
+        assert_eq!(
+            next_check_in(Some(1_000), 999),
+            Duration::ZERO,
+            "a clock set back must not stop checks"
+        );
+    }
+
+    /// A unique temp directory removed on drop; avoids a dev-dependency, as in
+    /// [`crate::syncignore`]'s tests.
+    struct TempDir(std::path::PathBuf);
+    impl TempDir {
+        fn new() -> Self {
+            use std::sync::atomic::{AtomicU64, Ordering};
+            static N: AtomicU64 = AtomicU64::new(0);
+            let p = std::env::temp_dir().join(format!(
+                "pdfs-update-{}-{}",
+                std::process::id(),
+                N.fetch_add(1, Ordering::Relaxed)
+            ));
+            std::fs::create_dir_all(&p).unwrap();
+            TempDir(p)
+        }
+    }
+    impl Drop for TempDir {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    #[test]
+    fn the_marker_next_to_bin_means_a_package_manager_updates() {
+        let prefix = TempDir::new();
+        let exe = prefix.0.join("bin/pdfs-app");
+        assert!(!updates_managed(&exe));
+        let marker = prefix.0.join(MANAGED_MARKER);
+        std::fs::create_dir_all(marker.parent().unwrap()).unwrap();
+        std::fs::write(&marker, "").unwrap();
+        assert!(updates_managed(&exe));
+    }
+}
@@ -723,16 +723,24 @@ fn scan_local_once(
    // has seen and stays indeterminate.
    let job = transfers.begin_background_job("Indexing this computer");
    job.detail("Scanning your files");
+    let mut failed = false;
    let walked = localindex::scan(&[home], &excludes, |batch| {
        if let Err(e) = db.local_upsert_batch(generation, &batch) {
            warn!(error = %e, "local index: batch write failed");
+            failed = true;
        }
    });

-    // Prune what this scan did not see and rebuild the FTS index over the rest,
-    // even if some batches failed — a partial index still beats none.
+    // Prune what this scan did not see, unless it did not see everything:
+    // a path it never reached, or one whose batch failed to write, is not a
+    // path that is gone (`docs/BUGS.md` B217).
    job.detail("Building the search index");
-    match db.local_finish_scan(generation, now_secs()) {
+    let finished = if failed || walked >= localindex::MAX_ENTRIES {
+        db.local_finish_partial_scan(now_secs())
+    } else {
+        db.local_finish_scan(generation, now_secs())
+    };
+    match finished {
        Ok(indexed) => info!(
            walked,
            indexed,
@@ -911,10 +911,22 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
                ))),
                Ok((file, len)) => {
                    let photos = core.photos();
+                    // Unless the caller knows better: the photo's own EXIF,
+                    // then the file's modification time, which a copy resets.
+                    let capture_time = capture_time.or_else(|| {
+                        let path = Path::new(&source_path);
+                        pdfs_core::exiftime::capture_time_of(path).or_else(|| {
+                            let modified =
+                                std::fs::metadata(path).and_then(|m| m.modified()).ok()?;
+                            let since = modified.duration_since(std::time::UNIX_EPOCH).ok()?;
+                            Some(since.as_secs() as i64)
+                        })
+                    });
                    let metadata = proton_drive_rs::PhotoUploadMetadata {
                        capture_time,
                        ..Default::default()
                    };
+                    let thumbnails = core.upload_thumbnails(Path::new(&source_path), &name);
                    let guard =
                        core.transfers
                            .begin(name.clone(), "", TransferDirection::Upload, len);
@@ -924,7 +936,7 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
                        &media_type,
                        reader,
                        len as i64,
-                        Vec::new(),
+                        thumbnails,
                        metadata,
                        false,
                    )) {
@@ -105,6 +105,15 @@ pub(crate) fn adopted_device_uid() -> Option<String> {
    (!uid.is_empty()).then_some(uid)
 }

+/// The paths no sync root may overlap, with the mountpoint as the config says
+/// now.
+pub(crate) fn sync_root_reserved() -> pdfs_core::syncroot::Reserved {
+    let config = pdfs_core::config::AppDirs::new()
+        .map(|dirs| dirs.load_config())
+        .unwrap_or_default();
+    pdfs_core::syncroot::Reserved::current(&config)
+}
+
 /// Pin (or, with `None`, unpin) the adopted device uid in `config.json`.
 pub(crate) fn set_adopted_device_uid(uid: Option<&str>) -> CoreResult<()> {
    let dirs = pdfs_core::config::AppDirs::new()
@@ -517,18 +526,20 @@ impl Core {
            .map_err(|e| CoreError::internal(format!("canonicalize {}: {e}", local.display())))?;
        let local_str = local.to_string_lossy().to_string();

-        // Reject duplicates up front for a clear error (UNIQUE would also catch it).
-        if self
+        // `/`, the home folder, the mount, this app's own data, and a folder
+        // inside or around another root are refused (`syncroot::problem`). A
+        // duplicate is one of those, refused here for a clear error before
+        // the UNIQUE constraint would catch it.
+        let others = self
            .db
            .sync_folder_list()
            .map_err(|e| CoreError::internal(format!("db: {e:?}")))?
            .iter()
-            .any(|f| f.local_path == local_str)
-        {
-            return Err(CoreError::invalid(format!(
-                "{} is already synced",
-                local.display()
-            )));
+            .map(|f| PathBuf::from(&f.local_path))
+            .collect::<Vec<_>>();
+        let reserved = sync_root_reserved();
+        if let Some(problem) = pdfs_core::syncroot::problem(&local, &others, &reserved) {
+            return Err(CoreError::invalid(problem));
        }

        let name = local
@@ -389,13 +389,7 @@ impl Core {
                // A name a change of ours is about to free is a wait, not a
                // failure: the trash or rename holding it lands in moments.
                let held = waits_for_name(e.as_ref());
-                let backoff = if held {
-                    DRAIN_BACKOFF_MIN
-                } else {
-                    DRAIN_BACKOFF_MIN
-                        .saturating_mul(1u32 << attempts.min(6))
-                        .min(DRAIN_BACKOFF_MAX)
-                };
+                let backoff = drain_backoff(attempts, held, op.id);
                warn!(uid = %op.uid, attempts, error = %err_str, "pending upload failed; will retry");
                if let Err(e) = self.db.record_attempt_failure(
                    op.id,
@@ -1118,7 +1112,7 @@ impl Core {
            _ => None,
        };
        let sent = self.create_sent_digests(op.id, current);
-        Ok(adoptable(is_dir, &twin, op.created_at, &sent).then_some(twin.uid))
+        Ok(adoptable(is_dir, &twin, self.first_sent(op), &sent).then_some(twin.uid))
    }

    /// Record the name the remote actually gave a node, after a conflict forced
@@ -1513,8 +1507,10 @@ impl Core {
            .as_deref()
            .is_some_and(|sha| holds_bytes(&twin, sha));
        let sent = self.create_sent_digests(op.id, current);
-        Ok(adoptable(op.kind == OP_MKDIR, &twin, op.created_at, &sent)
-            .then_some((twin.uid, holds_blob)))
+        Ok(
+            adoptable(op.kind == OP_MKDIR, &twin, self.first_sent(op), &sent)
+                .then_some((twin.uid, holds_blob)),
+        )
    }

    /// The SHA-1s of the bytes queued create `id` may have made its file with:
@@ -1529,6 +1525,22 @@ impl Core {
        sent
    }

+    /// When create `op` first went out, which is the earliest a node its lost
+    /// answer left can have been made. An op queued offline may wait for days
+    /// before that; measured from when it was queued, the adoption window let
+    /// it take a node another device made in the meantime. Ops sent before the
+    /// time was recorded fall back to when they were queued.
+    fn first_sent(&self, op: &PendingOp) -> i64 {
+        match self.db.create_first_sent(op.id) {
+            Ok(Some(at)) => at.max(op.created_at),
+            Ok(None) => op.created_at,
+            Err(e) => {
+                warn!(id = op.id, error = %e, "reading when a queued create was sent failed");
+                op.created_at
+            }
+        }
+    }
+
    /// Make one queued `create`/`mkdir` real under a given name, and hand back
    /// the API's own error so the caller can tell a name clash from a failure.
    ///
@@ -1541,7 +1553,7 @@ impl Core {
        name: &str,
    ) -> Result<NodeUid, Box<dyn std::error::Error>> {
        self.db
-            .note_create_target(op.id, &parent.to_string(), name)?;
+            .note_create_target(op.id, &parent.to_string(), name, now_millis())?;
        match op.kind == OP_MKDIR {
            true => Ok(self.block_on_bounded(self.drive.create_folder(
                parent,
@@ -1586,7 +1598,7 @@ impl Core {
            .begin(name, op.uid.clone(), TransferDirection::Upload, meta.len);
        let reader = CountingReader::new(File::open(blob)?, &guard);
        let uid = self.block_on_within(
-            link::upload_deadline(meta.len),
+            link::upload_deadline(meta.len, self.transfers.upload_cap()),
            self.drive.upload_file_from(
                parent,
                name,
@@ -1983,7 +1995,7 @@ impl Core {
                .begin(&alt, meta.uid.clone(), TransferDirection::Upload, meta.len);
        let reader = CountingReader::new(File::open(blob)?, &guard);
        self.block_on_within(
-            link::upload_deadline(meta.len),
+            link::upload_deadline(meta.len, self.transfers.upload_cap()),
            self.drive.upload_file_from(
                &parent,
                &alt,
@@ -2236,7 +2248,7 @@ impl Core {
            .clone()
            .ok_or("pending op has no staged blob")?;
        let blob = PathBuf::from(blob);
-        let meta: StagedWrite = serde_json::from_str(op.meta_json.as_deref().unwrap_or(""))?;
+        let mut meta: StagedWrite = serde_json::from_str(op.meta_json.as_deref().unwrap_or(""))?;
        let uid = parse_node_uid(&meta.uid).ok_or("staged write has an unparseable uid")?;

        if let Some(reason) = self.revision_conflict(&uid, &meta, &blob)? {
@@ -2275,6 +2287,22 @@ impl Core {
                &written,
            )
            .map_err(|e| self.errno_error(e, "gap-fill from base failed"))?;
+            // The blob is whole now. Recorded, so that a retry after a lost
+            // answer can match these bytes against the server's revision
+            // (`revision_conflict`) instead of forking a conflict copy of the
+            // user's own write.
+            meta.complete = true;
+            match serde_json::to_string(&meta) {
+                Ok(json) => {
+                    let path = op.blob_path.as_deref().unwrap_or_default();
+                    if let Err(e) = self.db.update_op_meta_for_blob(op.id, path, &json) {
+                        warn!(%uid, error = %e,
+                              "recording a gap-filled blob as whole failed; \
+                               a lost answer may land it as a conflict copy");
+                    }
+                }
+                Err(e) => warn!(%uid, error = %e, "serializing a gap-filled sidecar failed"),
+            }
        }

        let name = self.node_name(&uid);
@@ -2295,7 +2323,7 @@ impl Core {
        let reader = CountingReader::new(File::open(&blob)?, &guard).with_cancel(cancel.flag());
        let started = Instant::now();
        let sent = self.block_on_within(
-            link::upload_deadline(meta.len),
+            link::upload_deadline(meta.len, self.transfers.upload_cap()),
            self.drive
                .upload_new_revision_from(&uid, reader, meta.len as i64, thumbnails, None),
        );
@@ -2753,24 +2781,43 @@ fn waits_for_name(e: &(dyn std::error::Error + 'static)) -> bool {
    std::iter::successors(Some(e), |e| e.source()).any(|e| e.is::<NameHeld>())
 }

+/// How long an op waits after its `attempts`-th failure: doubling from
+/// [`DRAIN_BACKOFF_MIN`] up to [`DRAIN_BACKOFF_MAX`], plus up to a fifth more,
+/// different for each op (`seed`), so that ops that failed together are not
+/// all retried in the same second. One that waits for a name (`held`) waits
+/// the minimum.
+///
+/// The doubling stopped at 2^6, 128 s, so the maximum was never reached.
+fn drain_backoff(attempts: i64, held: bool, seed: i64) -> Duration {
+    if held {
+        return DRAIN_BACKOFF_MIN;
+    }
+    let base = DRAIN_BACKOFF_MIN
+        .saturating_mul(1u32 << attempts.clamp(0, 8))
+        .min(DRAIN_BACKOFF_MAX);
+    // A cheap, stable spread: the same op and attempt always wait the same.
+    let spread = (seed.wrapping_mul(0x9E37_79B9).wrapping_add(attempts) as u64 % 21) as u32;
+    base + base * spread / 100
+}
+
 /// How many attempts an op waits for a rename or a create on the wire to free
 /// the name it wants. Two files swapping names each wait for the other, so the
 /// wait has to end; a conflict name ends it.
 const NAME_HOLD_ATTEMPTS: i64 = 4;

-/// How much older than its op a remote node may be and still be the one an
-/// unanswered call made. The op is queued the moment the call gives up, so the
-/// node is at most one call's deadline older; the rest is clock skew between
-/// this machine and Proton.
+/// How much older than its op's first send a remote node may be and still be
+/// the one an unanswered call made. The node is made during that call, so it
+/// is at most one call's deadline older; the rest is clock skew between this
+/// machine and Proton.
 const ADOPT_WINDOW_MS: i64 = 2 * 60 * 1000;

 /// Whether `twin`, found holding the name a queued create wants, is the node an
-/// earlier, unanswered attempt at that create made: the same kind, created
-/// around when the op was queued, and for a file still empty, as the mount's
+/// earlier, unanswered attempt at that create made: the same kind, created no
+/// earlier than around when the op was first sent (`first_sent_ms`), and for a file still empty, as the mount's
 /// create leaves it, or holding exactly bytes the op uploaded, whose SHA-1 is
 /// one of `sent`.
-fn adoptable(is_dir: bool, twin: &Node, op_created_ms: i64, sent: &[String]) -> bool {
-    if twin.creation_time.saturating_mul(1000) < op_created_ms - ADOPT_WINDOW_MS {
+fn adoptable(is_dir: bool, twin: &Node, first_sent_ms: i64, sent: &[String]) -> bool {
+    if twin.creation_time.saturating_mul(1000) < first_sent_ms - ADOPT_WINDOW_MS {
        return false;
    }
    match &twin.kind {
@@ -3352,6 +3399,22 @@ mod tests {
        }
    }

+    #[test]
+    fn a_failing_op_backs_off_to_the_maximum_with_a_spread() {
+        let at = |attempts| drain_backoff(attempts, false, 7);
+        assert!(at(1) >= DRAIN_BACKOFF_MIN * 2);
+        assert!(at(2) > at(1));
+        // Reached, which the doubling capped at 2^6 never did.
+        assert!(at(8) >= DRAIN_BACKOFF_MAX);
+        assert!(at(30) <= DRAIN_BACKOFF_MAX + DRAIN_BACKOFF_MAX / 5);
+        // Ops that failed together do not all come back together.
+        let waits: std::collections::HashSet<_> =
+            (1..=20).map(|id| drain_backoff(8, false, id)).collect();
+        assert!(waits.len() > 5, "{waits:?}");
+        // A wait for a name stays short however often it repeats.
+        assert_eq!(drain_backoff(30, true, 7), DRAIN_BACKOFF_MIN);
+    }
+
    #[test]
    fn only_a_fresh_empty_twin_of_the_same_kind_is_adopted() {
        // The op was queued at t=1000 s, after a create that got no answer.
@@ -261,10 +261,13 @@ impl Filesystem for ProtonFs {
        // in-flight (possibly unsaved) content: authored bytes come from the
        // scratch file, untouched bytes from the base.
        //
-        // This path stays on the dispatch loop. `write` runs there too, so
-        // keeping its reads there as well preserves the ordering the write path
-        // has always had between a write and a read of the same handle; a mostly
-        // local read is not worth reasoning about that for.
+        // Answered on the dispatch loop when everything it needs is on this
+        // machine, which keeps the order `write` has with reads of the same
+        // handle. A base range that has to be downloaded goes to a worker
+        // instead, with the handle as it was when the read came in: the kernel
+        // issued the read before any write that comes after it, so that is
+        // the content it asked for. On the loop, the download held every
+        // request of the mount (`docs/BUGS.md` B227).
        let handle = {
            let st = self.core.state();
            st.active_writes.get(&ino.0).map(|h| {
@@ -279,7 +282,7 @@ impl Filesystem for ProtonFs {
            })
        };
        if let Some((file, len, uid, base_mtime, base_size, written)) = handle {
-            match self.core.serve_open_read(
+            match self.core.serve_open_read_local(
                &file,
                len,
                &uid,
@@ -289,7 +292,25 @@ impl Filesystem for ProtonFs {
                offset,
                size as u64,
            ) {
-                Ok(bytes) => reply.data(&bytes),
+                Ok(Some(bytes)) => reply.data(&bytes),
+                Ok(None) => {
+                    let fs = self.clone();
+                    self.core.workers.run(Lane::Transfer, "read", move || {
+                        match fs.core.serve_open_read(
+                            &file,
+                            len,
+                            &uid,
+                            base_mtime,
+                            base_size,
+                            &written,
+                            offset,
+                            size as u64,
+                        ) {
+                            Ok(bytes) => reply.data(&bytes),
+                            Err(e) => reply.error(e),
+                        }
+                    });
+                }
                Err(e) => reply.error(e),
            }
            return;
@@ -556,48 +577,62 @@ impl Filesystem for ProtonFs {
            return;
        }
        let new_end = offset.saturating_add(length);
-        let keep_size = (mode & 1) != 0; // FALLOC_FL_KEEP_SIZE
-
-        let is_punch_hole = (mode & 0x02) != 0; // FALLOC_FL_PUNCH_HOLE
-
-        let res = {
+        // Only the modes whose effect on the scratch file this handle can
+        // record. Anything else went through to the scratch file untracked:
+        // a zeroed range was refilled from the base at commit, and a collapse
+        // or insert shifted bytes that `len` and `written` did not follow
+        // (`docs/BUGS.md` B224). `EOPNOTSUPP` is also what makes glibc's
+        // `posix_fallocate` fall back to writing zeros.
+        let Some(kind) = falloc_kind(mode) else {
+            reply.error(Errno::EOPNOTSUPP);
+            return;
+        };
+        let file = {
+            let st = self.core.state();
+            match st.handles.get(&_fh.0).and_then(|i| st.active_writes.get(i)) {
+                Some(aw) => aw.file.clone(),
+                None => {
+                    reply.error(if st.entries.contains_key(&ino.0) {
+                        Errno::EBADF
+                    } else {
+                        Errno::ENOENT
+                    });
+                    return;
+                }
+            }
+        };
+        // The syscall can take a while on a large range; the state lock is
+        // not held across it, as `write` does not hold it across its I/O.
+        let ret = {
+            use std::os::unix::io::AsRawFd;
+            unsafe { libc::fallocate(file.as_raw_fd(), mode, offset as i64, length as i64) }
+        };
+        let res = if ret != 0 {
+            Err(Errno::from(std::io::Error::last_os_error()))
+        } else {
            let mut st = self.core.state();
-            match st
+            if let Some(aw) = st
                .handles
                .get(&_fh.0)
                .copied()
                .and_then(|i| st.active_writes.get_mut(&i))
            {
-                Some(aw) => {
-                    use std::os::unix::io::AsRawFd;
-                    let fd = aw.file.as_raw_fd();
-                    let ret = unsafe { libc::fallocate(fd, mode, offset as i64, length as i64) };
-                    if ret == 0 {
-                        if is_punch_hole {
-                            // A punched range reads as zero. Mark it authored so
-                            // queue_revision does not refill it from the remote
-                            // baseline and silently undo the hole at commit.
-                            aw.written.add(offset, new_end.min(aw.len));
-                            aw.dirty = true;
-                        } else if !keep_size && new_end > aw.len {
-                            aw.written.add(aw.len, new_end);
-                            aw.len = new_end;
-                            aw.dirty = true;
-                            st.set_size(ino.0, new_end);
-                        }
-                        Ok(())
-                    } else {
-                        Err(Errno::EIO)
-                    }
+                let len = aw.len;
+                let (authored, grown) = kind.effect(offset, new_end, len);
+                if let Some((from, to)) = authored {
+                    // Zeroed or punched bytes read as zero. Marked authored so
+                    // queue_revision does not refill them from the remote
+                    // baseline and silently undo them at commit.
+                    aw.written.add(from, to);
+                    aw.dirty = true;
                }
-                None => {
-                    if st.entries.contains_key(&ino.0) {
-                        Err(Errno::EBADF)
-                    } else {
-                        Err(Errno::ENOENT)
-                    }
+                if let Some(end) = grown {
+                    aw.len = end;
+                    aw.dirty = true;
+                    st.set_size(ino.0, end);
                }
            }
+            Ok(())
        };

        match res {
@@ -606,18 +641,47 @@ impl Filesystem for ProtonFs {
        }
    }

-    /// `close(2)` calls flush before release. The upload is queued in `release`
-    /// and performed in the background, so there is nothing
-    /// to push here — the written bytes are already in the scratch file.
+    /// `close(2)` calls flush before release, and flush is the only one of the
+    /// two whose answer reaches the program: the kernel drops `release`'s. So
+    /// the scratch file of a handle with writes on it is synced here, on a
+    /// worker, and a full disk or a failing one is what `close` returns.
+    ///
+    /// Before, flush answered `ok` at once and `release` synced the file, so an
+    /// `ENOSPC` that delayed allocation held back until then was reported to
+    /// nobody, and the program took the save as done (`docs/BUGS.md` B222).
+    /// It also means `release`, which stays on the dispatch loop for ordering,
+    /// finds the pages already on disk instead of writing back a whole file
+    /// while every other request on the mount waits.
    fn flush(
        &self,
        _req: &Request,
        _ino: INodeNo,
-        _fh: FileHandle,
+        fh: FileHandle,
        _lock_owner: LockOwner,
        reply: ReplyEmpty,
    ) {
-        reply.ok();
+        let file = {
+            let st = self.core.state();
+            st.handles
+                .get(&fh.0)
+                .and_then(|ino| st.active_writes.get(ino))
+                .filter(|aw| aw.dirty)
+                .map(|aw| aw.file.clone())
+        };
+        let Some(file) = file else {
+            reply.ok();
+            return;
+        };
+        let fs = self.clone();
+        self.core
+            .workers
+            .run(Lane::Transfer, "flush", move || match file.sync_data() {
+                Ok(()) => reply.ok(),
+                Err(e) => {
+                    error!(fh = fh.0, error = %e, "flush of scratch file failed");
+                    reply.error(fs.scratch_sync_errno(&e));
+                }
+            });
    }

    /// Durability here means the scratch file, not the remote: a caller asking
@@ -1022,6 +1086,52 @@ fn build_listing(st: &State, ino: u64) -> DirListing {
 /// The cookie handed back is the index of the *next* entry, so a resumed call
 /// continues exactly where the last one stopped — which is only true because
 /// the listing behind those indexes is a snapshot (`docs/BUGS.md` B43).
+/// What an `fallocate` mode does to a write handle, for the modes it can
+/// record (`docs/BUGS.md` B224).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum FallocKind {
+    /// Reserve space; past the end it grows the file unless `keep_size`.
+    Allocate { keep_size: bool },
+    /// Deallocate a range inside the file, which then reads as zero.
+    Punch,
+    /// Zero a range; past the end it grows the file unless `keep_size`.
+    Zero { keep_size: bool },
+}
+
+fn falloc_kind(mode: i32) -> Option<FallocKind> {
+    const KEEP: i32 = libc::FALLOC_FL_KEEP_SIZE;
+    const PUNCH: i32 = libc::FALLOC_FL_PUNCH_HOLE;
+    const ZERO: i32 = libc::FALLOC_FL_ZERO_RANGE;
+    match mode {
+        0 => Some(FallocKind::Allocate { keep_size: false }),
+        KEEP => Some(FallocKind::Allocate { keep_size: true }),
+        m if m == PUNCH | KEEP => Some(FallocKind::Punch),
+        ZERO => Some(FallocKind::Zero { keep_size: false }),
+        m if m == ZERO | KEEP => Some(FallocKind::Zero { keep_size: true }),
+        _ => None,
+    }
+}
+
+impl FallocKind {
+    /// For `[offset, end)` on a file `len` bytes long: the range that now
+    /// reads as zero and must count as written, and the new length if it grew.
+    fn effect(self, offset: u64, end: u64, len: u64) -> (Option<(u64, u64)>, Option<u64>) {
+        let grow = |keep_size: bool| (!keep_size && end > len).then_some(end);
+        let zeroed = |to: u64| (offset < to).then_some((offset, to));
+        match self {
+            // Space past the old end reads as zero, and nothing before it moved.
+            Self::Allocate { keep_size } => {
+                (grow(keep_size).map(|end| (len, end)), grow(keep_size))
+            }
+            Self::Punch => (zeroed(end.min(len)), None),
+            Self::Zero { keep_size } => {
+                let to = if keep_size { end.min(len) } else { end };
+                (zeroed(to), grow(keep_size))
+            }
+        }
+    }
+}
+
 fn reply_listing(listing: &DirListing, offset: u64, root: u64, mut reply: ReplyDirectory) {
    for (i, (ino, is_dir, name)) in listing.iter().enumerate().skip(offset as usize) {
        let ft = if *is_dir {
@@ -1435,6 +1545,20 @@ impl ProtonFs {
    }

    /// The body of [`Filesystem::fsync`], run off the dispatch loop.
+    /// The errno to give a program for a failed sync of a scratch file.
+    /// Delayed allocation means a full disk usually surfaces at the sync
+    /// rather than at `write(2)`, and `ENOSPC` is what a program checks for.
+    fn scratch_sync_errno(&self, e: &std::io::Error) -> Errno {
+        match e.raw_os_error() {
+            Some(libc::ENOSPC) => {
+                self.core.cache.emergency_evict();
+                Errno::ENOSPC
+            }
+            Some(libc::EDQUOT) => Errno::EDQUOT,
+            _ => Errno::EIO,
+        }
+    }
+
    fn serve_fsync(&self, fh: FileHandle, reply: ReplyEmpty) {
        // Everything the durability sidecar needs, copied out so no lock is held
        // across the sync.
@@ -1455,22 +1579,18 @@ impl ProtonFs {
                )
            })
        };
+        // A handle opened for reading has nothing of its own to make durable,
+        // and POSIX allows `fsync` on it; `EBADF` failed `sync FILE` and
+        // backup tools that sync what they read (`docs/BUGS.md` B222).
        let Some((f, path, uid, dirty, written, len, base_size, base_mtime, base_revision_id)) =
            handle
        else {
-            reply.error(Errno::EBADF);
+            reply.ok();
            return;
        };
        if let Err(e) = f.sync_all() {
            error!(fh = fh.0, error = %e, "fsync of scratch file failed");
-            // Delayed allocation means a full disk usually surfaces here rather
-            // than at `write(2)`; `ENOSPC` is what an application checks for.
-            if e.raw_os_error() == Some(libc::ENOSPC) {
-                self.core.cache.emergency_evict();
-                reply.error(Errno::ENOSPC);
-            } else {
-                reply.error(Errno::EIO);
-            }
+            reply.error(self.scratch_sync_errno(&e));
            return;
        }
        // A clean handle has nothing on it that the remote does not already
@@ -1717,9 +1837,7 @@ impl ProtonFs {
        // empty, which it is, so reads stay offline-clean across a restart too.
        if local {
            st.children.insert(ino, Vec::new());
-            if let Err(e) = self.core.db.set_listed(&uid, true) {
-                warn!(%uid, error = %e, "db set_listed(true) failed for local folder");
-            }
+            st.record_listed(uid);
        }
        let entry = st.entries.get(&ino).unwrap();
        let attr = self.attr(ino, &entry.node, entry.access);
@@ -2337,3 +2455,60 @@ impl ProtonFs {
        }
    }
 }
+
+#[cfg(test)]
+mod falloc_tests {
+    use super::*;
+
+    #[test]
+    fn only_the_modes_a_handle_can_record_are_accepted() {
+        let keep = libc::FALLOC_FL_KEEP_SIZE;
+        assert_eq!(
+            falloc_kind(0),
+            Some(FallocKind::Allocate { keep_size: false })
+        );
+        assert_eq!(
+            falloc_kind(keep),
+            Some(FallocKind::Allocate { keep_size: true })
+        );
+        assert_eq!(
+            falloc_kind(libc::FALLOC_FL_PUNCH_HOLE | keep),
+            Some(FallocKind::Punch)
+        );
+        assert_eq!(
+            falloc_kind(libc::FALLOC_FL_ZERO_RANGE),
+            Some(FallocKind::Zero { keep_size: false })
+        );
+        for mode in [
+            libc::FALLOC_FL_PUNCH_HOLE,
+            libc::FALLOC_FL_COLLAPSE_RANGE,
+            libc::FALLOC_FL_INSERT_RANGE,
+            libc::FALLOC_FL_UNSHARE_RANGE,
+        ] {
+            assert_eq!(falloc_kind(mode), None, "{mode:#x}");
+        }
+    }
+
+    /// A zeroed range was left unwritten, so the commit filled it back in
+    /// from the remote base (`docs/BUGS.md` B224).
+    #[test]
+    fn a_zeroed_or_punched_range_counts_as_written() {
+        let zero = FallocKind::Zero { keep_size: false };
+        assert_eq!(zero.effect(10, 20, 100), (Some((10, 20)), None));
+        assert_eq!(zero.effect(90, 120, 100), (Some((90, 120)), Some(120)));
+        let zero_keep = FallocKind::Zero { keep_size: true };
+        assert_eq!(zero_keep.effect(90, 120, 100), (Some((90, 100)), None));
+        assert_eq!(
+            FallocKind::Punch.effect(90, 120, 100),
+            (Some((90, 100)), None)
+        );
+        assert_eq!(FallocKind::Punch.effect(120, 130, 100), (None, None));
+        let alloc = FallocKind::Allocate { keep_size: false };
+        assert_eq!(alloc.effect(0, 50, 100), (None, None));
+        assert_eq!(alloc.effect(90, 120, 100), (Some((100, 120)), Some(120)));
+        assert_eq!(
+            FallocKind::Allocate { keep_size: true }.effect(90, 120, 100),
+            (None, None)
+        );
+    }
+}
@@ -116,6 +116,7 @@ mod upload;
 mod r#virtual;
 mod workers;
 use background::{forget_and_notify, run_event_sync, run_local_index, run_photos_event_sync};
+use link::BATCH_CALL_TIMEOUT;
 pub(crate) use mount::is_stale_mount;
 pub use mount::{MountOptions, MountOutcome, mount};
 use mount::{
@@ -2120,12 +2121,39 @@ impl Core {
        }
    }

-    /// Whether `ino`'s listing is already in memory, i.e. whether
-    /// [`Core::ensure_children`] would return without touching the network.
-    /// Lets a handler decide between answering inline and handing off to a
-    /// worker, at the cost of one uncontended map lookup.
+    /// Whether [`Core::ensure_children`] would answer for `ino` without
+    /// touching the network. Lets a handler decide between answering inline
+    /// and handing off to a worker.
+    ///
+    /// A resident listing is not enough on its own. A shared folder's, or the
+    /// Shared with me root's, is fetched again once it is a minute old, and
+    /// that fetch ran on the dispatch loop, so every request on the mount
+    /// waited for Drive to answer (`docs/BUGS.md` B219).
    fn children_cached(&self, ino: u64) -> bool {
-        self.state().children.contains_key(&ino)
+        let (uid, resident) = {
+            let st = self.state();
+            match st.entries.get(&ino) {
+                Some(e) => (e.uid.clone(), st.children.contains_key(&ino)),
+                // `list_children` answers ENOENT without the network.
+                None => return true,
+            }
+        };
+        if !resident {
+            return false;
+        }
+        let freshness = if is_virtual_uid(&uid) {
+            Some(SHARED_WITH_ME_SYNCED_MS.to_string())
+        } else if !self.is_own_or_virtual(&uid) && !is_local_uid(&uid) {
+            Some(Self::shared_folder_freshness_key(&uid))
+        } else {
+            None
+        };
+        freshness.is_none_or(|key| {
+            !listing_needs_refresh(
+                self.online.load(Ordering::Relaxed),
+                self.shared_listing_stale(&key),
+            )
+        })
    }

    /// Re-apply the optimistic size of any queued write to `nodes`.
@@ -2293,8 +2321,7 @@ impl Core {

        let generation = self.shared_generation.load(Ordering::SeqCst);
        let accepted = accepted_share_provenance(
-            self.rt
-                .block_on(self.client.enumerate_shared_with_me())
+            self.block_on_within(BATCH_CALL_TIMEOUT, self.client.enumerate_shared_with_me())
                .map_err(|error| {
                    error!(%error, "enumerating shared roots failed");
                    Errno::EIO
@@ -2303,12 +2330,14 @@ impl Core {
        let nodes = if accepted.uids.is_empty() {
            Vec::new()
        } else {
-            self.rt
-                .block_on(self.drive.enumerate_nodes_light(&accepted.uids))
-                .map_err(|error| {
-                    error!(%error, "materializing shared roots failed");
-                    Errno::EIO
-                })?
+            self.block_on_within(
+                BATCH_CALL_TIMEOUT,
+                self.drive.enumerate_nodes_light(&accepted.uids),
+            )
+            .map_err(|error| {
+                error!(%error, "materializing shared roots failed");
+                Errno::EIO
+            })?
        };
        let virtual_uid = shared_with_me_uid();
        let published = prepare_shared_roots(&accepted, nodes, &virtual_uid);
@@ -2687,6 +2716,7 @@ impl Core {
            return Ok(());
        }

+        let preassigned = state::inos_for(&self.db, &filtered_nodes);
        let mut st = self.state();
        // Lost the race? Another thread already populated it.
        if st.children.contains_key(&ino) {
@@ -2708,15 +2738,14 @@ impl Core {
            })
            .map(|n| n.uid.clone())
            .collect();
-        let inos = st.intern_batch(ino, filtered_nodes);
+        let inos = st.intern_batch_with_inos(ino, filtered_nodes, preassigned);
        child_inos.extend(inos);
        st.children.insert(ino, child_inos);
        let root_snapshot = primary_root.then(|| RootListingSnapshot::capture(&st, ino).unwrap());
        // Record the listing as complete so a later restart (or a trimmed hot
-        // cache) can rebuild it from the DB without the API.
-        if let Err(e) = self.db.set_listed(&folder_uid, true) {
-            warn!(%folder_uid, error = %e, "db set_listed(true) failed");
-        }
+        // cache) can rebuild it from the DB without the API. Written with the
+        // children's rows when the lock goes, not under it.
+        st.record_listed(folder_uid.clone());
        drop(st);
        self.flush_access_changes();
        if let Some(snapshot) = root_snapshot {
@@ -2879,7 +2908,8 @@ impl Core {
        let (mut key, mut uids, mut slot) = (key, uids, slot);
        loop {
            for chunk in uids.chunks(SIZE_UPGRADE_CHUNK) {
-                let result = self.rt.block_on(self.drive.enumerate_nodes(chunk));
+                let result =
+                    self.block_on_within(BATCH_CALL_TIMEOUT, self.drive.enumerate_nodes(chunk));
                self.apply_size_upgrade(key, result);
                slot.chunk_done();
            }
@@ -4378,9 +4408,15 @@ impl Core {
        if self.thumbnail_misses.lock().remote_contains(&key, mtime) {
            return Ok(None);
        }
+        // A file manager asks for one per file in a folder, on the metadata
+        // workers. Offline, or on a stalled link, each one held a worker for
+        // the SDK's whole retry budget, and every cold lookup, create and
+        // rename on the mount queued behind them (`docs/BUGS.md` B220).
+        if !self.is_online() {
+            return Ok(None);
+        }
        let bytes = self
-            .rt
-            .block_on(self.client.download_thumbnail(&uid, ttype))
+            .block_on_bounded(self.client.download_thumbnail(&uid, ttype))
            .map_err(|e| {
                warn!(%uid, error = %e, "download thumbnail failed");
                Errno::EIO
@@ -6129,11 +6165,61 @@ fn is_gone(e: &(dyn std::error::Error + 'static)) -> bool {
 /// (`sync.rs`, `conflict_path`), so the two halves of the product name the same
 /// situation the same way and a user only has to learn it once.
 fn conflict_name(name: &str, stamp: i64) -> String {
+    conflict_name_as(name, conflict_label(), stamp)
+}
+
+/// [`conflict_name`] with the machine's label given.
+fn conflict_name_as(name: &str, label: &str, stamp: i64) -> String {
    let path = Path::new(name);
    let stem = path.file_stem().and_then(|s| s.to_str()).unwrap_or(name);
+    let tag = conflict_tag(label, stamp, 0);
    match path.extension().and_then(|s| s.to_str()) {
-        Some(ext) => format!("{stem} (sync-conflict {stamp}).{ext}"),
-        None => format!("{stem} (sync-conflict {stamp})"),
+        Some(ext) => format!("{stem} (sync-conflict {tag}).{ext}"),
+        None => format!("{stem} (sync-conflict {tag})"),
+    }
+}
+
+/// This machine's name as its conflict copies carry it (`docs/BUGS.md` B251).
+///
+/// Two computers syncing one folder that each keep a copy of the same file in
+/// the same second would otherwise make the same name on Drive, and nobody
+/// could tell which computer a copy came from. Read once, from the hostname.
+fn conflict_label() -> &'static str {
+    static LABEL: OnceLock<String> = OnceLock::new();
+    LABEL.get_or_init(|| conflict_label_of(&this_hostname()))
+}
+
+/// `host` as one token: anything but ASCII letters, digits, `-`, `_` and `.`
+/// becomes `-`, so the label holds no space for `conflict_base_name` to trip
+/// on and no `/` or `)` to break the name.
+fn conflict_label_of(host: &str) -> String {
+    let label: String = host
+        .chars()
+        .take(32)
+        .map(|c| {
+            if c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '.') {
+                c
+            } else {
+                '-'
+            }
+        })
+        .collect();
+    label.trim_matches('-').to_string()
+}
+
+/// The inside of a conflict copy's marker: `<label> <stamp>`, with `-<n>`
+/// when an earlier copy already holds that name. Without a label it is the
+/// bare stamp that copies had before B251.
+fn conflict_tag(label: &str, stamp: i64, suffix: u32) -> String {
+    let suffix = if suffix == 0 {
+        String::new()
+    } else {
+        format!("-{suffix}")
+    };
+    if label.is_empty() {
+        format!("{stamp}{suffix}")
+    } else {
+        format!("{label} {stamp}{suffix}")
    }
 }

@@ -6743,7 +6829,27 @@ fn fuse_name(name: &OsStr) -> Result<String, Errno> {
    name.to_str().map(str::to_owned).ok_or(Errno::EILSEQ)
 }

+/// Whether a decrypted remote name can stand as one local path component.
+///
+/// Drive checks names only when a client creates or renames a node, and only
+/// for length, so a name made by another client, or by a server that should
+/// not be trusted, can hold anything. Joined onto a local path, a `/` or a `..`
+/// in it walks out of the folder it belongs to, and the mirror engine would
+/// then write or delete outside the sync root. In the mount, the kernel fails
+/// the whole listing with EIO on a single such name (`docs/BUGS.md` B215).
+pub(crate) fn remote_name_is_safe(name: &str) -> bool {
+    !name.is_empty()
+        && name != "."
+        && name != ".."
+        && name.len() <= 255
+        && !name.contains(['/', '\0'])
+}
+
 fn node_visible(node: &Node, folder_uid: &NodeUid, hidden: &HashSet<NodeUid>) -> bool {
+    if !remote_name_is_safe(&node.name) {
+        warn!(uid = %node.uid, "a remote name cannot be a local file name; leaving it out");
+        return false;
+    }
    !node.trashed && node.uid != *folder_uid && !hidden.contains(&node.uid)
 }

@@ -7492,14 +7598,15 @@ mod tests {
    use super::{
        Access, AccessFlags, Errno, HashMap, Intervals, PendingRevision, RootListingSnapshot,
        SELF_CHANGE_TTL_MS, ShareId, SharedWithMeItem, StateRegistry, VirtualRootPlan,
-        accepted_share_provenance, conflict_name, copy_pending_for_truncate, expand_restore,
-        first_seen_in_trash, fuse_name, is_stale_mount, node_visible, note_self_change,
-        off_the_runtime, orphan_past_retention, parse_node_uid, prepare_shared_roots,
-        preserve_on_access_denied, publish_virtual_root_in_listing,
-        reconcile_virtual_root_in_listing, release_can_discard_unlinked,
-        release_must_retain_queued_trash, release_unlinked_entry, rename_needs_queue,
-        require_node_parent_access, require_rename_access, resolve_anywhere_with,
-        shared_with_me_uid, take_self_change, uid_write_authority, virtual_node,
+        accepted_share_provenance, conflict_label, conflict_label_of, conflict_name,
+        conflict_name_as, copy_pending_for_truncate, expand_restore, first_seen_in_trash,
+        fuse_name, is_stale_mount, node_visible, note_self_change, off_the_runtime,
+        orphan_past_retention, parse_node_uid, prepare_shared_roots, preserve_on_access_denied,
+        publish_virtual_root_in_listing, reconcile_virtual_root_in_listing,
+        release_can_discard_unlinked, release_must_retain_queued_trash, release_unlinked_entry,
+        rename_needs_queue, require_node_parent_access, require_rename_access,
+        resolve_anywhere_with, shared_with_me_uid, take_self_change, uid_write_authority,
+        virtual_node,
    };
    use super::{Db, WriteAuthority};
    use std::time::Duration;
@@ -8454,15 +8561,38 @@ mod tests {
    #[test]
    fn conflict_name_keeps_the_extension() {
        assert_eq!(
-            conflict_name("notes.txt", 1700),
-            "notes (sync-conflict 1700).txt"
+            conflict_name_as("notes.txt", "laptop", 1700),
+            "notes (sync-conflict laptop 1700).txt"
        );
-        assert_eq!(conflict_name("README", 42), "README (sync-conflict 42)");
        assert_eq!(
-            conflict_name("archive.tar.gz", 7),
-            "archive.tar (sync-conflict 7).gz",
+            conflict_name_as("README", "laptop", 42),
+            "README (sync-conflict laptop 42)"
+        );
+        assert_eq!(
+            conflict_name_as("archive.tar.gz", "laptop", 7),
+            "archive.tar (sync-conflict laptop 7).gz",
            "only the last extension is one, as everywhere else"
        );
+        assert_eq!(
+            conflict_name_as("notes.txt", "", 1700),
+            "notes (sync-conflict 1700).txt"
+        );
+        assert_eq!(
+            conflict_name("notes.txt", 1700),
+            conflict_name_as("notes.txt", conflict_label(), 1700)
+        );
+    }
+
+    /// A hostname goes into a file name, so it is cut down to one safe token
+    /// (B251).
+    #[test]
+    fn a_hostname_becomes_one_safe_token() {
+        assert_eq!(conflict_label_of("laptop"), "laptop");
+        assert_eq!(conflict_label_of("my-pc.local"), "my-pc.local");
+        assert_eq!(conflict_label_of("Linux device"), "Linux-device");
+        assert_eq!(conflict_label_of("a/b) c"), "a-b--c");
+        assert_eq!(conflict_label_of("  "), "");
+        assert_eq!(conflict_label_of(&"x".repeat(40)).len(), 32);
    }

    #[test]
@@ -8654,6 +8784,28 @@ mod tests {
        ));
    }

+    #[test]
+    fn a_remote_name_that_is_not_one_path_component_is_left_out() {
+        let folder_uid = NodeUid::new(VolumeId::from("vol"), LinkId::from("folder"));
+        let none = std::collections::HashSet::new();
+        for name in [
+            "a/b",
+            "../../.bashrc",
+            "..",
+            ".",
+            "",
+            "a\0b",
+            &"x".repeat(256),
+        ] {
+            let node = node_helper("child", "folder", name, false);
+            assert!(!node_visible(&node, &folder_uid, &none), "{name:?}");
+        }
+        for name in [".hidden", "a..b", "unicodé-文件", &"x".repeat(255)] {
+            let node = node_helper("child", "folder", name, false);
+            assert!(node_visible(&node, &folder_uid, &none), "{name:?}");
+        }
+    }
+
    #[test]
    fn denied_queue_guard_preserves_accepted_bytes_and_pending_count() {
        use std::cell::Cell;
@@ -9159,6 +9311,32 @@ mod tests {
        assert!(online.contains("self.relist_offline_listings();"));
    }

+    #[test]
+    fn a_stale_shared_listing_is_fetched_off_the_dispatch_loop() {
+        // A resident listing that `list_children` would fetch again anyway
+        // must not be answered inline (B219).
+        let cached = function_source(include_str!("lib.rs"), "fn children_cached(");
+        assert!(cached.contains("SHARED_WITH_ME_SYNCED_MS"));
+        assert!(cached.contains("Self::shared_folder_freshness_key(&uid)"));
+        assert!(cached.contains("listing_needs_refresh("));
+        assert!(cached.contains("self.shared_listing_stale(&key)"));
+    }
+
+    #[test]
+    fn a_handler_does_not_wait_out_the_sdk_retry_budget() {
+        // Thumbnails, size upgrades and the share list held mount threads for
+        // minutes on a stalled link (B220).
+        let lib = include_str!("lib.rs");
+        let thumbnail = function_source(lib, "fn thumbnail(");
+        assert_before(thumbnail, "if !self.is_online()", "download_thumbnail");
+        assert!(thumbnail.contains(".block_on_bounded(self.client.download_thumbnail("));
+        let upgrade = function_source(lib, "fn run_size_upgrade(");
+        assert!(upgrade.contains("block_on_within(BATCH_CALL_TIMEOUT"));
+        let shared = function_source(lib, "fn ensure_shared_children(");
+        assert!(shared.contains("block_on_within(BATCH_CALL_TIMEOUT"));
+        assert!(!shared.contains("self.rt"));
+    }
+
    #[test]
    fn a_remote_read_gives_up_at_its_deadline() {
        // The SDK bounds requests, not reads; a stalled link held one `read`
@@ -29,6 +29,13 @@ use crate::{Core, ONLINE_PROBE_MAX, ONLINE_PROBE_MIN};
 /// keep waiting for; queueing the change is the better answer.
 pub(crate) const INTERACTIVE_CALL_TIMEOUT: Duration = Duration::from_secs(20);

+/// How long a mount thread waits on a remote read that answers a batch: a
+/// chunk of file sizes, or the list of shares. Longer than an interactive call,
+/// since its answer grows with the batch, but well short of the SDK's own retry
+/// budget, which held a worker for minutes on a stalled link
+/// (`docs/BUGS.md` B220).
+pub(crate) const BATCH_CALL_TIMEOUT: Duration = Duration::from_secs(60);
+
 /// How long one probe may wait for an answer. A probe is a single small request,
 /// and a probe stuck in the SDK's retry budget would delay noticing the link is
 /// back by as long as it waits.
@@ -112,10 +119,25 @@ pub(crate) fn no_answer(after: Duration) -> ProtonError {
 /// transfer that has stopped moving runs into it.
 const SLOWEST_UPLOAD: u64 = 32 * 1024;

+/// How many uploads can share the upload cap at once: one per drain worker
+/// and one per mirror sync task.
+const UPLOAD_SLOTS: u64 = (crate::DRAIN_WORKERS + crate::sync::SYNC_CONCURRENCY) as u64;
+
 /// How long an upload of `len` bytes may take before the link is treated as
 /// down: the budget of a metadata call, plus the bytes at [`SLOWEST_UPLOAD`].
-pub(crate) fn upload_deadline(len: u64) -> Duration {
-    INTERACTIVE_CALL_TIMEOUT + Duration::from_secs(len / SLOWEST_UPLOAD)
+///
+/// An upload cap of `cap` bytes per second (`0` for none) is shared by every
+/// upload running, so each may get as little as its share of it. Below
+/// [`SLOWEST_UPLOAD`] a share counts as the slowest rate instead: measured
+/// against the fixed rate, a large file under a low cap ran out of time on
+/// every attempt, took the mount offline each time, and started over from
+/// its first byte.
+pub(crate) fn upload_deadline(len: u64, cap: u64) -> Duration {
+    let slowest = match cap {
+        0 => SLOWEST_UPLOAD,
+        cap => SLOWEST_UPLOAD.min((cap / UPLOAD_SLOTS).max(1)),
+    };
+    INTERACTIVE_CALL_TIMEOUT + Duration::from_secs(len / slowest)
 }

 /// Run a remote call, giving up after [`INTERACTIVE_CALL_TIMEOUT`].
@@ -258,8 +280,9 @@ impl Core {
        self.relist_offline_listings();
        // Anything written while offline is queued and waiting on exactly this,
        // including ops that failed on the way down and are sitting out a
-        // backoff sized for a server that keeps refusing.
-        if let Err(e) = self.db.retry_failed_ops_now(crate::now_millis()) {
+        // backoff sized for a server that keeps refusing. Ops Drive refused
+        // keep theirs: the link was not why.
+        if let Err(e) = self.db.retry_unrefused_ops_now(crate::now_millis()) {
            warn!(error = %e, "moving backed-off ops up after a reconnect failed");
        }
        self.wake_drain();
@@ -403,13 +426,31 @@ mod tests {

    #[test]
    fn an_upload_gets_longer_the_bigger_it_is() {
-        assert_eq!(upload_deadline(0), INTERACTIVE_CALL_TIMEOUT);
+        assert_eq!(upload_deadline(0, 0), INTERACTIVE_CALL_TIMEOUT);
        assert_eq!(
-            upload_deadline(1 << 30),
+            upload_deadline(1 << 30, 0),
            INTERACTIVE_CALL_TIMEOUT + Duration::from_secs(32_768)
        );
    }

+    #[test]
+    fn an_upload_under_a_low_cap_gets_the_time_its_share_of_the_cap_needs() {
+        // A generous cap leaves the deadline as it was.
+        assert_eq!(
+            upload_deadline(1 << 30, 100 << 20),
+            upload_deadline(1 << 30, 0)
+        );
+        // 512 KiB/s shared by every upload slot is below the slowest rate.
+        let share = (512 << 10) / UPLOAD_SLOTS;
+        assert!(share < SLOWEST_UPLOAD);
+        assert_eq!(
+            upload_deadline(1 << 30, 512 << 10),
+            INTERACTIVE_CALL_TIMEOUT + Duration::from_secs((1 << 30) / share)
+        );
+        // A cap below one byte per slot still gives a finite deadline.
+        assert!(upload_deadline(1 << 20, 1) > upload_deadline(1 << 20, 512 << 10));
+    }
+
    #[test]
    fn a_call_past_its_deadline_reads_as_a_lost_link() {
        let rt = tokio::runtime::Builder::new_current_thread()
@@ -226,11 +226,7 @@ fn scale_thumbnail_with_exiftool(
    exiftool: &OsStr,
    timeout: Duration,
 ) -> ScaleAttempt {
-    let direct = image::ImageReader::new(std::io::Cursor::new(bytes))
-        .with_guessed_format()
-        .ok()
-        .and_then(|reader| reader.decode().ok());
-    let image = match direct {
+    let image = match decode_upright(bytes) {
        Some(image) => image,
        None if is_raw_image_name(name) => {
            let (preview, orientation) =
@@ -256,6 +252,27 @@ fn scale_thumbnail_with_exiftool(
    encode_thumb(&image)
 }

+/// Decode `bytes` and turn the picture the way its EXIF orientation says.
+///
+/// `ImageReader::decode` does not: a phone stores a portrait photo as landscape
+/// pixels plus an orientation tag, so every such thumbnail came out on its
+/// side, and the drain uploaded it to Drive that way for every client to show
+/// (`docs/BUGS.md` B226).
+fn decode_upright(bytes: &[u8]) -> Option<image::DynamicImage> {
+    use image::ImageDecoder as _;
+    let mut decoder = image::ImageReader::new(std::io::Cursor::new(bytes))
+        .with_guessed_format()
+        .ok()?
+        .into_decoder()
+        .ok()?;
+    let orientation = decoder
+        .orientation()
+        .unwrap_or(image::metadata::Orientation::NoTransforms);
+    let mut image = image::DynamicImage::from_decoder(decoder).ok()?;
+    image.apply_orientation(orientation);
+    Some(image)
+}
+
 /// Shrink a decoded image to a [`THUMB_EDGE`] JPEG, keeping its aspect ratio.
 fn encode_thumb(image: &image::DynamicImage) -> ScaleAttempt {
    let (width, height) = (image.width(), image.height());
@@ -417,6 +434,16 @@ fn exiftool_query(
    serde_json::from_slice(&output).map_err(|_| RawPreviewUnavailable)
 }

+/// Whether [`upload_thumbnails`] can make a thumbnail for a file `name` of
+/// `size` bytes, asked before the file is on disk: an image small enough to
+/// decode, or a video while ffmpeg is installed.
+pub(crate) fn can_make_thumbnail(name: &str, size: u64) -> bool {
+    if is_video_name(name) {
+        return ffmpeg_available();
+    }
+    is_thumbnail_image_name(name) && size <= UPLOAD_IMAGE_MAX_BYTES
+}
+
 /// Whether `name` is a video, whose thumbnail is a frame ffmpeg grabs rather
 /// than a picture the image decoder can scale.
 fn is_video_name(name: &str) -> bool {
@@ -2092,9 +2119,10 @@ impl Core {
 #[cfg(test)]
 mod thumb_tests {
    use super::{
-        RawTempFile, ScaleAttempt, THUMB_EDGE, UPLOAD_THUMB_MAX_BYTES, exiftool_binary,
-        fit_upload_thumb, is_video_name, ratio_of, scale_thumbnail, scale_thumbnail_with_exiftool,
-        similar_hashes, thumbnail_build_may_start, upload_thumbnails_with, video_thumbnail,
+        RawTempFile, ScaleAttempt, THUMB_EDGE, UPLOAD_IMAGE_MAX_BYTES, UPLOAD_THUMB_MAX_BYTES,
+        can_make_thumbnail, exiftool_binary, ffmpeg_available, fit_upload_thumb, is_video_name,
+        ratio_of, scale_thumbnail, scale_thumbnail_with_exiftool, similar_hashes,
+        thumbnail_build_may_start, upload_thumbnails_with, video_thumbnail,
    };
    use pdfs_core::control::{ThumbnailBuildStatus, is_thumbnail_image_name};
    use proton_drive_rs::ThumbnailType;
@@ -2149,6 +2177,64 @@ mod thumb_tests {
        assert_eq!(ratio_of(&thumb.bytes).map(|r| r < 1.0), Some(true));
    }

+    /// `jpeg` with an EXIF APP1 segment that carries only `orientation`.
+    fn jpeg_with_orientation(width: u32, height: u32, orientation: u16) -> Vec<u8> {
+        let plain = jpeg(width, height);
+        let mut tiff = Vec::new();
+        tiff.extend_from_slice(b"II*\0");
+        tiff.extend_from_slice(&8u32.to_le_bytes());
+        tiff.extend_from_slice(&1u16.to_le_bytes());
+        tiff.extend_from_slice(&0x0112u16.to_le_bytes());
+        tiff.extend_from_slice(&3u16.to_le_bytes());
+        tiff.extend_from_slice(&1u32.to_le_bytes());
+        tiff.extend_from_slice(&orientation.to_le_bytes());
+        tiff.extend_from_slice(&[0, 0]);
+        tiff.extend_from_slice(&0u32.to_le_bytes());
+        let mut app1 = b"Exif\0\0".to_vec();
+        app1.extend_from_slice(&tiff);
+        let mut out = plain[..2].to_vec();
+        out.extend_from_slice(&[0xFF, 0xE1]);
+        out.extend_from_slice(&u16::try_from(app1.len() + 2).unwrap().to_be_bytes());
+        out.extend_from_slice(&app1);
+        out.extend_from_slice(&plain[2..]);
+        out
+    }
+
+    /// A phone stores a portrait photo as landscape pixels and an EXIF
+    /// orientation; its thumbnail came out on its side (`docs/BUGS.md` B226).
+    /// A Takeout photo is copied out of its archive only when a thumbnail can
+    /// be made from the copy.
+    #[test]
+    fn only_a_photo_that_can_have_a_thumbnail_is_worth_copying_out() {
+        assert!(can_make_thumbnail("IMG_1.jpg", 4 << 20));
+        assert!(can_make_thumbnail("Screenshot.png", 4 << 20));
+        assert!(!can_make_thumbnail("IMG_1.jpg", UPLOAD_IMAGE_MAX_BYTES + 1));
+        assert!(!can_make_thumbnail("notes.txt", 10));
+        assert_eq!(can_make_thumbnail("clip.mp4", 1 << 30), ffmpeg_available());
+    }
+
+    #[test]
+    fn a_thumbnail_is_turned_the_way_its_exif_says() {
+        let ScaleAttempt::Made(thumb) = scale_thumbnail(
+            &jpeg_with_orientation(2000, 1000, 6),
+            "portrait.jpg",
+            &std::env::temp_dir(),
+        ) else {
+            panic!("a JPEG scales");
+        };
+        assert!(thumb.ratio < 1.0, "turned upright: {}", thumb.ratio);
+        assert_eq!(ratio_of(&thumb.bytes).map(|r| r < 1.0), Some(true));
+
+        let ScaleAttempt::Made(level) = scale_thumbnail(
+            &jpeg_with_orientation(2000, 1000, 1),
+            "landscape.jpg",
+            &std::env::temp_dir(),
+        ) else {
+            panic!("a JPEG scales");
+        };
+        assert!(level.ratio > 1.0);
+    }
+
    #[test]
    fn undecodable_bytes_are_not_a_thumbnail() {
        // What a photo in a format this build has no decoder for looks like: the
@@ -15,6 +15,7 @@ use pdfs_core::control::RestorableFolder;
 use pdfs_core::mounts::MountMode;
 use pdfs_core::profile::{
    PROFILE_DIR_NAME, PROFILE_FILE_NAME, PROFILE_VERSION, Profile, ProfileFolder, ProfilePin,
+    is_profile_file_name, profile_file_name, saved_folder,
 };
 use pdfs_core::{CoreError, CoreResult};
 use proton_drive_rs::proton_sdk::ids::NodeUid;
@@ -66,9 +67,14 @@ impl Core {
        });
    }

-    /// Serialize this machine's arrangement and upload it to `profile.json`
-    /// inside the device's `.proton-drive-linux` folder, replacing any existing
-    /// one.
+    /// Serialize this machine's arrangement and upload it to its own
+    /// `profile-<machine id>.json` inside the device's `.proton-drive-linux`
+    /// folder, replacing any existing one.
+    ///
+    /// Each machine writes its own file because several computers may sync
+    /// into one device. They used to share `profile.json`, and each save
+    /// replaced the other computers' folders with its own (B252). That file is
+    /// left as it is, so a client before 3.5.0 still finds it.
    ///
    /// Does nothing when no device is registered: a machine that has never
    /// synced a folder has nothing to describe, and registering a device just to
@@ -85,7 +91,11 @@ impl Core {
            CoreError::internal(format!("bad device root uid: {}", device.root_uid))
        })?;

-        let profile = self.build_profile(&device.uid)?;
+        let machine_id = pdfs_core::config::AppDirs::new()
+            .and_then(|dirs| dirs.machine_id())
+            .map_err(|e| CoreError::internal(format!("machine id: {e}")))?;
+        let file_name = profile_file_name(&machine_id);
+        let profile = self.build_profile(&device.uid, &machine_id)?;
        let bytes = profile.to_bytes().map_err(CoreError::internal)?;
        let len = bytes.len() as i64;

@@ -97,7 +107,7 @@ impl Core {
        // same name: the profile is a single mutable record, and a folder with
        // `profile.json` and `profile (1).json` in it teaches the restore
        // nothing about which to trust.
-        let existing = self.find_device_child_file(&dir_uid, PROFILE_FILE_NAME)?;
+        let existing = self.find_device_child_file(&dir_uid, &file_name)?;
        match existing {
            Some(uid) => self
                .rt
@@ -114,7 +124,7 @@ impl Core {
                self.rt
                    .block_on(self.drive.upload_file_replacing_draft_from(
                        &dir_uid,
-                        PROFILE_FILE_NAME,
+                        &file_name,
                        "application/json",
                        Cursor::new(bytes),
                        len,
@@ -130,7 +140,7 @@ impl Core {
    }

    /// Snapshot the local arrangement into a [`Profile`].
-    fn build_profile(&self, device_uid: &str) -> CoreResult<Profile> {
+    fn build_profile(&self, device_uid: &str, machine_id: &str) -> CoreResult<Profile> {
        let folders = self
            .db
            .sync_folder_list()
@@ -162,6 +172,7 @@ impl Core {
            version: PROFILE_VERSION,
            device_uid: device_uid.to_string(),
            hostname: this_hostname(),
+            machine_id: Some(machine_id.to_string()),
            saved_at: now_secs(),
            folders,
            pins,
@@ -197,6 +208,31 @@ impl Core {
            .map(|n| n.uid))
    }

+    /// The untrashed files directly under `parent_uid` whose name passes
+    /// `keep`.
+    fn device_child_files(
+        &self,
+        parent_uid: &NodeUid,
+        keep: impl Fn(&str) -> bool,
+    ) -> CoreResult<Vec<NodeUid>> {
+        let uids = self
+            .rt
+            .block_on(self.drive.enumerate_folder_children_node_uids(parent_uid))
+            .map_err(|e| CoreError::from_api(&e, "list device root"))?;
+        if uids.is_empty() {
+            return Ok(Vec::new());
+        }
+        let nodes = self
+            .rt
+            .block_on(self.drive.enumerate_nodes(&uids))
+            .map_err(|e| CoreError::from_api(&e, "resolve device root children"))?;
+        Ok(nodes
+            .into_iter()
+            .filter(|n| !n.is_folder() && !n.trashed && keep(&n.name))
+            .map(|n| n.uid)
+            .collect())
+    }
+
    /// The device's `.proton-drive-linux` folder, creating it if this is the
    /// first save on this device.
    ///
@@ -218,32 +254,43 @@ impl Core {
        Ok(uid)
    }

-    /// Download and parse this device's profile, if there is one.
+    /// Download and parse the profiles of every computer that syncs this
+    /// device.
    ///
-    /// Looks in `.proton-drive-linux/` first and falls back to the device root,
-    /// where clients before the B78 fix wrote it. The fallback is read-only: the
-    /// next save writes to the folder, and the legacy document is left alone
-    /// rather than trashed, so an older client on another machine keeps working.
-    fn load_profile(&self, root_uid: &NodeUid) -> CoreResult<Option<Profile>> {
-        let current = match self.find_device_child_folder(root_uid, PROFILE_DIR_NAME)? {
-            Some(dir_uid) => self.find_device_child_file(&dir_uid, PROFILE_FILE_NAME)?,
-            None => None,
+    /// Reads every profile in `.proton-drive-linux/`: one per machine, and the
+    /// shared `profile.json` of clients before 3.5.0. Falls back to the device
+    /// root, where clients before the B78 fix wrote it. The fallback is
+    /// read-only: the next save writes to the folder, and the legacy document
+    /// is left alone rather than trashed, so an older client on another
+    /// machine keeps working. A profile that cannot be read is left out and
+    /// logged; the others still count.
+    fn load_profiles(&self, root_uid: &NodeUid) -> CoreResult<Vec<Profile>> {
+        let mut uids = match self.find_device_child_folder(root_uid, PROFILE_DIR_NAME)? {
+            Some(dir_uid) => self.device_child_files(&dir_uid, is_profile_file_name)?,
+            None => Vec::new(),
        };
-        let uid = match current {
-            Some(uid) => uid,
-            None => match self.find_device_child_file(root_uid, PROFILE_FILE_NAME)? {
-                Some(uid) => {
-                    info!("reading legacy profile from the device root");
-                    uid
+        if uids.is_empty() {
+            uids = self.device_child_files(root_uid, |name| name == PROFILE_FILE_NAME)?;
+            if !uids.is_empty() {
+                info!("reading legacy profile from the device root");
+            }
+        }
+        let mut profiles = Vec::new();
+        for uid in uids {
+            let mut buf: Vec<u8> = Vec::new();
+            let parsed = self
+                .rt
+                .block_on(self.drive.download_file_to(&uid, &mut buf))
+                .map_err(|e| CoreError::from_api(&e, "download profile"))
+                .and_then(|()| Profile::parse(&buf).map_err(CoreError::invalid));
+            match parsed {
+                Ok(profile) => profiles.push(profile),
+                Err(e) => {
+                    warn!(%uid, error = %e.message, "could not read a profile; leaving it out")
                }
-                None => return Ok(None),
-            },
-        };
-        let mut buf: Vec<u8> = Vec::new();
-        self.rt
-            .block_on(self.drive.download_file_to(&uid, &mut buf))
-            .map_err(|e| CoreError::from_api(&e, "download profile"))?;
-        Profile::parse(&buf).map(Some).map_err(CoreError::invalid)
+            }
+        }
+        Ok(profiles)
    }

    // ---- restore ----------------------------------------
@@ -265,15 +312,16 @@ impl Core {
            CoreError::internal(format!("bad device root uid: {}", device.root_uid))
        })?;

-        let profile = match self.load_profile(&root_uid) {
+        let profiles = match self.load_profiles(&root_uid) {
            Ok(p) => p,
            // A missing or unreadable profile is not fatal: the remote tree
            // alone is enough to offer a restore, just with plainer defaults.
            Err(e) => {
-                warn!(error = %e.message, "could not read profile; proposing defaults");
-                None
+                warn!(error = %e.message, "could not read profiles; proposing defaults");
+                Vec::new()
            }
        };
+        let hostname = this_hostname();

        let uids = self
            .rt
@@ -304,11 +352,12 @@ impl Core {
            // offering it as a restorable folder would sync the bookkeeping
            // back onto the machine it describes.
            .filter(|n| n.is_folder() && !n.trashed && n.name != PROFILE_DIR_NAME)
+            // The name becomes a folder under the home folder: one with a `/`
+            // or a `..` in it would put the restore somewhere else.
+            .filter(|n| crate::remote_name_is_safe(&n.name))
            .map(|n| {
                let uid = n.uid.to_string();
-                let saved = profile
-                    .as_ref()
-                    .and_then(|p| p.folders.iter().find(|f| f.remote_uid == uid));
+                let saved = saved_folder(&profiles, &uid, &hostname);
                let proposed = saved
                    .map(|f| PathBuf::from(&f.local_path))
                    .filter(|p| path_is_usable_here(p))
@@ -349,23 +398,29 @@ impl Core {
            .sync_folder_list()
            .map_err(|e| CoreError::internal(format!("db: {e:?}")))?;

+        let reserved = crate::devices::sync_root_reserved();
+        let mut roots: Vec<PathBuf> = existing
+            .iter()
+            .map(|f| PathBuf::from(&f.local_path))
+            .collect();
        let mut restored = 0usize;
        let mut skipped: Vec<String> = Vec::new();
        for item in items {
-            let local = PathBuf::from(&item.local_path);
-            if !local.is_absolute() {
-                skipped.push(format!("{}: local path must be absolute", item.local_path));
-                continue;
-            }
+            // The path is proposed from the profile another machine wrote, and
+            // may hold a folder name from Drive: checked like any new root.
+            let local = match pdfs_core::syncroot::resolve(Path::new(&item.local_path)) {
+                Ok(local) => local,
+                Err(e) => {
+                    skipped.push(format!("{}: {e}", item.local_path));
+                    continue;
+                }
+            };
            if existing.iter().any(|f| f.remote_uid == item.remote_uid) {
                skipped.push(format!("{}: already synced", item.local_path));
                continue;
            }
-            if existing
-                .iter()
-                .any(|f| Path::new(&f.local_path) == local.as_path())
-            {
-                skipped.push(format!("{}: path already in use", item.local_path));
+            if let Some(problem) = pdfs_core::syncroot::problem(&local, &roots, &reserved) {
+                skipped.push(format!("{}: {problem}", item.local_path));
                continue;
            }
            if let Err(e) = std::fs::create_dir_all(&local) {
@@ -390,6 +445,7 @@ impl Core {
                let _ = self.request_sync_folder_mode(id, "ondemand");
            }
            let _ = self.sync_tx.send(sync::SyncMsg::Reconcile(id));
+            roots.push(local);
            restored += 1;
        }
        let _ = self.sync_tx.send(sync::SyncMsg::Rewatch);
@@ -482,7 +538,7 @@ mod tests {
    #[test]
    fn loading_falls_back_to_a_legacy_device_root_profile() {
        let source = include_str!("profile.rs");
-        let load = function_source(source, "fn load_profile(");
+        let load = function_source(source, "fn load_profiles(");
        assert!(load.contains("PROFILE_DIR_NAME"), "prefers the folder");
        assert!(
            load.find("PROFILE_DIR_NAME").unwrap()
@@ -491,6 +547,16 @@ mod tests {
        );
    }

+    /// Several computers may share a device, so each saves to a file named
+    /// after its own machine id and never to the shared `profile.json`
+    /// (B252).
+    #[test]
+    fn each_machine_saves_its_own_profile() {
+        let save = function_source(include_str!("profile.rs"), "fn save_profile(");
+        assert!(save.contains("profile_file_name(&machine_id)"));
+        assert!(!save.contains("PROFILE_FILE_NAME"));
+    }
+
    /// The profile folder is the client's own bookkeeping: neither the restore
    /// picker nor `add_sync_folder` may treat it as a user folder.
    #[test]
@@ -1070,37 +1070,35 @@ impl Core {
        offset: u64,
        size: u64,
    ) -> Result<Vec<u8>, Errno> {
-        if offset >= len || size == 0 {
-            return Ok(Vec::new());
-        }
-        let end = offset.saturating_add(size).min(len);
-        let mut out = Vec::with_capacity((end - offset) as usize);
-        for (s, e, authored) in written.segments(offset, end) {
-            if authored {
-                let mut buf = vec![0u8; (e - s) as usize];
-                file.read_exact_at(&mut buf, s).map_err(|err| {
-                    warn!(%uid, error = %err, "scratch read failed");
-                    Errno::EIO
-                })?;
-                out.extend_from_slice(&buf);
-            } else {
-                let bend = e.min(base_size);
-                if s < bend {
-                    out.extend_from_slice(&self.read_range(
-                        uid,
-                        base_mtime,
-                        base_size,
-                        s,
-                        bend - s,
-                        true,
-                    )?);
-                }
-                // Anything past the base is a hole: zero-fill.
-                let zeros = e.saturating_sub(s.max(base_size));
-                out.resize(out.len() + zeros as usize, 0);
-            }
-        }
-        Ok(out)
+        let read = assemble_open_read(file, len, uid, base_size, written, offset, size, |s, n| {
+            self.read_range(uid, base_mtime, base_size, s, n, true)
+                .map(Some)
+        })?;
+        Ok(read.unwrap_or_default())
+    }
+
+    /// [`Core::serve_open_read`] from bytes already on this machine only:
+    /// `Ok(None)` the moment a range of the base would have to be downloaded.
+    ///
+    /// The dispatch loop answers a read on a write handle with this, and hands
+    /// it to a worker only when it says `None`. Fetching the base there held
+    /// every request of the mount for as long as the download took, up to the
+    /// read deadline (`docs/BUGS.md` B227).
+    #[allow(clippy::too_many_arguments)]
+    pub(super) fn serve_open_read_local(
+        &self,
+        file: &Arc<File>,
+        len: u64,
+        uid: &NodeUid,
+        base_mtime: i64,
+        base_size: u64,
+        written: &Intervals,
+        offset: u64,
+        size: u64,
+    ) -> Result<Option<Vec<u8>>, Errno> {
+        assemble_open_read(file, len, uid, base_size, written, offset, size, |s, n| {
+            Ok(self.cached_range(uid, base_mtime, base_size, s, n))
+        })
    }

    /// The largest amount [`Core::fill_gaps_cached`] will copy out of the local
@@ -1242,6 +1240,49 @@ impl Core {
    }
 }

+/// The bytes `[offset, offset + size)` of a file open for writing: authored
+/// ranges from its scratch `file`, the rest from its base through `base`,
+/// and zeros past the base. `Ok(None)` when `base` says it cannot answer.
+#[allow(clippy::too_many_arguments)]
+fn assemble_open_read(
+    file: &File,
+    len: u64,
+    uid: &NodeUid,
+    base_size: u64,
+    written: &Intervals,
+    offset: u64,
+    size: u64,
+    mut base: impl FnMut(u64, u64) -> Result<Option<Vec<u8>>, Errno>,
+) -> Result<Option<Vec<u8>>, Errno> {
+    if offset >= len || size == 0 {
+        return Ok(Some(Vec::new()));
+    }
+    let end = offset.saturating_add(size).min(len);
+    let mut out = Vec::with_capacity((end - offset) as usize);
+    for (s, e, authored) in written.segments(offset, end) {
+        if authored {
+            let mut buf = vec![0u8; (e - s) as usize];
+            file.read_exact_at(&mut buf, s).map_err(|err| {
+                warn!(%uid, error = %err, "scratch read failed");
+                Errno::EIO
+            })?;
+            out.extend_from_slice(&buf);
+        } else {
+            let bend = e.min(base_size);
+            if s < bend {
+                match base(s, bend - s)? {
+                    Some(bytes) => out.extend_from_slice(&bytes),
+                    None => return Ok(None),
+                }
+            }
+            // Anything past the base is a hole: zero-fill.
+            let zeros = e.saturating_sub(s.max(base_size));
+            out.resize(out.len() + zeros as usize, 0);
+        }
+    }
+    Ok(Some(out))
+}
+
 #[cfg(test)]
 mod block_ring_tests {
    use super::*;
@@ -1394,3 +1435,54 @@ mod prefetch_tests {
        assert!(prefetch.streams.lock().len() <= MAX_PREFETCH_STREAMS + 1);
    }
 }
+
+#[cfg(test)]
+mod open_read_tests {
+    use super::*;
+    use proton_drive_rs::proton_sdk::ids::{LinkId, VolumeId};
+
+    fn scratch(bytes: &[u8]) -> (File, PathBuf) {
+        let path = std::env::temp_dir().join(format!(
+            "pdfs-open-read-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        let mut file = File::options()
+            .create_new(true)
+            .read(true)
+            .write(true)
+            .open(&path)
+            .unwrap();
+        file.write_all(bytes).unwrap();
+        (file, path)
+    }
+
+    /// The dispatch loop answers from what is on this machine and says so
+    /// when the base would have to be downloaded, for a worker to do it
+    /// (`docs/BUGS.md` B227).
+    #[test]
+    fn a_read_needing_the_base_says_so_instead_of_fetching() {
+        let uid = NodeUid::new(VolumeId::from("v"), LinkId::from("f"));
+        let (file, path) = scratch(b"ABCDEFGH");
+        let mut written = Intervals::default();
+        written.add(0, 4);
+
+        let authored = assemble_open_read(&file, 8, &uid, 8, &written, 0, 4, |_, _| {
+            panic!("an authored range never asks the base")
+        });
+        assert_eq!(authored.unwrap().as_deref(), Some(&b"ABCD"[..]));
+
+        let missing = assemble_open_read(&file, 8, &uid, 8, &written, 2, 6, |_, _| Ok(None));
+        assert_eq!(missing.unwrap(), None);
+
+        let base = assemble_open_read(&file, 10, &uid, 8, &written, 2, 8, |s, n| {
+            assert_eq!((s, n), (4, 4));
+            Ok(Some(b"efgh".to_vec()))
+        });
+        assert_eq!(base.unwrap().as_deref(), Some(&b"CDefgh\0\0"[..]));
+        let _ = std::fs::remove_file(path);
+    }
+}
@@ -190,6 +190,7 @@ impl Core {
            .map_err(|e| CoreError::internal(format!("stat {}: {e}", path.display())))?
            .len();
        let media_type = media_type_of(&candidate.name).unwrap_or("application/octet-stream");
+        let thumbnails = self.upload_thumbnails(&path, &candidate.name);

        let guard =
            self.transfers
@@ -206,7 +207,7 @@ impl Core {
            media_type,
            reader,
            size as i64,
-            Vec::new(),
+            thumbnails,
            metadata,
            false,
        ));
@@ -291,7 +292,14 @@ impl Core {
            let mut state = REDATE.lock();
            state.running = false;
            state.cancel = None;
-            state.last = outcome.as_ref().ok().cloned();
+            state.last = Some(match &outcome {
+                Ok(summary) => summary.clone(),
+                Err(e) => RedateSummary {
+                    error: Some(e.to_string()),
+                    dry_run,
+                    ..Default::default()
+                },
+            });
            match &outcome {
                Ok(summary) => info!(
                    candidates = summary.candidates,
@@ -1303,6 +1303,44 @@ mod tests {
        db.unwrap()
    }

+    #[test]
+    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse sim:: -- --ignored`"]
+    fn close_syncs_a_written_file_and_fsync_accepts_a_read_only_one() {
+        // `close` is answered by flush, which now syncs the scratch file so a
+        // failure reaches the program; `fsync` on a descriptor opened for
+        // reading failed with EBADF (B222).
+        use std::io::{Read, Write};
+        let drive = FakeDrive::new();
+        let dir = scratch("flush-fsync");
+        let daemon = Daemon::start(&dir, drive.client(1, Faults::lan())).unwrap();
+        let path = daemon.mountpoint.join("notes.txt");
+
+        let mut file = std::fs::File::create(&path).unwrap();
+        file.write_all(b"written then closed").unwrap();
+        drop(file);
+        let mut again = std::fs::OpenOptions::new()
+            .append(true)
+            .open(&path)
+            .unwrap();
+        again.write_all(b", twice").unwrap();
+        again.flush().unwrap();
+        drop(again);
+
+        let mut read_only = std::fs::File::open(&path).unwrap();
+        read_only.sync_all().unwrap();
+        let mut text = String::new();
+        read_only.read_to_string(&mut text).unwrap();
+        assert_eq!(text, "written then closed, twice");
+        drop(read_only);
+
+        assert!(wait_until(Duration::from_secs(30), || {
+            daemon.pending().is_ok_and(|items| items.is_empty())
+        }));
+        assert!(drive.lookup("notes.txt").is_some());
+        assert!(matches!(daemon.stop(), Ok(MountOutcome::Shutdown)));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
    #[test]
    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse sim:: -- --ignored`"]
    fn a_stop_ends_a_mirror_pass_after_the_uploads_it_is_sending() {
@@ -1363,6 +1401,216 @@ mod tests {
        let _ = std::fs::remove_dir_all(&dir);
    }

+    /// A folder `mirrored` on Drive, synced in mirror mode with `dir/local`,
+    /// which holds `files` before the first pass. Returns the daemon, the
+    /// folder's id and the link it uses.
+    fn start_mirror(
+        drive: &Arc<FakeDrive>,
+        dir: &Path,
+        files: &[(&str, &[u8])],
+    ) -> (Daemon, i64, FakeClient) {
+        let daemon = Daemon::start(dir, drive.client(1, Faults::lan())).unwrap();
+        std::fs::create_dir(daemon.mountpoint.join("mirrored")).unwrap();
+        assert!(wait_until(Duration::from_secs(30), || {
+            daemon.pending().is_ok_and(|items| items.is_empty())
+                && drive.lookup("mirrored").is_some()
+        }));
+        let remote = drive.lookup("mirrored").unwrap();
+        assert!(matches!(daemon.stop(), Ok(MountOutcome::Shutdown)));
+        let local = dir.join("local");
+        std::fs::create_dir_all(&local).unwrap();
+        for (name, bytes) in files {
+            std::fs::write(local.join(name), bytes).unwrap();
+        }
+        let folder = reopen(dir)
+            .sync_folder_add(local.to_str().unwrap(), &remote.to_string(), "")
+            .unwrap();
+        let client = drive.client(1, Faults::lan());
+        let daemon = Daemon::start(dir, client.clone()).unwrap();
+        (daemon, folder, client)
+    }
+
+    /// Wait until a pass of the mirror that began after `since` (epoch
+    /// seconds) is over without errors.
+    fn wait_for_pass(daemon: &Daemon, folder: i64, since: i64) -> bool {
+        wait_until(Duration::from_secs(30), || {
+            let Ok(Response::SyncFolders { items }) = daemon.request(&Request::ListSyncFolders)
+            else {
+                return false;
+            };
+            items.iter().any(|f| {
+                f.id == folder && f.state == "idle" && f.progress.is_none() && f.last_sync >= since
+            })
+        })
+    }
+
+    fn conflict_copies(dir: &Path, stem: &str) -> Vec<PathBuf> {
+        let prefix = format!("{stem} (sync-conflict ");
+        std::fs::read_dir(dir)
+            .unwrap()
+            .filter_map(|e| e.ok())
+            .map(|e| e.path())
+            .filter(|p| {
+                p.file_name()
+                    .and_then(|n| n.to_str())
+                    .is_some_and(|n| n.starts_with(&prefix))
+            })
+            .collect()
+    }
+
+    fn on_drive(drive: &FakeDrive, path: &str) -> Option<Vec<u8>> {
+        match drive.tree().get(path) {
+            Some(Entry::File(content)) => Some(content.to_vec()),
+            _ => None,
+        }
+    }
+
+    #[test]
+    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse sim:: -- --ignored`"]
+    fn a_joining_mirror_keeps_a_same_size_different_file_as_a_conflict() {
+        // A computer joining a folder another one syncs found a file of the
+        // same size at the same path and took it for the same file, so the two
+        // went on holding different content (B248). One that is the same is
+        // still taken as it is.
+        let drive = FakeDrive::new();
+        let dir = scratch("join-same-size");
+        let theirs: &[u8] = b"from the other computer";
+        let ours: &[u8] = b"written on this machine";
+        assert_eq!(theirs.len(), ours.len());
+        let daemon = {
+            let daemon = Daemon::start(&dir, drive.client(1, Faults::lan())).unwrap();
+            std::fs::create_dir(daemon.mountpoint.join("mirrored")).unwrap();
+            assert!(wait_until(Duration::from_secs(30), || {
+                daemon.pending().is_ok_and(|items| items.is_empty())
+                    && drive.lookup("mirrored").is_some()
+            }));
+            daemon
+        };
+        drive.device().write("mirrored/notes.txt", theirs);
+        drive.device().write("mirrored/same.txt", b"identical");
+        let remote = drive.lookup("mirrored").unwrap();
+        assert!(matches!(daemon.stop(), Ok(MountOutcome::Shutdown)));
+        let local = dir.join("local");
+        std::fs::create_dir_all(&local).unwrap();
+        std::fs::write(local.join("notes.txt"), ours).unwrap();
+        std::fs::write(local.join("same.txt"), b"identical").unwrap();
+        reopen(&dir)
+            .sync_folder_add(local.to_str().unwrap(), &remote.to_string(), "")
+            .unwrap();
+        let daemon = Daemon::start(&dir, drive.client(1, Faults::lan())).unwrap();
+
+        assert!(wait_until(Duration::from_secs(60), || {
+            conflict_copies(&local, "notes").len() == 1
+                && std::fs::read(local.join("notes.txt")).is_ok_and(|b| b == theirs)
+                && drive
+                    .tree()
+                    .keys()
+                    .any(|k| k.starts_with("mirrored/notes (sync-conflict "))
+        }));
+        let copy = &conflict_copies(&local, "notes")[0];
+        assert_eq!(std::fs::read(copy).unwrap(), ours);
+        assert_eq!(on_drive(&drive, "mirrored/notes.txt").unwrap(), theirs);
+        assert!(conflict_copies(&local, "same").is_empty());
+        assert!(matches!(daemon.stop(), Ok(MountOutcome::Shutdown)));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse sim:: -- --ignored`"]
+    fn a_mirror_edit_does_not_replace_a_revision_another_computer_made_since() {
+        // A local edit went up as a new revision of whatever Drive held at the
+        // time of the upload, from a plan made before another computer saved
+        // its own edit. Its edit was left only in the version history (B249).
+        let drive = FakeDrive::new();
+        let dir = scratch("mirror-revision-race");
+        let (daemon, folder, client) =
+            start_mirror(&drive, &dir, &[("a.txt", b"one"), ("b.txt", b"two")]);
+        let local = dir.join("local");
+        assert!(wait_until(Duration::from_secs(30), || {
+            drive.lookup("mirrored/a.txt").is_some() && drive.lookup("mirrored/b.txt").is_some()
+        }));
+        assert!(wait_for_pass(&daemon, folder, 0));
+        // The echoes of the first uploads read the files too.
+        std::thread::sleep(Duration::from_secs(2));
+
+        let a = drive.lookup("mirrored/a.txt").unwrap();
+        let check = client.hold_next_read(&a);
+        std::fs::write(local.join("a.txt"), b"edited here").unwrap();
+        assert!(wait_until(Duration::from_secs(30), || check.reached()));
+        drive
+            .device()
+            .write("mirrored/a.txt", b"edited on the other computer");
+        drop(check);
+        assert!(wait_until(Duration::from_secs(30), || {
+            take_logged()
+                .iter()
+                .any(|line| line.contains("changed on Drive since this pass looked"))
+        }));
+        daemon
+            .request(&Request::SyncNow { id: Some(folder) })
+            .unwrap();
+
+        assert!(wait_until(Duration::from_secs(60), || {
+            std::fs::read(local.join("a.txt")).is_ok_and(|b| b == b"edited on the other computer")
+                && conflict_copies(&local, "a").len() == 1
+                && drive
+                    .tree()
+                    .keys()
+                    .any(|k| k.starts_with("mirrored/a (sync-conflict "))
+        }));
+        assert_eq!(
+            std::fs::read(&conflict_copies(&local, "a")[0]).unwrap(),
+            b"edited here"
+        );
+        assert_eq!(
+            on_drive(&drive, "mirrored/a.txt").unwrap(),
+            b"edited on the other computer"
+        );
+        assert!(matches!(daemon.stop(), Ok(MountOutcome::Shutdown)));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse sim:: -- --ignored`"]
+    fn a_revision_made_during_a_mirror_download_still_arrives() {
+        // The baseline after a download read the node again, and recorded a
+        // revision another computer made while the download ran as synced.
+        // The disk held the older one, and the newer never arrived (B250).
+        let drive = FakeDrive::new();
+        let dir = scratch("mirror-download-race");
+        let (daemon, folder, client) =
+            start_mirror(&drive, &dir, &[("a.txt", b"one"), ("b.txt", b"two")]);
+        let local = dir.join("local");
+        assert!(wait_until(Duration::from_secs(30), || {
+            drive.lookup("mirrored/a.txt").is_some() && drive.lookup("mirrored/b.txt").is_some()
+        }));
+        assert!(wait_for_pass(&daemon, folder, 0));
+
+        let a = drive.lookup("mirrored/a.txt").unwrap();
+        drive.device().write("mirrored/a.txt", b"second");
+        let download = client.hold_next_download(&a);
+        daemon
+            .request(&Request::SyncNow { id: Some(folder) })
+            .unwrap();
+        assert!(wait_until(Duration::from_secs(30), || download.reached()));
+        drive.device().write("mirrored/a.txt", b"thirdd");
+        drop(download);
+        assert!(wait_until(Duration::from_secs(30), || {
+            std::fs::read(local.join("a.txt")).is_ok_and(|b| b == b"second")
+        }));
+        assert!(wait_for_pass(&daemon, folder, 0));
+
+        daemon
+            .request(&Request::SyncNow { id: Some(folder) })
+            .unwrap();
+        assert!(wait_until(Duration::from_secs(30), || {
+            std::fs::read(local.join("a.txt")).is_ok_and(|b| b == b"thirdd")
+        }));
+        assert!(conflict_copies(&local, "a").is_empty());
+        assert!(matches!(daemon.stop(), Ok(MountOutcome::Shutdown)));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
    #[test]
    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse sim:: -- --ignored`"]
    fn a_file_removed_with_its_folder_while_uploading_stays_removed() {
@@ -212,6 +212,31 @@ pub(crate) fn lid_ino(lid: i64) -> u64 {
    lid.unsigned_abs() + crate::ROOT_INO
 }

+/// The inodes of the stored nodes among `nodes`, from their local ids, for
+/// [`State::intern_batch_with_inos`]. Called before the state lock is taken;
+/// a node that already has a row keeps its id. Empty when the database fails,
+/// which leaves the allocation to the lock holder, as before.
+pub(crate) fn inos_for(db: &Db, nodes: &[Node]) -> HashMap<NodeUid, u64> {
+    let stored: Vec<&Node> = nodes
+        .iter()
+        .filter(|node| !crate::r#virtual::is_virtual_uid(&node.uid))
+        .collect();
+    if stored.is_empty() {
+        return HashMap::new();
+    }
+    match db.lids_for(&stored) {
+        Ok(lids) => stored
+            .iter()
+            .zip(lids)
+            .map(|(node, lid)| (node.uid.clone(), lid_ino(lid)))
+            .collect(),
+        Err(error) => {
+            warn!(%error, "no local ids before the listing; allocating them under the lock");
+            HashMap::new()
+        }
+    }
+}
+
 /// The local id of the node at inode `ino`, the inverse of [`lid_ino`]:
 /// `None` for the root and a fallback inode.
 pub(crate) fn ino_lid(ino: u64) -> Option<i64> {
@@ -1074,20 +1099,34 @@ impl State {
    ///
    /// This is what keeps `ls` on a large folder quick: one commit for the
    /// listing, rather than one autocommit — and one fsync — per child.
-    pub(crate) fn intern_batch(&mut self, parent: u64, mut nodes: Vec<Node>) -> Vec<u64> {
+    #[cfg(test)]
+    pub(crate) fn intern_batch(&mut self, parent: u64, nodes: Vec<Node>) -> Vec<u64> {
+        self.intern_batch_with_inos(parent, nodes, HashMap::new())
+    }
+
+    /// [`State::intern_batch`], with inodes for new entries that the caller
+    /// allocated before it took the lock, from [`inos_for`]. Allocating them
+    /// is a write transaction, and under the lock every inline handler of
+    /// every mount waited for it (`docs/BUGS.md` B221). A node missing from
+    /// `inos` still gets one here.
+    pub(crate) fn intern_batch_with_inos(
+        &mut self,
+        parent: u64,
+        mut nodes: Vec<Node>,
+        mut inos: HashMap<NodeUid, u64>,
+    ) -> Vec<u64> {
        for node in &mut nodes {
            self.keep_revision_mtime(node);
        }
        self.outbox.push(DbWrite::Upsert(nodes.clone()));
        let fresh: Vec<&Node> = nodes
            .iter()
-            .filter(|node| !self.by_uid.contains_key(&node.uid))
+            .filter(|node| !self.by_uid.contains_key(&node.uid) && !inos.contains_key(&node.uid))
            .collect();
-        let mut inos = if fresh.is_empty() {
-            HashMap::new()
-        } else {
-            self.new_inos(&fresh)
-        };
+        if !fresh.is_empty() {
+            let allocated = self.new_inos(&fresh);
+            inos.extend(allocated);
+        }
        nodes
            .into_iter()
            .map(|node| {
@@ -1098,6 +1137,13 @@ impl State {
            .collect()
    }

+    /// Record `uid`'s listing as complete once the lock is released, after the
+    /// rows of its children: written the other way round, a crash between the
+    /// two left a folder marked complete with no children to show.
+    pub(crate) fn record_listed(&mut self, uid: NodeUid) {
+        self.outbox.push(DbWrite::SetListed(uid, true));
+    }
+
    /// Check if a directory inode has any child nodes in memory or in the database.
    pub(crate) fn has_children(&self, parent: u64) -> bool {
        // A resident listing is authoritative even when empty. Falling through
@@ -1467,6 +1513,44 @@ mod tests {
        );
    }

+    /// A listing's inodes are allocated before the lock is taken, and are the
+    /// ones a node would get under it (`docs/BUGS.md` B221).
+    #[test]
+    fn inodes_allocated_before_the_lock_are_the_ones_the_node_keeps() {
+        let (mut st, _dir) = state();
+        let db = st.db.clone();
+        let listing = vec![
+            node("a", "root", "a.txt", false),
+            node("b", "root", "b.txt", false),
+        ];
+        let early = inos_for(&db, &listing);
+        assert_eq!(early.len(), 2);
+        let inos = st.intern_batch_with_inos(0, listing, early.clone());
+        assert_eq!(inos, [early[&uid("a")], early[&uid("b")]]);
+        st.flush_outbox();
+
+        let mut restarted = State::new(db, HashMap::new());
+        assert_eq!(
+            restarted.intern(0, node("b", "root", "b.txt", false)),
+            early[&uid("b")]
+        );
+    }
+
+    /// The listing is recorded complete with its children's rows, when the
+    /// lock goes, never ahead of them.
+    #[test]
+    fn a_listing_is_recorded_complete_after_its_children() {
+        let (mut st, _dir) = state();
+        let root = st.intern(0, node("root", "none", "root", true));
+        st.flush_outbox();
+        st.intern_batch(root, vec![node("a", "root", "a.txt", false)]);
+        st.record_listed(uid("root"));
+        assert!(st.db.children_if_listed(&uid("root")).unwrap().is_none());
+        st.flush_outbox();
+        let kids = st.db.children_if_listed(&uid("root")).unwrap().unwrap();
+        assert_eq!(kids.len(), 1);
+    }
+
    /// Audit A5. Moving a file out of a folder leaves that folder's DB row
    /// claiming a complete listing, so once the hot cache drops it, remote
    /// changes under it stop being seen. `relocate` has to clear both sides.
@@ -37,10 +37,12 @@ const CONFLICT_SWEEP_INTERVAL: Duration = Duration::from_secs(300);
 /// fresh mount does at startup (hydrate, recover, initial enumeration).
 const CONFLICT_SWEEP_WARMUP: Duration = Duration::from_secs(30);

-/// Strip a ` (sync-conflict <stamp>)` (optionally `-<n>`) marker from `name`,
-/// returning the original file name it was a copy of. `None` when `name` is not a
-/// conflict copy. Inverse of the `conflict_name` / `conflict_path_with_suffix`
-/// formats, so the two halves of the product agree on what a conflict is.
+/// Strip a ` (sync-conflict <label> <stamp>)` (optionally `-<n>`) marker from
+/// `name`, returning the original file name it was a copy of. The label names
+/// the computer that made the copy (B251); copies made before it have the bare
+/// stamp. `None` when `name` is not a conflict copy. Inverse of the
+/// `conflict_name` / `conflict_path_with_suffix` formats, so the two halves of
+/// the product agree on what a conflict is.
 pub(crate) fn conflict_base_name(name: &str) -> Option<String> {
    const MARKER: &str = " (sync-conflict ";
    let start = name.find(MARKER)?;
@@ -48,6 +50,20 @@ pub(crate) fn conflict_base_name(name: &str) -> Option<String> {
    let close_rel = name[after..].find(')')?;
    let close = after + close_rel;
    let inner = &name[after..close];
+    // A label is one token of the characters `conflict_label_of` keeps.
+    let inner = match inner.rsplit_once(' ') {
+        Some((label, token)) => {
+            let label_ok = !label.is_empty()
+                && label
+                    .chars()
+                    .all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '.'));
+            if !label_ok {
+                return None;
+            }
+            token
+        }
+        None => inner,
+    };
    // The token is `<digits>` or `<digits>-<digits>`; reject anything else so a
    // file that merely happens to contain the phrase is not mistaken for a copy.
    let mut parts = inner.splitn(2, '-');
@@ -486,6 +502,24 @@ mod tests {
            conflict_base_name("notes (sync-conflict 1700-3).txt").as_deref(),
            Some("notes.txt")
        );
+        // Named after the computer that made it (B251).
+        assert_eq!(
+            conflict_base_name("notes (sync-conflict laptop 1700).txt").as_deref(),
+            Some("notes.txt")
+        );
+        assert_eq!(
+            conflict_base_name("notes (sync-conflict my-pc.local 1700-2).txt").as_deref(),
+            Some("notes.txt")
+        );
+        assert_eq!(
+            conflict_base_name(&crate::conflict_name("notes.txt", 1700)).as_deref(),
+            Some("notes.txt")
+        );
+        assert_eq!(
+            conflict_base_name("x (sync-conflict two words 1).txt"),
+            None
+        );
+        assert_eq!(conflict_base_name("x (sync-conflict  1).txt"), None);
        // Not a conflict copy.
        assert_eq!(conflict_base_name("report.xml"), None);
        // Looks close but the token is not a stamp.
@@ -22,7 +22,7 @@ const POLL_INTERVAL: Duration = Duration::from_secs(120);
 /// per-item work is a network round-trip, so a folder with thousands of files is
 /// unusable done one-at-a-time; this bounds concurrency like the bulk-upload
 /// engine does.
-pub(super) const SYNC_CONCURRENCY: usize = 8;
+pub(crate) const SYNC_CONCURRENCY: usize = 8;

 /// A message to the sync engine's control thread.
 pub(crate) enum SyncMsg {
@@ -83,6 +83,46 @@ pub(super) struct RemoteItem {
    pub(super) is_dir: bool,
    pub(super) mtime: i64,
    pub(super) size: i64,
+    /// The active revision's id. The light walk carries it for every file, so
+    /// it is the signal that tells another client's new revision from a link
+    /// merely re-stamped.
+    pub(super) revision: Option<String>,
+    /// The active revision's content SHA-1, read only for files the walk
+    /// enumerated in full (no baseline, or a moved mtime). `None` is never
+    /// proof of anything.
+    pub(super) sha1: Option<String>,
+}
+
+/// What a pass saw of a remote file: the signature its baseline records once
+/// the file is synced, and what an upload checks Drive still holds before it
+/// supersedes it.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(super) struct RemoteSeen {
+    pub(super) mtime: i64,
+    pub(super) size: i64,
+    pub(super) revision: Option<String>,
+}
+
+impl RemoteSeen {
+    /// Whether `node` is still the revision this was taken from. The revision
+    /// id decides it when both sides have one; otherwise the modification time
+    /// and size, which is all a baseline row from before schema 44 holds.
+    pub(super) fn still_current(&self, node: &Node) -> bool {
+        match (&self.revision, crate::node_revision_id(node)) {
+            (Some(seen), Some(now)) => *seen == now,
+            _ => (self.mtime, self.size) == remote_file_sig(node),
+        }
+    }
+}
+
+impl From<&RemoteItem> for RemoteSeen {
+    fn from(item: &RemoteItem) -> Self {
+        Self {
+            mtime: item.mtime,
+            size: item.size,
+            revision: item.revision.clone(),
+        }
+    }
 }

 /// The result of a reconcile pass: what it moved, how many paths were kept as
@@ -113,7 +153,7 @@ impl Outcome {
            Applied::Uploaded => self.uploaded += 1,
            Applied::Downloaded => self.downloaded += 1,
            Applied::Conflict => self.conflicts += 1,
-            Applied::Vanished => {}
+            Applied::Vanished | Applied::Adopted => {}
        }
    }

@@ -157,10 +197,16 @@ pub(super) enum Pending {
    CreateDir { rel: String, parent: NodeUid },
    /// Upload a brand-new local file into `parent`.
    UploadNew { rel: String, parent: NodeUid },
-    /// Upload a changed local file as a new revision of `uid`.
-    UploadRevision { rel: String, uid: NodeUid },
-    /// Download remote `uid` to the local path, stamping `mtime`. `size` is the
-    /// remote's reported size, used as the transfer's expected total.
+    /// Upload a changed local file as a new revision of `uid`, if Drive still
+    /// holds the revision `seen` describes (B249).
+    UploadRevision {
+        rel: String,
+        uid: NodeUid,
+        seen: RemoteSeen,
+    },
+    /// Download remote `uid` to the local path, stamping `seen.mtime`.
+    /// `seen.size` is the remote's reported size, used as the transfer's
+    /// expected total.
    ///
    /// `local` is what the planning walk saw at this path, or `None` if nothing
    /// was there. A download can run for minutes, so the apply step revalidates
@@ -170,16 +216,26 @@ pub(super) enum Pending {
    Download {
        rel: String,
        uid: NodeUid,
-        mtime: i64,
-        size: i64,
+        seen: RemoteSeen,
        local: Option<LocalSig>,
    },
+    /// First sync of a path present on both sides at the same size, with a
+    /// digest on Drive: hash the local file, and record the baseline if it holds
+    /// the same bytes. A different file of the same size goes the way of
+    /// [`Pending::Conflict`]: two machines syncing one folder must not read as
+    /// in step while they hold different content.
+    Adopt {
+        rel: String,
+        uid: NodeUid,
+        seen: RemoteSeen,
+        sha1: String,
+        local: LocalSig,
+    },
    /// Both sides changed: set the local copy aside, then download remote `uid`.
    Conflict {
        rel: String,
        uid: NodeUid,
-        mtime: i64,
-        size: i64,
+        seen: RemoteSeen,
    },
    /// Both sides changed during a [`push pass`](Core::push_pass): upload the local
    /// copy into `parent` under a conflict name, leaving the remote file as it is.
@@ -194,6 +250,7 @@ impl Pending {
            | Pending::UploadNew { rel, .. }
            | Pending::UploadRevision { rel, .. }
            | Pending::Download { rel, .. }
+            | Pending::Adopt { rel, .. }
            | Pending::Conflict { rel, .. }
            | Pending::PushConflict { rel, .. } => rel,
        }
@@ -206,7 +263,9 @@ impl Pending {
            Pending::UploadNew { .. }
            | Pending::UploadRevision { .. }
            | Pending::PushConflict { .. } => ActivityKind::Upload,
-            Pending::Download { .. } | Pending::Conflict { .. } => ActivityKind::Download,
+            Pending::Download { .. } | Pending::Adopt { .. } | Pending::Conflict { .. } => {
+                ActivityKind::Download
+            }
        }
    }

@@ -217,6 +276,7 @@ impl Pending {
            Pending::UploadNew { .. } => "new file",
            Pending::UploadRevision { .. } => "new version",
            Pending::Download { .. } => "from Drive",
+            Pending::Adopt { .. } => "already the same on Drive",
            Pending::Conflict { .. } => "local changes kept as a conflict copy",
            Pending::PushConflict { .. } => "local changes uploaded as a conflict copy",
        }
@@ -199,14 +199,160 @@ pub(super) fn guard_local_wipe<B, L>(
    Ok(())
 }

+/// Refuse to run a pass whose remote side has vanished in its entirety: the
+/// remote twin of [`guard_local_wipe`].
+///
+/// An empty or truncated remote walk reads to the planner as "Drive deleted
+/// everything", which a pass answers by deleting the local copies. When not
+/// one synced path is left on Drive, a failed listing is far likelier than a
+/// deliberate wipe of the whole folder, so the pass stops instead.
+pub(super) fn guard_remote_wipe<B, R>(
+    baseline: &HashMap<String, B>,
+    remote: &HashMap<String, R>,
+) -> Result<(), String> {
+    if !baseline.is_empty() && baseline.keys().all(|rel| !remote.contains_key(rel)) {
+        return Err(format!(
+            "every one of the {} synced paths is missing on Proton Drive; refusing to \
+             delete them here. If they were deleted on purpose, remove the folder from sync.",
+            baseline.len()
+        ));
+    }
+    Ok(())
+}
+
+/// What a remote walk saw but could not read: a node the SDK left out because
+/// it would not decrypt, or a file whose size could not be read.
+///
+/// A path missing from the walk is read as deleted on Drive, so a pass must
+/// not classify one it only failed to read. Since a node that failed to decrypt
+/// has no name, all a walk can say is that a folder's listing came back short;
+/// every path under that folder that the walk did not return is then left out,
+/// as [`Unscanned`] leaves out what the local scan could not read.
+#[derive(Default)]
+pub(super) struct RemoteGaps {
+    /// Folders whose listing came back with fewer nodes than it named.
+    short: HashSet<String>,
+    /// Paths seen, but whose entry could not be read.
+    unread: HashSet<String>,
+}
+
+impl RemoteGaps {
+    /// The listing of `folder` named nodes that did not come back.
+    pub(super) fn short_listing(&mut self, folder: &str) {
+        self.short.insert(folder.to_string());
+    }
+
+    /// `rel` is on Drive, but the walk could not read what it needs of it.
+    pub(super) fn unread(&mut self, rel: String) {
+        self.unread.insert(rel);
+    }
+
+    pub(super) fn is_empty(&self) -> bool {
+        self.short.is_empty() && self.unread.is_empty()
+    }
+
+    /// Whether `rel` may be missing from `remote` only because the walk could
+    /// not read it. A path the walk returned is never hidden.
+    pub(super) fn hides<R>(
+        &self,
+        rel: &str,
+        remote: &HashMap<String, R>,
+        remote_dirs: &HashMap<String, NodeUid>,
+    ) -> bool {
+        if self.is_empty() || remote.contains_key(rel) {
+            return false;
+        }
+        if self.unread.contains(rel) {
+            return true;
+        }
+        // The deepest folder the walk did list decides: under a short listing,
+        // anything not returned may be one of the nodes it could not read.
+        let mut at = parent_rel(rel);
+        loop {
+            if remote_dirs.contains_key(at) {
+                return self.short.contains(at);
+            }
+            if at.is_empty() {
+                return false;
+            }
+            at = parent_rel(at);
+        }
+    }
+
+    /// The folders to name to the user, sorted.
+    pub(super) fn report(&self) -> Vec<String> {
+        let mut lines: Vec<String> = self
+            .short
+            .iter()
+            .map(|rel| {
+                let shown = if rel.is_empty() { "the folder" } else { rel };
+                format!("{shown} (items on Proton Drive that cannot be read)")
+            })
+            .chain(
+                self.unread
+                    .iter()
+                    .map(|rel| format!("{rel} (cannot be read on Proton Drive)")),
+            )
+            .collect();
+        lines.sort_unstable();
+        lines
+    }
+}
+
+/// Why the remote folder at `rel` must not be trashed although it was deleted
+/// here: something under it is new or changed on Drive since the last sync,
+/// so it is another device's work that this computer has never had.
+///
+/// Trashing the folder would take that work with it, and the next pass would
+/// then delete the copy this pass just downloaded. `None` when everything under
+/// it is exactly what the baseline recorded.
+pub(super) fn remote_subtree_changed(
+    rel: &str,
+    remote: &HashMap<String, RemoteItem>,
+    baseline: &HashMap<String, StoredSyncEntry>,
+) -> Option<String> {
+    let prefix = format!("{rel}/");
+    let mut changed: Vec<&String> = remote
+        .iter()
+        .filter(|(path, _)| path.starts_with(&prefix))
+        .filter(|(path, item)| match baseline.get(*path) {
+            None => true,
+            Some(_) if item.is_dir => false,
+            Some(base) => {
+                remote_sig(base) != Some((item.mtime, item.size))
+                    || revision_moved(Some(base), item.revision.as_deref())
+            }
+        })
+        .map(|(path, _)| path)
+        .collect();
+    changed.sort_unstable();
+    changed
+        .first()
+        .map(|path| format!("{path} is new or changed on Proton Drive"))
+}
+
 /// The size the baseline recorded for `rel`, if its remote signature's mtime
-/// still matches `mtime`.
+/// still matches `mtime` and its revision is still `revision`.
+///
+/// A row without a revision id, while Drive reports one, cannot vouch for the
+/// revision, so the size is read for real. Such a row comes from before
+/// schema 44, or from an upload Drive did not list yet when it was read back.
+/// Another computer's revision in the same second as that upload kept the
+/// modification time, and only the size could show it (B254). The pass then
+/// records the id on the row, so this costs one read per row.
 pub(super) fn unchanged_remote_size(
    baseline: &HashMap<String, StoredSyncEntry>,
    rel: &str,
    mtime: i64,
+    revision: Option<&str>,
 ) -> Option<i64> {
-    match baseline.get(rel).and_then(remote_sig) {
+    let base = baseline.get(rel)?;
+    if revision_moved(Some(base), revision)
+        || (base.remote_revision_id.is_none() && revision.is_some())
+    {
+        return None;
+    }
+    match remote_sig(base) {
        Some((recorded, size)) if recorded == mtime => Some(size),
        _ => None,
    }
@@ -221,6 +367,17 @@ pub(super) fn join_rel(prefix: &str, name: &str) -> String {
    }
 }

+/// Whether Drive's active revision `now` is not the one the baseline row was
+/// synced at. Only a revision id on both sides can say so; a row from before
+/// schema 44, or a node read without one, leaves it to the modification time
+/// and size.
+pub(super) fn revision_moved(base: Option<&StoredSyncEntry>, now: Option<&str>) -> bool {
+    match (base.and_then(|b| b.remote_revision_id.as_deref()), now) {
+        (Some(recorded), Some(now)) => recorded != now,
+        _ => false,
+    }
+}
+
 /// The stored remote signature of a baseline row, if it has one.
 pub(super) fn remote_sig(e: &StoredSyncEntry) -> Option<(i64, i64)> {
    match (&e.remote_rev, &e.remote_hash) {
@@ -251,7 +408,8 @@ pub(super) fn rel_to_path(rel: &str) -> PathBuf {
    rel.split('/').collect()
 }

-/// The name for a conflict copy of `path`, e.g. `notes (sync-conflict 1700000000).txt`.
+/// The name for a conflict copy of `path`, e.g.
+/// `notes (sync-conflict laptop 1700000000).txt`.
 #[cfg(test)]
 pub(super) fn conflict_path(path: &Path, stamp: i64) -> PathBuf {
    conflict_path_with_suffix(path, stamp, 0)
@@ -260,16 +418,17 @@ pub(super) fn conflict_path(path: &Path, stamp: i64) -> PathBuf {
 /// As [`conflict_path`], with a deterministic suffix used when that name already
 /// exists. This keeps conflict preservation from ever replacing an older copy.
 pub(super) fn conflict_path_with_suffix(path: &Path, stamp: i64, suffix: u32) -> PathBuf {
+    conflict_path_as(path, crate::conflict_label(), stamp, suffix)
+}
+
+/// [`conflict_path_with_suffix`] with the machine's label given.
+pub(super) fn conflict_path_as(path: &Path, label: &str, stamp: i64, suffix: u32) -> PathBuf {
    let stem = path.file_stem().and_then(|s| s.to_str()).unwrap_or("file");
    let ext = path.extension().and_then(|s| s.to_str());
-    let suffix = if suffix == 0 {
-        String::new()
-    } else {
-        format!("-{suffix}")
-    };
+    let tag = crate::conflict_tag(label, stamp, suffix);
    let name = match ext {
-        Some(ext) => format!("{stem} (sync-conflict {stamp}{suffix}).{ext}"),
-        None => format!("{stem} (sync-conflict {stamp}{suffix})"),
+        Some(ext) => format!("{stem} (sync-conflict {tag}).{ext}"),
+        None => format!("{stem} (sync-conflict {tag})"),
    };
    match path.parent() {
        Some(dir) => dir.join(name),
@@ -290,11 +449,14 @@ pub(super) enum FilePlan {
    DeleteLocal,
    DeleteRemote,
    ForgetBaseline,
-    /// First sync of a file that already exists on both sides with identical
-    /// content: record the baseline without transferring anything. Without this,
+    /// First sync of a file that exists on both sides at the same size, with a
+    /// digest on Drive: record the baseline without transferring anything if
+    /// the local file hashes the same, else keep a conflict copy. Without this,
    /// a folder synced for the first time cuts a `(sync-conflict)` copy of every
    /// pre-existing file, because a missing baseline makes both sides read as
-    /// "changed" (see the mass first-sync conflict storm in docs/BUGS.md).
+    /// "changed" (see the mass first-sync conflict storm in docs/BUGS.md). Size
+    /// alone is not enough: a second machine joining the folder would read a
+    /// different file of the same size as in step (B248).
    AdoptBaseline,
 }

@@ -313,8 +475,13 @@ pub(super) fn plan_file(
        // left the file the same length, so it was never uploaded.
        baseline.is_none_or(|base| !LocalSig::from(item).same_content(&LocalSig::from(base)))
    });
+    // Another client's new revision shows in its id even when the link's
+    // modification time and the size come out the same.
    let remote_changed = remote.is_some_and(|item| {
-        baseline.is_none_or(|base| remote_sig(base) != Some((item.mtime, item.size)))
+        baseline.is_none_or(|base| {
+            remote_sig(base) != Some((item.mtime, item.size))
+                || revision_moved(Some(base), item.revision.as_deref())
+        })
    });

    match (local, remote) {
@@ -324,10 +491,13 @@ pub(super) fn plan_file(
            (false, true) => FilePlan::Download,
            // With a baseline, both-changed is a genuine concurrent edit and must
            // be preserved as a conflict. Without one, "both changed" only means
-            // this is the first sync and there was nothing to compare to: adopt
-            // the baseline when the sizes already match rather than conflict-copy
-            // an already-identical file. Divergent sizes stay a real conflict.
-            (true, true) if baseline.is_none() && l.size == r.size => FilePlan::AdoptBaseline,
+            // this is the first sync and there was nothing to compare to: when the
+            // sizes match and Drive has a digest to compare against, the apply
+            // step hashes the local file before adopting it. Divergent sizes, or
+            // no digest, stay a real conflict: a missing digest proves nothing.
+            (true, true) if baseline.is_none() && l.size == r.size && r.sha1.is_some() => {
+                FilePlan::AdoptBaseline
+            }
            (true, true) => FilePlan::Conflict,
        },
        (Some(_), None) if baseline.is_none() || local_changed => FilePlan::UploadNew,
@@ -359,6 +529,8 @@ mod file_plan_tests {
            is_dir: false,
            mtime,
            size,
+            revision: None,
+            sha1: None,
        }
    }

@@ -376,6 +548,7 @@ mod file_plan_tests {
            local_size,
            remote_rev: Some(remote_mtime.to_string()),
            remote_hash: Some(remote_size.to_string()),
+            remote_revision_id: None,
        }
    }

@@ -497,12 +670,28 @@ mod file_plan_tests {
    fn first_sync_of_an_identical_file_adopts_the_baseline_not_a_conflict() {
        // No baseline yet (first sync). Same size on both sides is a pre-existing
        // identical file, not a concurrent edit: adopt it rather than cut a
-        // conflict copy of every file in the folder.
+        // conflict copy of every file in the folder. The apply step still
+        // hashes the local file before it records anything.
+        let local = local(10, 40);
+        let remote = RemoteItem {
+            sha1: Some("da39a3ee".into()),
+            ..remote(30, 40)
+        };
+        assert_eq!(
+            plan_file(Some(&local), Some(&remote), None),
+            FilePlan::AdoptBaseline
+        );
+    }
+
+    /// A file on Drive without a digest cannot be compared without a download,
+    /// and the same size is not the same content (B248).
+    #[test]
+    fn first_sync_without_a_remote_digest_is_a_conflict() {
        let local = local(10, 40);
        let remote = remote(30, 40);
        assert_eq!(
            plan_file(Some(&local), Some(&remote), None),
-            FilePlan::AdoptBaseline
+            FilePlan::Conflict
        );
    }

@@ -518,6 +707,73 @@ mod file_plan_tests {
        );
    }

+    /// Another computer's new revision can leave the modification time and
+    /// the size as they were. The revision id still tells it apart (B249).
+    #[test]
+    fn a_new_remote_revision_is_a_change_even_at_the_same_mtime_and_size() {
+        let mut base = baseline(10, 20, 30, 40);
+        base.remote_revision_id = Some("r1".into());
+        let unedited = local(10, 20);
+        let same = RemoteItem {
+            revision: Some("r1".into()),
+            ..remote(30, 40)
+        };
+        let newer = RemoteItem {
+            revision: Some("r2".into()),
+            ..remote(30, 40)
+        };
+        assert_eq!(
+            plan_file(Some(&unedited), Some(&same), Some(&base)),
+            FilePlan::Unchanged
+        );
+        assert_eq!(
+            plan_file(Some(&unedited), Some(&newer), Some(&base)),
+            FilePlan::Download
+        );
+        let edited = local(11, 20);
+        assert_eq!(
+            plan_file(Some(&edited), Some(&newer), Some(&base)),
+            FilePlan::Conflict
+        );
+
+        // A row from before schema 44 has no id to compare, and a node read
+        // without one says nothing: both fall back to the signature.
+        let old = baseline(10, 20, 30, 40);
+        assert_eq!(
+            plan_file(Some(&unedited), Some(&newer), Some(&old)),
+            FilePlan::Unchanged
+        );
+        assert_eq!(
+            plan_file(Some(&unedited), Some(&remote(30, 40)), Some(&base)),
+            FilePlan::Unchanged
+        );
+    }
+
+    /// The walk reuses the recorded size only while the revision is the one
+    /// the baseline holds.
+    #[test]
+    fn a_moved_revision_makes_the_walk_read_the_size_again() {
+        let mut base = baseline(10, 20, 30, 40);
+        base.remote_revision_id = Some("r1".into());
+        let rows = HashMap::from([("file".to_string(), base)]);
+        assert_eq!(
+            unchanged_remote_size(&rows, "file", 30, Some("r1")),
+            Some(40)
+        );
+        assert_eq!(unchanged_remote_size(&rows, "file", 30, None), Some(40));
+        assert_eq!(unchanged_remote_size(&rows, "file", 30, Some("r2")), None);
+        assert_eq!(unchanged_remote_size(&rows, "file", 31, Some("r1")), None);
+    }
+
+    /// A row without a revision id reuses its size only while Drive gives no
+    /// id either (B254).
+    #[test]
+    fn a_row_without_a_revision_makes_the_walk_read_the_size_again() {
+        let rows = HashMap::from([("file".to_string(), baseline(10, 20, 30, 40))]);
+        assert_eq!(unchanged_remote_size(&rows, "file", 30, Some("r1")), None);
+        assert_eq!(unchanged_remote_size(&rows, "file", 30, None), Some(40));
+    }
+
    #[test]
    fn a_missing_remote_signature_is_treated_as_changed() {
        let local = local(10, 20);
@@ -530,4 +786,96 @@ mod file_plan_tests {
            FilePlan::Download
        );
    }
+
+    fn uid(id: &str) -> NodeUid {
+        NodeUid::new(VolumeId::from("v"), LinkId::from(id))
+    }
+
+    fn folder() -> RemoteItem {
+        RemoteItem {
+            is_dir: true,
+            mtime: 0,
+            size: 0,
+            ..remote(0, 0)
+        }
+    }
+
+    /// An empty or failed remote listing must not read as "Drive deleted
+    /// everything" and delete the local copies.
+    #[test]
+    fn the_remote_wipe_guard_blocks_only_a_total_disappearance() {
+        let base = HashMap::from([("a".to_string(), ()), ("b".to_string(), ())]);
+        let none: HashMap<String, RemoteItem> = HashMap::new();
+        assert!(guard_remote_wipe(&base, &none).is_err());
+        let one = HashMap::from([("b".to_string(), remote(1, 1))]);
+        assert!(guard_remote_wipe(&base, &one).is_ok());
+        let empty: HashMap<String, ()> = HashMap::new();
+        assert!(guard_remote_wipe(&empty, &none).is_ok());
+    }
+
+    /// A node that failed to decrypt has no name, so everything a short
+    /// listing did not return is left out, and nothing else.
+    #[test]
+    fn a_short_remote_listing_hides_what_it_did_not_return() {
+        let remote = HashMap::from([
+            ("docs".to_string(), folder()),
+            ("docs/a.txt".to_string(), remote(1, 1)),
+            ("pics".to_string(), folder()),
+        ]);
+        let dirs = HashMap::from([
+            (String::new(), uid("root")),
+            ("docs".to_string(), uid("docs")),
+            ("pics".to_string(), uid("pics")),
+        ]);
+        let mut gaps = RemoteGaps::default();
+        assert!(!gaps.hides("docs/b.txt", &remote, &dirs));
+        gaps.short_listing("docs");
+        // Returned paths stand; unreturned ones under the short folder hide,
+        // and so does anything under a subfolder it failed to return.
+        assert!(!gaps.hides("docs/a.txt", &remote, &dirs));
+        assert!(gaps.hides("docs/b.txt", &remote, &dirs));
+        assert!(gaps.hides("docs/sub/deep.txt", &remote, &dirs));
+        // A complete sibling listing still reads deletions as deletions.
+        assert!(!gaps.hides("pics/gone.jpg", &remote, &dirs));
+        assert!(!gaps.hides("top.txt", &remote, &dirs));
+        gaps.short_listing("");
+        assert!(gaps.hides("top.txt", &remote, &dirs));
+    }
+
+    #[test]
+    fn a_file_whose_size_could_not_be_read_is_hidden() {
+        let remote: HashMap<String, RemoteItem> = HashMap::new();
+        let dirs = HashMap::from([(String::new(), uid("root"))]);
+        let mut gaps = RemoteGaps::default();
+        gaps.unread("a.txt".to_string());
+        assert!(gaps.hides("a.txt", &remote, &dirs));
+        assert!(!gaps.hides("b.txt", &remote, &dirs));
+        assert_eq!(gaps.report(), ["a.txt (cannot be read on Proton Drive)"]);
+    }
+
+    /// A folder deleted here holds another device's new work on Drive, so
+    /// trashing it would lose that work.
+    #[test]
+    fn a_remote_folder_with_new_or_changed_files_is_not_trashed() {
+        let mut base = HashMap::from([
+            ("x".to_string(), baseline(0, 0, 0, 0)),
+            ("x/old.txt".to_string(), baseline(1, 1, 5, 6)),
+        ]);
+        let mut remote_tree = HashMap::from([
+            ("x".to_string(), folder()),
+            ("x/old.txt".to_string(), remote(5, 6)),
+            ("xy/new.txt".to_string(), remote(1, 1)),
+        ]);
+        // Unchanged under x; a name-prefixed sibling does not count.
+        assert_eq!(remote_subtree_changed("x", &remote_tree, &base), None);
+
+        remote_tree.insert("x/old.txt".to_string(), remote(9, 6));
+        assert!(remote_subtree_changed("x", &remote_tree, &base).is_some());
+
+        remote_tree.insert("x/old.txt".to_string(), remote(5, 6));
+        remote_tree.insert("x/sub".to_string(), folder());
+        assert!(remote_subtree_changed("x", &remote_tree, &base).is_some());
+        base.insert("x/sub".to_string(), baseline(0, 0, 0, 0));
+        assert_eq!(remote_subtree_changed("x", &remote_tree, &base), None);
+    }
 }
@@ -25,7 +25,7 @@ use std::collections::{BTreeMap, HashMap};
 use std::io::Read;
 use std::path::PathBuf;
 use std::sync::Arc;
-use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};

 use pdfs_core::control::{ActivityKind, ImportSummary, TransferDirection};
 use pdfs_core::takeout::{Bucket, TakeoutPhoto, TakeoutScan, scan_archives};
@@ -36,6 +36,7 @@ use sha1::{Digest, Sha1};
 use tracing::{info, warn};

 use super::Core;
+use crate::photos::can_make_thumbnail;
 use crate::transfers::CountingReader;

 /// The one import this daemon may be running, and how the last one ended.
@@ -136,6 +137,30 @@ fn read_entry<R>(
 }

 impl Core {
+    /// Copy archive entry `entry` into the thumbnail staging folder and return
+    /// its path. The caller removes it.
+    fn stage_takeout_entry(
+        &self,
+        archive: &mut zip::ZipArchive<std::io::BufReader<std::fs::File>>,
+        entry: &str,
+    ) -> CoreResult<PathBuf> {
+        static STAGED: AtomicU64 = AtomicU64::new(0);
+        let path = self.cache.raw_thumbnail_staging_dir().join(format!(
+            "takeout-{}-{}",
+            std::process::id(),
+            STAGED.fetch_add(1, Ordering::Relaxed)
+        ));
+        let copied = read_entry(archive, entry, |reader| {
+            let mut file = std::fs::File::create(&path)?;
+            std::io::copy(reader, &mut file)
+        })?;
+        if let Err(e) = copied {
+            let _ = std::fs::remove_file(&path);
+            return Err(CoreError::internal(format!("copy {entry}: {e}")));
+        }
+        Ok(path)
+    }
+
    /// Import Google Photos Takeout archives. Blocking; run on its own thread.
    ///
    /// `cancel` stops the run at the next photo boundary — an upload already on
@@ -321,18 +346,65 @@ impl Core {
                    capture_time: photo.capture_time,
                    ..Default::default()
                };
-                let uploaded = read_entry(&mut archive, &photo.entry, |reader| {
-                    let counting = CountingReader::new(reader, &guard);
-                    self.rt.block_on(photos.upload_photo_from(
-                        &photo.name,
-                        &photo.media_type,
-                        counting,
-                        photo.size as i64,
-                        Vec::new(),
-                        metadata,
-                        false,
-                    ))
-                });
+                // A thumbnail is made from a file, so a photo that can have one
+                // is copied out of the archive first and uploaded from the copy.
+                // Without one, Proton's apps show a blank tile until they make
+                // their own.
+                let staged = can_make_thumbnail(&photo.name, photo.size)
+                    .then(|| self.stage_takeout_entry(&mut archive, &photo.entry))
+                    .and_then(|staged| {
+                        staged
+                            .inspect_err(|e| {
+                                warn!(name = photo.name, error = %e,
+                                      "copying a takeout photo out failed; uploading it without a thumbnail")
+                            })
+                            .ok()
+                    });
+                let uploaded = match &staged {
+                    Some(path) => {
+                        let thumbnails = self.upload_thumbnails(path, &photo.name);
+                        // No sidecar and no date in the name: the photo's own
+                        // EXIF, before Drive files it under today.
+                        let metadata = PhotoUploadMetadata {
+                            capture_time: metadata
+                                .capture_time
+                                .or_else(|| pdfs_core::exiftime::capture_time_of(path)),
+                            ..metadata
+                        };
+                        std::fs::File::open(path)
+                            .map_err(|e| {
+                                CoreError::internal(format!("open {}: {e}", path.display()))
+                            })
+                            .map(|file| {
+                                let counting =
+                                    CountingReader::new(std::io::BufReader::new(file), &guard);
+                                self.rt.block_on(photos.upload_photo_from(
+                                    &photo.name,
+                                    &photo.media_type,
+                                    counting,
+                                    photo.size as i64,
+                                    thumbnails,
+                                    metadata,
+                                    false,
+                                ))
+                            })
+                    }
+                    None => read_entry(&mut archive, &photo.entry, |reader| {
+                        let counting = CountingReader::new(reader, &guard);
+                        self.rt.block_on(photos.upload_photo_from(
+                            &photo.name,
+                            &photo.media_type,
+                            counting,
+                            photo.size as i64,
+                            Vec::new(),
+                            metadata,
+                            false,
+                        ))
+                    }),
+                };
+                if let Some(path) = staged {
+                    let _ = std::fs::remove_file(path);
+                }
                drop(guard);
                job.step();

@@ -480,7 +552,15 @@ impl Core {
                let mut state = IMPORT.lock();
                state.running = false;
                state.cancel = None;
-                state.last = outcome.as_ref().ok().cloned();
+                // A failed run is reported too: without it, `--wait` read
+                // "no import has run" and exited as if all was well.
+                state.last = Some(match &outcome {
+                    Ok(summary) => summary.clone(),
+                    Err(e) => ImportSummary {
+                        error: Some(e.to_string()),
+                        ..Default::default()
+                    },
+                });
            }
            match outcome {
                Ok(summary) => {
@@ -545,7 +625,7 @@ pub(crate) fn sha1_of(reader: &mut (dyn Read + Send)) -> CoreResult<String> {
    Ok(hex_lower(&hasher.finalize()))
 }

-fn hex_lower(bytes: &[u8]) -> String {
+pub(crate) fn hex_lower(bytes: &[u8]) -> String {
    let mut out = String::with_capacity(bytes.len() * 2);
    for byte in bytes {
        out.push_str(&format!("{byte:02x}"));
@@ -125,6 +125,11 @@ impl TransferRegistry {
        self.download_limit.set(download);
    }

+    /// The upload cap in bytes per second, `0` when there is none.
+    pub fn upload_cap(&self) -> u64 {
+        self.upload_limit.rate.load(Ordering::Relaxed)
+    }
+
    fn limit(&self, direction: TransferDirection) -> &RateLimit {
        match direction {
            TransferDirection::Upload => &self.upload_limit,
@@ -10,9 +10,14 @@
 //! `dead_code` allowances below are for — not code nobody uses.

 use std::path::{Path, PathBuf};
+use std::time::Duration;

 use pdfs_core::control::{PhotoKind, SearchHit};

+/// How long a `stat` of the mount may take before the file counts as not
+/// there. A frozen mount never answers, and every caller has a fallback.
+const STAT_TIMEOUT: Duration = Duration::from_secs(2);
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub(crate) enum DriveActivation {
    Folder,
@@ -55,18 +60,32 @@ pub(crate) fn mounted_target(mountpoint: &Path, hit: &SearchHit) -> Option<PathB
    present(mounted_or_relative(mountpoint, hit))
 }

-/// [`mounted_target`] for callers holding a mountpoint-relative path rather
-/// than a search hit — the browser's listing entries, which are by definition
-/// paths in the primary mount's tree.
-#[allow(dead_code)] // browser only
-pub(crate) fn mounted_target_rel(mountpoint: &Path, relative_path: &str) -> Option<PathBuf> {
-    present(mounted_path(mountpoint, relative_path))
-}
-
 fn present(path: PathBuf) -> Option<PathBuf> {
    path.symlink_metadata().is_ok().then_some(path)
 }

+/// Whether anything is at `path`, asked on a thread of its own and given up
+/// on after [`STAT_TIMEOUT`]. `None` means "not there" or "no answer".
+///
+/// For the GTK binaries, whose main thread must not `stat` the mount: a
+/// mount that hangs hung the whole window with it. The thread of a `stat`
+/// that never returns is left behind; there is no way to cancel one.
+#[allow(dead_code)] // GTK binaries only
+pub(crate) async fn present_within(path: PathBuf) -> Option<PathBuf> {
+    let (tx, rx) = async_channel::bounded(1);
+    std::thread::spawn(move || {
+        let _ = tx.send_blocking(present(path));
+    });
+    match gtk4::glib::future_with_timeout(STAT_TIMEOUT, rx.recv()).await {
+        Ok(Ok(target)) => target,
+        Ok(Err(_)) => None,
+        Err(_) => {
+            tracing::warn!("the mount did not answer in time");
+            None
+        }
+    }
+}
+
 /// The mount path for a hit, whether or not anything is there — for callers
 /// that have no fallback (a folder cannot be materialised) or already know the
 /// entry came from a mount listing.
@@ -10,6 +10,7 @@ pub(crate) mod pages;
 pub(crate) mod reload;
 #[path = "../theme.rs"]
 pub(crate) mod theme;
+pub(crate) mod update;
 pub(crate) mod widgets;

 use compat::*;
@@ -33,6 +34,7 @@ use pages::trash::*;
 use pages::verify::*;
 use reload::{LoadTicket, Loader, replace_items};
 use theme::{load_resources, proton_theme_active, set_proton_theme};
+use update::*;
 use widgets::compat::*;
 use widgets::crumb::*;
 use widgets::details::*;
@@ -69,7 +71,7 @@ use gtk4::glib::BoxedAnyObject;

 use pdfs_core::auth;

-use pdfs_core::config::{AppDirs, FileSort, FilesView};
+use pdfs_core::config::{AppDirs, FileSort, FilesView, WindowState};

 use pdfs_core::control::{
    ActivityEntry, ActivityKind, AlbumInfo, BookmarkInfo, ConflictInfo, ConflictKeep, DeviceInfo,
@@ -130,8 +132,12 @@ struct Ui {
    /// the page stack; [`sync_sidebar`] mirrors navigation that starts elsewhere.
    sidebar: gtk4::ListBox,
    /// The sidebar/content split. Collapsed while signed out, so the login page
-    /// owns the whole window and no destination is reachable without a session.
+    /// owns the whole window and no destination is reachable without a session,
+    /// and while the window is [`narrow`](Self::narrow).
    nav: adw::NavigationSplitView,
+    /// The window is too narrow for the sidebar beside a page, so the two take
+    /// turns. Set by the narrow breakpoint; [`refresh`] reads it.
+    narrow: Cell<bool>,
    /// Shared thumbnails for ordinary image files outside the Photos gallery.
    /// One cache and request queue serves Files, search, Shared and Trash, so
    /// the same image is downloaded and decoded only once.
@@ -151,6 +157,7 @@ struct Ui {
    pub(crate) locations: LocationsState,
    pub(crate) activity: ActivityState,
    pub(crate) takeout: TakeoutState,
+    pub(crate) update: UpdateState,
 }

 impl Ui {
@@ -297,7 +304,10 @@ fn present_window(app: &adw::Application) {
 /// Spawn the tray icon process in the background.
 pub(crate) fn spawn_tray() {
    match Command::new("pdfs-tray").spawn() {
-        Ok(_) => tracing::info!("spawned `pdfs-tray`"),
+        Ok(child) => {
+            tracing::info!("spawned `pdfs-tray`");
+            pdfs_core::opener::reap(child);
+        }
        Err(e) => tracing::error!("failed to spawn `pdfs-tray`: {e}"),
    }
 }
@@ -318,7 +328,9 @@ fn build_window(app: &adw::Application) {
        tracing::warn!("cannot create the app's directories: {e}");
    }

-    let stack = adw::ViewStack::new();
+    // Not homogeneous: each page sets the window's minimum width only while it
+    // is shown, so the widest page does not hold every other one wide.
+    let stack = adw::ViewStack::builder().hhomogeneous(false).build();
    let (login_page, login_widgets) = build_login_page();
    let main_widgets = build_main_page();
    let (browser_page, browser_widgets) = build_browser_page();
@@ -336,8 +348,12 @@ fn build_window(app: &adw::Application) {
    login_frame.add_top_bar(&{
        let header = adw::HeaderBar::new();
        header.set_show_title(false);
+        // The split is collapsed while signed out; going "back" would only
+        // uncover a sidebar with nowhere to go.
+        header.set_show_back_button(false);
        header
    });
+    login_frame.add_top_bar(&login_widgets.keyring_banner);
    login_frame.set_content(Some(&login_page));
    stack.add_named(&login_frame, Some("login"));
    stack.add_named(&browser_page, Some("browser"));
@@ -352,7 +368,8 @@ fn build_window(app: &adw::Application) {
    // Sidebar: the signed-in destinations. Selecting a row swaps the page stack;
    // `sync_sidebar` pushes the other way when navigation happens elsewhere (e.g.
    // login lands on Files).
-    let (sidebar_page, sidebar_list) = build_sidebar(&main_widgets.footer);
+    let update = UpdateState::new();
+    let (sidebar_page, sidebar_list) = build_sidebar(&main_widgets.footer, &update.banner);

    // Every page brings its own header bar (see `page_frame`), so the content
    // side is the bare stack.
@@ -365,6 +382,8 @@ fn build_window(app: &adw::Application) {
        .content(&content_page)
        .min_sidebar_width(200.0)
        .max_sidebar_width(240.0)
+        // A narrow window opens on the page, not the sidebar.
+        .show_content(true)
        .build();

    // Toasts float over everything, so a report from a background action reaches
@@ -372,17 +391,22 @@ fn build_window(app: &adw::Application) {
    let toasts = adw::ToastOverlay::new();
    toasts.set_child(Some(&split));

+    let (startup_session, keyring_error) = match read_session() {
+        Ok(session) => (session, None),
+        Err(e) => (None, Some(e)),
+    };
    let ui = Rc::new(Ui {
        dirs,
        stack: stack.clone(),
        toasts: toasts.clone(),
        busy: Cell::new(0),
        opening: RefCell::new(HashSet::new()),
-        session: RefCell::new(auth::load().ok()),
+        session: RefCell::new(startup_session),
        unlock_offered: Cell::new(false),
        mounted: RefCell::new(false),
        sidebar: sidebar_list.clone(),
        nav: split.clone(),
+        narrow: Cell::new(false),
        file_thumbs: FileThumbnailState::new(),
        login: login_widgets,
        status: StatusState {
@@ -412,6 +436,7 @@ fn build_window(app: &adw::Application) {
            theme_row: main_widgets.theme_row.clone(),
            online_map_row: main_widgets.online_map_row.clone(),
            tray_row: main_widgets.tray_row.clone(),
+            update_row: main_widgets.update_row.clone(),
            language_row: main_widgets.language_row.clone(),
            settings_suppress: Cell::new(false),
            budget_source: RefCell::new(None),
@@ -634,8 +659,12 @@ fn build_window(app: &adw::Application) {
            running: Cell::new(false),
            dry_run: Cell::new(false),
        },
+        update,
    });
    wire_login(&ui);
+    if let Some(e) = keyring_error {
+        keyring_unreadable(&ui, &e);
+    }
    let ui_status = ui.clone();
    main_widgets
        .status_button
@@ -677,6 +706,7 @@ fn build_window(app: &adw::Application) {
    wire_activity(&ui, &activity_widgets);
    wire_takeout(&ui, &takeout_widgets);
    wire_retry(&ui);
+    wire_update(&ui);

    // Lazily load the Files / Photos pages the first time they're shown, so the
    // network round-trip only happens on demand rather than on every refresh.
@@ -713,13 +743,18 @@ fn build_window(app: &adw::Application) {
        }
    });

+    let saved = ui.dirs.load_config().window.usable();
    let window = adw::ApplicationWindow::builder()
        .application(app)
        .title("Proton Drive")
-        .default_width(980)
-        .default_height(680)
+        .default_width(saved.width)
+        .default_height(saved.height)
+        .maximized(saved.maximized)
+        .width_request(WindowState::MIN_WIDTH)
+        .height_request(WindowState::MIN_HEIGHT)
        .content(&toasts)
        .build();
+    remember_window_state(&ui, app, &window);
    // A wide window docks the details pane beside the files instead of laying it
    // over them.
    let wide = adw::Breakpoint::new(
@@ -727,6 +762,18 @@ fn build_window(app: &adw::Application) {
    );
    wide.add_setter(&ui.browser.split, "collapsed", Some(&false.to_value()));
    window.add_breakpoint(wide);
+    // A narrow window shows the sidebar and the page in turn, so every header
+    // bar keeps room for the window buttons. Signals rather than a setter:
+    // `refresh` decides the collapse while signed out, and would undo one.
+    let narrow = adw::Breakpoint::new(
+        adw::BreakpointCondition::parse("max-width: 760sp").expect("static breakpoint"),
+    );
+    narrow.add_setter(&ui.browser.search, "width-chars", Some(&8.to_value()));
+    let ui_narrow = ui.clone();
+    narrow.connect_apply(move |_| set_narrow(&ui_narrow, true));
+    let ui_wide = ui.clone();
+    narrow.connect_unapply(move |_| set_narrow(&ui_wide, false));
+    window.add_breakpoint(narrow);
    install_shortcuts(&ui, &window);
    install_window_actions(&ui, &window);
    install_launch_actions(&ui, app, &window);
@@ -740,6 +787,51 @@ fn build_window(app: &adw::Application) {
    window.present();
 }

+/// Follow the narrow breakpoint. While signed out the login page keeps the
+/// split collapsed whatever the width.
+fn set_narrow(ui: &Ui, narrow: bool) {
+    ui.narrow.set(narrow);
+    if ui.session.borrow().is_some() {
+        ui.nav.set_collapsed(narrow);
+    }
+}
+
+/// Save the window's size when it closes, and when the app quits with the
+/// window still open (Ctrl+Q, the tray's Quit), which never asks it to close.
+fn remember_window_state(ui: &Rc<Ui>, app: &adw::Application, window: &adw::ApplicationWindow) {
+    let ui_close = ui.clone();
+    window.connect_close_request(move |window| {
+        save_window_state(&ui_close, window);
+        glib::Propagation::Proceed
+    });
+    let ui_quit = ui.clone();
+    let window_quit = window.downgrade();
+    app.connect_shutdown(move |_| {
+        if let Some(window) = window_quit.upgrade() {
+            save_window_state(&ui_quit, &window);
+        }
+    });
+}
+
+/// Write the window's unmaximised size and maximised state to the config, if
+/// either changed. Runs as the window goes away, so a failure is only logged.
+fn save_window_state(ui: &Ui, window: &adw::ApplicationWindow) {
+    let (width, height) = window.default_size();
+    let state = WindowState {
+        width,
+        height,
+        maximized: window.is_maximized(),
+    };
+    let mut config = ui.dirs.load_config();
+    if config.window == state {
+        return;
+    }
+    config.window = state;
+    if let Err(e) = ui.dirs.save_config(&config) {
+        tracing::warn!("cannot save the window size: {e}");
+    }
+}
+
 /// Whether `window` is minimised or otherwise out of sight (another workspace,
 /// fully covered), as far as the compositor tells us.
 fn window_hidden(window: &adw::ApplicationWindow) -> bool {
@@ -786,10 +878,13 @@ const DESTINATIONS: [(&str, &str, &str); 7] = [
 /// Index of the first row in the sidebar's sync section.
 const SIDEBAR_SYNC_SECTION: i32 = 6;

-/// The navigation sidebar: the destinations over a footer carrying the sync
-/// status, the account quota and the account menu. Returns the page (for the
+/// The navigation sidebar: the destinations under the update banner and over a
+/// footer carrying the sync status, the account quota and the account menu. Returns the page (for the
 /// split view) and the list (to drive + reflect the current page).
-fn build_sidebar(footer: &gtk4::Box) -> (adw::NavigationPage, gtk4::ListBox) {
+fn build_sidebar(
+    footer: &gtk4::Box,
+    update_banner: &adw::Banner,
+) -> (adw::NavigationPage, gtk4::ListBox) {
    let list = gtk4::ListBox::new();
    list.set_selection_mode(gtk4::SelectionMode::Single);
    list.add_css_class("navigation-sidebar");
@@ -842,6 +937,7 @@ fn build_sidebar(footer: &gtk4::Box) -> (adw::NavigationPage, gtk4::ListBox) {
        .build();
    let toolbar = adw::ToolbarView::new();
    toolbar.add_top_bar(&header);
+    toolbar.add_top_bar(update_banner);
    toolbar.set_content(Some(&scroll));
    toolbar.add_bottom_bar(footer);

@@ -867,6 +963,18 @@ fn set_busy_spinners(visible: bool) {
    });
 }

+/// `row` in a frame that scrolls sideways once the window is too narrow for it,
+/// so a row of labelled buttons never sets the window's minimum width.
+fn scroll_sideways(row: &impl IsA<gtk4::Widget>) -> gtk4::ScrolledWindow {
+    gtk4::ScrolledWindow::builder()
+        .hscrollbar_policy(gtk4::PolicyType::Automatic)
+        .vscrollbar_policy(gtk4::PolicyType::Never)
+        .propagate_natural_width(true)
+        .propagate_natural_height(true)
+        .child(row)
+        .build()
+}
+
 /// A destination page's frame: its own header bar over the page content, the
 /// way GNOME apps lay a split view out. The title sits in the middle with the
 /// busy spinner beside it; the page packs its actions into the returned header
@@ -930,6 +1038,14 @@ fn wire_sidebar(ui: &Rc<Ui>) {
            ui_row.stack.set_visible_child_name(page);
        }
    });
+    // In a narrow window the sidebar covers the page, so picking a row, even
+    // the selected one, has to bring the page forward.
+    let ui_open = ui.clone();
+    ui.sidebar.connect_row_activated(move |_, _| {
+        if ui_open.nav.is_collapsed() {
+            ui_open.nav.set_show_content(true);
+        }
+    });
 }

 /// Re-fetch the visible page from the server, bypassing every layer of cache
@@ -1065,8 +1181,17 @@ pub(crate) fn set_sidebar_badge(ui: &Ui, page: &str, count: u64) {
 /// Show a transient toast. Non-blocking by design: an action's outcome is
 /// reported without stealing focus or forcing a click, so the user can keep
 /// working while a slow upload lands.
+///
+/// A toast's title is Pango markup unless told otherwise. Messages carry file
+/// names and daemon errors, and one with a `&` or `<` in it showed as an empty
+/// toast, so every toast here is plain text.
 fn toast(ui: &Rc<Ui>, message: &str) {
-    ui.toasts.add_toast(adw::Toast::new(message));
+    ui.toasts.add_toast(
+        adw::Toast::builder()
+            .title(message)
+            .use_markup(false)
+            .build(),
+    );
 }

 /// Show a toast that offers one follow-up action — an Undo, or a way to the page
@@ -1077,6 +1202,7 @@ fn toast(ui: &Rc<Ui>, message: &str) {
 fn toast_action(ui: &Rc<Ui>, message: &str, label: &str, action: impl Fn(&Rc<Ui>) + 'static) {
    let toast = adw::Toast::builder()
        .title(message)
+        .use_markup(false)
        .button_label(label)
        .timeout(8)
        .build();
@@ -1099,7 +1225,11 @@ fn toast_error(ui: &Rc<Ui>, what: &str, detail: &str) {
        gettext_f("{what}: {detail}", &[("what", what), ("detail", detail)])
    };
    tracing::warn!("{message}");
-    let toast = adw::Toast::builder().title(&message).timeout(6).build();
+    let toast = adw::Toast::builder()
+        .title(&message)
+        .use_markup(false)
+        .timeout(6)
+        .build();
    ui.toasts.add_toast(toast);
 }

@@ -1699,9 +1829,12 @@ pub(crate) fn flash_copied(button: &gtk4::Button, icon: &'static str) {

 /// Open a local path with the handler the user configured — `xdg-open` unless
 /// `open_with` in `config.json` overrides it for this kind of file.
+///
+/// On a thread of its own: telling a folder from a file is a `stat`, and the
+/// path is often in the mount, which may hang.
 fn open_path(path: &str) {
-    let path = Path::new(path);
-    pdfs_core::opener::open_default(path, path.is_dir());
+    let path = PathBuf::from(path);
+    std::thread::spawn(move || pdfs_core::opener::open_default(&path, path.is_dir()));
 }

 /// [`open_path`] for a file the daemon materialised into the content cache,
@@ -378,7 +378,9 @@ pub(crate) fn activity_status(
 ) {
    ui.activity.status.set_icon_name(Some(icon));
    ui.activity.status.set_title(title);
-    ui.activity.status.set_description(Some(description));
+    ui.activity
+        .status
+        .set_description(Some(&gtk4::glib::markup_escape_text(description)));
    ui.activity.retry.set_visible(retry);
    ui.activity.content.set_visible_child_name("status");
 }
@@ -645,7 +645,9 @@ pub(crate) fn close_album(ui: &Rc<Ui>) {
 fn albums_status(ui: &Rc<Ui>, icon: &str, title: &str, description: &str) {
    ui.gallery.albums_status.set_icon_name(Some(icon));
    ui.gallery.albums_status.set_title(title);
-    ui.gallery.albums_status.set_description(Some(description));
+    ui.gallery
+        .albums_status
+        .set_description(Some(&gtk4::glib::markup_escape_text(description)));
    ui.gallery.albums_stack.set_visible_child_name("status");
 }

@@ -1,4 +1,4 @@
-use crate::activation::{DriveActivation, drive_activation, mounted_path, mounted_target_rel};
+use crate::activation::{DriveActivation, drive_activation, mounted_path, present_within};
 use crate::*;

 pub(crate) struct BrowserState {
@@ -376,7 +376,7 @@ pub(crate) fn build_browser_page() -> (gtk4::Widget, BrowserWidgets) {
    bulk_box.append(&bulk_clear);
    let bulk = gtk4::Revealer::builder()
        .transition_type(gtk4::RevealerTransitionType::SlideDown)
-        .child(&bulk_box)
+        .child(&scroll_sideways(&bulk_box))
        .build();

    // The status bar: contextual text (stretch 1), then the icon-size slider.
@@ -500,7 +500,9 @@ pub(crate) fn build_browser_page() -> (gtk4::Widget, BrowserWidgets) {
 pub(crate) fn browser_status(ui: &Rc<Ui>, icon: &str, title: &str, description: &str, retry: bool) {
    ui.browser.status.set_icon_name(Some(icon));
    ui.browser.status.set_title(title);
-    ui.browser.status.set_description(Some(description));
+    ui.browser
+        .status
+        .set_description(Some(&gtk4::glib::markup_escape_text(description)));
    ui.browser.retry.set_visible(retry);
    // Only the empty-folder state offers a way to fill the folder; every other
    // status (loading, offline, error) turns them back off.
@@ -981,28 +983,27 @@ pub(crate) fn background_context_menu(ui: &Rc<Ui>) -> ActionMenu {
 pub(crate) fn open_entry_with(ui: &Rc<Ui>, entry: &DirEntry) {
    let rel = entry_rel(ui, entry);
    let mountpoint = ui.dirs.resolved_mountpoint(&ui.dirs.load_config());
-    let Some(path) = mounted_target_rel(&mountpoint, &rel) else {
-        toast_error(
-            ui,
-            &gettext("Couldn't open file"),
-            &gettext("Open With needs the Proton Drive service to be running."),
-        );
-        return;
-    };
-    let launcher = gtk4::FileLauncher::new(Some(&gio::File::for_path(path)));
-    launcher.set_always_ask(true);
    let ui = ui.clone();
-    launcher.launch(
-        ui_window(&ui).as_ref(),
-        gio::Cancellable::NONE,
-        move |result| {
+    glib::spawn_future_local(async move {
+        let Some(path) = present_within(mounted_path(&mountpoint, &rel)).await else {
+            toast_error(
+                &ui,
+                &gettext("Couldn't open file"),
+                &gettext("Open With needs the Proton Drive service to be running."),
+            );
+            return;
+        };
+        let launcher = gtk4::FileLauncher::new(Some(&gio::File::for_path(path)));
+        launcher.set_always_ask(true);
+        let window = ui_window(&ui);
+        launcher.launch(window.as_ref(), gio::Cancellable::NONE, move |result| {
            if let Err(e) = result
                && !e.matches(gtk4::DialogError::Dismissed)
            {
                toast_error(&ui, &gettext("Couldn't open file"), &e.to_string());
            }
-        },
-    );
+        });
+    });
 }

 /// Copy the entry's public link, when it has one this client can read the
@@ -1110,27 +1111,29 @@ pub(crate) fn activate_entry(ui: &Rc<Ui>, entry: &DirEntry) {
 /// [`mounted_target`](crate::activation::mounted_target).
 pub(crate) fn download_and_open(ui: &Rc<Ui>, entry: &DirEntry) {
    let rel = entry_rel(ui, entry);
-    let mountpoint = ui.dirs.resolved_mountpoint(&ui.dirs.load_config());
-    if let Some(path) = mounted_target_rel(&mountpoint, &rel) {
-        open_path(&path.to_string_lossy());
-        return;
-    }
-    // Ignore a repeat activation of a file already downloading, so an impatient
-    // double-click doesn't kick off a second round-trip.
+    // Ignore a repeat activation of a file already opening, so an impatient
+    // double-click doesn't open it twice or kick off a second round-trip.
    if !ui.opening.borrow_mut().insert(rel.clone()) {
        return;
    }
-    ui.busy_begin();
-    let name = entry.name.clone();
-    let rx = spawn_request(
-        ui.dirs.control_socket(),
-        Request::OpenFile {
-            path: rel.clone(),
-            uid: Some(entry.uid.clone()),
-        },
-    );
+    let mountpoint = ui.dirs.resolved_mountpoint(&ui.dirs.load_config());
+    let (name, uid) = (entry.name.clone(), entry.uid.clone());
    let ui = ui.clone();
    glib::spawn_future_local(async move {
+        // Asked off the main thread: a mount that hangs used to hang the app.
+        if let Some(path) = present_within(mounted_path(&mountpoint, &rel)).await {
+            ui.opening.borrow_mut().remove(&rel);
+            open_path(&path.to_string_lossy());
+            return;
+        }
+        ui.busy_begin();
+        let rx = spawn_request(
+            ui.dirs.control_socket(),
+            Request::OpenFile {
+                path: rel.clone(),
+                uid: Some(uid),
+            },
+        );
        let result = rx.recv().await;
        ui.busy_end();
        ui.opening.borrow_mut().remove(&rel);
@@ -204,7 +204,9 @@ pub(crate) fn wire_devices(ui: &Rc<Ui>, widgets: &DevicesWidgets) {
 pub(crate) fn devices_status(ui: &Rc<Ui>, icon: &str, title: &str, description: &str, retry: bool) {
    ui.devices.status.set_icon_name(Some(icon));
    ui.devices.status.set_title(title);
-    ui.devices.status.set_description(Some(description));
+    ui.devices
+        .status
+        .set_description(Some(&gtk4::glib::markup_escape_text(description)));
    ui.devices.retry.set_visible(retry);
    ui.devices.content.set_visible_child_name("status");
 }
@@ -390,6 +392,7 @@ fn this_computer_row(
    let row = adw::ActionRow::builder()
        .title(me.map_or_else(|| gettext("This computer"), |d| d.name.clone()))
        .subtitle(this_computer_subtitle(folders))
+        .use_markup(false)
        .activatable(true)
        .build();
    row.add_prefix(&gtk4::Image::from_icon_name("computer-symbolic"));
@@ -426,6 +429,7 @@ fn other_computer_row(ui: &Rc<Ui>, dev: &DeviceInfo) -> adw::ActionRow {
    let row = adw::ActionRow::builder()
        .title(&dev.name)
        .subtitle(device_subtitle(dev))
+        .use_markup(false)
        .activatable(true)
        .build();
    row.add_prefix(&gtk4::Image::from_icon_name("computer-symbolic"));
@@ -440,6 +444,10 @@ fn other_computer_row(ui: &Rc<Ui>, dev: &DeviceInfo) -> adw::ActionRow {
        prompt_restore_folders(&ui_c, Some((uid_c.clone(), name_c.clone())))
    });
    let (ui_c, uid_c, name_c) = (ui.clone(), uid.clone(), name.clone());
+    menu.item(&gettext("Sync With This Computer…"), move || {
+        prompt_join_device(&ui_c, &uid_c, &name_c)
+    });
+    let (ui_c, uid_c, name_c) = (ui.clone(), uid.clone(), name.clone());
    menu.item(&gettext("Move to This Computer…"), move || {
        prompt_migrate_device(&ui_c, &uid_c, &name_c)
    });
@@ -763,7 +771,10 @@ fn show_restore_picker(
            .active(true)
            .valign(gtk4::Align::Center)
            .build();
-        let row = adw::EntryRow::builder().title(&f.name).build();
+        let row = adw::EntryRow::builder()
+            .title(&f.name)
+            .use_markup(false)
+            .build();
        row.set_text(&f.local_path);
        row.add_prefix(&check);
        group.add(&row);
@@ -1093,6 +1104,69 @@ pub(crate) fn prompt_adopt_device(ui: &Rc<Ui>, uid: &str, name: &str) {
    dialog.present(win.as_ref());
 }

+/// Ask before syncing into another computer's device alongside it, then offer
+/// its folders for syncing here.
+///
+/// The same adoption as "Continue This Backup Here", but the other computer
+/// goes on syncing, so the dialog says what that means: the two keep the same
+/// folders in step, deletions included.
+pub(crate) fn prompt_join_device(ui: &Rc<Ui>, uid: &str, name: &str) {
+    let win = ui_window(ui);
+    let dialog = adw::AlertDialog::builder()
+        .heading(gettext("Sync With This Computer?"))
+        // Translators: {name} is the name of the other computer this one syncs with.
+        .body(gettext_f(
+            "This computer and “{name}” keep the same folders in step. A change or a deletion on one reaches the other.\n\nNew synced folders on this computer go under “{name}” in Proton Drive. Folders already synced here stay where they are. Next you choose which of its folders to sync here.",
+            &[("name", name)],
+        ))
+        .build();
+    dialog.add_response("cancel", &gettext("Cancel"));
+    dialog.add_response("join", &gettext("Sync Here"));
+    dialog.set_response_appearance("join", adw::ResponseAppearance::Suggested);
+    dialog.set_default_response(Some("cancel"));
+    dialog.set_close_response("cancel");
+    let ui = ui.clone();
+    let uid = uid.to_string();
+    // Translators: {name} is the name of the other computer this one now syncs with.
+    let done = gettext_f("Now syncing with “{name}”", &[("name", name)]);
+    dialog.connect_response(None, move |_, resp| {
+        if resp != "join" {
+            return;
+        }
+        ui.busy_begin();
+        let rx = spawn_request(
+            ui.dirs.control_socket(),
+            Request::AdoptDevice {
+                uid: Some(uid.clone()),
+            },
+        );
+        let (ui, done) = (ui.clone(), done.clone());
+        glib::spawn_future_local(async move {
+            let result = rx.recv().await;
+            ui.busy_end();
+            let failed = gettext("Couldn't sync with that computer");
+            match result {
+                Ok(Ok(Response::Ok { .. })) => {
+                    reload_sync_pages(&ui);
+                    toast(&ui, &done);
+                    // The device is this computer's now, so its own restore
+                    // picker offers the folders.
+                    prompt_restore_folders(&ui, None);
+                }
+                Ok(Ok(Response::Error { message, kind })) => {
+                    toast_failure(&ui, &failed, &message, kind)
+                }
+                _ => toast_error(
+                    &ui,
+                    &failed,
+                    &gettext("The Proton Drive service didn't respond."),
+                ),
+            }
+        });
+    });
+    dialog.present(win.as_ref());
+}
+
 /// Ask before moving another computer's folders into this computer's backup,
 /// then offer them for syncing here.
 ///
@@ -209,7 +209,8 @@ fn ask(view: &Rc<FinderView>, finder: Finder, generation: u32) {
            Ok(Ok(Response::Error { message, .. })) => {
                view.status.set_icon_name(Some("dialog-warning-symbolic"));
                view.status.set_title(&failed);
-                view.status.set_description(Some(&message));
+                view.status
+                    .set_description(Some(&gtk4::glib::markup_escape_text(&message)));
                view.progress.set_visible(false);
                return;
            }
@@ -1145,7 +1145,9 @@ pub(crate) fn locations_status(
 ) {
    ui.locations.status.set_icon_name(Some(icon));
    ui.locations.status.set_title(title);
-    ui.locations.status.set_description(Some(description));
+    ui.locations
+        .status
+        .set_description(Some(&gtk4::glib::markup_escape_text(description)));
    ui.locations.retry.set_visible(retry);
    ui.locations.content.set_visible_child_name("status");
 }
@@ -9,6 +9,9 @@ pub(crate) struct LoginState {
    /// Spins inside the Sign in button while a sign-in is running.
    pub(crate) login_spinner: Spinner,
    pub(crate) login_status: gtk4::Label,
+    /// Shown over the form while a saved sign-in exists but the keyring would
+    /// not hand it over; see [`keyring_unreadable`].
+    pub(crate) keyring_banner: adw::Banner,
 }

 /// Where the login page's account links go.
@@ -87,6 +90,12 @@ pub(crate) fn build_login_page() -> (gtk4::Widget, LoginState) {
        .child(&inner)
        .build();
    let scroll = gtk4::ScrolledWindow::builder().child(&clamp).build();
+    let keyring_banner = adw::Banner::builder()
+        .title(gettext(
+            "Couldn't read your saved sign-in. Unlock the system keyring, then try again.",
+        ))
+        .button_label(gettext("Retry"))
+        .build();

    (
        scroll.upcast(),
@@ -96,10 +105,80 @@ pub(crate) fn build_login_page() -> (gtk4::Widget, LoginState) {
            login_button,
            login_spinner,
            login_status,
+            keyring_banner,
        },
    )
 }

+/// The stored session, `None` when there is none, or the keyring's error when
+/// it could not be read. A locked or absent keyring is not a sign-out: the
+/// session is still saved, and signing in again would only replace it.
+pub(crate) fn read_session() -> pdfs_core::Result<Option<auth::StoredSession>> {
+    match auth::load() {
+        Ok(session) => Ok(Some(session)),
+        Err(pdfs_core::Error::NotLoggedIn) => Ok(None),
+        Err(e) => Err(e),
+    }
+}
+
+/// How long to wait before each automatic retry of an unreadable keyring. A
+/// keyring daemon started with the session is usually up within seconds.
+const KEYRING_RETRIES: [u32; 4] = [2, 5, 10, 30];
+
+/// The keyring refused to hand over the saved session. Keep the login page up,
+/// but say why, and pick the session up as soon as the keyring answers: on its
+/// own a few times, and whenever the user presses Retry.
+pub(crate) fn keyring_unreadable(ui: &Rc<Ui>, error: &pdfs_core::Error) {
+    tracing::warn!("cannot read the saved session: {error}");
+    let banner = &ui.login.keyring_banner;
+    if banner.is_revealed() {
+        return;
+    }
+    banner.set_revealed(true);
+    let ui_retry = ui.clone();
+    let handler = banner.connect_button_clicked(move |_| retry_session(&ui_retry));
+    // Disconnected once the banner goes, so a later failure wires it afresh.
+    let handler = RefCell::new(Some(handler));
+    banner.connect_revealed_notify(move |banner| {
+        if !banner.is_revealed()
+            && let Some(handler) = handler.borrow_mut().take()
+        {
+            banner.disconnect(handler);
+        }
+    });
+    let ui = ui.clone();
+    glib::spawn_future_local(async move {
+        for seconds in KEYRING_RETRIES {
+            glib::timeout_future_seconds(seconds).await;
+            if !ui.login.keyring_banner.is_revealed() {
+                return;
+            }
+            retry_session(&ui);
+        }
+    });
+}
+
+/// Read the saved session again after [`keyring_unreadable`]. Found: show the
+/// signed-in window. Gone: the plain login page. Still unreadable: keep waiting.
+fn retry_session(ui: &Rc<Ui>) {
+    let ui = ui.clone();
+    glib::spawn_future_local(async move {
+        let Ok(result) = gio::spawn_blocking(read_session).await else {
+            return;
+        };
+        match result {
+            Ok(session) => {
+                ui.login.keyring_banner.set_revealed(false);
+                if session.is_some() && ui.session.borrow().is_none() {
+                    *ui.session.borrow_mut() = session;
+                    refresh(&ui);
+                }
+            }
+            Err(e) => tracing::debug!("the keyring still cannot be read: {e}"),
+        }
+    });
+}
+
 /// Connect the sign-in button: read the fields, run [`auth::login`] on a worker
 /// thread, and report the outcome back on the main loop.
 pub(crate) fn wire_login(ui: &Rc<Ui>) {
@@ -199,7 +278,14 @@ pub(crate) fn wire_login(ui: &Rc<Ui>) {
                    ui.login.login_status.set_text("");
                    ui.login.password.set_text("");
                    // Cache the new identity so `refresh` never hits the keyring.
-                    *ui.session.borrow_mut() = auth::load().ok();
+                    // Read on a worker: a keyring that has to be unlocked first
+                    // answers only once the user has, and the window must not
+                    // freeze until then.
+                    match gio::spawn_blocking(read_session).await {
+                        Ok(Ok(session)) => *ui.session.borrow_mut() = session,
+                        Ok(Err(e)) => keyring_unreadable(&ui, &e),
+                        Err(_) => {}
+                    }
                    // Enable+start the mount service now that we have a session.
                    let _ = gio::spawn_blocking(service::enable_start).await;
                    refresh(&ui);
@@ -227,6 +313,11 @@ pub(crate) fn login_error_message(error: &pdfs_core::Error) -> String {
        pdfs_core::Error::Proton(ProtonError::Api(api)) if api.http_status == 429 => {
            gettext("Too many sign-in attempts. Wait a few minutes and try again.")
        }
+        // Proton's text for this one asks the user to update an app that is
+        // already current.
+        pdfs_core::Error::Proton(e) if pdfs_core::error::sign_in_blocked(e) => gettext(
+            "Proton is temporarily refusing sign-in from this device. Your app version is not the problem. Wait several hours, up to a day, without trying again, then sign in.",
+        ),
        pdfs_core::Error::Proton(ProtonError::Api(api)) if !api.message.is_empty() => {
            api.message.clone()
        }
@@ -597,7 +688,7 @@ pub(crate) fn sign_out(ui: &Rc<Ui>) {
            glib::spawn_future_local(async move {
                let result = gio::spawn_blocking(|| {
                    service::disable_stop();
-                    auth::logout().map_err(|e| e.to_string())
+                    auth::logout().map(|_| ()).map_err(|e| e.to_string())
                })
                .await;
                if let Ok(Err(e)) = result {
@@ -628,6 +719,21 @@ mod tests {
        assert!(login_error_message(&error).contains("no mailbox password"));
    }

+    #[test]
+    fn a_blocked_sign_in_does_not_ask_for_an_update() {
+        use pdfs_core::proton_sdk::api::ResponseCode;
+        use pdfs_core::proton_sdk::{ProtonApiError, ProtonError};
+        let error = pdfs_core::Error::Proton(ProtonError::Api(ProtonApiError {
+            code: ResponseCode::Blocked,
+            http_status: 422,
+            message: "This version of the app is no longer supported, please update to continue using the app".into(),
+            details: None,
+        }));
+        let message = login_error_message(&error);
+        assert!(message.contains("temporarily refusing"), "{message}");
+        assert!(!message.contains("update"), "{message}");
+    }
+
    #[test]
    fn an_unmapped_error_keeps_its_text() {
        let error = pdfs_core::Error::Other("something odd".into());
@@ -275,14 +275,42 @@ pub(crate) fn load_photo(ui: &Rc<Ui>, viewer: &Rc<Viewer>, uid: String) {
            viewer.status.set_label(message);
            viewer.status.set_visible(true);
        };
-        match result {
-            Ok(Ok(Response::FilePath { path })) if is_video => {
+        let path = match result {
+            Ok(Ok(Response::FilePath { path })) => path,
+            Ok(Ok(Response::Error { message, .. })) => return fail(&message),
+            Ok(Ok(_)) => return fail(&gettext("Unexpected reply from the Proton Drive service.")),
+            Ok(Err(_)) | Err(_) => return fail(&gettext("Couldn't reach Proton Drive.")),
+        };
+        // Decoding a full-size photo and reading its EXIF take a good part of
+        // a second for a large one, which froze the whole app on the main
+        // thread. Done on a worker; a reply for a photo the user has since
+        // left is dropped like the request's own.
+        let loaded = {
+            let path = path.clone();
+            gio::spawn_blocking(move || {
+                let size = std::fs::metadata(&path).ok().map(|meta| meta.len());
+                if is_video {
+                    return (size, None, ExifInfo::default());
+                }
+                let texture = gtk4::gdk::Texture::from_filename(&path);
+                (size, Some(texture), read_exif(&path))
+            })
+            .await
+        };
+        if *viewer.uid.borrow() != uid {
+            return;
+        }
+        let Ok((size, texture, info)) = loaded else {
+            return fail(&gettext("Couldn't render this photo."));
+        };
+        match texture {
+            None => {
                viewer.video.set_filename(Some(&path));
                viewer.media.set_visible_child_name("video");
                *viewer.path.borrow_mut() = Some(path.clone());
-                show_info(&viewer, &path, ExifInfo::default());
+                show_info(&viewer, size, ExifInfo::default());
            }
-            Ok(Ok(Response::FilePath { path })) => match gtk4::gdk::Texture::from_filename(&path) {
+            Some(texture) => match texture {
                Ok(texture) => {
                    // Zoomed in on the thumbnail: keep the photo the size it is
                    // on screen, now drawn from the full-size pixels.
@@ -297,16 +325,13 @@ pub(crate) fn load_photo(ui: &Rc<Ui>, viewer: &Rc<Viewer>, uid: String) {
                        zoom_to(&viewer, Some(zoom), None);
                    }
                    *viewer.path.borrow_mut() = Some(path.clone());
-                    show_info(&viewer, &path, read_exif(&path));
+                    show_info(&viewer, size, info);
                }
                Err(e) => {
                    tracing::error!("Failed to load texture for {path}: {e}");
                    fail(&gettext("Couldn't render this photo."));
                }
            },
-            Ok(Ok(Response::Error { message, .. })) => fail(&message),
-            Ok(Ok(_)) => fail(&gettext("Unexpected reply from the Proton Drive service.")),
-            Ok(Err(_)) | Err(_) => fail(&gettext("Couldn't reach Proton Drive.")),
        }
    });
 }
@@ -452,16 +477,16 @@ pub(crate) fn clear_info(viewer: &Rc<Viewer>) {
 }

 /// Fill the details drawer for the photo now on screen: its own file facts
-/// (size, dimensions) plus whatever EXIF it carries.
-pub(crate) fn show_info(viewer: &Rc<Viewer>, path: &str, info: ExifInfo) {
+/// (`size`, dimensions) plus whatever EXIF it carries.
+pub(crate) fn show_info(viewer: &Rc<Viewer>, size: Option<u64>, info: ExifInfo) {
    while let Some(row) = viewer.info_rows.first_child() {
        viewer.info_rows.remove(&row);
    }

    let mut fields: Vec<(String, String)> = Vec::new();
-    if let Ok(meta) = std::fs::metadata(path) {
+    if let Some(size) = size {
        // Translators: label of a photo's file size in the details panel.
-        fields.push((pgettext("property", "Size"), human_bytes(meta.len())));
+        fields.push((pgettext("property", "Size"), human_bytes(size)));
    }
    fields.extend(info.fields);

@@ -481,6 +506,7 @@ pub(crate) fn show_info(viewer: &Rc<Viewer>, path: &str, info: ExifInfo) {
            let row = adw::ActionRow::builder()
                .title(label.as_str())
                .subtitle(value)
+                .use_markup(false)
                .subtitle_selectable(true)
                .build();
            row.add_css_class("property");
@@ -1259,8 +1285,11 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
    // Any real pointer movement brings the controls back; resting over one of
    // them keeps them up.
    let motion = gtk4::EventControllerMotion::new();
-    let viewer_motion = viewer.clone();
+    let viewer_motion = Rc::downgrade(&viewer);
    motion.connect_motion(move |_, x, y| {
+        let Some(viewer_motion) = viewer_motion.upgrade() else {
+            return;
+        };
        let (last_x, last_y) = viewer_motion.pointer.get();
        viewer_motion.pointer.set((x, y));
        if (x - last_x).abs() > 1.0 || (y - last_y).abs() > 1.0 {
@@ -1270,10 +1299,17 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
    body.add_controller(motion);
    for revealer in [&top_reveal, &prev_reveal, &next_reveal] {
        let hover = gtk4::EventControllerMotion::new();
-        let viewer_enter = viewer.clone();
-        hover.connect_enter(move |_, _, _| viewer_enter.chrome_hover.set(true));
-        let viewer_leave = viewer.clone();
+        let viewer_enter = Rc::downgrade(&viewer);
+        hover.connect_enter(move |_, _, _| {
+            if let Some(viewer) = viewer_enter.upgrade() {
+                viewer.chrome_hover.set(true);
+            }
+        });
+        let viewer_leave = Rc::downgrade(&viewer);
        hover.connect_leave(move |_| {
+            let Some(viewer_leave) = viewer_leave.upgrade() else {
+                return;
+            };
            viewer_leave.chrome_hover.set(false);
            show_chrome(&viewer_leave);
        });
@@ -1283,8 +1319,11 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
    // Ctrl+scroll zooms around the pointer; a plain scroll pans a zoomed photo.
    let wheel = gtk4::EventControllerScroll::new(gtk4::EventControllerScrollFlags::VERTICAL);
    wheel.set_propagation_phase(gtk4::PropagationPhase::Capture);
-    let viewer_wheel = viewer.clone();
+    let viewer_wheel = Rc::downgrade(&viewer);
    wheel.connect_scroll(move |controller, _, dy| {
+        let Some(viewer_wheel) = viewer_wheel.upgrade() else {
+            return glib::Propagation::Proceed;
+        };
        if !controller
            .current_event_state()
            .contains(gtk4::gdk::ModifierType::CONTROL_MASK)
@@ -1304,14 +1343,20 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
    scroller.add_controller(wheel);

    let pinch = gtk4::GestureZoom::new();
-    let viewer_pinch = viewer.clone();
+    let viewer_pinch = Rc::downgrade(&viewer);
    pinch.connect_begin(move |_, _| {
+        let Some(viewer_pinch) = viewer_pinch.upgrade() else {
+            return;
+        };
        viewer_pinch
            .pinch_start
            .set(current_scale(&viewer_pinch).unwrap_or(1.0));
    });
-    let viewer_pinch = viewer.clone();
+    let viewer_pinch = Rc::downgrade(&viewer);
    pinch.connect_scale_changed(move |gesture, delta| {
+        let Some(viewer_pinch) = viewer_pinch.upgrade() else {
+            return;
+        };
        let start = viewer_pinch.pinch_start.get();
        zoom_to(
            &viewer_pinch,
@@ -1323,8 +1368,11 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {

    // Dragging a zoomed photo pans it.
    let drag = gtk4::GestureDrag::new();
-    let viewer_drag = viewer.clone();
+    let viewer_drag = Rc::downgrade(&viewer);
    drag.connect_drag_begin(move |_, _, _| {
+        let Some(viewer_drag) = viewer_drag.upgrade() else {
+            return;
+        };
        let scroller = &viewer_drag.scroller;
        viewer_drag.drag_start.set((
            scroller.hadjustment().value(),
@@ -1334,8 +1382,11 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
            viewer_drag.picture.set_cursor_from_name(Some("grabbing"));
        }
    });
-    let viewer_drag = viewer.clone();
+    let viewer_drag = Rc::downgrade(&viewer);
    drag.connect_drag_update(move |_, dx, dy| {
+        let Some(viewer_drag) = viewer_drag.upgrade() else {
+            return;
+        };
        if viewer_drag.zoom.get().is_none() {
            return;
        }
@@ -1343,39 +1394,58 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
        viewer_drag.scroller.hadjustment().set_value(x - dx);
        viewer_drag.scroller.vadjustment().set_value(y - dy);
    });
-    let viewer_drag = viewer.clone();
+    let viewer_drag = Rc::downgrade(&viewer);
    drag.connect_drag_end(move |_, _, _| {
+        let Some(viewer_drag) = viewer_drag.upgrade() else {
+            return;
+        };
        if viewer_drag.zoom.get().is_some() {
            viewer_drag.picture.set_cursor_from_name(Some("grab"));
        }
    });
    scroller.add_controller(drag);

-    let w_close = window.clone();
+    let w_close = window.downgrade();
    close_btn.connect_clicked(move |_| {
+        let Some(w_close) = w_close.upgrade() else {
+            return;
+        };
        w_close.close();
    });

-    let viewer_closing = viewer.clone();
+    // The one strong handle on the viewer. Every handler holds a weak one: a
+    // strong one in a handler of a widget the viewer holds is a cycle, which
+    // kept every closed lightbox, its window and its full-size photo in memory
+    // for the life of the app.
+    let keep = RefCell::new(Some(viewer.clone()));
    window.connect_close_request(move |_| {
-        stop_video(&viewer_closing);
-        disarm_slide(&viewer_closing);
-        if let Some(source) = viewer_closing.chrome_source.borrow_mut().take() {
-            source.remove();
+        if let Some(viewer) = keep.borrow_mut().take() {
+            stop_video(&viewer);
+            disarm_slide(&viewer);
+            if let Some(source) = viewer.chrome_source.borrow_mut().take() {
+                source.remove();
+            }
+            viewer.picture.set_paintable(gtk4::gdk::Paintable::NONE);
        }
        glib::Propagation::Proceed
    });

-    let viewer_info = viewer.clone();
+    let viewer_info = Rc::downgrade(&viewer);
    info_toggle.connect_toggled(move |toggle| {
+        let Some(viewer_info) = viewer_info.upgrade() else {
+            return;
+        };
        viewer_info
            .info_revealer
            .set_reveal_child(toggle.is_active());
    });

    let ui_slides = ui.clone();
-    let viewer_slides = viewer.clone();
+    let viewer_slides = Rc::downgrade(&viewer);
    slideshow_btn.connect_toggled(move |toggle| {
+        let Some(viewer_slides) = viewer_slides.upgrade() else {
+            return;
+        };
        if toggle.is_active() {
            start_slideshow(&ui_slides, &viewer_slides);
        } else {
@@ -1387,9 +1457,15 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
    info_close.connect_clicked(move |_| toggle_off.set_active(false));

    let ui_map = ui.clone();
-    let viewer_map = viewer.clone();
-    let w_map = window.clone();
+    let viewer_map = Rc::downgrade(&viewer);
+    let w_map = window.downgrade();
    info_map.connect_clicked(move |_| {
+        let Some(w_map) = w_map.upgrade() else {
+            return;
+        };
+        let Some(viewer_map) = viewer_map.upgrade() else {
+            return;
+        };
        let coords = *viewer_map.coords.borrow();
        if let Some((lat, lon)) = coords {
            w_map.close();
@@ -1398,8 +1474,11 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
    });

    let ui_fav = ui.clone();
-    let viewer_fav = viewer.clone();
+    let viewer_fav = Rc::downgrade(&viewer);
    favorite_btn.connect_toggled(move |btn| {
+        let Some(viewer_fav) = viewer_fav.upgrade() else {
+            return;
+        };
        if viewer_fav.favorite_suppress.get() {
            return;
        }
@@ -1443,17 +1522,26 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
    // gone, and leaving it open on a trashed photo invites a second Delete on
    // something the user cannot see.
    let ui_delete = ui.clone();
-    let viewer_delete = viewer.clone();
-    let w_delete = window.clone();
+    let viewer_delete = Rc::downgrade(&viewer);
+    let w_delete = window.downgrade();
    delete_btn.connect_clicked(move |_| {
+        let Some(w_delete) = w_delete.upgrade() else {
+            return;
+        };
+        let Some(viewer_delete) = viewer_delete.upgrade() else {
+            return;
+        };
        let uid = viewer_delete.uid.borrow().clone();
        w_delete.close();
        trash_photos(&ui_delete, vec![uid], false);
    });

    let ui_group = ui.clone();
-    let viewer_group = viewer.clone();
+    let viewer_group = Rc::downgrade(&viewer);
    group_btn.connect_clicked(move |_| {
+        let Some(viewer_group) = viewer_group.upgrade() else {
+            return;
+        };
        let uid = viewer_group.uid.borrow().clone();
        let next =
            next_group_member(&viewer_group.group.borrow(), &uid).map(|item| item.uid.clone());
@@ -1464,9 +1552,15 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
    });

    let ui_download = ui.clone();
-    let w_download = window.clone();
-    let viewer_download = viewer.clone();
+    let w_download = window.downgrade();
+    let viewer_download = Rc::downgrade(&viewer);
    download_btn.connect_clicked(move |_| {
+        let Some(w_download) = w_download.upgrade() else {
+            return;
+        };
+        let Some(viewer_download) = viewer_download.upgrade() else {
+            return;
+        };
        if let Some(path) = viewer_download.path.borrow().as_deref() {
            let name = viewer_download.name.borrow();
            save_photo_to_disk(
@@ -1478,23 +1572,35 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
        }
    });

-    let w_ext = window.clone();
-    let viewer_ext = viewer.clone();
+    let w_ext = window.downgrade();
+    let viewer_ext = Rc::downgrade(&viewer);
    open_ext_btn.connect_clicked(move |_| {
+        let Some(w_ext) = w_ext.upgrade() else {
+            return;
+        };
+        let Some(viewer_ext) = viewer_ext.upgrade() else {
+            return;
+        };
        if let Some(path) = viewer_ext.path.borrow().as_deref() {
            open_with(&w_ext, path, viewer_ext.name.borrow().as_deref());
        }
    });

    let ui_prev = ui.clone();
-    let viewer_prev = viewer.clone();
+    let viewer_prev = Rc::downgrade(&viewer);
    prev_btn.connect_clicked(move |_| {
+        let Some(viewer_prev) = viewer_prev.upgrade() else {
+            return;
+        };
        navigate_photo(&ui_prev, &viewer_prev, -1);
    });

    let ui_next = ui.clone();
-    let viewer_next = viewer.clone();
+    let viewer_next = Rc::downgrade(&viewer);
    next_btn.connect_clicked(move |_| {
+        let Some(viewer_next) = viewer_next.upgrade() else {
+            return;
+        };
        navigate_photo(&ui_next, &viewer_next, 1);
    });

@@ -1503,8 +1609,11 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
    // reaching for the image doesn't fling the window shut; a zoomed photo has
    // no backdrop to speak of. Double-click toggles between fitted and 100 %.
    let backdrop = gtk4::GestureClick::new();
-    let viewer_click = viewer.clone();
+    let viewer_click = Rc::downgrade(&viewer);
    backdrop.connect_pressed(move |_, n_press, x, y| {
+        let Some(viewer_click) = viewer_click.upgrade() else {
+            return;
+        };
        if n_press != 2 {
            return;
        }
@@ -1521,9 +1630,15 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
            zoom_to(&viewer_click, Some((fit * 2.0).max(1.0)), Some(anchor));
        }
    });
-    let viewer_click = viewer.clone();
-    let w_click = window.clone();
+    let viewer_click = Rc::downgrade(&viewer);
+    let w_click = window.downgrade();
    backdrop.connect_released(move |_, n_press, x, y| {
+        let Some(w_click) = w_click.upgrade() else {
+            return;
+        };
+        let Some(viewer_click) = viewer_click.upgrade() else {
+            return;
+        };
        if n_press == 1
            && viewer_click.zoom.get().is_none()
            && !over_photo(&viewer_click.picture, x, y)
@@ -1535,9 +1650,15 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {

    let key_controller = gtk4::EventControllerKey::new();
    let ui_key = ui.clone();
-    let viewer_key = viewer.clone();
-    let w_key = window.clone();
+    let viewer_key = Rc::downgrade(&viewer);
+    let w_key = window.downgrade();
    key_controller.connect_key_pressed(move |_, key, _keycode, state| {
+        let Some(w_key) = w_key.upgrade() else {
+            return glib::Propagation::Proceed;
+        };
+        let Some(viewer_key) = viewer_key.upgrade() else {
+            return glib::Propagation::Proceed;
+        };
        let ctrl = state.contains(gtk4::gdk::ModifierType::CONTROL_MASK);
        let playing_video = viewer_key.media.visible_child_name().as_deref() == Some("video");
        match key.name().as_deref() {
@@ -609,7 +609,7 @@ pub(crate) fn build_gallery_page() -> (gtk4::Widget, GalleryWidgets) {
    select_box.append(&select_done);
    let select_bar = gtk4::Revealer::builder()
        .transition_type(gtk4::RevealerTransitionType::SlideDown)
-        .child(&select_box)
+        .child(&scroll_sideways(&select_box))
        .build();

    // All / Photos / Videos / Raw filter. Linked toggles acting as one segmented
@@ -1379,11 +1379,9 @@ pub(crate) fn wire_gallery(
                    "tiff" | "tif" => "image/tiff",
                    _ => "image/jpeg",
                };
-                let capture_time = std::fs::metadata(&path)
-                    .and_then(|m| m.modified())
-                    .ok()
-                    .and_then(|t| t.duration_since(std::time::SystemTime::UNIX_EPOCH).ok())
-                    .map(|d| d.as_secs() as i64);
+                // The daemon dates the photo: by its EXIF, or by the file's
+                // modification time when it has none.
+                let capture_time = None;

                ui.busy_begin();
                let rx = spawn_request(
@@ -3459,7 +3457,9 @@ pub(crate) fn load_gallery(ui: &Rc<Ui>, append: bool) {
 pub(crate) fn gallery_status(ui: &Rc<Ui>, icon: &str, title: &str, description: &str, retry: bool) {
    ui.gallery.status.set_icon_name(Some(icon));
    ui.gallery.status.set_title(title);
-    ui.gallery.status.set_description(Some(description));
+    ui.gallery
+        .status
+        .set_description(Some(&gtk4::glib::markup_escape_text(description)));
    ui.gallery.retry.set_visible(retry);
    // Only the empty timeline offers a way to fill it; every other status turns
    // those buttons back off.
@@ -3479,10 +3479,10 @@ pub(crate) fn gallery_unreachable(ui: &Rc<Ui>) {
 /// right tool for the HEVC `.mkv`s this is aimed at — and falls back to the
 /// user's default handler when mpv isn't installed.
 pub(crate) fn play_external(path: &str) {
-    if Command::new("mpv").arg(path).spawn().is_ok() {
-        return;
+    match Command::new("mpv").arg(path).spawn() {
+        Ok(child) => pdfs_core::opener::reap(child),
+        Err(_) => open_path(path),
    }
-    open_path(path);
 }

 #[cfg(test)]
@@ -448,7 +448,9 @@ pub(crate) fn close_place(ui: &Rc<Ui>) {
 fn places_status(ui: &Rc<Ui>, icon: &str, title: &str, description: &str) {
    ui.gallery.places_status.set_icon_name(Some(icon));
    ui.gallery.places_status.set_title(title);
-    ui.gallery.places_status.set_description(Some(description));
+    ui.gallery
+        .places_status
+        .set_description(Some(&gtk4::glib::markup_escape_text(description)));
    ui.gallery.places_stack.set_visible_child_name("status");
 }

@@ -311,7 +311,9 @@ pub(crate) fn wire_shared(ui: &Rc<Ui>, widgets: &SharedWidgets) {
 pub(crate) fn shared_status(ui: &Rc<Ui>, icon: &str, title: &str, description: &str, retry: bool) {
    ui.shared.status.set_icon_name(Some(icon));
    ui.shared.status.set_title(title);
-    ui.shared.status.set_description(Some(description));
+    ui.shared
+        .status
+        .set_description(Some(&gtk4::glib::markup_escape_text(description)));
    ui.shared.retry.set_visible(retry);
    ui.shared.content.set_visible_child_name("status");
 }
@@ -818,6 +820,7 @@ fn invitation_row(inv: &InvitationInfo) -> adw::ActionRow {
        .title(&item)
        // Translators: {email} is the address of the person who sent the invitation.
        .subtitle(gettext_f("From {email}", &[("email", &inv.inviter_email)]))
+        .use_markup(false)
        .build();
    row.add_prefix(&gtk4::Image::from_icon_name(if inv.is_dir {
        "folder-symbolic"
@@ -862,6 +865,7 @@ fn repaint_links(ui: &Rc<Ui>, bookmarks: &[BookmarkInfo]) {
        let row = adw::ActionRow::builder()
            .title(&title)
            .subtitle(&bm.url)
+            .use_markup(false)
            .subtitle_lines(1)
            .activatable(true)
            .tooltip_text(gettext("Open in browser"))
@@ -329,7 +329,9 @@ pub(crate) fn shared_by_me_status(
 ) {
    ui.shared_by_me.status.set_icon_name(Some(icon));
    ui.shared_by_me.status.set_title(title);
-    ui.shared_by_me.status.set_description(Some(description));
+    ui.shared_by_me
+        .status
+        .set_description(Some(&gtk4::glib::markup_escape_text(description)));
    ui.shared_by_me.retry.set_visible(retry);
    ui.shared_by_me.content.set_visible_child_name("status");
    ui.shared_by_me.subtitle.set_subtitle("");
@@ -52,6 +52,9 @@ pub(crate) struct StatusState {
    pub(crate) online_map_row: adw::SwitchRow,
    /// "Show tray icon" toggle. Guarded by [`Self::settings_suppress`].
    pub(crate) tray_row: adw::SwitchRow,
+    /// "Check for updates" toggle, not shown where a package manager brings
+    /// updates. Guarded by [`Self::settings_suppress`].
+    pub(crate) update_row: adw::SwitchRow,
    /// Language picker: "System Default", then [`i18n::LANGUAGES`]. Guarded by
    /// [`Self::settings_suppress`].
    pub(crate) language_row: adw::ComboRow,
@@ -164,6 +167,7 @@ pub(crate) struct MainWidgets {
    pub(crate) theme_row: adw::SwitchRow,
    pub(crate) online_map_row: adw::SwitchRow,
    pub(crate) tray_row: adw::SwitchRow,
+    pub(crate) update_row: adw::SwitchRow,
    pub(crate) language_row: adw::ComboRow,
 }

@@ -250,6 +254,17 @@ pub(crate) fn build_main_page() -> MainWidgets {
    let language_row = build_language_row();
    appearance_group.add(&language_row);

+    let updates_group = adw::PreferencesGroup::builder()
+        .title(gettext("Updates"))
+        .build();
+    let update_row = adw::SwitchRow::builder()
+        .title(gettext("Check for updates"))
+        .subtitle(gettext(
+            "Ask GitHub once a day whether a new version is out. GitHub learns your IP address and which version you use.",
+        ))
+        .build();
+    updates_group.add(&update_row);
+
    let general = adw::PreferencesPage::builder()
        .title(gettext("General"))
        .icon_name("preferences-system-symbolic")
@@ -258,6 +273,10 @@ pub(crate) fn build_main_page() -> MainWidgets {
    general.add(&location_group);
    general.add(&network_group);
    general.add(&appearance_group);
+    // A package manager brings new versions, so there is nothing to tell.
+    if !updates_managed_here() {
+        general.add(&updates_group);
+    }

    // ---- Preferences: Storage
    let storage_group = adw::PreferencesGroup::builder()
@@ -442,6 +461,7 @@ pub(crate) fn build_main_page() -> MainWidgets {
        theme_row,
        online_map_row,
        tray_row,
+        update_row,
        language_row,
    }
 }
@@ -541,6 +561,7 @@ pub(crate) fn wire_settings(
        .set_active(config.proton_theme.unwrap_or(false));
    ui.status.online_map_row.set_active(config.online_map);
    ui.status.tray_row.set_active(!config.tray_hidden);
+    ui.status.update_row.set_active(config.update_check);
    ui.status
        .language_row
        .set_selected(language_index(config.language.as_deref()));
@@ -690,6 +711,26 @@ pub(crate) fn wire_settings(
        }
    });

+    // Update check: saved, and the first check runs right away if one is due.
+    let ui_update = ui.clone();
+    ui.status.update_row.connect_active_notify(move |row| {
+        if ui_update.status.settings_suppress.get() {
+            return;
+        }
+        let mut config = ui_update.dirs.load_config();
+        config.update_check = row.is_active();
+        if let Err(e) = ui_update.dirs.save_config(&config) {
+            toast_error(
+                &ui_update,
+                &gettext("Couldn't save the update setting"),
+                &e.to_string(),
+            );
+            return;
+        }
+        show_latest(&ui_update);
+        start_update_checks(&ui_update);
+    });
+
    // Tray icon: the tray reads the same flag at start, so hiding it here also
    // keeps the login autostart from bringing it back.
    let ui_tray = ui.clone();
@@ -860,7 +901,7 @@ pub(crate) fn refresh(ui: &Rc<Ui>) {
                if ui.stack.visible_child_name().as_deref() == Some("login") {
                    ui.stack.set_visible_child_name("browser");
                }
-                ui.nav.set_collapsed(false);
+                ui.nav.set_collapsed(ui.narrow.get());
                if ui.status.account_name.label() != s.username {
                    ui.status.account_name.set_label(&s.username);
                    ui.status.account_name.set_tooltip_text(Some(&s.username));
@@ -1566,6 +1607,7 @@ pub(crate) fn repaint_pins(ui: &Rc<Ui>, pins: &[pdfs_core::cache::Pin], mounted:
        let row = adw::ActionRow::builder()
            .title(&name)
            .subtitle(&pin.path)
+            .use_markup(false)
            .build();
        let icon = gtk4::Image::from_icon_name("pdfs-offline-symbolic");
        row.add_prefix(&icon);
@@ -510,6 +510,7 @@ pub(crate) fn repaint_archives(ui: &Rc<Ui>) {
                        .unwrap_or_else(|| path.display().to_string()),
                )
                .subtitle(human_bytes(size))
+                .use_markup(false)
                .build();
            let remove = gtk4::Button::builder()
                .icon_name("edit-delete-symbolic")
@@ -645,7 +646,12 @@ pub(crate) fn refresh_takeout(ui: &Rc<Ui>) {
            // An import runs for hours, so its ending is announced rather than
            // left to be discovered: a toast for whoever is looking at the
            // window, and a desktop notification for whoever is not.
-            if was_running {
+            let failed = summary.as_ref().and_then(|s| s.error.clone());
+            if was_running && let Some(error) = &failed {
+                let headline = gettext("Couldn't import from Google Photos");
+                toast_error(&ui, &headline, error);
+                notify("takeout-import", &headline, error);
+            } else if was_running {
                let dry = ui.takeout.dry_run.get();
                let headline = if dry {
                    gettext("Scan finished")
@@ -701,7 +707,18 @@ fn repaint_summary(ui: &Rc<Ui>, summary: &ImportSummary) {
    } else {
        gettext("Last import")
    });
-    ui.takeout.summary_group.set_description(Some(&if dry {
+    ui.takeout.summary_group.set_description(Some(&if let Some(error) = &summary.error {
+        // The reason is the service's own text, which is not translated. A
+        // group's description is markup, and the reason may name a path.
+        glib::markup_escape_text(&gettext_f(
+            "{what}: {detail}",
+            &[
+                ("what", &gettext("Couldn't import from Google Photos")),
+                ("detail", error),
+            ],
+        ))
+        .to_string()
+    } else if dry {
        gettext("Nothing was uploaded — this is what an import would do.")
    } else if summary.cancelled {
        gettext("Stopped early. Everything uploaded so far is in your timeline; run it again to continue where it left off.")
@@ -330,7 +330,9 @@ pub(crate) fn trash_unreachable(ui: &Rc<Ui>) {
 pub(crate) fn trash_status(ui: &Rc<Ui>, icon: &str, title: &str, description: &str, retry: bool) {
    ui.trash.status.set_icon_name(Some(icon));
    ui.trash.status.set_title(title);
-    ui.trash.status.set_description(Some(description));
+    ui.trash
+        .status
+        .set_description(Some(&gtk4::glib::markup_escape_text(description)));
    ui.trash.retry.set_visible(retry);
    ui.trash.content.set_visible_child_name("status");
    ui.trash.subtitle.set_subtitle("");
@@ -0,0 +1,168 @@
+//! Tells the user when a newer release is out, if they turned on Preferences →
+//! Updates. The decisions are [`pdfs_core::update`]'s; this asks GitHub and
+//! shows the banner.
+
+use crate::*;
+
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use pdfs_core::update::{
+    RELEASES_LATEST_API, is_newer, latest_version, next_check_in, release_url, updates_managed,
+};
+
+/// How long one request to GitHub may take.
+const FETCH_TIMEOUT: Duration = Duration::from_secs(10);
+
+/// How long to wait after a failed check, such as one made offline, before
+/// trying again. Not saved, so a restart tries again straight away.
+const RETRY_AFTER: Duration = Duration::from_secs(60 * 60);
+
+pub(crate) struct UpdateState {
+    /// Over the sidebar, so it shows whichever page is open.
+    pub(crate) banner: adw::Banner,
+    /// The check loop is running. Turning the setting off and on again while it
+    /// sleeps must not start a second one.
+    running: Cell<bool>,
+    /// The release page the banner's button opens.
+    url: RefCell<String>,
+}
+
+impl UpdateState {
+    pub(crate) fn new() -> Self {
+        Self {
+            banner: adw::Banner::builder()
+                .button_label(gettext("Download"))
+                .build(),
+            running: Cell::new(false),
+            url: RefCell::new(String::new()),
+        }
+    }
+}
+
+/// Whether a package manager brings new releases to this install. The app then
+/// never asks, and Preferences does not offer to.
+pub(crate) fn updates_managed_here() -> bool {
+    std::env::current_exe().is_ok_and(|exe| updates_managed(&exe))
+}
+
+/// Wire the banner, show a release an earlier check found, and start checking
+/// if the user asked for it.
+pub(crate) fn wire_update(ui: &Rc<Ui>) {
+    let ui_open = ui.clone();
+    ui.update
+        .banner
+        .connect_button_clicked(move |_| open_uri(&ui_open.update.url.borrow()));
+    show_latest(ui);
+    start_update_checks(ui);
+}
+
+/// Start the daily check, unless it is off, managed elsewhere, or running.
+pub(crate) fn start_update_checks(ui: &Rc<Ui>) {
+    if updates_managed_here()
+        || !ui.dirs.load_config().update_check
+        || ui.update.running.replace(true)
+    {
+        return;
+    }
+    let ui = ui.clone();
+    glib::spawn_future_local(async move {
+        // Also kept here, so a config that cannot be saved does not make every
+        // pass ask GitHub again.
+        let mut checked = None;
+        loop {
+            let config = ui.dirs.load_config();
+            if !config.update_check {
+                break;
+            }
+            let wait = next_check_in(config.update_last_checked.max(checked), unix_now());
+            if !wait.is_zero() {
+                glib::timeout_future(wait).await;
+                continue;
+            }
+            match fetch_latest().await {
+                Ok(latest) => {
+                    checked = Some(unix_now());
+                    let mut config = ui.dirs.load_config();
+                    config.update_last_checked = checked;
+                    config.update_latest = latest;
+                    if let Err(e) = ui.dirs.save_config(&config) {
+                        tracing::warn!("update check: cannot save the result: {e}");
+                    }
+                    show_latest(&ui);
+                }
+                Err(e) => {
+                    tracing::warn!("update check: {e}");
+                    glib::timeout_future(RETRY_AFTER).await;
+                }
+            }
+        }
+        ui.update.running.set(false);
+    });
+}
+
+/// Reveal the banner if the last check found a release newer than this one,
+/// and hide it otherwise.
+pub(crate) fn show_latest(ui: &Ui) {
+    let config = ui.dirs.load_config();
+    let newer = config
+        .update_latest
+        .filter(|latest| config.update_check && is_newer(latest, env!("CARGO_PKG_VERSION")));
+    match newer {
+        Some(version) => {
+            ui.update.banner.set_title(&gettext_f(
+                "Proton Drive {version} is available",
+                &[("version", &version)],
+            ));
+            *ui.update.url.borrow_mut() = release_url(&version);
+            ui.update.banner.set_revealed(!updates_managed_here());
+        }
+        None => ui.update.banner.set_revealed(false),
+    }
+}
+
+fn unix_now() -> i64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map_or(0, |d| d.as_secs() as i64)
+}
+
+/// The latest release's version, asked on a worker thread so the window never
+/// waits on GitHub. `Ok(None)` when the answer names no `X.Y.Z` release.
+async fn fetch_latest() -> Result<Option<String>, String> {
+    let (tx, rx) = async_channel::bounded(1);
+    std::thread::spawn(move || {
+        let _ = tx.send_blocking(fetch_latest_blocking());
+    });
+    rx.recv().await.map_err(|e| e.to_string())?
+}
+
+fn fetch_latest_blocking() -> Result<Option<String>, String> {
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .map_err(|e| format!("no runtime: {e}"))?;
+    let client = reqwest::Client::builder()
+        .user_agent(concat!(
+            "proton-drive-linux/",
+            env!("CARGO_PKG_VERSION"),
+            " (",
+            env!("CARGO_PKG_REPOSITORY"),
+            ")"
+        ))
+        .timeout(FETCH_TIMEOUT)
+        .build()
+        .map_err(|e| format!("no HTTP client: {e}"))?;
+    runtime.block_on(async {
+        let reply = client
+            .get(RELEASES_LATEST_API)
+            .header("Accept", "application/vnd.github+json")
+            .send()
+            .await
+            .map_err(|e| e.to_string())?;
+        if !reply.status().is_success() {
+            return Err(format!("GitHub answered {}", reply.status()));
+        }
+        let body = reply.bytes().await.map_err(|e| e.to_string())?;
+        Ok(latest_version(&body))
+    })
+}
@@ -98,6 +98,8 @@ pub(crate) fn build_details_pane() -> (gtk4::Widget, DetailsWidgets) {
        .title(gettext("Location"))
        .subtitle("—")
        .subtitle_lines(3)
+        // A folder path, which may hold `&` or `<`.
+        .use_markup(false)
        .build();
    path_row.add_css_class("property");
    props.add(&size_row);
@@ -491,6 +491,7 @@ pub(crate) fn repaint_share_people(state: &Rc<ShareDialog>, entries: &[ShareEntr
        let row = adw::ActionRow::builder()
            .title(&entry.email)
            .subtitle(&subtitle)
+            .use_markup(false)
            .build();
        row.add_prefix(&adw::Avatar::new(32, Some(&entry.email), true));

@@ -506,10 +507,16 @@ pub(crate) fn repaint_share_people(state: &Rc<ShareDialog>, entries: &[ShareEntr
                .selected(role_wire_to_index(&entry.role))
                .valign(gtk4::Align::Center)
                .build();
-            let state_role = state.clone();
+            // Weak, here and in every row below: the rows belong to groups the
+            // dialog state holds, so a strong handle in a row's handler is a
+            // cycle that kept each closed dialog in memory.
+            let state_role = Rc::downgrade(state);
            let id = entry.id.clone();
            let kind = entry.kind;
            drop.connect_selected_notify(move |d| {
+                let Some(state_role) = state_role.upgrade() else {
+                    return;
+                };
                share_dialog_op(
                    &state_role,
                    state_role.target.update_role(
@@ -539,12 +546,14 @@ pub(crate) fn repaint_share_people(state: &Rc<ShareDialog>, entries: &[ShareEntr
            .valign(gtk4::Align::Center)
            .build();
        remove.add_css_class("flat");
-        let state_rm = state.clone();
+        let state_rm = Rc::downgrade(state);
        let id = entry.id.clone();
        let kind = entry.kind;
        let who = entry.email.clone();
        remove.connect_clicked(move |btn| {
-            let state = state_rm.clone();
+            let Some(state) = state_rm.upgrade() else {
+                return;
+            };
            let id = id.clone();
            let button = btn.clone();
            confirm_destructive(
@@ -605,6 +614,7 @@ pub(crate) fn repaint_share_link(state: &Rc<ShareDialog>, link: Option<&PublicLi
                    url.clone()
                })
                .subtitle(&subtitle)
+                .use_markup(false)
                .build();
            row.add_css_class("property");

@@ -615,12 +625,12 @@ pub(crate) fn repaint_share_link(state: &Rc<ShareDialog>, link: Option<&PublicLi
                    .valign(gtk4::Align::Center)
                    .build();
                copy.add_css_class("flat");
-                let state_copy = state.clone();
+                let ui_copy = state.ui.clone();
                let url_copy = url.clone();
                copy.connect_clicked(move |btn| {
                    btn.clipboard().set_text(&url_copy);
                    flash_copied(btn, "edit-copy-symbolic");
-                    toast(&state_copy.ui, &gettext("Link copied"));
+                    toast(&ui_copy, &gettext("Link copied"));
                });
                row.add_suffix(&copy);
            }
@@ -631,10 +641,12 @@ pub(crate) fn repaint_share_link(state: &Rc<ShareDialog>, link: Option<&PublicLi
                .valign(gtk4::Align::Center)
                .build();
            remove.add_css_class("flat");
-            let state_rm = state.clone();
+            let state_rm = Rc::downgrade(state);
            let id = link.id.clone();
            remove.connect_clicked(move |btn| {
-                let state = state_rm.clone();
+                let Some(state) = state_rm.upgrade() else {
+                    return;
+                };
                let id = id.clone();
                let button = btn.clone();
                confirm_destructive(
@@ -688,9 +700,12 @@ pub(crate) fn repaint_share_link(state: &Rc<ShareDialog>, link: Option<&PublicLi
            let btn = create.clone();
            pw_row.connect_entry_activated(move |_| btn.emit_clicked());

-            let state_c = state.clone();
+            let state_c = Rc::downgrade(state);
            let pw_for = pw_row.clone();
            create.connect_clicked(move |btn| {
+                let Some(state_c) = state_c.upgrade() else {
+                    return;
+                };
                if !btn.is_sensitive() {
                    return;
                }
@@ -219,6 +219,7 @@ fn repaint_versions(state: &Rc<VersionsDialog>, items: &[RevisionInfo]) {
        let row = adw::ActionRow::builder()
            .title(title)
            .subtitle(subtitle)
+            .use_markup(false)
            .build();

        let save = gtk4::Button::builder()
@@ -15,7 +15,6 @@ mod thumbs;
 use std::cell::{Cell, RefCell};
 use std::path::{Path, PathBuf};
 use std::rc::Rc;
-use std::time::Duration;

 use adw::prelude::*;
 use gtk4::{gdk, gio, glib};
@@ -24,7 +23,7 @@ use pdfs_core::config::AppDirs;
 use pdfs_core::control::{Request, Response, SearchFilters, SearchHit, SearchSource};
 use pdfs_core::opener::{self, OpenWith};

-use crate::activation::{DriveActivation, drive_activation, mounted_or_relative, mounted_target};
+use crate::activation::{DriveActivation, drive_activation, mounted_or_relative, present_within};
 use crate::compat::{Spinner, spinner};
 use crate::theme::set_proton_theme;
 use crate::{
@@ -38,10 +37,6 @@ use thumbs::Thumbs;
 /// Recent files shown above the pinned ones while the query is empty.
 const RECENT_LIMIT: usize = 8;

-/// How long opening waits for the mount to answer whether it has a file. A
-/// frozen mount must not freeze the launcher; the daemon is asked instead.
-const STAT_TIMEOUT: Duration = Duration::from_secs(2);
-
 /// The titled groups of the result list.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 enum Section {
@@ -516,22 +511,11 @@ pub(crate) fn build_window(app: &adw::Application) -> Option<Rc<Ui>> {
    Some(ui)
 }

-/// Whether the mount has `hit`, asked on a worker thread and given up on
-/// after [`STAT_TIMEOUT`]. `None` means "not there" or "no answer"; either
-/// way the daemon is the fallback.
+/// Whether the mount has `hit`, without blocking the window
+/// ([`present_within`]). `None` means "not there" or "no answer"; either way
+/// the daemon is the fallback.
 async fn mounted_target_within(mountpoint: PathBuf, hit: SearchHit) -> Option<PathBuf> {
-    let (tx, rx) = async_channel::bounded(1);
-    std::thread::spawn(move || {
-        let _ = tx.send_blocking(mounted_target(&mountpoint, &hit));
-    });
-    match glib::future_with_timeout(STAT_TIMEOUT, rx.recv()).await {
-        Ok(Ok(target)) => target,
-        Ok(Err(_)) => None,
-        Err(_) => {
-            tracing::warn!("the mount did not answer in time; opening through the daemon");
-            None
-        }
-    }
+    present_within(mounted_or_relative(&mountpoint, &hit)).await
 }

 impl Ui {
@@ -109,7 +109,8 @@ fn sync_line(items: &[TransferItem], jobs: &[JobItem]) -> String {
                    &[("title", &j.title), ("done", &done), ("total", &total)],
                )
            }
-            Some(j) => format!("{}…", j.title),
+            // Translators: {title} names a running job whose size is not known yet.
+            Some(j) => gettext_f("{title}…", &[("title", &j.title)]),
            None => String::new(),
        },
        [t] => {
@@ -118,10 +119,19 @@ fn sync_line(items: &[TransferItem], jobs: &[JobItem]) -> String {
                TransferDirection::Upload => "↑",
            };
            if t.bytes_total == 0 {
-                format!("{arrow} {}…", t.name)
+                // Translators: one transfer of unknown size; {arrow} is ↑ or ↓, {name} a file name.
+                gettext_f("{arrow} {name}…", &[("arrow", arrow), ("name", &t.name)])
            } else {
                let pct = (t.bytes_completed * 100 / t.bytes_total.max(1)).min(100);
-                format!("{arrow} {} ({pct}%)", t.name)
+                // Translators: one transfer; {arrow} is ↑ or ↓, {name} a file name, {percent} how much is done.
+                gettext_f(
+                    "{arrow} {name} ({percent}%)",
+                    &[
+                        ("arrow", arrow),
+                        ("name", &t.name),
+                        ("percent", &pct.to_string()),
+                    ],
+                )
            }
        }
        _ => {
@@ -361,8 +371,9 @@ fn open_manager(args: &[&str]) {
        .and_then(|p| p.parent().map(|d| d.join("pdfs-app")))
        .filter(|p| p.exists())
        .unwrap_or_else(|| PathBuf::from("pdfs-app"));
-    if let Err(e) = Command::new(&exe).args(args).spawn() {
-        tracing::error!("failed to launch {}: {e}", exe.display());
+    match Command::new(&exe).args(args).spawn() {
+        Ok(child) => pdfs_core::opener::reap(child),
+        Err(e) => tracing::error!("failed to launch {}: {e}", exe.display()),
    }
 }

@@ -255,7 +255,9 @@ not one this daemon sealed itself (`own_sealed_rev` table), the queued bytes are
 conflict copy (`Core::revision_conflict`) next to the remote version. A name taken on Drive by a
 node this machine has not seen lands under a conflict name too. Both go to the activity log.

-Conflict copies are named `{stem} (sync-conflict {unix_secs}).{ext}`.
+Conflict copies are named `{stem} (sync-conflict {host} {unix_secs}).{ext}`, where `{host}` is the
+hostname cut down to one token (`conflict_label`). `conflict_base_name` also reads the older form
+without a host.

 ### Failures and sync issues

@@ -342,6 +344,22 @@ Safety rules:
 - **Ignore rules.** `.pdfsignore` (or `.protonignore`) at the folder root plus `ignore_patterns`
  from `config.json`, in gitignore syntax. Ignoring never deletes.

+Another client may write the same folder, such as a second computer syncing into the device. The
+baseline therefore also records the active revision id each file was synced at (schema 44):
+
+- **A new revision is a remote change** even when the link's modification time and the size come
+  out the same.
+- **An upload checks first.** `upload_revision` reads the node and leaves a file whose revision
+  moved since the walk for the next pass, which classifies it as a conflict. A revision committed
+  between that check and the SDK's own revision draft is not caught.
+- **The baseline records what was transferred.** A download records the revision the pass
+  planned to fetch, not a read-back that may already show a newer one. An upload records the
+  read-back only when its SHA-1 is the one sent.
+- **A first sync compares content.** A path present on both sides without a baseline is adopted
+  only when the local SHA-1 matches Drive's digest; otherwise it is a conflict.
+
+Remote changes still reach a mirror only through the 120 s poll.
+
 ### Moves between locations

 My files and each online-only folder are separate FUSE sessions, and a mirrored folder has none,
@@ -369,12 +387,18 @@ named like the hostname, else a new one. An adopted uid that no longer exists is
 replaced silently.

 The local database does not survive a lost machine, so the daemon backs up its arrangement to
-`<device root>/.proton-drive-linux/profile.json` (`pdfs_core::profile`): each synced folder's
+`<device root>/.proton-drive-linux/profile-<machine id>.json` (`pdfs_core::profile`): each synced folder's
 remote uid, local path and mode, the pins, and the ignore patterns. It is uploaded like any other
 file, so it is end-to-end encrypted. `Core::touch_profile` coalesces bursts of changes into one
 upload. `PROFILE_VERSION` guards the format: a profile from a newer client is refused, not applied
 in part.

+The machine id is random and lives in `machine-id` next to `config.json`. Each machine has its
+own file because several computers may sync into one device: `pdfs devices join` and **Sync With
+This Computer…** adopt another computer's device without taking it over. Restore reads every
+profile there, the legacy shared `profile.json` included, and prefers the one with this hostname,
+then the newest (`profile::saved_folder`).
+
 Restore lists the device's folders, proposes a local path from the profile, and on confirmation
 adds a synced folder bound to the remote uid. The download is an ordinary pass against an empty
 baseline. The user side is in [RECOVERY.md](RECOVERY.md).
@@ -11,6 +11,162 @@ scratch (user data in `staging/` and `recovery/` is never touched by this).

 ## [Unreleased]

+### Added
+- **A COPR repository for Fedora**, so `dnf upgrade` brings each new release:
+  `sudo dnf copr enable narl-rs/proton-drive-linux`. Every release also ships the vendored crates
+  as `proton-drive-linux-vendor-<version>.tar.xz`, which the COPR build uses offline (#42).
+- **The app can tell you about a new release.** Turn on **Check for updates** in Preferences, and
+  the app asks GitHub once a day and shows a banner with a **Download** button when a newer
+  version is out. It is off by default, and not offered for packages that a package manager
+  updates (COPR, the AUR, Nix) (#42).
+
+### Changed
+- **Reorganised documentation, now also on the
+  [wiki](https://github.com/narrrl/proton-drive-linux/wiki).** A new
+  [Getting started](https://github.com/narrrl/proton-drive-linux/wiki/Getting-Started) page and
+  an [FAQ](https://github.com/narrrl/proton-drive-linux/wiki/FAQ). The user guide is split into
+  pages for files, synced folders, Photos, sharing, computers, and the launcher and tray.
+  Installation puts the COPR repository first for Fedora and explains updating and uninstalling
+  for each kind of package. Each release publishes `docs/` to the wiki.
+
+## [3.5.0] — 2026-10-16
+
+Schema: **44**. Queued changes get an index by kind and name, and each synced file remembers the
+version on Proton Drive it was synced at. Nothing is rewritten, and the upgrade takes a moment.
+
+### Added
+- **Several computers can sync the same folders.** On the Computers page, **Sync With This
+  Computer…** on another computer, or `pdfs devices join`, makes this computer sync into that
+  computer's backup alongside it, then offers its folders for syncing here. Both computers keep
+  them in step, deletions included. Each computer now keeps its own settings backup in the
+  shared backup, so they no longer overwrite each other (B252).
+- **The app remembers its window size**, and whether it was maximized, between runs.
+
+### Fixed
+- **The app's window could not shrink to fit a small or scaled screen**, so the minimize,
+  maximize and close buttons ended up off-screen. Below about 760 pixels the sidebar and the
+  page now take turns, and every page fits in a window 480 pixels wide.
+- **The app showed the sign-in page when the system keyring was locked or not running yet**, as
+  if the sign-in had been lost. It now says that the keyring could not be read, and opens on its
+  own once the keyring answers (B253).
+- **A new version saved on another computer in the same second as an upload from here could
+  be missed for good** when Drive had not listed the uploaded file yet. The first sync pass
+  after upgrading reads each file's size from Drive once more to close this (B254).
+- **An edit in a synced folder could replace one another computer had just saved.** The newer
+  version from the other computer was left only in the version history. The edit is now kept as
+  a conflict copy (B249).
+- **A version saved on another computer while this one downloaded the previous version never
+  arrived.** (B250)
+- **Syncing a folder into one that already held a file of the same name and size took the two
+  for the same file**, even when their content differed. The content is now compared, and a
+  different file is kept as a conflict copy (B248).
+- **Conflict copies now name the computer that made them**, for example
+  `notes (sync-conflict laptop 1700000000).txt`, so two computers no longer make the same name
+  (B251).
+- **A folder deleted on another device took files with it that had never reached Drive.** A new
+  file, an edit or an ignored `.git` in a synced folder was deleted along with the folder. Such a
+  folder is now kept and created on Drive again (B211).
+- **Files on Drive that could not be decrypted were deleted from the synced folder.** They read
+  as deleted on Drive. They are now left alone and named in the activity feed, and a pass in which
+  nothing synced is left on Drive is refused (B212).
+- **An edit made while a synced folder was being checked could be deleted** when another device
+  had deleted the file. It is now kept and uploaded (B213).
+- **Deleting a synced folder sent another device's new files in it to the trash.** The folder now
+  stays on Drive with them (B214).
+- **A file name on Drive containing `/` or `..` could write outside the synced folder**, and made
+  its folder in the mount fail to list. Such names are left out (B215).
+- **A damaged database lost the changes still waiting to upload.** It is still moved aside and
+  rebuilt, but queued changes, synced folders' state and files kept offline are copied out of it
+  first (B216).
+- **Search slowed down over time, and the database grew far larger than needed.** The search
+  indexes are now compacted once a day; on one machine that took the local index from 317 MiB to
+  20 MiB (B217).
+- **`pdfs diagnose` and `pdfs cache inspect` froze the drive while they checked the database**,
+  for half a minute on a large one. They no longer hold up anything else (B218).
+- **Listing a folder shared with you could freeze the whole drive on a slow connection**, and so
+  could folders of photos asking for thumbnails while the connection stalled (B219, B220).
+- **Opening a large folder for the first time held up every other file operation on the drive.**
+  (B221)
+- **A full disk while saving a file was not reported.** The program saving it now gets the error
+  when it closes the file. Copying a large file into the drive no longer stalls everything else at
+  the end, `fsync` on a file opened for reading no longer fails, and `fallocate` modes the drive
+  cannot honour are refused instead of corrupting the file (B222, B224, B227).
+- **A damaged settings file was replaced with defaults at the next settings change**, losing the
+  mount location and the ignore rules. Settings are no longer saved over a file that cannot be
+  read (B223).
+- **Google Photos import gave some photos another photo's name and date.** A photo without its
+  own metadata file took a similarly named one's, and an edited copy took its original's name. An
+  edited copy now takes its original's date and keeps its own name (B225).
+- **Thumbnails of portrait photos lay on their side**, here and in Proton's own apps (B226).
+- **A write could be lost to a power cut after the program saving it had closed the file.** Saving
+  a change into the upload queue is now written through to disk (B229).
+- **A partly written file whose upload answer was lost came back as a conflict copy of itself.**
+  The retry now recognises its own upload (B228).
+- **A file or folder created offline could merge with another device's of the same name** made
+  while this computer was offline (B230).
+- **A large upload under a low upload limit never finished.** It ran out of time on every try,
+  took the drive offline and started over. Its time limit now allows for its share of the limit
+  (B231).
+- **Every reconnect sent all failed uploads again at once,** including those Proton had refused
+  for a full quota or missing access, and failed uploads were retried no later than every two
+  minutes. Refused uploads now keep their wait, which grows to five minutes, and retries are
+  spread out (B237).
+- **Signing out left the session valid on Proton.** It is now ended there too; `pdfs logout` says
+  so when Proton cannot be reached (B233).
+- **Any folder could be synced, the home folder included,** which uploaded the app's own cache
+  and walked into the drive itself. The root of the file system, the home folder and the folders
+  above it, the Proton Drive folder, the app's own data and folders inside or around another
+  synced folder are now refused, also when restoring another computer's folders (B234).
+- **Names with `&` or `<` showed as empty rows in the app**, and some names were drawn as
+  formatting, for example shared items, computer names and link addresses (B232).
+- **Photos imported from Google Photos, re-dated, or uploaded from the app had no thumbnail** in
+  Proton's apps (B236).
+- **Photos with no other date were filed under the day they were uploaded.** Their own EXIF date
+  is now used, for Google Photos imports and for uploads from the app (B244).
+- **Scanning a Google Photos export with a large folder took up to half a minute.** 10,000 photos
+  now take a tenth of a second (B235).
+- **Every photo opened in the viewer stayed in memory**, with its full-size image, until the app
+  quit. The Share dialog leaked the same way (B241).
+- **Opening a large photo froze the app** while it was decoded (B242).
+- **The app froze when opening a file while the drive did not respond.** It now falls back to
+  downloading the file after two seconds. Applications the app started also no longer linger as
+  zombie processes (B243).
+- **`pdfs import-google-photos --wait` and `pdfs redate-photos --wait` succeeded when the run
+  failed.** They now exit with an error when the run failed, was cancelled or left photos failed,
+  and the app shows why an import failed (B239).
+- **`pdfs mount`, `login`, `unlock` and `logout` could be core-dumped with the account's keys in
+  memory.** Only the background service was protected. A file named like an option, such as
+  `--json`, also broke the file manager's "Keep offline" script (B240).
+- **Signing in while the system keyring was locked froze the app window** until the keyring was
+  unlocked (B246).
+- **A program the background service started could keep it from being restarted when it hung**
+  (B245).
+- **The tray's transfer line was not translated** (B247).
+
+### Changed
+- **Draining a large batch of offline changes no longer slows down with its size.** The queue is
+  indexed by name (schema 43, B238).
+- **Release binaries are stripped of their symbols**: `pdfs` goes from 43 to 35 MB, `pdfs-app`
+  from 24 to 19 MB and `pdfs-tray` from 12 to 8 MB.
+
+## [3.4.1] — 2026-10-16
+
+Schema: **42**, unchanged.
+
+### Fixed
+- **After a password reset, the drive never mounted and the app stayed on "Connecting…".** A
+  reset gives the account new keys, and Proton locks the Drive volume that was encrypted to the
+  old ones. The service then failed every start with `failed to decrypt: missing key`. It now
+  starts a new My Files volume, as the web app does. The files in the locked volume can still be
+  restored from [drive.proton.me](https://drive.proton.me) with the previous password
+  (B210, [#40](https://github.com/narrrl/proton-drive-linux/issues/40)).
+- **A blocked sign-in said the app version was no longer supported.** Proton refuses sign-in for
+  a while after it suspects abuse, and its message then asks you to update. The app and
+  `pdfs login` now say that Proton is refusing sign-in for now and that waiting helps
+  (B209, [#39](https://github.com/narrrl/proton-drive-linux/issues/39)).
+- **`pdfs diagnose` failed the `database` check on a fresh install.** The daemon creates the
+  database after the first sign-in, so a missing one is now a warning.
+
 ## [3.4.0] — 2026-10-12

 Schema: **42**, unchanged.
@@ -1786,6 +1942,8 @@ First stable release: FUSE files-on-demand mount, sync daemon under `proton-driv
 - The outstanding FUSE defects tracked in `docs/BUGS.md`, plus a truncate defect, validated
  by a new POSIX compliance suite for the filesystem.

+[3.5.0]: https://github.com/narrrl/proton-drive-linux/releases/tag/v3.5.0
+[3.4.1]: https://github.com/narrrl/proton-drive-linux/releases/tag/v3.4.1
 [3.4.0]: https://github.com/narrrl/proton-drive-linux/releases/tag/v3.4.0
 [3.3.0]: https://github.com/narrrl/proton-drive-linux/releases/tag/v3.3.0
 [3.2.1]: https://github.com/narrrl/proton-drive-linux/releases/tag/v3.2.1
@@ -4,7 +4,8 @@
 talks to the running service (`proton-drive.service`); `login`, `logout`, `mount`, `daemon` and
 `diagnose` work without it.

-`pdfs <command> --help` prints the full help of any command. This page groups them by task.
+`pdfs <command> --help` prints the full help of any command. This page groups them by task. For
+what the commands do in the app, see the [user guide](USER_GUIDE.md).

 - [Conventions](#conventions)
 - [Account and service](#account-and-service)
@@ -35,15 +36,18 @@ talks to the running service (`proton-drive.service`); `login`, `logout`, `mount

 | Command | Description |
 |---|---|
-| `pdfs login [-u EMAIL]` | Sign in (password, then a 2FA code if the account has one) and store the session in the system keyring. Restarts the service if it is running. |
-| `pdfs logout` | Remove the stored session. |
+| `pdfs login [-u EMAIL] [--remember]` | Sign in (password, then a 2FA code if the account has one) and store the session in the system keyring. Restarts the service if it is running. `--remember` keeps a two-password account unlocked across logins. |
+| `pdfs unlock [--remember]` | Enter the mailbox password of a two-password account, so the service can open your files. Needed once per login session, or once with `--remember`. |
+| `pdfs lock` | Forget the unlock held in memory; the account is locked again. |
+| `pdfs logout` | End the session on Proton and remove the stored session. |
 | `pdfs status` | Account, mount, queue and cache state. |
 | `pdfs quota` | Storage used across all Proton products. |
 | `pdfs locations` | Every local place the service occupies: the Proton Drive folder and each synced folder, with mode and state. |
 | `pdfs daemon [MOUNTPOINT]` | Run the service in the foreground: wait for a session, mount, stay mounted. `proton-drive.service` runs this. |
 | `pdfs mount [MOUNTPOINT]` | Mount once and block until unmounted. Defaults to `~/ProtonDrive`. |

-`pdfs login` cannot show a CAPTCHA. If Proton asks for one, sign in with `pdfs-app` instead.
+If Proton asks for a CAPTCHA, `pdfs login` prints the address of the page. Open it in your
+browser, complete it, then press Enter.

 ## Files

@@ -86,7 +90,7 @@ commands are for scripts and for cases where the mount is not available.
 | `pdfs sync export ID DEST` | Save a copy of a queued upload's content. `DEST` may be a folder; an existing file is never overwritten. The upload stays queued. |
 | `pdfs sync discard ID [--yes]` | Drop a queued change and undo it here: a new file or folder goes, anything else goes back to what Proton Drive has. Content not exported first is lost. |
 | `pdfs sync retry [ID]` | Retry one queued operation, or every failed one. |
-| `pdfs sync restore [--device UID] [--yes]` | Re-attach this computer's backed-up folders to local folders and download them. `--device` restores another computer's folders. See [RECOVERY.md](RECOVERY.md). |
+| `pdfs sync restore [--device UID] [--yes]` | Re-attach this computer's backed-up folders to local folders and download them. `--device` restores another computer's folders. See [Recovery](RECOVERY.md). |

 ## Conflicts

@@ -102,8 +106,9 @@ commands are for scripts and for cases where the mount is not available.
 | `pdfs devices list` | List computers registered to the account. |
 | `pdfs devices rename UID NAME` | Rename a computer. |
 | `pdfs devices rm UID` | Remove a computer and its backup from the account. |
+| `pdfs devices join UID [--yes]` | Sync the same folders as another computer. This machine syncs into that computer's backup alongside it, then offers its folders like `pdfs sync restore`. Both computers keep them in step. `--yes` skips the confirmation and accepts every proposed path. |
 | `pdfs devices adopt UID` | Make this machine continue another computer's backup, for example after a reinstall. `--clear` returns to matching by hostname. |
-| `pdfs devices migrate UID [--yes]` | Move another computer's folders into this computer's backup, then restore them here like `pdfs sync restore`. The other computer stays registered, without those folders. `--yes` skips the confirmation and accepts every proposed path. See [RECOVERY.md](RECOVERY.md). |
+| `pdfs devices migrate UID [--yes]` | Move another computer's folders into this computer's backup, then restore them here like `pdfs sync restore`. The other computer stays registered, without those folders. `--yes` skips the confirmation and accepts every proposed path. See [Recovery](RECOVERY.md). |

 ## Trash

@@ -176,7 +181,7 @@ commands are for scripts and for cases where the mount is not available.
 | `pdfs cache vacuum` | Compact the database. Needs free space for a second copy of it while it runs. |
 | `pdfs cache clear` | Delete cached file content. Files kept available offline stay. |

-[TROUBLESHOOTING.md](TROUBLESHOOTING.md) explains when to use each of these.
+[Troubleshooting](TROUBLESHOOTING.md) explains when to use each of these.

 ## Scripting with `--json`

@@ -0,0 +1,60 @@
+# Computers
+
+Every computer that backs up folders to your account has its own entry in Proton Drive. The
+**Computers** page lists this computer and every other one, including computers that run the
+official Windows or macOS app.
+
+- [What you can do](#what-you-can-do)
+- [Syncing several computers](#syncing-several-computers)
+- [Replacing or reinstalling a computer](#replacing-or-reinstalling-a-computer)
+
+![The Computers page](../images/computers.png)
+
+## What you can do
+
+**On this computer:**
+
+- See its synced folders and their state, and add more with **Add Folder to Sync**. See
+  [Synced folders](SYNCED_FOLDERS.md).
+- **Restore Folders…** brings back folders that are backed up under this computer but not synced
+  here yet, for example after a reinstall.
+
+**On another computer**, from its menu:
+
+| Choose | When | What happens |
+|---|---|---|
+| **Browse Files** | You need a file from it | Its backup opens read-only, like My files |
+| **Restore to This Computer…** | You want a copy of its folders here | Its folders download here and stay part of its backup |
+| **Sync With This Computer…** | Both computers should share the same folders, such as a desktop and a laptop | Both keep the folders in step. See [below](#syncing-several-computers) |
+| **Continue This Backup Here…** | This computer replaces it, after a reinstall or with new hardware | This computer takes over its backup. See [Recovery](RECOVERY.md) |
+| **Move to This Computer…** | You switch for good, for example from Windows to Linux | Its folders move into this computer's backup and are offered for syncing here. The other computer stays in the list, without those folders |
+
+`pdfs devices list` shows the same computers with their IDs, for the commands in the
+[command-line reference](CLI.md#computers).
+
+## Syncing several computers
+
+Two or more computers can sync the same folders through one backup in Proton Drive.
+
+1. Sync the folders on the first computer as usual.
+2. On the second computer, open **Computers**, open the menu of the first computer and choose
+   **Sync With This Computer…**. From a terminal: `pdfs devices join UID`, with the ID from
+   `pdfs devices list`.
+3. Choose which of its folders to sync here, and where.
+
+From then on, both computers sync into that backup:
+
+- A folder you add later on either computer lands there too. A folder with the same name joins
+  the one already there.
+- A change on one computer reaches the other within about two minutes.
+- When both computers change the same file within that time, each keeps the other's version under
+  the original name, and its own as a conflict copy named after it. See
+  [Conflicts](SYNCED_FOLDERS.md#conflicts).
+
+Folders that were synced on this computer before it joined stay in its own backup.
+
+## Replacing or reinstalling a computer
+
+Your synced folders are on Proton Drive, so a new or reinstalled computer can pick up where the
+old one stopped. [Recovering on a new computer](RECOVERY.md) walks through it step by step, and
+explains what is lost with a machine and what is not.
@@ -14,6 +14,7 @@ and where the client keeps its data.
 | Path | Contents |
 |---|---|
 | `~/.config/proton-drive-linux/config.json` | Settings (this page) |
+| `~/.config/proton-drive-linux/machine-id` | A random id for this machine. It names this machine's profile in a computer's backup that several computers may share |
 | `~/.local/state/proton-drive-linux/cache.db` | Metadata database: names, folder tree, sync state, upload queue, photo index |
 | `~/.local/state/proton-drive-linux/sdk_cache.db` | Encrypted cache of Proton Drive metadata. Safe to delete while the service is stopped |
 | `~/.local/state/proton-drive-linux/control.sock` | Socket the app, tray, prompt and CLI use to reach the service |
@@ -38,7 +39,7 @@ Inside `content/`:
 > not reached Proton Drive and exists nowhere else.

 Everything in these directories except the keyring is **decrypted**. See
-[ARCHITECTURE.md §10](ARCHITECTURE.md#10-threat-model-what-this-client-writes-to-disk-in-plaintext).
+the [security model](SECURITY_MODEL.md#what-is-kept-on-this-computer).

 ## `config.json`

@@ -60,7 +61,9 @@ fix it.
  "proton_theme": true,
  "online_map": false,
  "tray_hidden": false,
+  "update_check": false,
  "files_view": { "list": true, "sort": "modified", "descending": true, "folders_first": true },
+  "window": { "width": 980, "height": 680, "maximized": false },
  "open_with": {
    "terminal": ["alacritty", "-e"],
    "rules": [{ "match": ["@text"], "command": ["nvim"], "terminal": true }]
@@ -78,14 +81,18 @@ fix it.
 | `upload_limit` | bytes/s | none | General → Network | Shared cap for all uploads. `0` or `null` means none |
 | `download_limit` | bytes/s | none | General → Network | Shared cap for all downloads, reads from the mount included |
 | `ignore_patterns` | list | see below | — | Global ignore rules for synced folders |
-| `device_uid` | string | none | Computers → Continue This Backup Here… | The computer this machine continues. Unset means "match by hostname" |
+| `device_uid` | string | none | Computers → Continue This Backup Here… or Sync With This Computer… | The computer this machine syncs into. Unset means "match by hostname" |
 | `conflict_sweep` | `off` / `report` / `enforce` | `report` | — | See [`conflict_sweep`](#conflict_sweep) |
 | `local_first` | bool | `true` | — | See [`local_first`](#local_first) |
 | `language` | gettext code | system | General → Appearance | Language of the app, tray and prompt, such as `de` or `pt_BR` |
 | `proton_theme` | bool | follow system | General → Appearance | Proton's colours instead of the system theme |
 | `online_map` | bool | `false` | General → Appearance | Street map for Places from OpenFreeMap |
 | `tray_hidden` | bool | `false` | General → Appearance | Hide the tray icon |
+| `update_check` | bool | `false` | General → Updates | Ask GitHub once a day for a newer release and show it over the sidebar. Not offered where a package manager installs updates |
+| `update_last_checked` | Unix seconds | none | — | Written by the update check, so a restart does not ask again within a day |
+| `update_latest` | version | none | — | The latest release the update check found |
 | `files_view` | object | grid, by name | My files view menu | `list`, `sort` (`name`, `size`, `modified`), `descending`, `folders_first` |
+| `window` | object | 980 × 680 | Resizing the app window | `width`, `height` (the unmaximized size), `maximized` |
 | `open_with` | object | `xdg-open` | — | See [`open_with`](#open_with) |
 | `prompt` | object | built-in window | — | See [`prompt`](#prompt) |

@@ -106,7 +113,7 @@ Gitignore-style rules applied to every synced folder, in addition to each folder
 ```

 Set it to `[]` to turn the defaults off. See
-[USER_GUIDE.md](USER_GUIDE.md#excluding-files-with-pdfsignore) for how ignoring behaves.
+[Synced folders](SYNCED_FOLDERS.md#excluding-files-with-pdfsignore) for how excluding behaves.

 ### `conflict_sweep`

@@ -195,7 +202,7 @@ Command-line flags win over the file: `--gtk`, `--dmenu`, `--fzf` and `--menu`.
 | `PDFS_STAND_IN_WIDGETS` | app | `1` uses the libadwaita 1.5 fallback widgets on newer systems (development) |

 The tests have their own variables (`PDFS_ACCEPTANCE_*`, `PDFS_SIM_*`, `PDFS_MIGRATE_DB`),
-listed in [TESTING.md](TESTING.md).
+listed in [Testing](TESTING.md).

 ## The systemd service

@@ -141,31 +141,50 @@ file to `po/POTFILES.in`, run `po/update.sh`, and translate the new entries in e
 unit test, a simulation scenario or a `regression B<n>` acceptance case, and cite the entry in the
 code as `docs/BUGS.md B<n>`. Do not cite planning notes that are not in the repository.

-**A user-visible change.** Update the matching page (user guide, CLI reference, configuration)
-and the `[Unreleased]` section of [CHANGELOG.md](CHANGELOG.md). `scripts/publish-wiki.sh` copies
-the six user pages (`INSTALL`, `USER_GUIDE`, `CLI`, `CONFIGURATION`, `TROUBLESHOOTING`, `RECOVERY`)
-to the GitHub wiki, so keep their file names.
+**A user-visible change.** Update the matching page (a user guide topic, the CLI reference,
+configuration) and the `[Unreleased]` section of [CHANGELOG.md](CHANGELOG.md). Link between pages
+with relative links such as `[Conflicts](SYNCED_FOLDERS.md#conflicts)`, and show screenshots from
+`images/` with `../images/<name>.png`.
+
+**The wiki.** `docs/` is the source of the [GitHub wiki](https://github.com/narrrl/proton-drive-linux/wiki).
+`scripts/publish-wiki.sh` turns each page listed in its `SECTIONS` into a wiki page, rewrites the
+links, copies the images and writes the sidebar. `docs/README.md` becomes the wiki's Home.
+`BUGS.md` and `CHANGELOG.md` stay out of it; the wiki links to them on GitHub.
+
+- `scripts/publish-wiki.sh --check` checks every link and heading anchor in `docs/`, `README.md`,
+  `CONTRIBUTING.md` and `SECURITY.md`. It fails on a page in `docs/` that is not in `SECTIONS`
+  or `EXCLUDED`. `.github/workflows/wiki.yml` runs it for every change to the documentation.
+- Each release publishes the wiki from the tag. Run the **Wiki** workflow from the Actions tab to
+  publish `main` in between, for example after fixing a mistake.
+- `scripts/publish-wiki.sh [WORKDIR]` builds and commits the wiki in a local clone without
+  pushing, so you can look at the result first. `--push` pushes it.
+
+Never edit the wiki in the browser: the next publish replaces every page.

 ## Releasing

 Releases are cut from `main` by pushing a `v*` tag. `.github/workflows/release.yml` then:

-1. checks that the tag, the workspace version in `Cargo.toml` and `pkgver` in
-   `packaging/PKGBUILD` agree;
+1. checks that the tag, the workspace version in `Cargo.toml`, `pkgver` in
+   `packaging/PKGBUILD` and the default version in `packaging/proton-drive-linux.spec` agree;
 2. runs the quality gates;
-3. builds the release binaries and packages a `.tar.gz`, a `.deb` and a GPG-signed `.rpm`, and
-   builds the Nix flake at the tag, which is what a flake input pinned to `vX.Y.Z` gets, and
-   pushes it to the `proton-drive-linux` Cachix cache (secret `CACHIX_AUTH_TOKEN`);
+3. builds the release binaries and packages a `.tar.gz`, a `.deb`, a GPG-signed `.rpm` and a
+   `.tar.xz` of the vendored crates, and builds the Nix flake at the tag, which is what a flake
+   input pinned to `vX.Y.Z` gets, and pushes it to the `proton-drive-linux` Cachix cache (secret
+   `CACHIX_AUTH_TOKEN`);
 4. publishes them as a GitHub release, with the version's section of `docs/CHANGELOG.md` as the
   notes;
 5. calls `.github/workflows/aur.yml`, which updates and pushes the AUR recipes and commits them
-   back to `main`.
+   back to `main`;
+6. calls `.github/workflows/copr.yml`, which builds the release in the
+   [COPR repository](../packaging/copr/README.md) (secret `COPR_CONFIG`);
+7. calls `.github/workflows/wiki.yml`, which publishes `docs/` at the tag to the wiki.

 To prepare a release:

 ```bash
-# 1. Bump the version in Cargo.toml, packaging/PKGBUILD, po/pdfs.pot and the pinned flake
-#    URL in docs/INSTALL.md, then refresh the lock file.
+# 1. Bump the version in Cargo.toml, packaging/PKGBUILD, packaging/proton-drive-linux.spec,
+#    po/pdfs.pot and the pinned flake URL in docs/INSTALL.md, then refresh the lock file.
 cargo update --workspace
 # 2. Move the [Unreleased] notes in docs/CHANGELOG.md under the new version.
 # 3. Commit, tag and push.
@@ -0,0 +1,104 @@
+# FAQ
+
+Short answers to common questions, with links to the details.
+
+- [Is this an official Proton app?](#is-this-an-official-proton-app)
+- [If I delete a file in `~/ProtonDrive`, is it deleted on Proton Drive?](#if-i-delete-a-file-in-protondrive-is-it-deleted-on-proton-drive)
+- [Online only, available offline or synced folder: which do I want?](#online-only-available-offline-or-synced-folder-which-do-i-want)
+- [Does it work offline?](#does-it-work-offline)
+- [How do I get updates?](#how-do-i-get-updates)
+- [Why is there no tray icon?](#why-is-there-no-tray-icon)
+- [What is stored unencrypted on my computer?](#what-is-stored-unencrypted-on-my-computer)
+- [Does it send telemetry?](#does-it-send-telemetry)
+- [Can I use it on several computers?](#can-i-use-it-on-several-computers)
+- [Can I continue a backup from Windows or macOS?](#can-i-continue-a-backup-from-windows-or-macos)
+- [Can I run it on a server without a desktop?](#can-i-run-it-on-a-server-without-a-desktop)
+- [Which architectures and languages are supported?](#which-architectures-and-languages-are-supported)
+- [How do I report a bug?](#how-do-i-report-a-bug)
+
+## Is this an official Proton app?
+
+No. It is an independent, open-source client, not affiliated with or endorsed by Proton AG. It
+uses a Rust port of Proton's own Drive SDK, and everything stays end-to-end encrypted. It has had
+no independent security audit. See the [security model](SECURITY_MODEL.md).
+
+## If I delete a file in `~/ProtonDrive`, is it deleted on Proton Drive?
+
+Yes. `~/ProtonDrive` is your Proton Drive, not a copy. A deleted file moves to the Proton Drive
+Trash, and you can restore it from **Trash** in the app or the web. See [Trash](FILES.md#trash).
+
+Stopping the service is not the same: once the service stops, `~/ProtonDrive` is just an empty
+folder, and your files stay on Proton Drive.
+
+## Online only, available offline or synced folder: which do I want?
+
+- **Online only** for most of your Drive. Files take no space until you open them.
+- **Available offline** for files in `~/ProtonDrive` you need without a connection.
+- **Synced folder** for a folder that lives on this computer, such as `~/Documents`, and should be
+  backed up.
+
+[Getting started](GETTING_STARTED.md#3-choose-how-files-are-kept) compares them side by side.
+
+## Does it work offline?
+
+Yes, for files that are on this computer: available-offline files, synced folders, and recently
+opened files still in the cache. You can also create, rename, move and delete files offline. The
+changes are queued and sent when the connection is back. See
+[Changes waiting for Proton Drive](SYNCED_FOLDERS.md#changes-waiting-for-proton-drive).
+
+## How do I get updates?
+
+Through your package manager. The Fedora COPR repository, the AUR and the Nix flake get every
+release, so `dnf upgrade`, your AUR helper or a flake update brings it. The `.deb` has to be
+downloaded again for each release. To be told about new releases, turn on **Check for updates**
+in **Preferences**. The app never updates itself. See [Installation → Updating](INSTALL.md#updating).
+
+## Why is there no tray icon?
+
+GNOME needs the
+[AppIndicator extension](https://extensions.gnome.org/extension/615/appindicator-support/) to show
+tray icons. If you hid the icon from its own menu, turn it back on under
+**Preferences → General → Appearance**.
+
+## What is stored unencrypted on my computer?
+
+To show your files, the client decrypts them on this computer. Recently opened files, files kept
+offline, changes waiting to upload, and the names of your files and folders are stored without
+extra encryption. Use full-disk or home-folder encryption. The
+[security model](SECURITY_MODEL.md#what-is-kept-on-this-computer) has the full list.
+
+## Does it send telemetry?
+
+No. The client connects only to Proton, and, if you turn them on, to OpenFreeMap for the street map
+in Photos and to GitHub to check for updates. See
+[Network connections](SECURITY_MODEL.md#network-connections).
+
+## Can I use it on several computers?
+
+Yes. Each computer has its own backup in Proton Drive, and two or more computers can also sync the
+same folders. See [Syncing several computers](COMPUTERS.md#syncing-several-computers).
+
+## Can I continue a backup from Windows or macOS?
+
+Yes. On the **Computers** page, choose **Move to This Computer…** on the old computer. Its folders
+move into this computer's backup on Proton Drive, without uploading anything again. See
+[Moving another computer's backup here](RECOVERY.md#moving-another-computers-backup-here).
+
+## Can I run it on a server without a desktop?
+
+Yes, with `pdfs daemon` or `pdfs mount`. It still needs a Secret Service provider such as GNOME
+Keyring or KeePassXC to hold the session. See
+[Headless and server use](INSTALL.md#headless-and-server-use).
+
+## Which architectures and languages are supported?
+
+Release packages are for x86_64. Other architectures can [build from source](INSTALL.md#build-from-source).
+
+The app, tray and launcher are available in English, German, Spanish, French, Italian, Dutch,
+Polish and Brazilian Portuguese. [Translating](TRANSLATING.md) explains how to add a language.
+
+## How do I report a bug?
+
+Run `pdfs diagnose`, then [open an issue](https://github.com/narrrl/proton-drive-linux/issues/new/choose)
+with what [Reporting a problem](TROUBLESHOOTING.md#reporting-a-problem) lists. Report security
+problems privately, as described in [SECURITY.md](../SECURITY.md).
@@ -0,0 +1,88 @@
+# Files and offline access
+
+Your Proton Drive appears on this computer as a folder, `~/ProtonDrive`. Every file and folder in
+it is listed straight away, but a file only downloads when a program opens it. This page covers
+working in that folder, keeping files on this computer, the Trash, and earlier versions of a
+file.
+
+- [Your Drive as a folder](#your-drive-as-a-folder)
+- [Keep files available offline](#keep-files-available-offline)
+- [Browse in the app](#browse-in-the-app)
+- [Trash](#trash)
+- [Earlier versions of a file](#earlier-versions-of-a-file)
+- [Choose which program opens a file](#choose-which-program-opens-a-file)
+
+## Your Drive as a folder
+
+`~/ProtonDrive` is your Proton Drive, called **My files** in the app. It is not a copy. A file you
+change there changes on Proton Drive, and a file you delete there goes to the Proton Drive
+Trash. Every program can use it, from your file manager to a terminal.
+
+- **Only what you read is downloaded.** A video player that seeks, or a tool that reads only the
+  start of a file, downloads only those parts. Videos and music start playing before the whole
+  file is down.
+- **Changes are instant, online or offline.** Creating, renaming, moving and deleting return at
+  once. When a program saves and closes a file, the new content is stored on this computer and
+  sent to Proton Drive in the background. Changes survive a lost connection, a crash or a reboot.
+  See [Changes waiting for Proton Drive](SYNCED_FOLDERS.md#changes-waiting-for-proton-drive).
+- **Recently opened files are cached** up to a size limit (5 GiB by default, set in
+  **Preferences → Storage**). The oldest are removed first to make room.
+- **Shared with me** is a folder inside `~/ProtonDrive` that holds what other people share with
+  you. Shares where you are a viewer are read-only.
+
+Proton Drive cannot store symbolic links, hard links, device files or FIFOs. A program that tries
+to create one gets an error at once. For a project that needs them, use a
+[synced folder](SYNCED_FOLDERS.md) and exclude those paths.
+
+To move the folder somewhere else, change **Preferences → General → Location**.
+
+## Keep files available offline
+
+Files you mark **Available offline** are downloaded completely and stay on this computer, so
+they open without a connection.
+
+- **In the app:** select a file or folder in **My files** and turn on **Available offline**.
+- **From a terminal:** `pdfs pin ~/ProtonDrive/Documents/Taxes`
+
+For a folder, every file in it and in its subfolders downloads in the background. The tray and
+the app show the progress. **Preferences → Storage → Available offline** and `pdfs pins` list
+what is kept.
+
+Turn it off again with the same switch, or `pdfs unpin PATH`. This frees the space. The files stay
+on Proton Drive. A file inside a folder that is kept offline stays with its folder: turn the
+folder off instead.
+
+## Browse in the app
+
+![My files in the app](../images/files.png)
+
+The **My files** page shows the same files without going through the folder. It has a grid and
+a list view, sorting, thumbnails (including camera RAW previews), multi-select, and drag and drop
+to upload. **Details** (Alt+Enter) shows the size, dates, sharing and version history of the
+selected item.
+
+## Trash
+
+Deleted files go to the Trash, both from `~/ProtonDrive` and from the app. The **Trash** page
+lists them with the date they were deleted.
+
+- **Restore** puts an item back where it was, together with any trashed folders above it.
+- **Delete Forever** and **Empty Trash** are permanent.
+
+From a terminal: `pdfs trash` lists the Trash with an ID for each item, and `pdfs restore`,
+`pdfs delete-forever` and `pdfs empty-trash` take those IDs.
+
+## Earlier versions of a file
+
+Proton Drive keeps earlier versions of every file. Open them with **Details → Versions…** in the
+app, or `pdfs versions list PATH`. You can:
+
+- **Restore** a version. This happens on Proton Drive, so nothing is uploaded again.
+- **Save** a version to a separate file, without touching the current one.
+- **Delete** an old version permanently. The current version cannot be deleted.
+
+## Choose which program opens a file
+
+The app and the search launcher open files with your desktop's default program (`xdg-open`). To
+open some file types differently, for example text files in Neovim inside a terminal, add
+`open_with` rules to `config.json`. See [Configuration → `open_with`](CONFIGURATION.md#open_with).
@@ -0,0 +1,72 @@
+# Getting started
+
+From installing to your first synced folder in a few minutes.
+
+> [!IMPORTANT]
+> Proton Drive for Linux is an unofficial client, built by the community and not by Proton. Try it
+> first with files you also have somewhere else.
+
+## 1. Install
+
+| Distribution | Command |
+|---|---|
+| Fedora 44 or newer | `sudo dnf copr enable narl-rs/proton-drive-linux`<br>`sudo dnf install proton-drive-linux` |
+| Arch Linux | `paru -S proton-drive-for-linux` (or any other AUR helper) |
+| Debian, Ubuntu 24.04 or newer | Download the `.deb` from the [latest release](https://github.com/narrrl/proton-drive-linux/releases/latest), then `sudo apt install ./proton-drive-linux_*_amd64.deb` |
+| NixOS | See [Installation → NixOS](INSTALL.md#nixos-flake) |
+
+On GNOME, also install the
+[AppIndicator extension](https://extensions.gnome.org/extension/615/appindicator-support/) to see
+the tray icon. [Installation](INSTALL.md) has every option, building from source, and the optional
+extras.
+
+## 2. Sign in
+
+![The sign-in window](../images/login.png)
+
+1. Open **Proton Drive** from your applications menu.
+2. Sign in with your Proton email and password, and the two-factor code if your account has one.
+   If Proton asks you to prove you are human (common on a VPN), solve the challenge in the window
+   that opens.
+3. Wait a moment. Your Proton Drive appears as the folder `~/ProtonDrive`.
+
+The app starts the Proton Drive service for you, and the service starts by itself whenever you
+log in. Your session is kept in the system keyring (GNOME Keyring, KWallet or KeePassXC), so you
+sign in only once.
+
+## 3. Choose how files are kept
+
+There are three ways to have your files on this computer. You can mix them freely.
+
+| | Takes disk space | Works offline | Use it for |
+|---|---|---|---|
+| **Online only** (the default in `~/ProtonDrive`) | Only for files you opened recently | Only files still in the cache | Most of your Drive: archives, media, anything large |
+| **Available offline** | Yes | Yes | Files and folders you need on the road |
+| **Synced folder** | Yes, a full copy | Yes | Folders that live on this computer, such as `~/Documents`, backed up to Proton Drive |
+
+- **Online only:** open `~/ProtonDrive` in your file manager. Files download when you open them.
+- **Available offline:** select a file or folder in the app and turn on **Available offline**.
+  [More about offline files](FILES.md#keep-files-available-offline).
+- **Synced folder:** in the app, open **Computers** and choose **Add Folder to Sync**.
+  [More about synced folders](SYNCED_FOLDERS.md).
+
+## 4. Know where to look
+
+- **Tray icon:** shows whether everything is up to date, and pauses or resumes sync.
+- **Sync → Overview** in the app: what is uploading, what is waiting, and anything that needs you.
+- **Search launcher:** bind `pdfs-prompt` to a keyboard shortcut to find any file in Proton Drive
+  or your home folder. See [Search launcher and tray](LAUNCHER_AND_TRAY.md).
+
+> [!WARNING]
+> `~/ProtonDrive` is your Proton Drive, not a copy. Deleting a file there moves it to the Proton
+> Drive Trash on every device. You can restore it from **Trash** in the app.
+
+## Next steps
+
+- [User guide](USER_GUIDE.md): everything the app, tray and launcher do.
+- [FAQ](FAQ.md): short answers to common questions.
+- [Troubleshooting](TROUBLESHOOTING.md): when something does not work.
+- [Recovering on a new computer](RECOVERY.md): read this before you rely on the client for
+  backups.
+- Prefer a terminal? `pdfs status` shows the state of everything, and the
+  [command-line reference](CLI.md) lists every command.
@@ -1,70 +1,53 @@
 # Installation

-This page covers installing Proton Drive for Linux from a package or from source, the first
-sign-in, running without a desktop, and removing the client again.
+Install Proton Drive for Linux from your distribution's package, sign in, and keep it up to date.
+This page also covers building from source, running without a desktop, and removing the client
+again.

- [Requirements](#requirements)
 - [Install a package](#install-a-package)
- [Build from source](#build-from-source)
+- [Optional extras](#optional-extras)
 - [First run](#first-run)
- [Headless and server use](#headless-and-server-use)
 - [Updating](#updating)
 - [Uninstalling](#uninstalling)
-
-## Requirements
-
-| | Minimum |
-|---|---|
-| Architecture | x86_64 (release packages); other architectures build from source |
-| Kernel | FUSE 3 (`fuse3` package, `/dev/fuse` available to your user) |
-| GTK / libadwaita | GTK 4.12, libadwaita 1.5 (1.8 or newer gets the newest widgets) |
-| WebKitGTK | 6.0 — used only for the CAPTCHA page during sign-in |
-| Secret Service | GNOME Keyring, KWallet, KeePassXC, or another provider of `org.freedesktop.secrets` |
-| Rust (source builds) | 1.96 |
-
-The session is stored only in the Secret Service. Without a running provider, sign-in succeeds but
-cannot be saved, and the service cannot start unattended.
-
-Optional runtime extras:
-
-| Package | Adds |
-|---|---|
-| `exiftool` (`perl-image-exiftool`, `libimage-exiftool-perl`) | Thumbnails for camera RAW files |
-| `ffmpeg` | Video thumbnails |
-| `iso-codes` | Country names in your language on the Places map |
-| `xdg-utils` | "Open Folder" in the tray, and the default file opener |
-| `fzf` plus a terminal (foot, kitty, alacritty, …) | `pdfs-prompt --fzf`, the search-as-you-type launcher |
-| AppIndicator extension (GNOME only) | The tray icon. KDE Plasma and most other desktops show it natively |
+- [Headless and server use](#headless-and-server-use)
+- [Build from source](#build-from-source)
+- [What the packages install](#what-the-packages-install)

 ## Install a package

-Every [release](https://github.com/narrrl/proton-drive-linux/releases/latest) ships a `.deb`, a
-signed `.rpm` and a `.tar.gz` of the raw binaries. All packages install the same files:
+| Distribution | Package | Updates |
+|---|---|---|
+| [Fedora 44 or newer](#fedora-44-or-newer) | COPR repository `narl-rs/proton-drive-linux` | With `dnf upgrade` |
+| [Arch Linux](#arch-linux-aur) | `proton-drive-for-linux` in the AUR | With your AUR helper |
+| [Debian, Ubuntu 24.04 or newer](#debian-and-ubuntu-2404-or-newer) | `.deb` from the release page | Download each release |
+| [NixOS](#nixos-flake) | The flake in this repository | With `nix flake update` |
+| [Anything else](#other-distributions) | `.tar.gz` from the release page, or [build from source](#build-from-source) | By hand |

-| Path | Purpose |
-|---|---|
-| `/usr/bin/pdfs` | Command-line client and background service |
-| `/usr/bin/pdfs-app` | Desktop app |
-| `/usr/bin/pdfs-tray` | Tray icon |
-| `/usr/bin/pdfs-prompt` | Search launcher |
-| `/usr/lib/systemd/user/proton-drive.service` | User service that keeps the drive mounted |
-| `/etc/xdg/autostart/io.narl.proton-drive-linux-tray.desktop` | Starts the tray at login |
-| `/usr/share/locale/*/LC_MESSAGES/pdfs.mo` | Translations |
-
-### Debian and Ubuntu (24.04 or newer)
-
-```bash
-sudo apt install ./proton-drive-linux_*_amd64.deb
-```
+Release packages are for x86_64. You also need a Secret Service provider, such as GNOME
+Keyring, KWallet or KeePassXC, to keep your session. Most desktops have one already.

 ### Fedora (44 or newer)

+Enable the [COPR repository](https://copr.fedorainfracloud.org/coprs/narl-rs/proton-drive-linux/)
+and install the package:
+
+```bash
+sudo dnf copr enable narl-rs/proton-drive-linux
+sudo dnf install proton-drive-linux
+```
+
+COPR builds every release for Fedora 44, 45 and Rawhide, so `sudo dnf upgrade` keeps the client
+up to date along with the rest of your system.
+
+You can also download the signed `.rpm` from the
+[latest release](https://github.com/narrrl/proton-drive-linux/releases/latest). It installs the
+same files, but you have to download each new version yourself:
+
 ```bash
 sudo dnf install ./proton-drive-linux-*.x86_64.rpm
 ```

-For a Fedora package built from your own checkout, see
-[Build an RPM locally](#build-an-rpm-locally).
+To build an RPM from your own checkout, see [Build an RPM locally](#build-an-rpm-locally).

 ### Arch Linux (AUR)

@@ -72,21 +55,33 @@ Three packages cover the usual choices. They conflict with each other, so instal

 | Package | Contents |
 |---|---|
-| [`proton-drive-for-linux`](https://aur.archlinux.org/packages/proton-drive-for-linux) | Latest tagged release, built from source |
-| [`proton-drive-for-linux-bin`](https://aur.archlinux.org/packages/proton-drive-for-linux-bin) | Latest tagged release, prebuilt binaries |
-| [`proton-drive-for-linux-git`](https://aur.archlinux.org/packages/proton-drive-for-linux-git) | `main`, built from git |
+| [`proton-drive-for-linux`](https://aur.archlinux.org/packages/proton-drive-for-linux) | Latest release, built from source |
+| [`proton-drive-for-linux-bin`](https://aur.archlinux.org/packages/proton-drive-for-linux-bin) | Latest release, prebuilt binaries |
+| [`proton-drive-for-linux-git`](https://aur.archlinux.org/packages/proton-drive-for-linux-git) | The newest code on `main`, built from git |

 ```bash
 paru -S proton-drive-for-linux     # or yay, or any other AUR helper
 ```

-The recipes live in [`packaging/aur/`](../packaging/aur/README.md).
+The recipes are in [`packaging/aur/`](../packaging/aur/README.md).
+
+### Debian and Ubuntu (24.04 or newer)
+
+Download the `.deb` from the [latest release](https://github.com/narrrl/proton-drive-linux/releases/latest)
+and install it:
+
+```bash
+sudo apt install ./proton-drive-linux_*_amd64.deb
+```
+
+There is no APT repository yet, so repeat this for each new release. Turn on **Check for
+updates** in **Preferences** to be told when one is out.

 ### NixOS (flake)

-The repository is a flake. Add it as an input and enable the module, which installs the package,
-links the user service into every graphical session and turns on the `fusermount3` wrapper and
-GNOME Keyring for you:
+The repository is a flake. Add it as an input and enable the module. The module installs the
+package, starts the user service in every graphical session, and turns on the `fusermount3`
+wrapper and GNOME Keyring for you:

 ```nix
 {
@@ -107,7 +102,7 @@ That URL follows `main`. To stay on releases, pin the input to a release tag ins
 the tag to update:

 ```nix
-inputs.proton-drive-linux.url = "github:narrrl/proton-drive-linux/v3.3.0";
+inputs.proton-drive-linux.url = "github:narrrl/proton-drive-linux/v3.5.0";
 ```

 Each release tag is built with Nix before the release is published.
@@ -128,29 +123,176 @@ nix.settings = {
 ```

 The cache holds the build against the `nixpkgs` this flake locks. Setting
-`inputs.proton-drive-linux.inputs.nixpkgs.follows = "nixpkgs"` builds against yours instead, which
-the cache does not have, so Nix compiles it. `nix run` and `nix shell` ask whether to use the
-cache the first time; answer yes, or run `cachix use proton-drive-linux`.
+`inputs.proton-drive-linux.inputs.nixpkgs.follows = "nixpkgs"` builds against yours instead,
+which the cache does not have, so Nix compiles it. `nix run` and `nix shell` ask whether to use
+the cache the first time; answer yes, or run `cachix use proton-drive-linux`.

-To try it without changing your system, run the app straight from the flake:
+To try it without changing your system, run it straight from the flake:

 ```bash
 nix run github:narrrl/proton-drive-linux#proton-drive-linux -- --help   # the CLI
 nix shell github:narrrl/proton-drive-linux -c pdfs-app                   # the desktop app
 ```

-The mount itself needs the setuid `fusermount3` from NixOS (`programs.fuse.enable`, on by default
-with the module) and a Secret Service such as GNOME Keyring or KWallet. To leave out ffmpeg and
-with it video thumbnails, override the package with `withFfmpeg = false`. The recipe lives in
+The mount needs the setuid `fusermount3` from NixOS (`programs.fuse.enable`, on by default with
+the module) and a Secret Service such as GNOME Keyring or KWallet. To leave out ffmpeg, and with
+it video thumbnails, override the package with `withFfmpeg = false`. The recipe is in
 [`packaging/nix/`](../packaging/nix/).

 ### Other distributions

-Unpack the `.tar.gz` into a directory on your `PATH`, then install the service unit as shown in
-[Using a binary outside `/usr/bin`](#using-a-binary-outside-usrbin).
+Unpack the `.tar.gz` from the [latest release](https://github.com/narrrl/proton-drive-linux/releases/latest)
+into a directory on your `PATH`, then install the service as shown in
+[Using a binary outside `/usr/bin`](#using-a-binary-outside-usrbin). The binaries need GTK 4.12,
+libadwaita 1.5, WebKitGTK 6.0 and FUSE 3; see [Requirements](#requirements).
+
+## Optional extras
+
+The packages pull in what the client needs. These add features if you install them:
+
+| Package | Adds |
+|---|---|
+| `exiftool` (`perl-image-exiftool`, `libimage-exiftool-perl`) | Thumbnails for camera RAW files |
+| `ffmpeg` | Video thumbnails |
+| `iso-codes` | Country names in your language on the Places map |
+| `xdg-utils` | "Open Folder" in the tray, and the default file opener |
+| `fzf` and a terminal (foot, kitty, alacritty, …) | `pdfs-prompt --fzf`, the search-as-you-type launcher |
+| [AppIndicator extension](https://extensions.gnome.org/extension/615/appindicator-support/) (GNOME only) | The tray icon. KDE Plasma and most other desktops show it without help |
+
+## First run
+
+### With the desktop app
+
+1. Open **Proton Drive** from your applications menu, or run `pdfs-app`.
+2. Sign in with your Proton email and password, and your two-factor code if the account has one.
+   If Proton asks for a CAPTCHA (common on a VPN or a new network), the app shows the challenge in
+   a window and continues after you solve it.
+3. The app enables and starts `proton-drive.service`. Your Drive appears at `~/ProtonDrive`.
+
+The service belongs to your desktop session. It starts after you log in and stops when you log
+out. To put the folder somewhere else, change **Preferences → General → Location**.
+
+[Getting started](GETTING_STARTED.md) explains what to do next.
+
+### With the command line
+
+`pdfs login` stores the session but does not enable the service, so a setup that runs the service
+another way stays untouched. Enable it yourself:
+
+```bash
+pdfs login                                        # email, password, 2FA code
+systemctl --user enable --now proton-drive.service
+pdfs status                                       # account, mount and queue state
+```
+
+`pdfs login` prints the address of the CAPTCHA page if Proton asks for one: open it in your
+browser, solve it, then press Enter.
+
+## Updating
+
+| Installed from | Update with |
+|---|---|
+| COPR (Fedora) | `sudo dnf upgrade` |
+| AUR | `paru -Syu`, or your AUR helper's equivalent |
+| Nix flake | `nix flake update proton-drive-linux`, or change the pinned tag, then rebuild |
+| `.deb`, release `.rpm`, `.tar.gz` | Download the new release and install it over the old one |
+
+The service switches to the new version the next time it starts. To switch at once:
+
+```bash
+systemctl --user restart proton-drive.service
+```
+
+With the `.deb`, the release `.rpm` or the `.tar.gz`, nothing tells you about a new release.
+Turn on **Preferences → General → Check for updates**: the app asks GitHub once a day and shows a
+banner over the sidebar when a newer version is out. The app never installs updates itself.
+Packages that a package manager updates do not offer the setting. A package marks itself that way
+by installing the empty file `share/proton-drive-linux/managed-updates` under the prefix of its
+`bin/` directory, for example `/usr/share/proton-drive-linux/managed-updates`.
+
+Coming from 2.8.0 or older, re-enable the service once. Those releases started it before the
+desktop session was ready, and on KDE that crashes `ksecretd` at every login. Signing in again or
+toggling **Start on login** does this as well:
+
+```bash
+systemctl --user reenable proton-drive.service
+```
+
+Database upgrades run by themselves and only move forward. A newer release's database does not
+open in an older release, so going back to an older version means clearing the local database
+(see [Troubleshooting](TROUBLESHOOTING.md#start-over-with-a-clean-local-state)).
+
+## Uninstalling
+
+> [!WARNING]
+> Check that nothing is waiting to upload before you remove anything. `pdfs sync queue` must be
+> empty. Changes that have not reached Proton Drive exist only on this computer.
+
+1. Stop the service and sign out:
+
+   ```bash
+   pdfs sync queue                                   # must list nothing
+   systemctl --user disable --now proton-drive.service
+   pdfs logout                                       # removes the session from the keyring
+   ```
+
+2. Remove the package:
+
+   | Installed from | Remove with |
+   |---|---|
+   | COPR (Fedora) | `sudo dnf remove proton-drive-linux`, then `sudo dnf copr remove narl-rs/proton-drive-linux` |
+   | Release `.rpm` | `sudo dnf remove proton-drive-linux` |
+   | `.deb` | `sudo apt remove proton-drive-linux` |
+   | AUR | `sudo pacman -R proton-drive-for-linux` (or the `-bin` or `-git` package) |
+   | NixOS | Remove the module and the flake input, then rebuild |
+
+   Removing the package also stops the service of every logged-in user, in case step 1 was
+   skipped.
+
+3. If you want no trace left, remove the local data:
+
+   ```bash
+   rm -rf ~/.config/proton-drive-linux ~/.local/state/proton-drive-linux ~/.cache/proton-drive-linux
+   ```
+
+4. Sign the device out in your Proton account settings. If you no longer want this computer's
+   backups, remove it from **Computers** in the Proton Drive web app.
+
+> [!CAUTION]
+> Do not delete `~/ProtonDrive` while it is mounted. It is your Proton Drive, not a copy: every
+> file deleted there is moved to the Proton Drive trash. Once the service is stopped, the folder
+> is empty, and removing it is safe.
+
+## Headless and server use
+
+The packaged service starts with a desktop session. On a machine without one, run the service
+directly or from your own systemd unit:
+
+```bash
+pdfs daemon                      # waits for a stored session, mounts, stays mounted
+pdfs mount /srv/proton           # mounts once at a given path, blocks until unmounted
+```
+
+Both still need a Secret Service provider for the session. On a server, run
+`gnome-keyring-daemon --unlock` or KeePassXC's Secret Service integration inside the user's D-Bus
+session.

 ## Build from source

+### Requirements
+
+| | Minimum |
+|---|---|
+| Architecture | Any that Rust and GTK support. Release packages are x86_64 only |
+| Kernel | FUSE 3 (`fuse3` package, `/dev/fuse` available to your user) |
+| GTK / libadwaita | GTK 4.12, libadwaita 1.5 (1.8 or newer gets the newest widgets) |
+| WebKitGTK | 6.0, used only for the CAPTCHA page during sign-in |
+| Secret Service | GNOME Keyring, KWallet, KeePassXC, or another provider of `org.freedesktop.secrets` |
+| Rust | 1.96 |
+
+The session is stored only in the Secret Service. Without a running provider, sign-in succeeds
+but cannot be saved, and the service cannot start unattended.
+
 ### Build dependencies

 **Debian / Ubuntu 24.04+**
@@ -173,8 +315,8 @@ sudo dnf install -y cargo rust gettext pkgconf-pkg-config fuse3-devel gtk4-devel
 sudo pacman -S --needed rust gettext pkgconf fuse3 gtk4 libadwaita webkitgtk-6.0 libsecret dbus
 ```

-Install Rust 1.96 or newer with [rustup](https://rustup.rs) if your distribution ships an older
-toolchain.
+If your distribution ships a Rust older than 1.96, install a newer one with
+[rustup](https://rustup.rs).

 ### Compile

@@ -185,7 +327,7 @@ cargo build --release --locked
 po/build.sh target/locale        # optional: compile the translations
 ```

-The four binaries are in `target/release/`: `pdfs`, `pdfs-app`, `pdfs-tray` and `pdfs-prompt`.
+The four programs are in `target/release/`: `pdfs`, `pdfs-app`, `pdfs-tray` and `pdfs-prompt`.

 ### Build a package from the working tree

@@ -211,7 +353,7 @@ sudo dnf install packaging/out/x86_64/proton-drive-linux-*.rpm

 ### Using a binary outside `/usr/bin`

-The service unit starts `/usr/bin/pdfs daemon`. If you installed the binaries somewhere else, for
+The service unit starts `/usr/bin/pdfs daemon`. If you installed the programs somewhere else, for
 example `~/.local/bin`, install the unit for your user and point it at your binary:

 ```bash
@@ -223,98 +365,20 @@ systemctl --user daemon-reload
 ```

 To start the tray at login, copy `packaging/io.narl.proton-drive-linux-tray.desktop` to
-`~/.config/autostart/`. For the app launcher entry, copy `packaging/io.narl.proton-drive-linux.desktop`
-to `~/.local/share/applications/` and the icon `packaging/io.narl.proton-drive-linux.svg` to
-`~/.local/share/icons/hicolor/scalable/apps/`.
+`~/.config/autostart/`. For the entry in your applications menu, copy
+`packaging/io.narl.proton-drive-linux.desktop` to `~/.local/share/applications/` and the icon
+`packaging/io.narl.proton-drive-linux.svg` to `~/.local/share/icons/hicolor/scalable/apps/`.

-## First run
+## What the packages install

-### With the desktop app
+Every package installs the same files:

-1. Open **Proton Drive** from your application menu, or run `pdfs-app`.
-2. Sign in with your Proton email and password, and your two-factor code if the account has one.
-   If Proton asks for a CAPTCHA (common on a VPN or a new network), the app shows the challenge in
-   a window and continues after you solve it.
-3. The app enables and starts `proton-drive.service`. Your Drive appears at `~/ProtonDrive`.
-
-The service is tied to your graphical session. It starts after you log in and stops when you log
-out. Change the folder location under **Preferences → General → Location**.
-
-### With the command line
-
-`pdfs login` stores the session but does not enable the service, so a setup that runs the daemon
-another way stays untouched. Enable the service yourself:
-
-```bash
-pdfs login                                        # email, password, 2FA code
-systemctl --user enable --now proton-drive.service
-pdfs status                                       # account, mount and queue state
-```
-
-The CLI cannot show a CAPTCHA. If sign-in reports one, sign in once with `pdfs-app` instead; the
-session it stores is used by the CLI and the service as well.
-
-## Headless and server use
-
-The service unit is bound to `graphical-session.target`. On a machine without a desktop session,
-run the daemon directly or from your own unit:
-
-```bash
-pdfs daemon                      # waits for a stored session, mounts, stays mounted
-pdfs mount /srv/proton           # mounts once at a given path, blocks until unmounted
-```
-
-Both still need a Secret Service provider. On a server, run
-`gnome-keyring-daemon --unlock` or KeePassXC's Secret Service integration inside the user's D-Bus
-session.
-
-## Updating
-
-Install the new package over the old one. The service picks up the new binary the next time it
-starts; to switch at once:
-
-```bash
-systemctl --user restart proton-drive.service
-```
-
-Coming from 2.8.0 or older, re-enable the service once. Those releases hooked it into
-`default.target`, which starts it before the desktop session is ready; on KDE that crashes
-`ksecretd` at every login. Signing in again or toggling "Start on login" does this as well:
-
-```bash
-systemctl --user reenable proton-drive.service
-```
-
-Database migrations run automatically and only move forward. A database written by a newer
-release refuses to open in an older one, so downgrading means clearing the local database (see
-[Troubleshooting](TROUBLESHOOTING.md#start-over-with-a-clean-local-state)).
-
-## Uninstalling
-
-> [!WARNING]
-> Check that nothing is waiting to upload before you remove local state. `pdfs sync queue` must be
-> empty. Queued writes exist only on this computer until they reach Proton Drive.
-
-```bash
-pdfs sync queue                                   # must list nothing
-systemctl --user disable --now proton-drive.service
-pdfs logout                                       # removes the session from the keyring
-```
-
-Then remove the package (`sudo apt remove proton-drive-linux`, `sudo dnf remove
-proton-drive-linux`, or `sudo pacman -R proton-drive-for-linux`). Removing the package also stops
-the service of every logged-in user, in case a step above was skipped.
-
-> [!CAUTION]
-> Do not delete `~/ProtonDrive` while it is mounted. It is your Proton Drive, not a copy: every
-> file deleted there is moved to the Proton Drive trash. Once the service is stopped the folder is
-> an empty mount point, and removing it is safe.
-
-If you want no trace left, remove the local data as well:
-
-```bash
-rm -rf ~/.config/proton-drive-linux ~/.local/state/proton-drive-linux ~/.cache/proton-drive-linux
-```
-
-Sign out of the device in your Proton account settings as well, and remove the computer from
-**Computers** in the Proton Drive web app if you no longer want its backups.
+| Path | Purpose |
+|---|---|
+| `/usr/bin/pdfs` | Command-line client and background service |
+| `/usr/bin/pdfs-app` | Desktop app |
+| `/usr/bin/pdfs-tray` | Tray icon |
+| `/usr/bin/pdfs-prompt` | Search launcher |
+| `/usr/lib/systemd/user/proton-drive.service` | User service that keeps the drive mounted |
+| `/etc/xdg/autostart/io.narl.proton-drive-linux-tray.desktop` | Starts the tray at login |
+| `/usr/share/locale/*/LC_MESSAGES/pdfs.mo` | Translations |
@@ -0,0 +1,86 @@
+# Search launcher and tray
+
+The search launcher finds files in Proton Drive and in your home folder from a keyboard shortcut.
+The tray icon shows whether everything is up to date and gives quick access to the app.
+
+- [Search launcher](#search-launcher)
+- [Using your own launcher](#using-your-own-launcher)
+- [Search as you type with fzf](#search-as-you-type-with-fzf)
+- [Tray](#tray)
+
+## Search launcher
+
+![The search launcher](../images/prompt_gtk.png)
+
+`pdfs-prompt` searches Proton Drive and your home folder together, in one list with the best
+matches first. It copes with prefixes, abbreviations, typos and swapped letters, and also matches
+the names of parent folders.
+
+To set it up, bind `pdfs-prompt` to a keyboard shortcut in your desktop's settings.
+
+The window stays loaded after the first use, so later shortcuts open it instantly. Folders, music
+and videos open straight from `~/ProtonDrive`, so players can start before the whole file is down.
+Other files from Proton Drive download first, then open.
+
+To make even the first shortcut instant, start the launcher hidden when you log in.
+`pdfs-prompt --preload` loads the window without showing it, and does nothing if the launcher is
+already running. For example, in Hyprland:
+
+```ini
+exec-once = pdfs-prompt --preload
+bind = SUPER, space, exec, pdfs-prompt
+```
+
+Which program opens a file can be changed per file type. See
+[Choose which program opens a file](FILES.md#choose-which-program-opens-a-file).
+
+## Using your own launcher
+
+`pdfs-prompt --dmenu` shows the results in fuzzel, rofi, wofi, tofi, bemenu or dmenu, whichever is
+installed:
+
+```bash
+pdfs-prompt --dmenu
+pdfs-prompt --dmenu --menu 'fuzzel --dmenu --width 60'
+pdfs-prompt --dmenu --query invoice
+```
+
+These launchers filter a fixed list and cannot ask for new results while you type, so the search
+takes two steps:
+
+1. The first list, `Search Drive ›`, shows your available-offline files. Type a search and press
+   Enter.
+2. The second list, `Drive: invoice ›`, shows the results. Enter opens one. Typing something else
+   searches again.
+
+## Search as you type with fzf
+
+![The search launcher in fzf](../images/prompt_fzf.png)
+
+`pdfs-prompt --fzf` searches again on every key press, like the built-in window. It needs `fzf`.
+Started from a keyboard shortcut, it opens a terminal by itself (foot, ghostty, kitty, alacritty,
+wezterm or xterm) with the app ID `pdfs-prompt`, so one window rule covers all of them. For
+example, in Hyprland:
+
+```ini
+windowrulev2 = float, class:^(pdfs-prompt)$
+windowrulev2 = size 900 500, class:^(pdfs-prompt)$
+windowrulev2 = center, class:^(pdfs-prompt)$
+bind = SUPER, space, exec, pdfs-prompt --fzf
+```
+
+To make `--dmenu` or `--fzf` the default without changing your shortcut, set `prompt.mode` in
+`config.json` (see [Configuration → `prompt`](CONFIGURATION.md#prompt)). `--gtk` always opens the
+built-in window.
+
+## Tray
+
+`pdfs-tray` starts when you log in and shows whether your files are up to date, syncing, paused or
+offline. Its menu opens the app or `~/ProtonDrive`, pauses or resumes sync, and stops or connects
+the service.
+
+- **GNOME** shows tray icons only with the
+  [AppIndicator extension](https://extensions.gnome.org/extension/615/appindicator-support/).
+  KDE Plasma and most other desktops show it without help.
+- **Hide Tray Icon** in its menu removes it until you turn it back on under
+  **Preferences → General → Appearance → Show tray icon**.
@@ -0,0 +1,77 @@
+# Photos
+
+The **Photos** page of the app shows your Proton Photos library. Photos are stored apart from
+My files, so they do not appear in `~/ProtonDrive`.
+
+- [Timeline](#timeline)
+- [Albums](#albums)
+- [Places](#places)
+- [Viewer and duplicates](#viewer-and-duplicates)
+- [Importing from Google Photos](#importing-from-google-photos)
+- [Fixing photos filed under the wrong date](#fixing-photos-filed-under-the-wrong-date)
+
+![The Photos timeline](../images/photos.png)
+
+## Timeline
+
+- The timeline groups photos by day, month or year as you zoom. Drag the scrubber on the right
+  edge to jump through the years.
+- **On this day** shows photos taken on the same date in earlier years.
+- **Filters** narrow the timeline to images, videos or RAW files, to favorites, or to photos that
+  are in no album.
+- **RAW + JPEG pairs** of the same shot show as one tile. The viewer switches between the two, and
+  moving the tile to the Trash removes both.
+- **Upload** adds photos from this computer.
+
+## Albums
+
+**Albums** lists your own albums and the albums others share with you. Create, rename and delete
+albums, and add or remove photos. Deleting an album keeps its photos in the timeline.
+
+## Places
+
+![Places on the map](../images/photos_map.png)
+
+**Places** groups photos by the town they were taken in, as cards or on a map. Town names come
+from [GeoNames](https://www.geonames.org/) data (CC BY 4.0) and the map from
+[Natural Earth](https://www.naturalearthdata.com/) (public domain). Both ship with the app, so
+nothing is fetched online.
+
+A street map from [OpenFreeMap](https://openfreemap.org/) (© OpenStreetMap contributors) can be
+turned on under **Preferences → General → Appearance**. It is off by default, because the map
+server learns which areas you look at.
+
+## Viewer and duplicates
+
+- The viewer marks favorites, shows EXIF details, shows a photo on the map, and runs a slideshow
+  (F5).
+- **Find Duplicates…** in the page menu lists byte-identical copies. Turn on **Similar** to also
+  find resized or re-encoded copies and burst shots.
+
+## Importing from Google Photos
+
+1. Request a [Google Takeout](https://takeout.google.com/) export of Google Photos and download
+   every `.zip` of it.
+2. In the app, open the **Upload** menu on the Photos page and choose **Import from Google
+   Photos…**. Select all the `.zip` files at once, because a photo and its details are often in
+   different parts of the export.
+
+From a terminal:
+
+```bash
+pdfs import-google-photos --dry-run ~/Downloads/takeout-*.zip   # show what would happen
+pdfs import-google-photos --wait ~/Downloads/takeout-*.zip
+```
+
+The import recreates your albums and takes capture dates and locations from the export. Photos
+already in your library are skipped, so an interrupted import can simply be run again.
+`pdfs import-status` shows how far an import is, and `pdfs cancel-import` stops it.
+
+## Fixing photos filed under the wrong date
+
+Photos from an earlier import sometimes sit under the day they were uploaded instead of the day
+they were taken. `pdfs redate-photos --dry-run` finds those whose file name carries a different
+date, and `pdfs redate-photos` fixes them.
+
+Proton cannot change a capture date in place. So each fix uploads the photo again with the right
+date and moves the original to the Trash. Favorites and albums are kept.
@@ -1,19 +1,48 @@
-# Documentation
+# Proton Drive for Linux documentation

-## For users
+Proton Drive for Linux is an unofficial Proton Drive client for the Linux desktop. Your Drive
+appears as a folder that downloads files when you open them, local folders are backed up and kept
+in sync, and a GTK app with a tray icon and a search launcher covers Photos, sharing and more. A
+command-line client does all of it from a terminal.
+
+These pages are also published as the
+[wiki](https://github.com/narrrl/proton-drive-linux/wiki), generated from the
+[`docs/`](https://github.com/narrrl/proton-drive-linux/tree/main/docs) folder of the repository.
+
+## Where to start
+
+- **New here?** [Getting started](GETTING_STARTED.md) takes you from installing to your first
+  synced folder.
+- **Installing or updating?** [Installation](INSTALL.md) covers Fedora (COPR), Arch (AUR),
+  Debian and Ubuntu, NixOS, and building from source.
+- **Something not working?** [Troubleshooting](TROUBLESHOOTING.md) starts with `pdfs diagnose`
+  and goes through common problems.
+- **New computer, or the old one is gone?** [Recovering on a new computer](RECOVERY.md) gets your
+  synced folders back.
+- **Quick question?** Try the [FAQ](FAQ.md).
+
+## Using it
+
+| Page | What it covers |
+|---|---|
+| [User guide](USER_GUIDE.md) | How the pieces fit together, the words the app uses, preferences |
+| [Files and offline access](FILES.md) | The `~/ProtonDrive` folder, keeping files available offline, the Trash, earlier versions |
+| [Synced folders](SYNCED_FOLDERS.md) | Backing up local folders, excluding files, changes waiting to upload, conflicts, pausing |
+| [Photos](PHOTOS.md) | Timeline, albums, places, duplicates, importing from Google Photos |
+| [Sharing](SHARING.md) | Invitations, public links, items shared with you |
+| [Computers](COMPUTERS.md) | Other computers in your account, syncing several computers |
+| [Search launcher and tray](LAUNCHER_AND_TRAY.md) | Finding files from a keyboard shortcut, the tray icon |
+
+## Reference

 | Page | What it covers |
 |---|---|
-| [Installation](INSTALL.md) | Packages, building from source, first sign-in, updating and uninstalling |
-| [User guide](USER_GUIDE.md) | My files, available offline, synced folders, sync issues and conflicts, Photos, sharing, Trash and versions, Computers, the search launcher, the tray |
 | [Command-line reference](CLI.md) | Every `pdfs` command, grouped by task, and scripting with `--json` |
 | [Configuration](CONFIGURATION.md) | `config.json`, environment variables, file locations, the systemd service |
-| [Troubleshooting](TROUBLESHOOTING.md) | Diagnosing problems, common symptoms, starting over, reporting a bug |
-| [Recovering on a new computer](RECOVERY.md) | What survives a lost machine and how to restore your synced folders |
 | [Security model](SECURITY_MODEL.md) | What protects your files, what is kept on this computer, what the client connects to |
 | [Changelog](CHANGELOG.md) | What changed in each release |

-## For contributors
+## Contributing

 | Page | What it covers |
 |---|---|
@@ -24,5 +53,5 @@
 | [Roadmap](ROADMAP.md) | Planned work and verification still owed |
 | [Bug ledger](BUGS.md) | Every tracked defect with its analysis and status |

-Also see [CONTRIBUTING.md](../CONTRIBUTING.md) and [SECURITY.md](../SECURITY.md) in the repository
-root.
+Also see [CONTRIBUTING.md](../CONTRIBUTING.md), and [SECURITY.md](../SECURITY.md) to report a
+vulnerability privately.
@@ -3,6 +3,10 @@
 Your laptop is lost, stolen or reinstalled. This page explains what survives, and how to get
 your synced folders back on the replacement machine.

+**In short:** sign the old machine out of your Proton account. Then, on the new one, install the
+client and sign in. On the **Computers** page, choose **Continue This Backup Here…** on the old
+computer, then **Restore Folders…** on this one.
+
 - [1. What survives](#1-what-survives)
 - [2. Restore your synced folders](#2-restore-your-synced-folders)
 - [3. How the restore works](#3-how-the-restore-works)
@@ -17,7 +21,7 @@ your synced folders back on the replacement machine.
 | Every file that finished uploading | Proton Drive |
 | The computer's registration and its backup | **Computers** in the app and the web |
 | One folder per synced folder, under that computer | Proton Drive |
-| The machine profile: which folders were synced, to which local path, in which mode; pins; ignore patterns | `.proton-drive-linux/profile.json` under the computer's backup, end-to-end encrypted like any other file |
+| The machine profile: which folders were synced, to which local path, in which mode; pins; ignore patterns | `.proton-drive-linux/profile-<machine id>.json` under the computer's backup, one per computer that syncs into it, end-to-end encrypted like any other file. Clients before 3.5.0 wrote `profile.json` |
 | Your account, keys and shares | Proton |

 The service rewrites the profile a short while after you add, remove or switch a synced folder,
@@ -52,7 +56,7 @@ be decrypted.

 ### Step 1: Install and sign in

-Install the client as described in [INSTALL.md](INSTALL.md) and sign in with `pdfs-app`. Signing
+Install the client as described in [Installation](INSTALL.md) and sign in with `pdfs-app`. Signing
 in from the app also starts the service.

 ### Step 2: Continue the old computer's backup
@@ -100,7 +104,7 @@ progress on **Sync → Overview** or with `pdfs sync list`.
 > Restore into empty or missing directories. If a directory already holds files, for example
 > from another backup, the client cannot tell which side is newer. It keeps both: your local file
 > is renamed to a `(sync-conflict …)` copy and the version from Proton Drive is downloaded. See
-> [Conflicts](USER_GUIDE.md#conflicts).
+> [Conflicts](SYNCED_FOLDERS.md#conflicts).

 ### Step 4: Restore the rest by hand

@@ -166,18 +170,21 @@ This section is for the curious and for anyone debugging a restore.
  in the account is reported in the log instead of being replaced silently.
 - **What can be restored.** `pdfs sync restore` lists the folders directly under the computer's
  backup, except `.proton-drive-linux`. Folders already synced on this machine are skipped.
- **Proposed paths.** When the profile names a local path whose parent directory exists on this
+- **Proposed paths.** Several computers may sync into one backup, each with its own profile. The
+  profile written by a computer with this machine's hostname is used first, then the newest one
+  that has the folder. When it names a local path whose parent directory exists on this
  machine, that path is proposed. Otherwise the proposal is `~/<folder name>`. The service never
  writes to a path you have not confirmed.
 - **Attaching by UID.** The restore binds each local path to the remote folder's UID, not to its
  name. Restoring `Documents` into `~/docs` works.
 - **Downloading.** A restored folder starts with an empty sync baseline. Against an empty local
  directory, every remote file counts as new and is downloaded. Files present on both sides with
-  no baseline become conflict copies, as described above.
+  no baseline are compared by content: identical files are taken as they are, and different
+  ones become conflict copies, as described above.
 - **The wipe guard.** A sync pass in which every previously synced file has vanished locally is
  refused instead of being mirrored to Proton Drive as a mass deletion. A folder that was emptied
  by accident therefore does not empty the backup.
- **The profile format.** `profile.json` carries a `version` field. A client refuses a profile
+- **The profile format.** Each profile carries a `version` field. A client refuses a profile
  written by a newer, incompatible client instead of applying part of it.

 ## 4. Known gaps
@@ -188,4 +195,4 @@ This section is for the curious and for anyone debugging a restore.
 | No warning at shutdown or sign-out while changes are queued | Check `pdfs sync queue` before you retire a machine |
 | The full disaster drill (delete all local state, restore, compare byte for byte) has not been run against a live account | The individual steps are tested; the whole sequence is not |

-Planned work is tracked in [ROADMAP.md](ROADMAP.md).
+Planned work is tracked in the [roadmap](ROADMAP.md).
@@ -60,8 +60,12 @@ The client connects only to:
 - **Proton**, for the Drive and account API, and for the CAPTCHA page when Proton asks for one.
 - **OpenFreeMap**, for the street map of Places in Photos, only if you turn it on in Preferences. It is off by default, because the tile server learns which parts of the
  world you look at. The default map is drawn from data shipped with the app.
+- **GitHub**, once a day, to ask for the latest release, only if you turn on **Check for updates**
+  in Preferences. It is off by default, because GitHub learns your IP address and, from the user
+  agent, which version you run. Packages updated by a package manager (COPR, the AUR, Nix) do
+  not offer the setting and never ask.

-There is no telemetry, no analytics and no update check. The SDK can report timings of its own
+There is no telemetry and no analytics. The SDK can report timings of its own
 operations, and the client only writes them to its local log.

 ## What this client does not protect against
@@ -75,7 +79,9 @@ operations, and the client only writes them to its local log.

 ## Packages

- The `.rpm` is signed with GPG.
+- The `.rpm` on the release page is signed with GPG.
+- The COPR packages are built by Fedora's COPR service from the tagged source and the vendored
+  crates of the release, and are signed with the COPR project's own key.
 - The `.deb` and the `.tar.gz` are built by GitHub Actions from the tagged source, and are not
  signed.
 - The AUR packages build from the tagged source or from `main`, or install the release binaries
@@ -0,0 +1,52 @@
+# Sharing
+
+Share files and folders with other people, by invitation or with a public link, and use what
+others share with you.
+
+- [Invite people](#invite-people)
+- [Create a public link](#create-a-public-link)
+- [See what you share](#see-what-you-share)
+- [Shared with you](#shared-with-you)
+
+## Invite people
+
+1. Select a file or folder and choose **Share…**.
+2. Enter one or more email addresses and choose **Can view** or **Can edit**.
+3. Send the invitation. People appear as members once they accept.
+
+The admin role, which may also manage the share, is available from the command line
+(`--role admin`).
+
+From a terminal:
+
+```bash
+pdfs share Documents/Plans alex@example.com --role editor
+pdfs members Documents/Plans          # members, pending invitations and the public link
+```
+
+`pdfs share-role` changes someone's role, and `pdfs unshare` removes one person or stops sharing
+altogether. See the [command-line reference](CLI.md#sharing).
+
+## Create a public link
+
+In **Share…**, create a public link. Anyone with the link can open the item. You can protect the
+link with a password and let it expire on a date. From a terminal, use `pdfs public-link create`
+and `pdfs public-link remove`.
+
+## See what you share
+
+**Shared by me** lists everything you share. Filter it by links, by people, or by expired links.
+Copy a link that is still valid, or stop several shares at once. `pdfs shared` prints the same
+list.
+
+## Shared with you
+
+**Shared with me** lists what other people share with you, who shared it, and what you may do with
+it. The same items are in the `Shared with me` folder inside `~/ProtonDrive`. Items where you are
+a viewer are read-only.
+
+- **Invitations** wait in a banner at the top of the page until you accept or reject them. From a
+  terminal: `pdfs invitations list`, then `accept ID` or `reject ID`.
+- **Saved public links** have their own view. `pdfs bookmarks` manages them.
+- **Leave…** a share you no longer need, or run `pdfs leave UID` with the ID from
+  `pdfs shared-with-me`.
@@ -0,0 +1,163 @@
+# Synced folders
+
+A synced folder is an ordinary folder on this computer, for example `~/Documents`, that is backed
+up to Proton Drive and kept in step with it. This page covers adding one, what to do with files
+that should not be backed up, changes that are still waiting to upload, conflicts, and pausing.
+
+- [Add a folder](#add-a-folder)
+- [Synced or online only](#synced-or-online-only)
+- [Move files between synced folders and My files](#move-files-between-synced-folders-and-my-files)
+- [Stop syncing a folder](#stop-syncing-a-folder)
+- [Excluding files with `.pdfsignore`](#excluding-files-with-pdfsignore)
+- [Changes waiting for Proton Drive](#changes-waiting-for-proton-drive)
+- [Conflicts](#conflicts)
+- [Pausing and limiting sync](#pausing-and-limiting-sync)
+
+![Synced folders in the app](../images/sync.png)
+
+## Add a folder
+
+- **In the app:** open **Computers** and choose **Add Folder to Sync**.
+- **From a terminal:** `pdfs sync add ~/Documents`
+
+The folder is backed up under this computer's name. It shows on the **Computers** page of the app
+and in the Proton Drive web app.
+
+From then on, changes go both ways:
+
+- A file you change here uploads a few seconds after the program closes it. A file that a
+  program still holds open for writing waits until it is closed.
+- A file changed somewhere else downloads on the next sync pass.
+
+**Sync → Folders** in the app, and `pdfs sync list`, show every synced folder and its state.
+
+To sync the same folders on two computers, see [Syncing several computers](COMPUTERS.md#syncing-several-computers).
+
+## Synced or online only
+
+A synced folder normally keeps a full copy on this computer. You can switch it to **Online
+only**: the files stay visible in the same place, but take no disk space until you open them, the
+same as in `~/ProtonDrive`.
+
+- **In the app:** use the **Synced / Online only** switch on the folder's card.
+- **From a terminal:** `pdfs sync mode ID ondemand`, and `pdfs sync mode ID mirror` to switch
+  back. `pdfs sync list` shows the ID.
+
+The switch waits until everything in the folder is on Proton Drive. It refuses while the folder
+holds something that never goes there, such as an excluded `.git/` folder, a symbolic link, or a
+folder you may not read. The message names what is in the way.
+
+`pdfs locations` lists every place on this computer the Proton Drive service uses.
+
+## Move files between synced folders and My files
+
+`~/ProtonDrive`, each online-only folder and each synced folder are separate places for your
+system. Moving a file between them with `mv` or a file manager copies and then deletes: every file
+is downloaded, uploaded again, and the original goes to the Trash.
+
+Use **Move to…** in the app or `pdfs move` instead. The move happens on Proton Drive and takes
+seconds, whatever the size:
+
+```sh
+pdfs move ~/Documents/Scans ~/ProtonDrive/Archive
+pdfs move ~/Documents/a.pdf ~/Documents/b.pdf ~/ProtonDrive/Archive
+```
+
+The last path is the destination folder. Everything before it moves there.
+
+A move out of a synced folder waits until its files are on Proton Drive. A file that is still
+uploading, has changes that are not uploaded yet, or is excluded by `.pdfsignore` stops the move,
+and the message names it. Files you already opened in an online-only folder are not downloaded
+again when they move into a synced one.
+
+## Stop syncing a folder
+
+**Stop Syncing** in the app, or `pdfs sync rm ID`, keeps both the local files and the copy on
+Proton Drive. To delete the copy on Proton Drive as well, tick **Also delete from Proton Drive**,
+or add `--delete-remote`.
+
+## Excluding files with `.pdfsignore`
+
+Synced folders skip build output, dependency folders and editor leftovers. Two sets of rules
+apply together:
+
+1. A `.pdfsignore` file at the top of the synced folder (`.protonignore` works too). It uses the
+   same syntax as `.gitignore`, including `!` to include something again:
+
+   ```gitignore
+   build/
+   *.log
+   !important.log
+   ```
+
+2. The `ignore_patterns` list in `config.json`, for every synced folder (see
+   [Configuration](CONFIGURATION.md#ignore_patterns)). When you have not set it, it skips
+   `.git/`, `.hg/`, `.svn/`, `node_modules/`, `target/`, `.venv/`, `__pycache__/`, `*~`,
+   `*.swp`, `*.tmp`, `.DS_Store` and `Thumbs.db`.
+
+Rules are read again on every sync pass. Excluding never deletes anything: a file that becomes
+excluded is no longer synced, and its copy on Proton Drive stays.
+
+A folder you may not read, such as a cache that a container created as root, is skipped the same
+way, and the activity feed mentions it once. Add it to `.pdfsignore` to stop the message.
+
+## Changes waiting for Proton Drive
+
+A change you make exists only on this computer until it reaches Proton Drive. `pdfs status`, the
+tray and **Sync → Overview** count what is still waiting, and `pdfs sync queue` lists it.
+
+Sometimes Proton Drive refuses a change: the storage is full, a share was taken away, the folder
+is gone, the folder holds too many items, or Proton Drive does not accept the name. The change
+then needs you. It shows at once in **Sync → Overview**, in the tray and in `pdfs sync issues`,
+with what it means and what you can do. The file or folder also gets a warning badge in
+**Files**. Hover over it to see why.
+
+Nothing is deleted. The change stays queued and is tried again. You can:
+
+- **Retry** it now, for example after freeing space: the same list, or `pdfs sync retry`.
+- **Export** a file's content to keep your version: `pdfs sync export ID FILE`.
+- **Discard** the change: `pdfs sync discard ID`. It is undone here and never sent. A new file or
+  folder goes away, and anything else goes back to what Proton Drive has. Export first if you want
+  to keep the content.
+
+Two cases are not refused, and the activity log records both:
+
+- A new file or folder whose name is already taken on Proton Drive, by something this computer
+  had not seen yet, lands under a `(sync-conflict …)` name. See [Conflicts](#conflicts).
+- A new file whose folder was deleted on another device in the meantime lands at the top of My
+  files, so its content is not lost.
+
+> [!IMPORTANT]
+> Before you switch off or wipe a computer for good, check that nothing is waiting. Changes that
+> have not reached Proton Drive are lost with the machine. See
+> [Recovery](RECOVERY.md#lost-with-the-machine).
+
+## Conflicts
+
+![Sync history with resolved conflicts](../images/conflicts.png)
+
+When the same file changed on this computer and somewhere else since the last sync, neither
+version is thrown away:
+
+- The other version keeps the original name.
+- Your local version is kept as a copy named like
+  `report (sync-conflict laptop 1759068180).odt`. `laptop` is the computer that made the copy,
+  and the number is the time of the conflict. Copies made before 3.5.0 have no computer name.
+
+Conflicts show under **Sync → Overview → Needs attention** and in `pdfs conflicts`. For each one,
+keep the original, keep the copy, or keep both under a new name:
+
+```bash
+pdfs conflicts
+pdfs conflicts resolve "Documents/report (sync-conflict laptop 1759068180).odt" --keep copy
+```
+
+The version you do not keep goes to the Trash, so a wrong choice can be undone.
+
+## Pausing and limiting sync
+
+- **Pause** from the tray, the **Sync** page, or `pdfs sync pause`. Uploads and synced folders
+  wait, and opening files keeps working. `pdfs sync pause --for 1h` resumes by itself, and
+  `pdfs sync resume` continues at once.
+- **Limit bandwidth** under **Preferences → General → Network**, or with
+  `pdfs sync limit --up 2M --down 10M`. `0` removes a limit.
@@ -5,7 +5,7 @@ Three layers check the client, from fast and offline to slow and against a real
 | Layer | Needs | Runs in CI |
 |---|---|---|
 | [Unit tests](#unit-tests) | Nothing | Every push and pull request |
-| [Simulation runs](#simulation-runs) | `/dev/fuse` | Every push to `main` |
+| [Simulation runs](#simulation-runs) | `/dev/fuse` | Every push to `main` and every pull request |
 | [Acceptance suite](#acceptance-suite) | Nothing for the reference run; a signed-in account for the rest | The reference run only |

 ## Unit tests
@@ -57,7 +57,7 @@ journalctl --user -u proton-drive.service -b -p warning  # warnings since boot
 ```

 For more detail, raise the log level with a drop-in (see
-[CONFIGURATION.md](CONFIGURATION.md#the-systemd-service)) and restart the service.
+[Configuration](CONFIGURATION.md#the-systemd-service)) and restart the service.

 ### Service state

@@ -68,75 +68,123 @@ pdfs status

 ## Signing in

-**"Proton is asking for a CAPTCHA"** — Proton wants human verification, usually on a VPN or an
-unfamiliar network. `pdfs login` prints the verification page's address: open it in your browser,
-complete it, then press Enter. The app shows the page in its own window.
+### Proton is asking for a CAPTCHA

-**"Verify in Your Browser"** — WebKit, which shows the CAPTCHA page in the app, could not start
-its sandbox. Hardened systems such as secureblue keep its bubblewrap from the journal socket, and
-the log then shows `bwrap: Can't get type of source /run/systemd/journal/socket: Permission
-denied` and `Failed to fully launch dbus-proxy`. Choose **Open Verification Page**, complete the
-page in your browser, then choose **Continue**. If that sign-in is refused too, check that `bwrap`
-and `xdg-dbus-proxy` are installed. As a last resort, sign in once with the sandbox switched off
-for this one run:
+Proton wants to check that you are human, usually on a VPN or an unfamiliar network. The app
+shows the page in its own window. `pdfs login` prints the page's address instead: open it in your
+browser, complete it, then press Enter.
+
+### "Verify in Your Browser"
+
+WebKit, which shows the CAPTCHA page in the app, could not start its sandbox. Hardened systems
+such as secureblue keep its bubblewrap away from the journal socket. The log then shows
+`bwrap: Can't get type of source /run/systemd/journal/socket: Permission denied` and
+`Failed to fully launch dbus-proxy`.
+
+1. Choose **Open Verification Page** and complete the page in your browser.
+2. Choose **Continue**.
+
+If that sign-in is refused too, check that `bwrap` and `xdg-dbus-proxy` are installed. As a last
+resort, quit the app and sign in once with the sandbox switched off for this one run:

 ```bash
 WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1 pdfs-app
 ```

-Quit the app first, so this starts a new instance. The page then runs without WebKit's isolation,
-so use this only for the sign-in. The stored session keeps working without it. Signing in from
-your usual network, without a VPN, often avoids the CAPTCHA in the first place.
+The page then runs without WebKit's isolation, so use this only for the sign-in. The stored
+session keeps working without it. Signing in from your usual network, without a VPN, often avoids
+the CAPTCHA in the first place.

-**Sign-in works but is forgotten after a restart** — no Secret Service provider is running, or its
-keyring is locked. Install and unlock GNOME Keyring, KWallet or KeePassXC (with Secret Service
-enabled). `pdfs diagnose` shows `keyring session` as failing in that case.
+### "This version of the app is no longer supported" or "Proton is temporarily refusing sign-in from this device"
+
+Proton blocks sign-in for a while after too many attempts, or from a network it distrusts. It sends
+the first message even when your version is current. Do not retry for several hours, up to a day,
+then sign in once.
+
+If it still fails, run `RUST_LOG=debug pdfs login` and look for `code=` in the
+`proton api request failed` line. 2028 is this block; 5003 is a release Proton no longer accepts.
+
+### Sign-in works but is forgotten after a restart
+
+No Secret Service provider is running, or its keyring is locked. Install and unlock GNOME
+Keyring, KWallet or KeePassXC (with Secret Service turned on). `pdfs diagnose` then shows
+`keyring session` as failing.
+
+When the app finds a saved sign-in it cannot read, it says so above the sign-in form, and opens
+by itself once the keyring is unlocked. You do not have to sign in again.
+
+### Asked for the mailbox password after every reboot
+
+The account has a separate mailbox password (two-password mode). Such accounts are locked by
+default: the unlock lasts until you log out or restart. To stay unlocked, turn on **Keep unlocked
+on this computer** in the unlock dialog, or run `pdfs unlock --remember`. Either one stores the
+unlock in the system keyring. The [security model](SECURITY_MODEL.md) explains what that trades
+away.

 ## The Proton Drive folder

 > [!TIP]
 > When the service hangs, any program that touches the Proton Drive folder can hang with it,
-> including `ls` and your shell's prompt. Prefix exploratory commands with `timeout 5`.
+> including `ls` and your shell's prompt. Put `timeout 5` in front of commands you try.

-**`Transport endpoint is not connected`** — the service stopped without unmounting. Unmount and
-restart:
+### `Transport endpoint is not connected`
+
+The service stopped without unmounting. Unmount and restart:

 ```bash
 fusermount3 -uz ~/ProtonDrive
 systemctl --user restart proton-drive.service
 ```

-**The folder is empty or missing** — check that the service runs and is signed in
-(`pdfs status`). The service waits for a stored session before it mounts.
+### The folder is empty or missing

-**Everything in the folder hangs** — find out what the service is doing, then restart it:
+Check that the service runs and is signed in, with `pdfs status`. The service waits for a stored
+session before it shows your files.
+
+### `fetch My Files root: … failed to decrypt: missing key` in the log
+
+Your account keys cannot open your Drive, which happens after a password reset: Proton locks the
+files that were encrypted with the old keys. Since 3.4.1 the client then starts a new, empty My
+files. Your old files are still there, locked: open [drive.proton.me](https://drive.proton.me) and
+restore them with your previous password.
+
+### Everything in the folder hangs
+
+Find out what the service is doing, then restart it:

 ```bash
 timeout 10 pdfs diagnostics
 systemctl --user restart proton-drive.service
 ```

-The service watchdog restarts a service that stops answering for two minutes by itself. Attach the
-`pdfs diagnostics` output to a bug report; it shows which worker is stuck.
+The service restarts by itself when it stops answering for two minutes. Attach the
+`pdfs diagnostics` output to a bug report; it shows which part is stuck.

-**A change made on another device does not show up** — changes arrive through Proton's event
-stream, normally within seconds. To fetch a folder again at once:
+### A change made on another device does not show up
+
+Changes from other devices normally arrive within seconds. To fetch a folder again at once:

 ```bash
 pdfs refresh Documents
 ```

-**"Permission denied" when writing** — the item is in a share where you are a viewer, or under
-`Shared with me/`, which is read-only as a folder. Check your role with `pdfs shared-with-me`.
+### "Permission denied" when writing

-**`ln` or another program fails with "Operation not permitted"** — Proton Drive cannot store
-symbolic links, hard links, device files or FIFOs, so creating one fails at once. The error is
-intentional. Use a synced folder for projects that need them, or exclude those paths.
+The item is in a share where you are a viewer, or directly under `Shared with me/`, which is
+read-only. Check your role with `pdfs shared-with-me`.
+
+### `ln` or another program fails with "Operation not permitted"
+
+Proton Drive cannot store symbolic links, hard links, device files or FIFOs, so creating one fails
+at once. This is on purpose. For projects that need them, use a
+[synced folder](SYNCED_FOLDERS.md) and exclude those paths.

 ## Uploads and sync

-**A change shows here but not on other devices** — changes are recorded on this computer first
-and sent from a queue. List what is still waiting, and what needs attention:
+### A change shows here but not on other devices
+
+Changes are recorded on this computer first and sent from a queue. List what is still waiting,
+and what needs you:

 ```bash
 pdfs sync queue
@@ -144,72 +192,89 @@ pdfs sync issues
 ```

 The app shows the same on **Sync → Overview**. A change waits while the service is offline or
-sync is paused (`pdfs status`), and backs off after a failure. To retry at once:
+sync is paused (`pdfs status`), and waits longer after each failure. To retry at once:

 ```bash
-pdfs sync retry           # every failed operation
-pdfs sync retry 42        # one operation
+pdfs sync retry           # every failed change
+pdfs sync retry 42        # one change
 ```

 A change Proton Drive refuses (storage full, access taken away, folder gone) is listed by
 `pdfs sync issues` with what to do. It stays queued until you fix the cause or drop it. Dropping
-it undoes it here; save a file's content first if you want to keep it:
+it undoes it here, so save a file's content first if you want to keep it:

 ```bash
 pdfs sync export 42 ~/Desktop/
 pdfs sync discard 42
 ```

-If you suspect the local-first behaviour of 3.0.0 itself, `"local_first": false` in `config.json`
-makes the Proton Drive folder wait for Proton Drive again while online (see
-[CONFIGURATION.md](CONFIGURATION.md#local_first)), and please report the problem.
+[Changes waiting for Proton Drive](SYNCED_FOLDERS.md#changes-waiting-for-proton-drive) explains
+the choices.

-**A file in a synced folder does not upload** — check that:
+If you suspect that the instant, queued changes introduced in 3.0.0 are the problem,
+`"local_first": false` in `config.json` makes the Proton Drive folder wait for Proton Drive again
+while online (see [Configuration](CONFIGURATION.md#local_first)). Please report the problem too.

- it is not matched by `.pdfsignore` or `ignore_patterns`;
+### A file in a synced folder does not upload
+
+Check that:
+
+- it is not excluded by `.pdfsignore` or `ignore_patterns`;
 - no program still holds it open for writing (such files wait until closed);
- sync is not paused (`pdfs status`, tray);
- the folder has no error on **Sync → Folders**.
+- sync is not paused (`pdfs status`, or the tray);
+- the folder shows no error on **Sync → Folders**.

-`pdfs sync now` starts a pass immediately.
+`pdfs sync now` starts a sync pass at once.

-**Files named `(sync-conflict …)` appeared** — the file changed in two places at once. Nothing was
-lost; see [Conflicts](USER_GUIDE.md#conflicts) to pick a version.
+### Files named `(sync-conflict …)` appeared

-**Photos show the wrong date after a Google Takeout import** — run
-`pdfs redate-photos --dry-run`, see [USER_GUIDE.md](USER_GUIDE.md#importing-from-google-photos).
+The file changed in two places at once. Nothing was lost. See
+[Conflicts](SYNCED_FOLDERS.md#conflicts) to pick a version.
+
+### Photos show the wrong date after a Google Takeout import
+
+Run `pdfs redate-photos --dry-run`. See
+[Fixing photos filed under the wrong date](PHOTOS.md#fixing-photos-filed-under-the-wrong-date).

 ## Disk space

 | What | Check | Reduce |
 |---|---|---|
-| Content cache | `pdfs cache inspect` | Lower **Preferences → Storage → Cache size limit**, or `pdfs cache clear` |
+| Cache of opened files | `pdfs cache inspect` | Lower **Preferences → Storage → Cache size limit**, or `pdfs cache clear` |
 | Available-offline files | `pdfs pins` | `pdfs unpin PATH` |
 | Metadata database | `pdfs cache inspect` (reclaimable) | `pdfs cache vacuum` |
 | Synced folders | `pdfs sync list` | Switch large folders to online only: `pdfs sync mode ID ondemand` |

-`pdfs cache vacuum` locks the database while it runs and needs free space for a second copy of it.
+`pdfs cache vacuum` locks the database while it runs, and needs free space for a second copy of
+it.

 ## Desktop integration

-**No tray icon on GNOME** — install and enable the AppIndicator and KStatusNotifierItem Support
-extension. Other desktops show the icon natively. If you hid it from its own menu, turn it back on
-under **Preferences → General → Appearance**.
+### No tray icon on GNOME

-**The search launcher does nothing** — `pdfs-prompt` needs the service. Run it from a terminal to
-see its error. For `--fzf`, install `fzf` and a supported terminal.
+Install and turn on the
+[AppIndicator and KStatusNotifierItem Support](https://extensions.gnome.org/extension/615/appindicator-support/)
+extension. Other desktops show the icon without help. If you hid it from its own menu, turn it
+back on under **Preferences → General → Appearance**.

-**The app shows "Not responding"** — the service runs but does not answer within five seconds.
-See [Everything in the folder hangs](#the-proton-drive-folder).
+### The search launcher does nothing
+
+`pdfs-prompt` needs the service. Run it from a terminal to see its error. For `--fzf`, install
+`fzf` and a supported terminal.
+
+### The app shows "Not responding"
+
+The service runs but does not answer within five seconds. See
+[Everything in the folder hangs](#everything-in-the-folder-hangs).

 ## Start over with a clean local state

-This removes the local database and cache so they are rebuilt from Proton Drive. It is the fix for
-a damaged database and the only way to downgrade to an older release.
+This removes the local database and cache, so they are built again from Proton Drive. It fixes a
+damaged database, and it is the only way to go back to an older release.

 > [!WARNING]
 > Content in `staging/` and `recovery/` has not reached Proton Drive yet. Deleting it loses those
-> changes permanently. Wait until `pdfs sync queue` is empty.
+> changes for good. Wait until `pdfs sync queue` is empty.

 ```bash
 pdfs sync queue                                   # must list nothing
@@ -220,8 +285,8 @@ systemctl --user start proton-drive.service
 ```

 Your session is in the keyring and your settings in `~/.config`, so you stay signed in. Synced
-folders are not re-attached automatically; restore them with `pdfs sync restore` as described in
-[RECOVERY.md](RECOVERY.md#2-restore-your-synced-folders). Delete the `.bak` directories once
+folders are not attached again by themselves. Restore them with `pdfs sync restore`, as described
+in [Recovery](RECOVERY.md#2-restore-your-synced-folders). Delete the `.bak` directories once
 everything is back.

 ## Reporting a problem
@@ -232,7 +297,7 @@ Include:
 - the output of `pdfs diagnose`;
 - relevant log lines from `journalctl --user -u proton-drive.service`;
 - for a hang, the output of `timeout 10 pdfs diagnostics`;
- the steps that reproduce it.
+- the steps that make it happen.

 Logs contain file names. Remove anything private before posting. Report security problems
-privately as described in [SECURITY.md](../SECURITY.md).
+privately, as described in [SECURITY.md](../SECURITY.md).
@@ -1,29 +1,27 @@
 # User guide

-How Proton Drive for Linux works and how to use it day to day. For installation see
-[INSTALL.md](INSTALL.md); every command mentioned here is described in [CLI.md](CLI.md).
+How Proton Drive for Linux works and how to use it day to day. To install it, see
+[Installation](INSTALL.md). If you are new, [Getting started](GETTING_STARTED.md) is the quicker
+read.

- [How it works](#how-it-works)
- [My files](#my-files)
- [Keeping files on this computer](#keeping-files-on-this-computer)
- [Syncing local folders](#syncing-local-folders)
- [Changes waiting for Proton Drive](#changes-waiting-for-proton-drive)
- [Conflicts](#conflicts)
- [Pausing and limiting sync](#pausing-and-limiting-sync)
- [Photos](#photos)
- [Sharing](#sharing)
- [Trash and version history](#trash-and-version-history)
- [Computers](#computers)
- [Search launcher](#search-launcher)
- [Choosing how files open](#choosing-how-files-open)
- [Tray](#tray)
- [Preferences](#preferences)
+## Topics
+
+| Page | What it covers |
+|---|---|
+| [Files and offline access](FILES.md) | The `~/ProtonDrive` folder, keeping files available offline, the Trash, earlier versions |
+| [Synced folders](SYNCED_FOLDERS.md) | Backing up local folders, excluding files, changes waiting to upload, conflicts, pausing |
+| [Photos](PHOTOS.md) | Timeline, albums, places, duplicates, importing from Google Photos |
+| [Sharing](SHARING.md) | Invitations, public links, items shared with you |
+| [Computers](COMPUTERS.md) | Other computers in your account, syncing several computers |
+| [Search launcher and tray](LAUNCHER_AND_TRAY.md) | Finding files from a keyboard shortcut, the tray icon |
+
+Every command mentioned in these pages is listed in the
+[command-line reference](CLI.md).

 ## How it works

 A background service, `proton-drive.service`, runs `pdfs daemon`. It holds your session, talks to
-Proton Drive, and keeps your Drive mounted as a folder. Everything else is a front end that asks
-the service to do things over a local socket:
+Proton Drive, and shows your Drive as a folder. Everything else asks the service to do things:

 | Program | What it is |
 |---|---|
@@ -32,337 +30,30 @@ the service to do things over a local socket:
 | `pdfs-prompt` | A search launcher for a keyboard shortcut |
 | `pdfs` | The command-line client, for everything above and for scripts |

-Your Drive, your file names and your photos are end-to-end encrypted by Proton. On this computer,
-the service must decrypt what it shows you, and it keeps a decrypted cache and index on disk. Use
-full-disk or home-directory encryption. [ARCHITECTURE.md §10](ARCHITECTURE.md#10-threat-model-what-this-client-writes-to-disk-in-plaintext)
+Your files, file names and photos are end-to-end encrypted by Proton. To show them to you, the
+service decrypts them on this computer and keeps a cache, which is not encrypted. Use full-disk or
+home-folder encryption. The [security model](SECURITY_MODEL.md#what-is-kept-on-this-computer)
 lists exactly what is stored.

-The app uses these words consistently, and so does this guide:
+## Words used in the app
+
+The app uses these words, and so do these pages:

 | Term | Meaning |
 |---|---|
-| **My files** | The root of your Drive |
-| **Proton Drive folder** | Where My files appears on disk, `~/ProtonDrive` by default |
-| **Online only** | A file or folder whose content downloads when opened |
+| **My files** | Everything in your Proton Drive, apart from Photos and computer backups |
+| **Proton Drive folder** | Where My files appears on this computer, `~/ProtonDrive` by default |
+| **Online only** | A file or folder that downloads when you open it |
 | **Available offline** | A file, or a folder with everything in it, kept on this computer |
 | **Synced folder** | A local folder with a full copy on this computer, backed up to Proton Drive |
 | **Proton Drive service** | The background service (`proton-drive.service`) |

-## My files
-
-My files is mounted at `~/ProtonDrive`. Every file and folder appears immediately, but content
-downloads only when a program reads it:
-
- **Reads fetch only what is needed.** A video player that seeks, or a tool that reads a file
-  header, downloads only those parts. Media streams while it plays.
- **Changes work at local speed.** Creating, renaming, moving and deleting files and folders
-  returns at once, online or offline. When a program closes a file it wrote, the new content is
-  stored on disk. Every change is queued and sent to Proton Drive in the background; the changes
-  to one file are sent in the order you made them. The queue survives network loss, restarts and
-  crashes. See [Changes waiting for Proton Drive](#changes-waiting-for-proton-drive).
- **Recently read content is cached** on disk up to the cache size limit (5 GiB by default) and
-  evicted oldest first.
- **Items shared with you** appear under `Shared with me/` inside the Proton Drive folder. Shares
-  where you are a viewer are read-only.
-
-The **My files** page of the app browses the same tree without going through the mount. It has a
-grid and a list view, sorting, thumbnails (including camera RAW previews), multi-select and drag
-and drop upload. **Details** (Alt+Enter) shows size, dates, sharing and version history for the
-selected item.
-
-Symbolic links, hard links, device files and FIFOs cannot be stored on Proton Drive. Programs that
-try to create them get a clean error, not a hang or `EIO`.
-
-## Keeping files on this computer
-
-Turn on **Available offline** for a file or folder in My files, or run `pdfs pin <path>`. A file
-is downloaded completely and never evicted from the cache. For a folder, every file in it and in
-its subfolders downloads in the background, and the tray and the app show the progress.
-`pdfs pins` lists what is kept, and **Preferences → Storage → Available offline** shows it in the
-app.
-
-Turning it off (`pdfs unpin <path>`) frees the space. The files stay on Proton Drive. A file inside
-a folder kept offline stays with its folder: turn the folder off instead.
-
-## Syncing local folders
-
-A synced folder is an ordinary folder on this computer, for example `~/Documents`, that is
-backed up to Proton Drive under this computer's name. It appears on the **Computers** page of the
-app and in the web app.
-
- Add one with **Add Folder to Sync** on the **Computers** page, or `pdfs sync add ~/Documents`.
- Changes flow both ways. Local edits upload a few seconds after the file is closed; remote edits
-  download on the next pass.
- A file that another program still holds open for writing is not uploaded until it is closed.
- **Sync → Folders** in the app, and `pdfs sync list`, show every folder and its state.
-
-Each synced folder can also be switched to **Online only**. The local copy is replaced by a mount
-of the folder, so the files stay visible but take no disk space until opened. Switch with the
-**Synced / Online only** switch on the folder's card, or `pdfs sync mode <id> ondemand` and back
-with `pdfs sync mode <id> mirror`. The switch waits until everything in the folder is on Proton
-Drive, and refuses while the folder holds something that never goes there: an ignored path such
-as `.git/`, a symlink, or a folder you may not read. The message names it. `pdfs locations` lists every local place the service occupies.
-
-### Moving between synced folders and My files
-
-`~/ProtonDrive` and each online-only folder are separate mounts, and a mirrored folder is a plain
-folder on disk. `mv`, and dragging in a file manager, cannot rename across them, so they copy
-and then delete: every file is downloaded, uploaded again, and the original goes to the Trash.
-
-Use `pdfs move <path> <folder>` or **Move to…** in the app instead. The move happens on Proton
-Drive, so it takes seconds whatever the size. For example:
-
-```sh
-pdfs move ~/Documents/Scans ~/ProtonDrive/Archive
-pdfs move ~/Documents/a.pdf ~/Documents/b.pdf ~/ProtonDrive/Archive
-```
-
-The last path is the destination folder; everything before it moves there.
-Files already opened in an online-only folder are not downloaded again when
-they move into a mirrored one.
-
-A move out of a synced folder waits until its files are on Proton Drive. A file that is still
-uploading, has changes that are not uploaded, or is excluded by `.pdfsignore` stops the move,
-and the message names it.
-
-Removing a synced folder (**Stop Syncing** or `pdfs sync rm <id>`) keeps the local files and the
-copy on Proton Drive. Add `--delete-remote` (or tick **Also delete from Proton Drive**) to delete
-the copy on Proton Drive as well.
-
-### Excluding files with `.pdfsignore`
-
-Synced folders skip build output, dependency folders and editor leftovers. Rules come from two
-places, and both apply:
-
-1. A `.pdfsignore` file at the root of the synced folder (`.protonignore` also works), using
-   gitignore syntax, including `!` to re-include:
-
-   ```gitignore
-   build/
-   *.log
-   !important.log
-   ```
-
-2. The global `ignore_patterns` list in `config.json` (see
-   [CONFIGURATION.md](CONFIGURATION.md#ignore_patterns)). When unset, it defaults to `.git/`,
-   `.hg/`, `.svn/`, `node_modules/`, `target/`, `.venv/`, `__pycache__/`, `*~`, `*.swp`, `*.tmp`,
-   `.DS_Store` and `Thumbs.db`.
-
-Rules are re-read on every pass. Ignoring never deletes anything: a file that becomes ignored is
-simply no longer tracked, and its copy on Proton Drive stays.
-
-A folder you may not read, such as a cache a container created as root, is skipped the same way,
-and the activity feed names it once. Add it to `.pdfsignore` to stop that message.
-
-## Changes waiting for Proton Drive
-
-A change you made in the Proton Drive folder exists only on this computer until it reaches
-Proton Drive. `pdfs status`, the tray and **Sync → Overview** count what is still waiting, and
-`pdfs sync queue` lists it.
-
-Sometimes Proton Drive refuses a change: the storage is full, a share was taken away, the folder
-is gone, the folder holds too many items, or Drive does not accept a name. The change then needs
-your attention. It shows at once in **Sync → Overview**, in the tray, and in `pdfs sync issues`,
-with what it means and what you can do. A file or folder with such a change carries a warning
-badge in **Files**; hover it to see why.
-
-Nothing is deleted. The change stays queued and is retried. You can:
-
- **Retry** it now, from the same list or with `pdfs sync retry`, for example after freeing space.
- **Export** a file's content to keep your version (`pdfs sync export <id> <file>`).
- **Discard** the change (`pdfs sync discard <id>`). It is undone here and never sent: a new file
-  or folder goes away, anything else goes back to what Proton Drive has. Export first if you want
-  to keep the content.
-
-Two cases are not refused, and the activity log records both:
-
- A new file or folder whose name is already taken on Proton Drive by something this computer had
-  not seen yet lands under a `(sync-conflict …)` name, as described below.
- A new file whose folder was deleted on another device meanwhile lands at the top of My files,
-  so its content is not lost.
-
-Before you shut down a computer for good, check that nothing is waiting: see
-[RECOVERY.md](RECOVERY.md#lost-with-the-machine).
-
-## Conflicts
-
-When the same file changed on this computer and somewhere else since the last sync, neither side
-is thrown away. The local version is kept as a copy named like
-`report (sync-conflict 1759068180).odt`, where the number is the time of the conflict in seconds
-since 1970, and the remote version takes the original name.
-
-Conflicts appear under **Sync → Overview → Needs attention** and in `pdfs conflicts`. For each
-one, keep the original, keep the copy, or keep both under a new name:
-
-```bash
-pdfs conflicts
-pdfs conflicts resolve "Documents/report (sync-conflict 1759068180).odt" --keep copy
-```
-
-The version you do not keep goes to the Trash, so a wrong choice can be undone.
-
-## Pausing and limiting sync
-
- **Pause** from the tray, the Sync page, or `pdfs sync pause`. Uploads and synced folders wait;
-  reading files keeps working. `pdfs sync resume` continues.
- **Limit bandwidth** under **Preferences → General → Network**, or with
-  `pdfs sync limit --up 2M --down 10M`. `0` removes a limit.
-
-## Photos
-
-The **Photos** page shows your Proton Photos library. Photos are stored separately from My files
-and do not appear in the Proton Drive folder.
-
- **Timeline** groups photos by day, month or year as you zoom. Drag the scrubber on the right edge
-  to jump through the years. **On this day** shows photos from the same date in earlier years.
- **Filters** narrow the timeline to images, videos or RAW files, to favorites, or to photos that
-  are in no album.
- **RAW + JPEG pairs** of the same shot show as one tile. The viewer switches between them, and
-  moving the tile to the Trash removes both.
- **Albums** lists your albums and albums shared with you. Create, rename and delete albums, and
-  add or remove photos.
- **Places** groups photos by the town they were taken in, as cards or on a map. Towns come from
-  bundled [GeoNames](https://www.geonames.org/) data (CC BY 4.0) and the map from
-  [Natural Earth](https://www.naturalearthdata.com/) (public domain), so nothing is fetched online.
-  An optional street map from [OpenFreeMap](https://openfreemap.org/) (© OpenStreetMap
-  contributors) can be enabled under **Preferences → General → Appearance**. It is off by default
-  because the tile server learns which areas you look at.
- **Viewer**: favorites, EXIF details, show on map, slideshow (F5).
- **Find Duplicates…** in the page menu lists byte-identical copies. The **Similar** switch also
-  finds resized or re-encoded copies and burst shots by comparing thumbnails.
- **Upload** adds photos. Its menu holds **Import from Google Photos…**.
-
-### Importing from Google Photos
-
-Request a Google Takeout export of Google Photos, then pass every `.zip` of it at once. A photo's
-metadata often sits in a different part of the export than the photo itself.
-
-```bash
-pdfs import-google-photos --dry-run ~/Downloads/takeout-*.zip   # see what would happen
-pdfs import-google-photos --wait ~/Downloads/takeout-*.zip
-```
-
-Albums are recreated, capture dates and locations are taken from the metadata, and photos already
-on the account are skipped, so an interrupted import can be run again. `pdfs import-status` and
-`pdfs cancel-import` follow or stop an import that runs in the background.
-
-If photos from an earlier import are filed under the day they were uploaded,
-`pdfs redate-photos --dry-run` finds those whose file name carries a different date, and
-`pdfs redate-photos` fixes them. Proton cannot change a capture date in place, so each fix
-re-uploads the photo and moves the original to the Trash, keeping favorites and albums.
-
-## Sharing
-
- **Share…** on a file or folder invites people by email as viewer or editor, or creates a public
-  link with an optional password and expiry. `pdfs share`, `pdfs members`, `pdfs share-role`,
-  `pdfs unshare` and `pdfs public-link` do the same from a terminal.
- **Shared by me** lists everything you share, filtered by links, people or expired links. Copy a
-  live link or stop several shares at once.
- **Shared with me** lists what others share with you, with who shared it and your access.
-  Pending invitations wait in a banner; `pdfs invitations` accepts or rejects them. Saved public
-  links (`pdfs bookmarks`) have their own view.
-
-## Trash and version history
-
-The **Trash** page lists trashed items with the date they were deleted. Restore puts an item back
-where it was, together with trashed folders above it. **Delete Forever** and **Empty Trash** are
-permanent. The CLI equivalents are `pdfs trash`, `pdfs restore`, `pdfs delete-forever` and
-`pdfs empty-trash`.
-
-Proton Drive keeps earlier versions of every file. **Details → Versions…** in the app, or
-`pdfs versions list <path>`, shows them. You can:
-
- **Restore** a version. This happens on the server; nothing is re-uploaded.
- **Save** a version to a separate local file without touching the current one.
- **Delete** an old version permanently. The current version cannot be deleted.
-
-## Computers
-
-**Computers** lists this computer and every other computer that backs up to your account.
-
- **This computer** shows its synced folders with their state, and **Restore Folders…** brings
-  back folders that are backed up under it but not synced here yet.
- **Another computer** can be browsed read-only in the same list or grid as My files, and
-  **Restore to This Computer…** downloads its folders here.
- **Continue This Backup Here…** makes this computer take over another computer's backup, for
-  example after reinstalling or replacing a machine. See [RECOVERY.md](RECOVERY.md).
- **Move to This Computer…** moves another computer's folders into this computer's backup, for
-  example when you switch from Windows to Linux, and then offers them for syncing here. The other
-  computer stays in the list, without those folders.
-
-## Search launcher
-
-`pdfs-prompt` searches Proton Drive and your home folder together, in one ranked list. It
-tolerates prefixes, abbreviations, typos and swapped letters, and matches on parent folder names
-as well. Bind it to a keyboard shortcut in your desktop settings.
-
-The window stays loaded after the first use, so later shortcuts open it instantly. Folders, audio
-and video open straight from the Proton Drive folder, so players can start before the whole file
-downloads. Other Drive files download first, then open.
-
-To make the first shortcut instant as well, start the launcher hidden with your session.
-`pdfs-prompt --preload` loads the window without showing it and does nothing if the launcher is
-already running. For Hyprland:
-
-```ini
-exec-once = pdfs-prompt --preload
-bind = SUPER, space, exec, pdfs-prompt
-```
-
-### Using your own launcher
-
-`pdfs-prompt --dmenu` shows the results in fuzzel, rofi, wofi, tofi, bemenu or dmenu, whichever is
-installed:
-
-```bash
-pdfs-prompt --dmenu
-pdfs-prompt --dmenu --menu 'fuzzel --dmenu --width 60'
-pdfs-prompt --dmenu --query invoice
-```
-
-A dmenu-style launcher filters a fixed list and cannot ask for new results per keystroke, so the
-search takes two steps. The first list, `Search Drive ›`, shows your available-offline files; type
-a query and press Enter to search. The second, `Drive: invoice ›`, shows the results; Enter opens
-one, and typing something else searches again.
-
-### Search as you type with fzf
-
-`pdfs-prompt --fzf` re-queries the service on every keystroke, like the built-in window. When
-started from a keybinding without a terminal, it opens one itself (foot, ghostty, kitty,
-alacritty, wezterm or xterm) with the app ID `pdfs-prompt`, so one window rule covers all of them.
-For Hyprland:
-
-```ini
-windowrulev2 = float, class:^(pdfs-prompt)$
-windowrulev2 = size 900 500, class:^(pdfs-prompt)$
-windowrulev2 = center, class:^(pdfs-prompt)$
-bind = SUPER, space, exec, pdfs-prompt --fzf
-```
-
-To make `--dmenu` or `--fzf` the default without changing your keybinding, set `prompt.mode` in
-`config.json` ([CONFIGURATION.md](CONFIGURATION.md#prompt)). `--gtk` forces the built-in window.
-
-## Choosing how files open
-
-Files open with `xdg-open` by default. The `open_with` section of `config.json` overrides that per
-file type, for example text in Neovim inside a terminal. The rules apply to the search launcher
-and to the app. See [CONFIGURATION.md](CONFIGURATION.md#open_with).
-
-## Tray
-
-`pdfs-tray` starts at login and shows whether files are up to date, syncing, paused or offline.
-Its menu opens the app or the Proton Drive folder, pauses or resumes sync, and stops or connects
-the service. **Hide Tray Icon** removes it until you turn it back on under
-**Preferences → General → Appearance → Show tray icon**.
-
-GNOME needs the AppIndicator extension to show tray icons.
-
 ## Preferences

 | Page | Settings |
 |---|---|
-| **General** | Start on login · Proton Drive folder location · upload and download limits · Proton theme, street map for Places, tray icon · language |
+| **General** | Start on login · Proton Drive folder location · upload and download limits · Proton theme, street map for Places, tray icon · language · check for updates |
 | **Storage** | Cache size limit · clear the cache · files kept available offline |

-The account menu shows storage used and holds **Sign Out…**. Settings not exposed in the app are
-listed in [CONFIGURATION.md](CONFIGURATION.md).
+The account menu shows the storage you use and holds **Sign Out…**. Settings that are not in the
+app are described in [Configuration](CONFIGURATION.md).
@@ -9,7 +9,7 @@
 # Build + install:   cd packaging && makepkg -fi

 pkgname=proton-drive-linux
-pkgver=3.4.0
+pkgver=3.5.0
 pkgrel=1
 pkgdesc="Unofficial Proton Drive client for Linux: files-on-demand FUSE mount, CLI, GTK4 app + tray"
 arch=('x86_64')
@@ -1,6 +1,6 @@
 pkgbase = proton-drive-for-linux-bin
 	pkgdesc = Unofficial Proton Drive client: FUSE files-on-demand mount, CLI, GTK4 app, tray (binaries)
-	pkgver = 3.3.0
+	pkgver = 3.5.0
 	pkgrel = 1
 	url = https://proton-drive.narl.io
 	install = proton-drive.install
@@ -22,25 +22,25 @@ pkgbase = proton-drive-for-linux-bin
 	optdepends = xdg-utils: "Open folder" action in the tray menu
 	optdepends = fzf: search-as-you-type launcher (pdfs-prompt --fzf)
 	optdepends = foot: terminal that hosts pdfs-prompt --fzf when started from a keybinding
-	provides = proton-drive-for-linux=3.3.0
-	provides = proton-drive-linux=3.3.0
+	provides = proton-drive-for-linux=3.5.0
+	provides = proton-drive-linux=3.5.0
 	provides = pdfs
 	conflicts = proton-drive-linux
 	conflicts = proton-drive-for-linux
 	conflicts = proton-drive-for-linux-git
 	options = !strip
 	options = !debug
-	source = proton-drive-linux-3.3.0-x86_64.tar.gz::https://github.com/narrrl/proton-drive-linux/releases/download/v3.3.0/proton-drive-linux-3.3.0-x86_64.tar.gz
-	source = io.narl.proton-drive-linux-3.3.0.desktop::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.3.0/packaging/io.narl.proton-drive-linux.desktop
-	source = io.narl.proton-drive-linux-tray-3.3.0.desktop::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.3.0/packaging/io.narl.proton-drive-linux-tray.desktop
-	source = io.narl.proton-drive-linux-3.3.0.svg::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.3.0/packaging/io.narl.proton-drive-linux.svg
-	source = proton-drive-3.3.0.service::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.3.0/packaging/proton-drive.service
-	source = LICENSE-3.3.0::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.3.0/LICENSE
-	sha256sums = 2e4a8ee660f1d1d683a03afd7d3c1262be87cebeb53893cae55f5e1b44199a04
+	source = proton-drive-linux-3.5.0-x86_64.tar.gz::https://github.com/narrrl/proton-drive-linux/releases/download/v3.5.0/proton-drive-linux-3.5.0-x86_64.tar.gz
+	source = io.narl.proton-drive-linux-3.5.0.desktop::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.5.0/packaging/io.narl.proton-drive-linux.desktop
+	source = io.narl.proton-drive-linux-tray-3.5.0.desktop::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.5.0/packaging/io.narl.proton-drive-linux-tray.desktop
+	source = io.narl.proton-drive-linux-3.5.0.svg::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.5.0/packaging/io.narl.proton-drive-linux.svg
+	source = proton-drive-3.5.0.service::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.5.0/packaging/proton-drive.service
+	source = LICENSE-3.5.0::https://raw.githubusercontent.com/narrrl/proton-drive-linux/v3.5.0/LICENSE
+	sha256sums = 902f60de5f471cb15c84d0ecb29cb4644a0ac52ce36d2be54c16b4befeba8de0
 	sha256sums = d190d6771fff0b975271fb62fd3fb0fa8bbf17d7278c10853c18557855b0c123
 	sha256sums = 1d95e250370220e3bb6aead6ce34d1d6cc759f42c4803b75f1667e78ff47c6c0
 	sha256sums = e598a93c2715c3a9fdc7fb937902083d4a1135e8fbdfe6fe7e37f0383ebbd828
-	sha256sums = 77280bff5f693fbc5ffa9f3ccd06a43cfff96d770290aa8d7d0c28e9dde277be
+	sha256sums = 44c25dca6e759c46fca50b58099aa6194abe78293dee07d971bbbce0ff3ca58f
 	sha256sums = 02c419e7f9af08dda720e4f852f3e57cf5a69e192605440f750e9d244fa2817c

 pkgname = proton-drive-for-linux-bin
@@ -1,7 +1,7 @@
 # Maintainer: Nils Pukropp <contact@narl.io>

 pkgname=proton-drive-for-linux-bin
-pkgver=3.3.0
+pkgver=3.5.0
 pkgrel=1
 pkgdesc="Unofficial Proton Drive client: FUSE files-on-demand mount, CLI, GTK4 app, tray (binaries)"
 arch=('x86_64')
@@ -36,11 +36,11 @@ source=("proton-drive-linux-$pkgver-x86_64.tar.gz::$_repo/releases/download/$_ta
        "io.narl.proton-drive-linux-$pkgver.svg::$_raw/packaging/io.narl.proton-drive-linux.svg"
        "proton-drive-$pkgver.service::$_raw/packaging/proton-drive.service"
        "LICENSE-$pkgver::$_raw/LICENSE")
-sha256sums=('2e4a8ee660f1d1d683a03afd7d3c1262be87cebeb53893cae55f5e1b44199a04'
+sha256sums=('902f60de5f471cb15c84d0ecb29cb4644a0ac52ce36d2be54c16b4befeba8de0'
            'd190d6771fff0b975271fb62fd3fb0fa8bbf17d7278c10853c18557855b0c123'
            '1d95e250370220e3bb6aead6ce34d1d6cc759f42c4803b75f1667e78ff47c6c0'
            'e598a93c2715c3a9fdc7fb937902083d4a1135e8fbdfe6fe7e37f0383ebbd828'
-            '77280bff5f693fbc5ffa9f3ccd06a43cfff96d770290aa8d7d0c28e9dde277be'
+            '44c25dca6e759c46fca50b58099aa6194abe78293dee07d971bbbce0ff3ca58f'
            '02c419e7f9af08dda720e4f852f3e57cf5a69e192605440f750e9d244fa2817c')

 package() {
@@ -65,4 +65,7 @@ package() {
  cp -r --no-preserve=ownership "$srcdir/locale" "$pkgdir/usr/share/locale"

  install -Dm644 "$srcdir/LICENSE-$pkgver" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+
+  # pacman brings new releases, so the app never checks for them itself.
+  install -Dm644 /dev/null "$pkgdir/usr/share/proton-drive-linux/managed-updates"
 }
@@ -1,6 +1,6 @@
 pkgbase = proton-drive-for-linux-git
 	pkgdesc = Unofficial Proton Drive client: FUSE files-on-demand mount, CLI, GTK4 app, tray (git)
-	pkgver = 3.3.0.r0.g160626b
+	pkgver = 3.5.0.r0.geb25c16
 	pkgrel = 1
 	url = https://proton-drive.narl.io
 	install = proton-drive.install
@@ -25,8 +25,8 @@ pkgbase = proton-drive-for-linux-git
 	optdepends = xdg-utils: "Open folder" action in the tray menu
 	optdepends = fzf: search-as-you-type launcher (pdfs-prompt --fzf)
 	optdepends = foot: terminal that hosts pdfs-prompt --fzf when started from a keybinding
-	provides = proton-drive-for-linux=3.3.0.r0.g160626b
-	provides = proton-drive-linux=3.3.0.r0.g160626b
+	provides = proton-drive-for-linux=3.5.0.r0.geb25c16
+	provides = proton-drive-linux=3.5.0.r0.geb25c16
 	provides = pdfs
 	conflicts = proton-drive-linux
 	conflicts = proton-drive-for-linux