Sync: encryption cannot be downgraded, sign-ins stay local, nothing is swallowed

[fylorn]

Fixes from the review of the sync integration branch (#352), on top of #354 / #356.

Encryption cannot be downgraded

• Encrypted location (by setting, or an "on" keyring there): unencrypted versions and device records are never read (tw_pack::read_strict); they are skipped and counted.
• A missing keyring, an older "off" keyring put back, or a keyring that stays unreadable is the keyring_missing state. Encryption is never turned off and the passphrase never dropped because of it.
• Turning encryption off rewrites the keyring as "off": sealed with the passphrase, plus a plain marker that only devices without a passphrase go by (a device with the passphrase ignores the marker and goes by what the keyring says). Keyrings carry a growing generation, so an old "off" keyring is recognised. Devices keep their passphrase after encryption is turned off.
• Each device keeps the last keyring it opened. POST /sync/republish puts it back (or makes a new one) and uploads this device's configuration when nothing at the location is readable.
• After a keyring race on a cloud folder, a device whose own versions no longer open merges two-way, re-uploads, and deletes those versions.

Merging

• Upstreams signed in on another device stay disabled where there is no sign-in. That disable is local state: it is never uploaded, in rounds, joins (both modes) or after imports. Signing in turns them on as synced.
• The "nothing changed" shortcut is keyed on the round's starting point plus what the round did, so mid-round edits and arrivals are not swallowed.
• The base is used only if it is an ancestor of the heads (versions record up to 200 ancestors); otherwise two-way. Pruning keeps the common ancestor of several heads; earlier bases are kept locally.
• Global sections reset to defaults merge field by field. The invalid-merge fallback applies changes in reference order and repeats.
• "Keep both" on a gateway key gives the copy a new key and no client. SyncConflict.options lists the allowed choices; "remote" is refused for invalid conflicts.

The location

• Clearly broken files are skipped at once; files that may still be arriving are waited for 30 minutes. SyncView.skipped counts them.
• An empty read becomes emptied only after 3 rounds, 10 minutes and the device's own record being gone. Nothing is deleted or turned off. A missing WebDAV folder counts as unreachable. Purge deletes only sync files.
• iCloud placeholders read as not arrived. Reads are size-limited while streaming. This device's leftover temp files are swept. A request that hits a pooled connection the server just closed is retried once (Apache closes idle connections after 5 s; found in the compatibility run below).
• S3 prefixes reject .. and a leading /. A plain http:// location cannot use a proxy.

API (still 50)

States keyring_missing, emptied, misconfigured; SyncView.skipped; SyncConflict.options; POST /sync/republish (and twcore sync republish). New codes: sync.keyring_missing, sync.keyring_rolled_back, sync.looks_empty, sync.location_empty (replaces sync.emptied, whose sentence changed), sync.take_not_allowed, sync.too_new_unknown, sync.store.too_large, sync.webdav.root_missing, sync.config.prefix, sync.config.plain_http_proxy.

Tests

• The review's repro cases are now regression tests: crates/tw-sync/tests/regressions.rs (24) and crates/tw-control/tests/sync_regressions.rs (5).
• The fake S3 verifies SigV4 signatures with its own implementation, checked against AWS's published examples. A deterministic test covers the stale-connection retry.
• Local: cargo test --workspace 3822 passed, 0 failed; cargo clippy --workspace --all-targets -D warnings clean; cargo fmt --check clean; scripts/smoke.sh 84 passed, 0 failed.
• Compatibility run (not in CI): two real twcore processes ran against servers in containers on localhost: MinIO (bitnamilegacy/minio:2025.7.23-debian-12-r5), Apache mod_dav (bytemark/webdav:2.4) and rclone (rclone/rclone:1.69.1 serve webdav). Each run covered encrypted enable, join, changes both ways, a conflict resolved through the endpoints, encryption off and back on, and a purge. 13/13 checks passed on each server.

🤖 Generated with Claude Code