fix(sync): let a device with no local copy join a File Sync folder whose attachment files have not arrived yet instead of refusing the folder forever

Author: dongdongbh

docs/release-notes/diagnostics-ledger.md

@@ -19,6 +19,7 @@ Field names are checked against the log sanitizer by `packages/core/src/release-
 ### Added
 
 - **`v1.2.8/desktop-reminder-fired`** — `apps/desktop/src/lib/notification-service.tsx`, in `checkDueAndNotify` (`logReminderFired`), at all three fire sites: due-time repeats, task reminders and project review reminders. Message: `Desktop reminder fired`. Fields: `kind` (`due-repeat` | `task` | `project`), `entity` (`task` | `project`), `fireAt` (ISO occurrence time), `appState` (`focused` | `hidden`). No task title or body is ever logged. Tester's log: a user who sees no toast now has one line proving the scheduler fired, which separates a scheduling bug from a delivery bug (#1146).
+- **`v1.2.8/file-activation-absent-blobs`** — `packages/core/src/sync-run.ts`, in `prepareRemoteWriteData` after `assertActivationAttachmentsProven`. Message: `Sync folder activation accepted attachments the folder does not hold yet`. Fields: `backend` (`file`), `deferred` (count), `ids` (first five attachment ids). Tester's log: a fresh desktop joining a Syncthing or mounted folder whose `attachments/` has not arrived now shows this line and the switch completes, where 1.2.7 logged `Sync failed … Candidate attachment proof failed for <id>` and left the previous sync settings active; the ids listed must later download on a normal cycle (in-app feedback, 2026-09-04).
 - **`v1.2.8/desktop-notification-path`** — same file, in `sendNotification` (`logNotificationSent` / `logNotificationFailed`). Messages: `Desktop notification sent` and `Desktop notification send failed`. Fields: `path` (`flatpak` | `windows-packaged` | `plugin` | `web`) and, on the failure line, `error`. Tester's log: on a Microsoft Store install the line must read `path=windows-packaged`; a Store install that still falls through to `plugin` means the packaged command rejected, and the warning names the HRESULT it rejected with (#1146).
 
 ## v1.2.7 (add before tagging, trim in the release after)

docs/release-notes/unreleased.md

@@ -6,6 +6,8 @@ Changes collected after `v1.2.7` and before the next version tag.
 
 - Desktop Timeline: the view is easier to read. A line now separates one project from the next, task bars are drawn in a lighter tint of the project color so the project bar stands out as their parent, a task title is shown once in the name column on the left instead of also on the bar, task bars are thinner than the solid project bar, the daily and weekly gridlines are drawn as crisp lines instead of a repeating pattern that blurred into soft vertical bands on scaled displays, and the view opens centered on today and re-centers when you change the zoom. (#1111)
 
+- Sync: a desktop joining a File Sync folder whose attachment files had not arrived yet (a Syncthing or mounted folder that carried `data.json` but not `attachments/`) refused the folder with "Candidate attachment proof failed for <id>" and kept the previous sync settings, on every retry. When the device holds no copy of the file, the switch now completes and the record stays downloadable, so the file arrives on a later sync once the folder delivers it. A device that does hold the file is still refused. (from in-app feedback)
+
 - Sync: leaving the app mid-sync (switching to another app on a phone, or a background sync hitting its deadline) could leave the shared sync lock behind on Dropbox and WebDAV, and every device then reported "Remote sync is temporarily reserved by mindwtr-mobile" and waited up to five minutes before syncing again. The abort cancelled the request that removes the lock. Lock requests on desktop and mobile now finish independently of the abort, so an interrupted cycle still releases its lock. The "Sync follow-up scheduled" log line also now reports the delay that actually applies instead of only the pacing delay. (from a v1.2.7 device log)
 
 - Sync: a phone could keep syncing every second or two with no changes, warning "syncConflictDiscarded" for the same attachments on every cycle, after another device had deleted attachments the phone still listed. Two causes are fixed. The app kept its own older copy of a task whenever only its attachments had changed, and then wrote that copy back over what sync had just stored. And two devices that hold the same records in a different order were treated as different, so every cycle uploaded again and a self-hosted server answered with a merge each time. The order of records no longer counts as a change, and attachment-only changes now replace the in-memory task. (#1136)

packages/core/src/release-diagnostics-fields.test.ts

@@ -21,6 +21,7 @@ const RELEASE_CHECK_FIELD_NAMES = [
     'decision', 'registered', 'storedInterval', 'interval', 'appState',
     // desktop-reminder-fired / desktop-notification-path (apps/desktop/src/lib/notification-service.tsx)
     'kind', 'entity', 'fireAt', 'path', 'error',
+    'deferred', 'ids',
 ];
 
 describe('release diagnostics field names', () => {

packages/core/src/sync-run.test.ts

@@ -2523,6 +2523,78 @@ describe('activation proof with unrecoverable attachments (#1119)', () => {
         ]);
     });
 
+    it('activates a sync folder whose blob has not arrived yet when this device holds no bytes', async () => {
+        // A fresh desktop joins a Syncthing folder that carries data.json but not
+        // attachments/ yet: the file backend finds no blob, tombstones nothing, and
+        // leaves the record keyed + missing. Refusing here strands the folder
+        // forever; the record stays downloadable for a later cycle instead.
+        const remoteTask = createTask('t-absent-blob', 'Blob not synced yet');
+        remoteTask.attachments = [fileAttachment('attachment-absent', 'Arrives later')];
+        const syncAttachments = vi.fn(async (data: AppData) => data);
+        const { harness, io, run } = createHarness({
+            backend: 'file',
+            local: createData(),
+            remote: createData([remoteTask]),
+            activationProbe: true,
+            io: { syncAttachments },
+        });
+
+        const result = await run();
+
+        expect(result.success).toBe(true);
+        expect(io.writeRemote).toHaveBeenCalledTimes(1);
+        // The key survives (localStatus is device-local and never written remotely)
+        // and nothing was tombstoned, so a later cycle can still download it.
+        expect(harness.remote?.tasks[0]?.attachments).toEqual([
+            expect.objectContaining({
+                id: 'attachment-absent',
+                cloudKey: 'attachments/attachment-absent.txt',
+            }),
+        ]);
+        expect(harness.remote?.tasks[0]?.attachments?.[0]?.deletedAt).toBeUndefined();
+        expect(harness.warnings).toContainEqual(
+            expect.objectContaining({ message: 'Sync folder activation accepted attachments the folder does not hold yet' }),
+        );
+    });
+
+    it('still refuses a sync folder whose blob is absent when this device held bytes for the record', async () => {
+        const localTask = createTask('t-held-absent', 'Held here, absent there');
+        localTask.attachments = [{
+            id: 'attachment-held-absent',
+            kind: 'file',
+            title: 'Held locally',
+            uri: '/managed/held-absent.txt',
+            localStatus: 'available',
+            fileHash: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+            createdAt: STAMP,
+            updatedAt: STAMP,
+        }];
+        const remoteTask = cloneAppData(createData([localTask])).tasks[0]!;
+        remoteTask.attachments![0] = {
+            ...remoteTask.attachments![0]!,
+            uri: '',
+            cloudKey: 'attachments/attachment-held-absent.txt',
+            fileHash: 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
+            localStatus: 'missing',
+        };
+        const syncAttachments = vi.fn(async (data: AppData) => data);
+        const { io, run } = createHarness({
+            backend: 'file',
+            local: createData([localTask]),
+            remote: createData([remoteTask]),
+            activationProbe: true,
+            io: { syncAttachments },
+        });
+
+        const result = await run();
+
+        expect(result).toMatchObject({
+            success: false,
+            error: expect.stringContaining('Candidate attachment proof failed for attachment-held-absent'),
+        });
+        expect(io.writeRemote).not.toHaveBeenCalled();
+    });
+
     it('refuses activation when the trial tombstones a record this device held bytes for', async () => {
         const localTask = createTask('t-held-bytes', 'Held bytes');
         localTask.attachments = [{

packages/core/src/sync-run.ts

@@ -425,8 +425,9 @@ const assertActivationAttachmentsProven = (
     noLocalBytesIds: ReadonlySet<string>,
     backend: SyncBackend,
     originalCloudKeys: ReadonlyMap<string, string>,
-): void => {
+): string[] => {
     const resolved = new Set<string>();
+    const deferred: string[] = [];
     const owners: Array<['task' | 'project', { title?: string; deletedAt?: string; attachments?: Attachment[] }]> = [
         ...data.tasks.map((task) => ['task', task] as ['task', typeof task]),
         ...data.projects.map((project) => ['project', project] as ['project', typeof project]),
@@ -463,6 +464,23 @@ const assertActivationAttachmentsProven = (
                 if (expectedIds.has(attachment.id)) resolved.add(attachment.id);
                 continue;
             }
+            // File Sync: a blob the folder does not hold yet is not a verdict. A
+            // replicator (Syncthing, a mounted drive) can deliver it after the
+            // switch, and this device holds no bytes that waiting could lose. Keep
+            // the key, leave the record missing for a later cycle to download,
+            // instead of refusing the folder forever (a fresh desktop joining a
+            // folder whose attachments/ had not arrived, 2026-09-04 feedback).
+            if (
+                backend === 'file'
+                && noLocalBytesIds.has(attachment.id)
+                && attachment.cloudKey
+                && attachment.localStatus === 'missing'
+                && attachment.pendingContentUpload !== true
+            ) {
+                deferred.push(attachment.id);
+                if (expectedIds.has(attachment.id)) resolved.add(attachment.id);
+                continue;
+            }
             if (
                 !attachment.cloudKey
                 || attachment.localStatus !== 'available'
@@ -478,6 +496,7 @@ const assertActivationAttachmentsProven = (
     if (resolved.size !== expectedIds.size) {
         throw new Error(`Candidate attachment proof incomplete: expected ${expectedIds.size}, proved ${resolved.size}`);
     }
+    return deferred;
 };
 
 class SharedSyncRunMachine {
@@ -1443,14 +1462,25 @@ class SharedSyncRunMachine {
                     ? result
                     : fallbackRetry.data;
             }
-            assertActivationAttachmentsProven(
+            const deferredIds = assertActivationAttachmentsProven(
                 provenData,
                 activationSnapshot.expectedIds,
                 activationSnapshot.metadataOnlyIds,
                 activationSnapshot.noLocalBytesIds,
                 this.backend,
                 activationSnapshot.originalCloudKeys,
             );
+            if (deferredIds.length > 0) {
+                this.notifier.logWarningExtra(
+                    'Sync folder activation accepted attachments the folder does not hold yet',
+                    {
+                        releaseCheck: '1.2.8/file-activation-absent-blobs',
+                        backend: this.backend,
+                        deferred: String(deferredIds.length),
+                        ids: deferredIds.slice(0, 5).join(','),
+                    },
+                );
+            }
             this.ensureLocalSnapshotFresh();
             this.notifier.onDiagnostic?.({
                 event: 'attachments-prepare-complete',