pinokiod 8.0.42 → 8.0.45

package/kernel/vault/index.js

@@ -6,10 +6,7 @@ const Registry = require('./registry')
 const Sweeper = require('./sweeper')
 const { walkBatches, statMany } = require('./walker')
 const { fileSnapshot, sameSnapshot, sameContentState } = require('./snapshot')
-const {
-  SIZE_THRESHOLD, CANDIDATE_SIZE_OPTIONS, TMP_SUFFIX, SHA256_RE,
-  DIR_CONCURRENCY, STAT_CONCURRENCY
-} = require('./constants')
+const { SIZE_THRESHOLD, TMP_SUFFIX, SHA256_RE, DIR_CONCURRENCY, STAT_CONCURRENCY } = require('./constants')
 
 // Shared model store engine (spec/requirements/shared-model-store.md).
 // Store + registry + volume probe + hashing + adopt/convert/verify, plus the
@@ -19,7 +16,6 @@ const {
 
 const NO_LINK_CODES = new Set(["EXDEV", "ENOTSUP", "ENOSYS"])
 const LOCK_CODES = new Set(["EBUSY", "EPERM", "EACCES"])
-const COPY_PROGRESS_CHUNK_SIZE = 8 * 1024 * 1024
 const isMissingError = (error) => !!(error && (error.code === "ENOENT" || error.code === "ENOTDIR"))
 const isAccessError = (error) => !!(error && (error.code === "EACCES" || error.code === "EPERM"))
 const lstatIfPresent = async (filePath) => {
@@ -71,18 +67,14 @@ const sameFileMetadata = (left, right) => {
 }
 
 const sourceId = (kind, name) => `${kind}:${encodeURIComponent(name)}`
-const externalSourceId = (root) => {
-  const value = process.platform === "win32" ? path.resolve(root).toLowerCase() : path.resolve(root)
-  return `external:${crypto.createHash("sha256").update(value).digest("hex")}`
-}
 
 class Vault {
   constructor(kernel) {
     this.kernel = kernel
     this.enabled = false
     this.initialized = false
-    this.mode = null          // 'link' | 'unsupported' for the vault's volume
-    this.volumeModes = new Map()  // dev -> 'link' | 'unsupported'
+    this.mode = null          // 'link' | 'copy' for the vault's own volume
+    this.volumeModes = new Map()  // dev -> 'link' | 'copy'
     this.registry = null
     this.worker = null
     this.workerJobs = new Map()
@@ -98,15 +90,8 @@ class Vault {
     this.initializationPromise = null
     this.verificationPending = false
     this.scanError = null
-    this.scanPersistenceWarning = false
     this.scanScopeId = null
-    this.fileAction = null
-    this.fileActions = new Map()
-    this.actionSequence = 0
-    this.scanEvents = null
-    this.scanCreatedStores = null
-    this.scanRetiredStores = null
-    this.scanRestoredStores = null
+    this.fileActionProgress = null
   }
   get root() {
     return path.resolve(this.kernel.homedir, "vault")
@@ -114,6 +99,9 @@ class Vault {
   get blobRoot() {
     return path.resolve(this.root, "sha256")
   }
+  get sourceRoot() {
+    return path.resolve(this.root, "sources")
+  }
   storePathFor(hash) {
     if (typeof hash !== "string" || !SHA256_RE.test(hash)) {
       throw new TypeError("Invalid vault content identifier.")
@@ -171,123 +159,18 @@ class Vault {
       return result
     })
   }
-  queueFileMutation(kind, filePath, sourceId, bytesTotal, operation, progress = {}) {
-    const id = `action-${crypto.randomUUID()}`
-    const action = {
-      id,
-      kind,
-      path: filePath || null,
-      source_id: sourceId || null,
-      phase: "queued",
-      bytes_copied: 0,
-      bytes_total: Math.max(0, Number(bytesTotal) || 0),
-      files_completed: Math.max(0, Number(progress.files_completed) || 0),
-      files_total: Math.max(0, Number(progress.files_total) || 0)
-    }
-    this.fileActions.set(id, action)
-    this.actionSequence += 1
-    return this.runExclusive(async () => {
-      action.phase = kind.startsWith("deduplicate") ? "deduplicating" : "copying"
-      this.fileAction = action
-      this.actionSequence += 1
-      try {
-        const result = await operation(action)
-        try {
-          if (this.registry) await this.registry.flush()
-        } catch (error) {
-          return Object.assign({}, result, { persistence_warning: true })
-        }
-        return result
-      } finally {
-        if (this.fileAction === action) this.fileAction = null
-        this.fileActions.delete(id)
-        this.actionSequence += 1
-      }
-    })
-  }
-  beginScanDraft() {
-    this.scanEvents = []
-    this.scanCreatedStores = []
-    this.scanRetiredStores = []
-    this.scanRestoredStores = []
-  }
-  rememberScanStore(storePath, stat) {
-    if (this.scanCreatedStores) this.scanCreatedStores.push({ storePath, stat })
-  }
-  rememberRetiredScanStore(storePath, stat, sourcePaths = []) {
-    if (this.scanRetiredStores) {
-      this.scanRetiredStores.push({ storePath, stat, sourcePaths: [...new Set(sourcePaths)] })
-    }
-  }
-  async restoreRetiredScanStore(item) {
-    const current = await this.storeStatIfPresent(item.storePath)
-    if (current) return sameIdentity(current, item.stat) ? current : null
-    const key = this.registry.inoKey(item.stat.dev, item.stat.ino)
-    const sourcePaths = new Set([
-      ...(item.sourcePaths || []),
-      ...(this.registry.pathsByIno.get(key) || [])
-    ])
-    for (const filePath of sourcePaths) {
-      const st = await lstatIfPresent(filePath)
-      if (!sameIdentity(st, item.stat)) continue
-      await fs.promises.link(filePath, item.storePath)
-      const restored = await this.storeStatIfPresent(item.storePath)
-      return sameIdentity(restored, item.stat) ? restored : null
-    }
-    return null
-  }
-  async commitScanDraft() {
-    const events = (this.scanEvents || []).slice(-this.registry.maxEvents)
-    const retired = this.scanRetiredStores || []
-    const removed = []
+  async runFileAction(progress, operation) {
+    this.fileActionProgress = progress
     try {
-      for (const item of retired) {
-        if (!await unlinkIfSame(item.storePath, item.stat)) continue
-        removed.push(item)
-        const hash = this.registry.byIno.get(this.registry.inoKey(item.stat.dev, item.stat.ino))
-        if (hash) await this.refreshLinkSnapshots(hash, item.stat.dev, item.stat.ino)
-      }
-    } catch (error) {
-      for (const item of removed.reverse()) {
-        const restored = await this.restoreRetiredScanStore(item).catch(() => null)
-        if (restored) this.scanRestoredStores.push({ item, stat: restored })
-      }
-      throw error
-    }
-    this.scanEvents = null
-    this.scanCreatedStores = null
-    this.scanRetiredStores = null
-    this.scanRestoredStores = null
-    try {
-      await this.registry.appendEvents(events)
-      return true
-    } catch (error) {
-      return false
+      return await operation(progress)
+    } finally {
+      if (this.fileActionProgress === progress) this.fileActionProgress = null
     }
   }
-  async abortScanDraft(snapshot) {
-    const created = this.scanCreatedStores || []
-    const restored = this.scanRestoredStores || []
-    this.scanEvents = null
-    this.scanCreatedStores = null
-    this.scanRetiredStores = null
-    this.scanRestoredStores = null
-    for (const item of created.reverse()) {
-      await unlinkIfSame(item.storePath, item.stat).catch(() => {})
-    }
-    this.registry.replaceState(snapshot, { persist: false })
-    for (const item of restored) {
-      const hash = this.registry.byIno.get(
-        this.registry.inoKey(item.stat.dev, item.stat.ino))
-      if (hash) await this.refreshLinkSnapshots(hash, item.stat.dev, item.stat.ino)
-    }
-    return restored.length > 0
-  }
   startScan(scopeId = null) {
     if (!this.enabled || !this.sweeper) return { started: false, disabled: true }
     if (this.scanPromise) return { started: false, already_running: true }
     this.scanError = null
-    this.scanPersistenceWarning = false
     this.scanScopeId = scopeId
     this.scanPromise = this.runExclusive(() => this.sweeper.scan(scopeId))
       .catch((error) => {
@@ -317,71 +200,49 @@ class Vault {
           }
         }
       }
-      case "remove_source":
-        return this.runMutation(() => this.removeExternalSource(payload.source_id))
       case "scan":
         if (payload.scope_id && !this.scanSource(payload.scope_id)) {
           return { error: "That scan location is no longer available." }
         }
-        if (payload.candidate_min_bytes !== undefined) {
-          if (!CANDIDATE_SIZE_OPTIONS.includes(payload.candidate_min_bytes)) {
-            return { error: "Choose one of the available minimum file sizes." }
-          }
-          if (this.scanPromise || (this.sweeper && this.sweeper.state.active)) {
-            return { error: "Wait for the current scan to finish before changing the minimum file size." }
-          }
-          this.sizeThreshold = payload.candidate_min_bytes
-          this.registry.settings.candidate_min_bytes = this.sizeThreshold
-          this.registry.schedulePersist()
-        }
         return this.startScan(payload.scope_id || null)
       case "deduplicate":
-        if (typeof payload.scope_id !== "string" || !payload.scope_id) {
-          return { error: "Choose a location to deduplicate." }
+        if (typeof payload.path === "string" && payload.path) {
+          return this.runMutation(() => this.runFileAction({
+            kind: "deduplicate-file",
+            path: path.resolve(payload.path)
+          }, () => this.deduplicateFile(payload.path, {
+            batch_id: `batch-${crypto.randomUUID()}`
+          })))
         }
-        {
-          const paths = Array.isArray(payload.paths) ? payload.paths : null
-          const filesTotal = paths
-            ? new Set(paths.filter((filePath) => typeof filePath === "string" && filePath)).size
-            : this.registry.duplicates.size
-          return this.queueFileMutation(
-            "deduplicate",
-            null,
-            payload.scope_id,
-            0,
-            (progress) => this.deduplicateScope(payload.scope_id, {
-              batch_id: `batch-${crypto.randomUUID()}`,
-              paths,
-              progress
-            }),
-            { files_total: filesTotal }
-          )
+        const selection = payload.selection || null
+        if (selection && selection !== "duplicates" && selection !== "kept-separate") {
+          return { error: "Choose files to deduplicate." }
         }
-      case "deduplicate_all": {
-        const seenPaths = new Set()
-        const pathsByScope = new Map()
-        for (const group of Array.isArray(payload.groups) ? payload.groups : []) {
-          if (!group || typeof group.scope_id !== "string" || !group.scope_id) continue
-          if (!pathsByScope.has(group.scope_id)) pathsByScope.set(group.scope_id, [])
-          for (const filePath of Array.isArray(group.paths) ? group.paths : []) {
-            if (typeof filePath !== "string" || !filePath || seenPaths.has(filePath)) continue
-            seenPaths.add(filePath)
-            pathsByScope.get(group.scope_id).push(filePath)
-          }
+        if (payload.scope_id != null &&
+            (typeof payload.scope_id !== "string" || !payload.scope_id)) {
+          return { error: "Choose a valid location to deduplicate." }
         }
-        const groups = [...pathsByScope]
-          .map(([scope_id, paths]) => ({ scope_id, paths }))
-          .filter((group) => group.paths.length)
-        if (!groups.length) return { error: "No displayed files were selected." }
-        return this.queueFileMutation(
-          "deduplicate_all",
-          null,
-          null,
-          0,
-          (progress) => this.deduplicateAll(groups, progress),
-          { files_total: seenPaths.size }
-        )
-      }
+        const scopeId = typeof payload.scope_id === "string" && payload.scope_id
+          ? payload.scope_id
+          : null
+        if (!selection && !scopeId) {
+          return { error: "Choose a location to deduplicate." }
+        }
+        return this.runMutation(() => this.runFileAction({
+          kind: "deduplicate",
+          scope_id: scopeId,
+          selection: selection || "duplicates",
+          files_total: 0,
+          files_completed: 0
+        }, async (progress) => {
+          const options = {
+            batch_id: `batch-${crypto.randomUUID()}`,
+            progress
+          }
+          return selection
+            ? this.deduplicateSelection(selection, scopeId, options)
+            : this.deduplicateScope(scopeId, options)
+        }))
       case "reclaim":
         return this.runMutation(() => this.reclaim(payload.hash))
       case "reclaim_all":
@@ -396,24 +257,16 @@ class Vault {
           return { done: true }
         })
       case "undo":
-        return this.queueFileMutation("undo", null, null, 0,
-          (action) => this.undoBatch(payload.batch_id, action))
-      case "detach": {
-        const entry = this.registry.links.get(payload.path)
-        return this.queueFileMutation(
-          "detach",
-          payload.path,
-          entry && entry.source_id,
-          entry && this.registry.blobs.get(entry.hash)
-            ? this.registry.blobs.get(entry.hash).size
-            : 0,
-          (action) => this.detach(payload.path, action)
-        )
-      }
-      case "skip":
-        return this.runMutation(() => this.skip(payload.path))
-      case "reshare":
-        return this.runMutation(() => this.reshare(payload.path))
+        return this.runMutation(() => this.undoBatch(payload.batch_id))
+      case "detach":
+        if (typeof payload.path !== "string" || !payload.path) return { status: "not-found" }
+        return this.runMutation(() => {
+          const targetPath = path.resolve(payload.path)
+          const kind = this.registry.duplicates.has(targetPath)
+            ? "keep-separate"
+            : "make-separate"
+          return this.runFileAction({ kind, path: targetPath }, () => this.detach(targetPath))
+        })
       default:
         return { error: "unknown action" }
     }
@@ -435,31 +288,44 @@ class Vault {
     const decorate = async (source) => {
       if (!source.root) return source
       try {
-        const st = await fs.promises.lstat(source.root)
+        const st = await fs.promises.stat(source.root)
         source.dev = st.dev
-        source.available = st.isDirectory() && !st.isSymbolicLink()
+        source.available = st.isDirectory()
         source.shareable = source.available && storeDev !== null && st.dev === storeDev && this.mode === "link"
       } catch (error) {
-        if (!isMissingError(error) && !isAccessError(error)) throw error
+        if (!isMissingError(error)) throw error
         source.available = false
         source.shareable = false
-        source.error_code = error && error.code ? error.code : null
       }
       return source
     }
 
-    const externalPaths = this.registry && Array.isArray(this.registry.settings.external_sources)
-      ? this.registry.settings.external_sources
-      : []
-    for (const externalPath of externalPaths) {
-      const canonical = path.resolve(externalPath)
-      sources.push(await decorate({
-        id: externalSourceId(canonical),
-        kind: "external",
-        label: path.basename(canonical) || canonical,
-        root: canonical,
-        parent_id: "external"
-      }))
+    const seenExternalRoots = new Set()
+    const addExternalEntries = async (importRoot, idPrefix = "") => {
+      let entries = []
+      try {
+        entries = await fs.promises.readdir(importRoot, { withFileTypes: true })
+      } catch (error) {
+        if (!isMissingError(error)) throw error
+      }
+      for (const entry of entries) {
+        if (!entry.isSymbolicLink()) continue
+        const mountPath = path.resolve(importRoot, entry.name)
+        try {
+          const root = await fs.promises.realpath(mountPath)
+          const st = await fs.promises.stat(root)
+          if (!st.isDirectory()) continue
+          const canonical = path.resolve(root)
+          if (seenExternalRoots.has(canonical)) continue
+          seenExternalRoots.add(canonical)
+          sources.push(await decorate({
+            id: sourceId("external", `${idPrefix}${entry.name}`), kind: "external", label: entry.name,
+            root: canonical, mount_path: mountPath, parent_id: "external"
+          }))
+        } catch (error) {
+          if (!isMissingError(error)) throw error
+        }
+      }
     }
 
     let apiEntries = []
@@ -477,6 +343,11 @@ class Vault {
         }))
       }
     }
+    await addExternalEntries(apiRoot)
+    if (await this.directoryIfSafe(this.sourceRoot)) {
+      await addExternalEntries(this.sourceRoot, "vault:")
+    }
+
     let homeEntries = []
     try {
       homeEntries = await fs.promises.readdir(home, { withFileTypes: true })
@@ -496,10 +367,13 @@ class Vault {
     this._sourceBases = new Map()
     for (const source of sources) {
       if (!source.root || source.kind === "virtual") continue
-      const resolved = path.resolve(source.root)
-      const key = process.platform === "win32" ? resolved.toLowerCase() : resolved
-      if (!this._sourceBases.has(key)) this._sourceBases.set(key, [])
-      this._sourceBases.get(key).push(source)
+      for (const base of [source.root, source.mount_path]) {
+        if (!base) continue
+        const resolved = path.resolve(base)
+        const key = process.platform === "win32" ? resolved.toLowerCase() : resolved
+        if (!this._sourceBases.has(key)) this._sourceBases.set(key, [])
+        this._sourceBases.get(key).push(source)
+      }
     }
     return sources
   }
@@ -533,106 +407,50 @@ class Vault {
     if (existing) {
       return { created: false, source: existing }
     }
-    const configured = [...this.registry.settings.external_sources]
-    if (configured.some((root) => isPathWithin(root, canonical) || isPathWithin(canonical, root))) {
-      throw new Error("Choose a folder that does not contain or overlap another scan location.")
-    }
-    const previousScan = this.registry.lastScan
-    const previousAttempt = this.registry.lastScanAttempt
-    this.registry.settings.external_sources = [...configured, canonical]
-    this.registry.lastScan = null
-    this.registry.lastScanAttempt = null
-    this.registry.schedulePersist()
-    try {
-      await this.registry.flush()
-      await this.refreshSources()
-      const source = this._sources.find((item) =>
-        item.kind === "external" && item.root && samePath(item.root, canonical))
-      if (!source) throw new Error("The folder could not be added.")
-      return { created: true, source }
-    } catch (error) {
-      this.registry.settings.external_sources = configured
-      this.registry.lastScan = previousScan
-      this.registry.lastScanAttempt = previousAttempt
-      this.registry.schedulePersist()
-      await this.registry.flush().catch(() => {})
-      await this.refreshSources().catch(() => {})
-      throw error
-    }
-  }
-  async removeExternalSource(sourceId) {
-    if (typeof sourceId !== "string" || !sourceId) {
-      throw new Error("Choose an external folder to remove.")
-    }
-    await this.refreshSources()
-    const source = this._sources.find((item) =>
-      item.id === sourceId && item.kind === "external" && item.root)
-    if (!source) throw new Error("That external folder is no longer configured.")
 
-    let canonical
-    let rootStat
-    try {
-      canonical = path.resolve(await fs.promises.realpath(source.root))
-      rootStat = await fs.promises.stat(canonical)
-    } catch (error) {
-      throw new Error("Reconnect this folder before removing it.")
-    }
-    if (!rootStat.isDirectory() || !samePath(canonical, source.root)) {
-      throw new Error("Reconnect this folder before removing it.")
-    }
-
-    const storesToRemove = new Map()
-    for (const [filePath, entry] of this.registry.links) {
-      if (entry.source_id !== source.id) continue
-      let fileStat
+    const importRoot = this.sourceRoot
+    await this.ensureDirectory(importRoot)
+    const baseLabel = path.basename(canonical) || "external-folder"
+    let mountPath = null
+    for (let index = 1; index < 10000; index++) {
+      const label = index === 1 ? baseLabel : `${baseLabel}-${index}`
+      const candidate = path.resolve(importRoot, label)
       try {
-        fileStat = await fs.promises.lstat(filePath)
+        await fs.promises.symlink(canonical, candidate, this.kernel.platform === "win32" ? "junction" : "dir")
+        mountPath = candidate
+        break
       } catch (error) {
-        if (isMissingError(error)) continue
-        throw new Error("Some files in this folder could not be checked.")
-      }
-      if (!fileStat.isFile()) continue
-      const storePath = this.storePathFor(entry.hash)
-      const storeStat = await this.storeStatIfPresent(storePath)
-      const visibleNames = fileStat.nlink - (sameIdentity(fileStat, storeStat) ? 1 : 0)
-      if (visibleNames > 1) {
-        throw new Error("Turn sharing off for this folder before removing it.")
-      }
-      if (visibleNames === 1 && sameIdentity(fileStat, storeStat)) {
-        storesToRemove.set(entry.hash, {
-          path: storePath,
-          stat: storeStat
-        })
+        if (error && error.code === "EEXIST") continue
+        if (error && (error.code === "EACCES" || error.code === "EPERM")) {
+          throw new Error("Pinokio does not have permission to add that folder.")
+        }
+        throw new Error("Pinokio could not add that folder.")
       }
     }
+    if (!mountPath) throw new Error("Pinokio could not create a unique name for that folder.")
 
-    for (const [hash, store] of storesToRemove) {
-      if (await unlinkIfSame(store.path, store.stat)) {
-        this.registry.removeBlob(hash)
+    try {
+      await this.refreshSources()
+      const source = this._sources.find((item) => item.kind === "external" && item.mount_path && samePath(item.mount_path, mountPath))
+      if (!source) throw new Error("The folder could not be added. Restart Pinokio and try again.")
+      return { created: true, source }
+    } catch (error) {
+      // Adding a source is transactional. Roll back only the exact directory
+      // link created above; preserve any path an external writer replaced.
+      try {
+        const [mounted, target] = await Promise.all([
+          fs.promises.lstat(mountPath),
+          fs.promises.realpath(mountPath)
+        ])
+        if (mounted.isSymbolicLink() && samePath(target, canonical)) {
+          await fs.promises.unlink(mountPath)
+        }
+      } catch {
+        // The original error remains authoritative; an unverified path is
+        // deliberately preserved rather than deleted.
       }
+      throw error
     }
-
-    for (const [filePath, entry] of [...this.registry.links]) {
-      if (entry.source_id === source.id) this.registry.untrack(filePath)
-    }
-    for (const [filePath, entry] of [...this.registry.duplicates]) {
-      if (entry.source_id === source.id) this.registry.untrack(filePath)
-    }
-    for (const [filePath, entry] of [...this.registry.scanIndex]) {
-      if (entry.source_id === source.id) this.registry.untrack(filePath)
-    }
-    for (const [filePath, entry] of [...this.registry.excluded]) {
-      if (entry.source_id === source.id) this.registry.excluded.delete(filePath)
-    }
-    this.registry.sourceScans.delete(source.id)
-    this.registry.sourceScanAttempts.delete(source.id)
-    this.registry.settings.external_sources = this.registry.settings.external_sources
-      .filter((root) => !samePath(root, source.root))
-    this.registry.lastScan = null
-    this.registry.lastScanAttempt = null
-    this.registry.schedulePersist()
-    await this.refreshSources()
-    return { removed: true, source_id: source.id }
   }
   sourceForPath(filePath, preferredId) {
     let cursor = path.resolve(filePath)
@@ -664,7 +482,9 @@ class Vault {
     const source = this.sourceForPath(filePath, preferredId)
     if (!source) return { source_id: null, relative_path: path.basename(filePath) }
     const absolute = path.resolve(filePath)
-    const relative = path.relative(source.root, absolute).split(path.sep).join("/") || path.basename(absolute)
+    let base = source.root
+    if (source.mount_path && isPathWithin(source.mount_path, absolute)) base = source.mount_path
+    const relative = path.relative(base, absolute).split(path.sep).join("/") || path.basename(absolute)
     return {
       source_id: source.id,
       source_kind: source.kind,
@@ -679,13 +499,6 @@ class Vault {
       const context = location.source_id ? location : { relative_path: event.path }
       entry = Object.assign({}, event, context)
     }
-    if (this.scanEvents) {
-      this.scanEvents.push(entry)
-      if (this.scanEvents.length > this.registry.maxEvents * 2) {
-        this.scanEvents.splice(0, this.registry.maxEvents)
-      }
-      return true
-    }
     try {
       await this.registry.appendEvent(entry)
       return true
@@ -770,16 +583,12 @@ class Vault {
     await this.ensureDirectory(this.blobRoot)
     this.registry = new Registry(this.root)
     this.mode = await this.probe(this.root)
-    const loaded = await this.registry.load()
     await this.refreshSources()
+    const loaded = await this.registry.load()
     const missingWithBlobs = !loaded.existed && await this.hasStoredBlobs()
     if (loaded.corrupt || missingWithBlobs) {
-      // Recovery may inspect Vault's own hash shards, but it must not discover
-      // or walk configured sources. A later explicit Scan or Repair rebuilds
-      // visible-path state.
-      await this.rebuild([], { preserveState: false })
+      await this.rebuild(undefined, { preserveState: false })
     }
-    this.sizeThreshold = this.registry.settings.candidate_min_bytes || SIZE_THRESHOLD
     this.sweeper = new Sweeper(this)
     this.initialized = true
     return {
@@ -842,7 +651,7 @@ class Vault {
     if (this.volumeModes.has(dev)) return this.volumeModes.get(dev)
     const a = path.resolve(dir, `.pinokio-probe-${crypto.randomBytes(6).toString("hex")}`)
     const b = a + "-link"
-    let mode = "unsupported"
+    let mode = "copy"
     let aStat = null
     let bStat = null
     let failure = null
@@ -879,11 +688,7 @@ class Vault {
         const job = this.workerJobs.get(id)
         if (!job) return
         this.workerJobs.delete(id)
-        if (error) {
-          const failure = new Error(error.message || String(error))
-          if (error.code) failure.code = error.code
-          job.reject(failure)
-        }
+        if (error) job.reject(new Error(error))
         else job.resolve({ hash, size })
         // Keep the worker warm across the scan queue. Starting one worker per
         // file costs ~30ms and adds up quickly on a first scan.
@@ -939,10 +744,7 @@ class Vault {
           hash,
           source_id: entry.source_id || null
         }))
-      } catch (error) {
-        this.registry.scanIndex.delete(linkPath)
-        entry.unverified = true
-      }
+      } catch (error) {}
     }
     this.registry.schedulePersist()
   }
@@ -952,7 +754,7 @@ class Vault {
     for (const linkPath of this.registry.pathsByIno.get(key) || []) {
       const entry = this.registry.links.get(linkPath)
       if (!entry) continue
-      if (entry.hash !== hash ||
+      if (entry.hash !== hash || entry.mode !== "link" ||
           entry.dev !== storeStat.dev || entry.ino !== storeStat.ino) continue
       const expected = this.registry.scanIndex.get(linkPath)
       if (expected && expected.hash === hash && sameSnapshot(expected, storeStat)) {
@@ -965,15 +767,13 @@ class Vault {
     try {
       hashed = await this.hashFile(storePath)
     } catch (error) {
-      if (isMissingError(error)) return { valid: false }
-      throw error
+      return { valid: false }
     }
     let after
     try {
       after = await this.storeStatIfPresent(storePath)
     } catch (error) {
-      if (isMissingError(error)) return { valid: false }
-      throw error
+      return { valid: false }
     }
     if (!sameSnapshot(before, after) || hashed.hash !== hash || hashed.size !== after.size) {
       return { valid: false }
@@ -995,6 +795,7 @@ class Vault {
       source_id: meta.source_id || null,
       dev: st.dev,
       ino: st.ino,
+      mode: "link"
     }
     const storeStat = await this.storeStatIfPresent(storePath, {
       createParent: this.mode === "link"
@@ -1012,12 +813,25 @@ class Vault {
       if (!sameSnapshot(before, current)) return { status: "stale" }
       return { status: "duplicate", storePath }
     }
-    if (this.mode !== "link") return { status: "unavailable", code: "ENOTSUP" }
+    const registerCopy = async () => {
+      const current = await lstatIfPresent(filePath)
+      if (!sameSnapshot(before, current)) return { status: "stale" }
+      linkEntry.mode = "copy"
+      this.registry.addBlob(hash, { size: st.size, source_urls: meta.source_urls || [] })
+      this.registry.addLink(filePath, linkEntry)
+      await this.refreshLinkSnapshots(hash, st.dev, st.ino)
+      await this.recordEvent({
+        kind: "adopt", hash, path: filePath, app: meta.app || null,
+        source_id: meta.source_id || null, bytes_saved: 0, mode: "copy"
+      })
+      return { status: "copy-mode" }
+    }
+    if (this.mode === "copy") return registerCopy()
     try {
       await fs.promises.link(filePath, storePath)
     } catch (e) {
       if (NO_LINK_CODES.has(e.code)) {
-        return { status: "unavailable", code: e.code }
+        return registerCopy()
       }
       throw e
     }
@@ -1045,7 +859,6 @@ class Vault {
     }
     this.registry.addBlob(hash, { size: st.size, source_urls: meta.source_urls || [] })
     this.registry.addLink(filePath, linkEntry)
-    this.rememberScanStore(storePath, currentStore)
     await this.refreshLinkSnapshots(hash, st.dev, st.ino)
     await this.recordEvent({ kind: "adopt", hash, path: filePath, app: meta.app || null, source_id: meta.source_id || null, bytes_saved: 0 })
     return { status: "adopted" }
@@ -1055,28 +868,39 @@ class Vault {
   async convert(targetPath, hash, meta = {}) {
     if (!this.enabled) return { status: "disabled" }
     const storePath = this.storePathFor(hash)
-    const storeStat = await this.storeStatIfPresent(storePath)
-    if (!storeStat) return { status: "no-blob" }
-    let targetStat
+    let storeStat
     try {
-      targetStat = await fs.promises.lstat(targetPath)
-    } catch (error) {
-      if (LOCK_CODES.has(error && error.code)) return { status: "locked" }
-      if (isMissingError(error)) return { status: "stale" }
-      throw error
+      storeStat = await this.storeStatIfPresent(storePath)
+    } catch (e) {
+      return { status: "no-blob" }
     }
+    if (!storeStat) return { status: "no-blob" }
+    let targetStat = await fs.promises.lstat(targetPath)
     if (!storeStat.isFile() || !targetStat.isFile()) return { status: "stale" }
     if (meta.expected && !sameSnapshot(meta.expected, targetStat)) {
-      return { status: "stale" }
+      // Windows metadata operations can change ctime without changing the
+      // file's identity or bytes. Recover only that isolated mismatch by
+      // hashing the target again, then retain the exact pre-rename check below.
+      if (!sameContentState(meta.expected, targetStat)) return { status: "stale" }
+      const before = fileSnapshot(targetStat)
+      let verifiedTarget
+      try {
+        verifiedTarget = await this.hashFile(targetPath)
+      } catch (error) {
+        return { status: "stale" }
+      }
+      const after = await lstatIfPresent(targetPath)
+      if (!sameSnapshot(before, after) ||
+          verifiedTarget.hash !== hash || verifiedTarget.size !== after.size) {
+        return { status: "stale" }
+      }
+      targetStat = after
     }
     if (storeStat.dev !== targetStat.dev) {
       return { status: "unavailable", code: "EXDEV" }
     }
     if (storeStat.dev === targetStat.dev && storeStat.ino === targetStat.ino) {
-      this.registry.addLink(targetPath, {
-        hash, app: meta.app || null, source_id: meta.source_id || null,
-        dev: storeStat.dev, ino: storeStat.ino, unverified: false
-      })
+      this.registry.addLink(targetPath, { hash, app: meta.app || null, source_id: meta.source_id || null, dev: storeStat.dev, ino: storeStat.ino, mode: "link" })
       await this.refreshLinkSnapshots(hash, storeStat.dev, storeStat.ino)
       return { status: "already" }
     }
@@ -1158,10 +982,10 @@ class Vault {
     }
     this.registry.addLink(targetPath, {
       hash, app: meta.app || null, source_id: meta.source_id || null,
-      dev: st.dev, ino: st.ino, batch_id: meta.batch_id || null,
-      unverified: false
+      dev: st.dev, ino: st.ino, mode: "link", batch_id: meta.batch_id || null
     })
     await this.refreshLinkSnapshots(hash, st.dev, st.ino)
+    this.registry.addSaved(storeStat.size)
     await this.recordEvent({
       kind: "convert", hash, path: targetPath, app: meta.app || null, source_id: meta.source_id || null,
       bytes_saved: storeStat.size, batch_id: meta.batch_id || null
@@ -1180,138 +1004,196 @@ class Vault {
       return !!(runningPath && isPathWithin(appRoot, runningPath))
     })
   }
-  async deduplicateScope(scopeId, options = {}) {
+  async deduplicateFile(filePath, options = {}) {
+    if (!this.enabled || typeof filePath !== "string" || !filePath) {
+      return { status: this.enabled ? "not-found" : "disabled" }
+    }
     await this.refreshSources()
-    const source = this._sources.find((item) => item.id === scopeId && item.kind !== "virtual")
-    if (!source) return { error: "That location is no longer available. Scan again to refresh it." }
-    if (!source.shareable) return { error: "This location is on a disk that cannot share space with this vault." }
-    if (this.sourceAppIsRunning(source)) {
-      return { error: "This app has a running script. Stop it first, then deduplicate." }
+    return this.deduplicateExcludedFile(filePath, options)
+  }
+  async deduplicateExcludedFile(filePath, options = {}) {
+    const targetPath = path.resolve(filePath)
+    const excluded = this.registry.excluded.get(targetPath)
+    if (!excluded) return { status: "not-found" }
+    const source = this.sourceForPath(targetPath, excluded.source_id)
+    if (!source || !await this.canonicalPathIsWithinSource(targetPath, source)) {
+      return { status: "stale" }
     }
+    if (!source.shareable) return { status: "unavailable" }
+    if (this.sourceAppIsRunning(source)) return { status: "locked" }
 
-    const registry = this.registry
-    const batch = options.batch_id || `batch-${crypto.randomUUID()}`
-    const requestedPaths = options.paths === undefined
-      ? new Set([...registry.duplicates.keys()])
-      : new Set((options.paths || [])
-        .filter((filePath) => typeof filePath === "string" && filePath))
-    if (!requestedPaths.size) return { error: "No displayed files were selected." }
-    const candidates = [...registry.duplicates].filter(([filePath, entry]) => {
-      if (!requestedPaths.has(filePath)) return false
-      const currentSource = this.sourceForPath(filePath, entry.source_id)
-      return !!(currentSource && currentSource.id === scopeId && currentSource.shareable)
+    const before = await lstatIfPresent(targetPath)
+    if (!before || !before.isFile()) return { status: "stale" }
+    let hashed
+    try {
+      hashed = await this.hashFile(targetPath)
+    } catch (error) {
+      return { status: "stale" }
+    }
+    const after = await lstatIfPresent(targetPath)
+    if (!sameSnapshot(fileSnapshot(before), after) || hashed.size !== after.size) {
+      return { status: "stale" }
+    }
+    if (!this.registry.blobs.has(hashed.hash)) return { status: "no-match" }
+    if (!await this.canonicalPathIsWithinSource(targetPath, source)) return { status: "stale" }
+    const current = await lstatIfPresent(targetPath)
+    if (!sameSnapshot(fileSnapshot(after), current)) return { status: "stale" }
+
+    const result = await this.convert(targetPath, hashed.hash, {
+      app: source.kind === "app" ? source.app : null,
+      source_id: source.id,
+      batch_id: options.batch_id || `batch-${crypto.randomUUID()}`,
+      source,
+      expected: fileSnapshot(current)
     })
-    const progress = options.progress || null
-    if (progress) {
-      progress.files_completed = 0
-      progress.files_total = candidates.length
-      this.actionSequence += 1
+    if (result.status === "converted" || result.status === "already") {
+      this.registry.allowSharing(targetPath)
     }
-    const summary = { converted: 0, bytes_saved: 0, locked: 0, stale: 0, incompatible: 0, unavailable: 0, failed: 0 }
-    const staleHashes = new Set()
-    for (const [filePath, entry] of candidates) {
+    return result
+  }
+  sourceIsWithinScope(source, scopeId) {
+    if (!scopeId) return true
+    const seen = new Set()
+    let current = source
+    while (current && !seen.has(current.id)) {
+      if (current.id === scopeId) return true
+      seen.add(current.id)
+      current = this._sources.find((item) => item.id === current.parent_id)
+    }
+    return false
+  }
+  async deduplicateSelection(selection, scopeId, options = {}) {
+    if (selection === "duplicates") {
+      return this.deduplicateScope(scopeId, Object.assign({}, options, { includeDescendants: true }))
+    }
+    await this.refreshSources()
+    if (scopeId && !this._sources.some((source) => source.id === scopeId)) {
+      return { error: "That location is no longer available. Scan again to refresh it." }
+    }
+    const paths = [...this.registry.excluded].filter(([filePath, entry]) => {
+      const source = this.sourceForPath(filePath, entry.source_id)
+      return source ? this.sourceIsWithinScope(source, scopeId) : !scopeId
+    }).map(([filePath]) => filePath)
+    if (options.progress) options.progress.files_total = paths.length
+    const summary = {
+      converted: 0, bytes_saved: 0, locked: 0, stale: 0, unmatched: 0,
+      incompatible: 0, unavailable: 0, failed: 0
+    }
+    const batch = options.batch_id || `batch-${crypto.randomUUID()}`
+    for (const filePath of paths) {
       try {
-        const currentSource = this.sourceForPath(filePath, entry.source_id)
-        if (!currentSource || currentSource.id !== scopeId || !currentSource.shareable) continue
-        if (entry.unverified) {
-          summary.unavailable += 1
-          continue
-        }
-        if (!await this.canonicalPathIsWithinSource(filePath, currentSource)) {
-          summary.stale += 1
-          continue
-        }
-        const indexed = registry.scanIndex.get(filePath)
-        const expected = indexed && indexed.hash === entry.hash
-          ? indexed
-          : (entry.dev !== undefined && entry.ino !== undefined &&
-              entry.mtime !== undefined && entry.ctime !== undefined ? entry : null)
-        if (!expected) {
+        const result = await this.deduplicateExcludedFile(filePath, { batch_id: batch })
+        if (result.status === "converted" || result.status === "already") {
+          summary.converted += 1
+          summary.bytes_saved += result.bytes_saved || 0
+        } else if (result.status === "locked") {
+          summary.locked += 1
+        } else if (result.status === "stale") {
           summary.stale += 1
-          continue
-        }
-        if (staleHashes.has(entry.hash)) {
-          summary.stale += 1
-          continue
-        }
-        try {
-          const result = await this.convert(filePath, entry.hash, {
-            app: source.kind === "app" ? source.app : (entry.app || null),
-            source_id: scopeId,
-            batch_id: batch,
-            source: currentSource,
-            expected
-          })
-          if (result.status === "converted" || result.status === "already") {
-            summary.converted += 1
-            summary.bytes_saved += result.bytes_saved || 0
-          } else if (result.status === "locked") {
-            summary.locked += 1
-          } else if (result.status === "stale") {
-            summary.stale += 1
-          } else if (result.status === "stale-blob") {
-            staleHashes.add(entry.hash)
-            summary.stale += 1
-          } else if (result.status === "metadata-mismatch") {
-            entry.unavailable_reason = "metadata"
-            summary.incompatible += 1
-          } else if (result.status === "unavailable") {
-            summary.unavailable += 1
-          } else {
-            summary.failed += 1
-          }
-        } catch (error) {
+        } else if (result.status === "no-match" || result.status === "no-blob" ||
+            result.status === "size-mismatch") {
+          summary.unmatched += 1
+        } else if (result.status === "metadata-mismatch") {
+          summary.incompatible += 1
+        } else if (result.status === "unavailable" || result.status === "copy-mode") {
+          summary.unavailable += 1
+        } else {
           summary.failed += 1
         }
-      } finally {
-        if (progress) {
-          progress.files_completed += 1
-          this.actionSequence += 1
-        }
-        if (options.onFileComplete) options.onFileComplete()
+      } catch (error) {
+        summary.failed += 1
       }
+      if (options.progress) options.progress.files_completed += 1
     }
-    registry.schedulePersist()
     return summary
   }
-  async deduplicateAll(groups, progress) {
-    const summary = {
-      converted: 0,
-      bytes_saved: 0,
-      locked: 0,
-      stale: 0,
-      incompatible: 0,
-      unavailable: 0,
-      failed: 0,
-      locations_skipped: 0
-    }
-    const fields = ["converted", "bytes_saved", "locked", "stale", "incompatible", "unavailable", "failed"]
-    progress.files_completed = 0
-    progress.files_total = groups.reduce((sum, group) => sum + group.paths.length, 0)
-    this.actionSequence += 1
-    for (const group of groups) {
-      let completed = 0
-      const result = await this.deduplicateScope(group.scope_id, {
-        batch_id: `batch-${crypto.randomUUID()}`,
-        paths: group.paths,
-        onFileComplete: () => {
-          completed += 1
-          progress.files_completed += 1
-          this.actionSequence += 1
-        }
-      })
-      if (result.error) {
-        summary.unavailable += group.paths.length
-        summary.locations_skipped += 1
-      } else {
-        for (const field of fields) summary[field] += Number(result[field]) || 0
+  async deduplicateScope(scopeId, options = {}) {
+    await this.refreshSources()
+    const includeDescendants = options.includeDescendants === true
+    const source = scopeId
+      ? this._sources.find((item) => item.id === scopeId && (includeDescendants || item.kind !== "virtual"))
+      : null
+    if ((!includeDescendants || scopeId) && !source) {
+      return { error: "That location is no longer available. Scan again to refresh it." }
+    }
+    if (!includeDescendants) {
+      if (!source.shareable) return { error: "This location is on a disk that cannot share space with this vault." }
+      if (this.sourceAppIsRunning(source)) {
+        return { error: "This app has a running script. Stop it first, then deduplicate." }
+      }
+    }
+
+    const registry = this.registry
+    const batch = options.batch_id || `batch-${crypto.randomUUID()}`
+    const summary = { converted: 0, bytes_saved: 0, locked: 0, stale: 0, incompatible: 0, unavailable: 0, failed: 0 }
+    const staleHashes = new Set()
+    const entries = [...registry.duplicates]
+    const matchesScope = (currentSource) => currentSource && currentSource.shareable &&
+      (includeDescendants ? this.sourceIsWithinScope(currentSource, scopeId) : currentSource.id === scopeId)
+    if (options.progress) {
+      options.progress.files_total = entries.reduce((total, [filePath, entry]) => {
+        const currentSource = this.sourceForPath(filePath, entry.source_id)
+        return total + (matchesScope(currentSource) ? 1 : 0)
+      }, 0)
+    }
+    const completeProgress = () => {
+      if (options.progress) options.progress.files_completed += 1
+    }
+    for (const [filePath, entry] of entries) {
+      const currentSource = this.sourceForPath(filePath, entry.source_id)
+      if (!matchesScope(currentSource)) continue
+      if (!await this.canonicalPathIsWithinSource(filePath, currentSource)) {
+        summary.stale += 1
+        completeProgress()
+        continue
       }
-      const unprocessed = Math.max(0, group.paths.length - completed)
-      if (unprocessed) {
-        progress.files_completed += unprocessed
-        this.actionSequence += 1
+      const indexed = registry.scanIndex.get(filePath)
+      const expected = indexed && indexed.hash === entry.hash
+        ? indexed
+        : (entry.dev !== undefined && entry.ino !== undefined &&
+            entry.mtime !== undefined && entry.ctime !== undefined ? entry : null)
+      if (!expected) {
+        summary.stale += 1
+        completeProgress()
+        continue
+      }
+      if (staleHashes.has(entry.hash)) {
+        summary.stale += 1
+        completeProgress()
+        continue
+      }
+      try {
+        const result = await this.convert(filePath, entry.hash, {
+          app: currentSource.kind === "app" ? currentSource.app : (entry.app || null),
+          source_id: currentSource.id,
+          batch_id: batch,
+          source: currentSource,
+          expected
+        })
+        if (result.status === "converted" || result.status === "already") {
+          summary.converted += 1
+          summary.bytes_saved += result.bytes_saved || 0
+        } else if (result.status === "locked") {
+          summary.locked += 1
+        } else if (result.status === "stale") {
+          summary.stale += 1
+        } else if (result.status === "stale-blob") {
+          staleHashes.add(entry.hash)
+          summary.stale += 1
+        } else if (result.status === "metadata-mismatch") {
+          entry.unavailable_reason = "metadata"
+          summary.incompatible += 1
+        } else if (result.status === "unavailable" || result.status === "copy-mode") {
+          summary.unavailable += 1
+        } else {
+          summary.failed += 1
+        }
+      } catch (error) {
+        summary.failed += 1
       }
+      completeProgress()
     }
+    registry.schedulePersist()
     return summary
   }
   // reclaim: delete an orphan's store name. Refuses when any app name remains.
@@ -1321,6 +1203,10 @@ class Vault {
     if (!this.registry.blobs.has(hash)) return { status: "not-found" }
     const st = await this.storeStatIfPresent(storePath)
     if (!st) {
+      const hasCopyNames = options.hasCopyNames === undefined
+        ? [...this.registry.links.values()].some((entry) => entry.hash === hash && entry.mode === "copy")
+        : options.hasCopyNames
+      if (hasCopyNames) return { status: "unavailable" }
       if (!options.deferRegistry) this.registry.removeBlob(hash)
       return options.deferRegistry ? { status: "gone", remove_hash: true } : { status: "gone" }
     }
@@ -1345,41 +1231,26 @@ class Vault {
     if (!this.enabled || !this.registry) return
     const preservePath = options.preservePath || (() => false)
     const includePath = options.includePath || (() => true)
-    const preserveReadError = (error, filePath, entry) => {
-      if (isMissingError(error)) return false
-      if (options.onAccessError) {
-        if (!isAccessError(error) || !options.onAccessError(error, filePath)) return false
-      }
-      if (entry) entry.unverified = true
-      return true
-    }
+    const handleAccessError = (error, filePath) => !!(
+      isAccessError(error) && options.onAccessError && options.onAccessError(error, filePath)
+    )
     if (options.reconcile !== false) this.reconcileConfiguredSources()
     for (const [linkPath, entry] of [...this.registry.links]) {
       if (!includePath(linkPath)) continue
       if (preservePath(linkPath)) continue
       try {
         const source = this.sourceForPath(linkPath, entry.source_id)
-        if (source && source.available === false) {
-          entry.unverified = true
-          continue
-        }
-        if (!source) {
+        const managedPath = source && await this.canonicalPathIsWithinSource(linkPath, source, { strictErrors: true })
+        if (!managedPath) {
           this.registry.untrack(linkPath)
           continue
         }
         const st = await lstatIfPresent(linkPath)
-        if (!st) {
+        if (!st || !st.isFile() || st.ino !== entry.ino || st.dev !== entry.dev) {
           this.registry.untrack(linkPath)
-          continue
         }
-        const managedPath = await this.canonicalPathIsWithinSource(
-          linkPath, source, { strictErrors: true })
-        const expected = this.registry.scanIndex.get(linkPath)
-        entry.unverified = !managedPath || !st.isFile() ||
-          st.ino !== entry.ino || st.dev !== entry.dev ||
-          !expected || expected.hash !== entry.hash || !sameSnapshot(expected, st)
       } catch (error) {
-        if (!preserveReadError(error, linkPath, entry)) throw error
+        if (!handleAccessError(error, linkPath)) throw error
       }
     }
     for (const [dupPath, entry] of [...this.registry.duplicates]) {
@@ -1388,28 +1259,17 @@ class Vault {
       let valid = false
       try {
         const source = this.sourceForPath(dupPath, entry.source_id)
-        if (source && source.available === false) {
-          entry.unverified = true
-          continue
-        }
         const st = await lstatIfPresent(dupPath)
-        if (!st) {
-          this.registry.untrack(dupPath)
-          continue
-        }
-        const expected = this.registry.scanIndex.get(dupPath)
-        valid = !!(source && st.isFile() &&
-          await this.canonicalPathIsWithinSource(dupPath, source, { strictErrors: true }) &&
-          expected && expected.hash === entry.hash && sameSnapshot(expected, st))
+        valid = !!(source && st && st.isFile() &&
+          await this.canonicalPathIsWithinSource(dupPath, source, { strictErrors: true }))
       } catch (error) {
-        if (preserveReadError(error, dupPath, entry)) continue
+        if (handleAccessError(error, dupPath)) continue
         throw error
       }
       if (!valid) {
-        entry.unverified = true
+        this.registry.untrack(dupPath)
         continue
       }
-      entry.unverified = false
       const storeStat = await this.storeStatIfPresent(this.storePathFor(entry.hash))
       if (storeStat && storeStat.isFile()) {
         await unlinkIfSame(dupPath + TMP_SUFFIX, storeStat)
@@ -1430,6 +1290,7 @@ class Vault {
       const st = await this.storeStatIfPresent(storePath)
       if (!st) {
         const names = linksByHash.get(hash) || []
+        const copyNames = names.filter(([, entry]) => entry.mode === "copy")
         // Deleting a name changes ctime, so trusted re-adoption compares the
         // preserved identity, size, and mtime. Changed or legacy-unsnapshotted
         // content waits for the next explicit scan instead of being assigned a
@@ -1437,6 +1298,7 @@ class Vault {
         let readopted = false
         let inaccessibleName = false
         for (const [linkPath, entry] of names) {
+          if (entry.mode !== "link") continue
           if (preservePath(linkPath)) {
             inaccessibleName = true
             continue
@@ -1448,7 +1310,7 @@ class Vault {
             if (!source || !await this.canonicalPathIsWithinSource(linkPath, source, { strictErrors: true })) continue
             linkStat = await lstatIfPresent(linkPath)
           } catch (error) {
-            if (!preserveReadError(error, linkPath, entry)) throw error
+            if (!handleAccessError(error, linkPath)) throw error
             inaccessibleName = true
             continue
           }
@@ -1486,7 +1348,10 @@ class Vault {
           readopted = true
           break
         }
-        if (readopted || inaccessibleName) {
+        // On a volume without file sharing support, copy-mode names are the
+        // durable content group. They remain useful for duplicate discovery
+        // even though there is no canonical file in the vault tree.
+        if (readopted || copyNames.length || inaccessibleName) {
           blob.orphan = false
           blob.verified_at = inaccessibleName && !readopted ? null : Date.now()
         } else {
@@ -1516,14 +1381,9 @@ class Vault {
       blobs: new Map(registry.blobs),
       links: new Map(registry.links),
       excluded: new Map(registry.excluded),
+      totals: Object.assign({}, registry.totals),
       lastScan: registry.lastScan ? Object.assign({}, registry.lastScan) : null,
-      lastScanAttempt: registry.lastScanAttempt
-        ? Object.assign({}, registry.lastScanAttempt)
-        : null,
       sourceScans: new Map([...registry.sourceScans].map(([id, scan]) => [id, Object.assign({}, scan)])),
-      sourceScanAttempts: new Map([...registry.sourceScanAttempts]
-        .map(([id, scan]) => [id, Object.assign({}, scan)])),
-      settings: Object.assign({}, registry.settings),
       duplicates: new Map(registry.duplicates),
       scanIndex: new Map(registry.scanIndex)
     } : null
@@ -1571,18 +1431,7 @@ class Vault {
     await this.refreshSources()
     const walkRoots = roots
       ? roots.map((root) => typeof root === "string" ? { root, source_id: null } : root)
-      : [
-          { root: path.resolve(this.kernel.homedir), source_id: "pinokio" },
-          ...this._sources
-            .filter((source) => source.kind === "external" && source.root)
-            .map((source) => ({ root: source.root, source_id: source.id }))
-        ]
-    for (const entry of walkRoots) {
-      const rootStat = await fs.promises.lstat(entry.root)
-      if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) {
-        throw new Error(`Repair source is not a real directory: ${entry.root}`)
-      }
-    }
+      : this.scanRoots()
     for (const entry of walkRoots) {
       await this.walkForInoMatch(
         entry.root,
@@ -1595,6 +1444,38 @@ class Vault {
     const rebuiltScanIndex = new Map()
     const trustedHashes = new Set()
     if (preserved) {
+      // Copy-mode content has no store inode to rediscover. Preserve only names
+      // whose exact scan snapshot still proves the recorded content group.
+      for (const [linkPath, link] of preserved.links) {
+        if (link.mode !== "copy" || preserved.excluded.has(linkPath)) continue
+        const blob = preserved.blobs.get(link.hash)
+        const expected = preserved.scanIndex.get(linkPath)
+        const source = this.sourceForPath(linkPath, link.source_id)
+        if (!blob || !expected || expected.hash !== link.hash || !source ||
+            !await this.canonicalPathIsWithinSource(linkPath, source, { strictErrors: true })) continue
+        try {
+          const st = await fs.promises.lstat(linkPath)
+          if (!st.isFile() || st.size < this.sizeThreshold ||
+              link.dev !== st.dev || link.ino !== st.ino ||
+              !sameSnapshot(expected, st)) continue
+          if (!rebuiltBlobs.has(link.hash)) {
+            rebuiltBlobs.set(link.hash, Object.assign({}, blob, {
+              size: st.size,
+              verified_at: Date.now(),
+              orphan: false
+            }))
+          }
+          rebuiltLinks.set(linkPath, Object.assign({}, link, {
+            app: source.kind === "app" ? source.app : (link.app || null),
+            source_id: source.id,
+            dev: st.dev,
+            ino: st.ino,
+            mode: "copy"
+          }))
+        } catch (error) {
+          if (!isMissingError(error)) throw error
+        }
+      }
       // A store filename is only a trustworthy content hash when at least one
       // surviving name still matches the snapshot captured when that content
       // was hashed. Repair itself never hashes, so unverified names are left
@@ -1666,10 +1547,8 @@ class Vault {
       duplicates: rebuiltDuplicates,
       excluded: preserved ? preserved.excluded : new Map(),
       lastScan: preserved ? preserved.lastScan : null,
-      lastScanAttempt: preserved ? preserved.lastScanAttempt : null,
       sourceScans: preserved ? preserved.sourceScans : new Map(),
-      sourceScanAttempts: preserved ? preserved.sourceScanAttempts : new Map(),
-      settings: preserved ? preserved.settings : {},
+      totals: preserved ? preserved.totals : { lifetime_bytes_saved: 0 },
       byIno: rebuiltByIno,
       pathsByIno: rebuiltPathsByIno
     })
@@ -1680,8 +1559,7 @@ class Vault {
     for await (const batch of walkBatches(root, {
       concurrency: this.dirConcurrency,
       skipDirectory: (full) => full === vaultRoot,
-      strictErrors: true,
-      onRootMissing: (error) => { throw error }
+      strictErrors: true
     })) {
       const files = batch.flatMap((group) => group.files.map((file) => file.path))
       const stats = await statMany(files, this.statConcurrency, null, {
@@ -1690,19 +1568,19 @@ class Vault {
       })
       for (let index = 0; index < files.length; index++) {
         const st = stats[index]
-        if (!st || !st.isFile()) continue
+        if (!st || !st.isFile() || st.size < this.sizeThreshold) continue
         const hash = storeInoToHash.get(`${st.dev}:${st.ino}`)
         if (hash) {
           const source = this.sourceForPath(files[index], preferredSourceId)
           const previous = this.registry.links.get(files[index])
-          const batchId = previous && previous.hash === hash &&
+          const batchId = previous && previous.hash === hash && previous.mode === "link" &&
             previous.dev === st.dev && previous.ino === st.ino
             ? previous.batch_id || null
             : null
           const link = {
             hash, app: source && source.kind === "app" ? source.app : null,
             source_id: source ? source.id : null, dev: st.dev, ino: st.ino,
-            created: Date.now(),
+            mode: "link", created: Date.now(),
             batch_id: batchId
           }
           if (outputLinks) outputLinks.set(files[index], link)
@@ -1722,7 +1600,6 @@ class Vault {
   // memory + one stat per blob and occupied shard; never a walk.
   async status(scopeId = null) {
     if (!this.enabled || !this.registry) return { enabled: false }
-    const responseActionSequence = this.actionSequence
     const registry = this.registry
     const scope = scopeId ? this.scanSource(scopeId) : null
     if (scopeId && !scope) throw new Error("That location is no longer available.")
@@ -1745,8 +1622,7 @@ class Vault {
       if (!namesByHash.has(entry.hash)) namesByHash.set(entry.hash, [])
       const location = this.locationForPath(linkPath, entry.source_id)
       namesByHash.get(entry.hash).push(Object.assign({
-        path: linkPath, app: entry.app || null, mode: "link",
-        unverified: !!entry.unverified
+        path: linkPath, app: entry.app || null, mode: entry.mode
       }, location))
       if (entry.batch_id && (!scopeId || entry.source_id === scopeId)) {
         if (!undoBatchMap.has(entry.batch_id)) {
@@ -1758,6 +1634,11 @@ class Vault {
         batch.bytes += blob && Number.isFinite(blob.size) ? blob.size : 0
       }
     }
+    const pendingBytesByHash = new Map()
+    for (const entry of registry.duplicates.values()) {
+      if (scopeId && entry.source_id !== scopeId) continue
+      pendingBytesByHash.set(entry.hash, (pendingBytesByHash.get(entry.hash) || 0) + (entry.size || 0))
+    }
     const blobEntries = [...registry.blobs].filter(([hash]) => !scopeHashes || scopeHashes.has(hash))
     if (!await this.directoryIfSafe(this.root) || !await this.directoryIfSafe(this.blobRoot)) {
       throw unsafeStoragePath(this.blobRoot)
@@ -1771,7 +1652,8 @@ class Vault {
       null,
       { strictErrors: true, followSymlinks: false }
     )
-    let savedBySharing = 0
+    let bytesOnDisk = 0
+    let wouldBe = 0
     for (let index = 0; index < blobEntries.length; index++) {
       const [hash, blob] = blobEntries[index]
       const names = namesByHash.get(hash) || []
@@ -1780,17 +1662,14 @@ class Vault {
       const nlink = storeStat ? storeStat.nlink : null
       storeStats.set(hash, storeStat)
       const size = blob.size || 0
-      const liveNames = storeStat ? Math.max(0, storeStat.nlink - 1) : 0
-      if (liveNames >= 2) {
-        for (const name of names) {
-          if (name.unverified || (scopeId && name.source_id !== scopeId)) continue
-          savedBySharing += size - (size / liveNames)
-        }
-      }
+      const linkedCopy = storeStat || names.some((name) => name.mode === "link") ? 1 : 0
+      const physicalCopies = linkedCopy + names.filter((name) => name.mode === "copy").length
+      const pendingBytes = pendingBytesByHash.get(hash) || 0
+      bytesOnDisk += (size * physicalCopies) + pendingBytes
+      wouldBe += (size * Math.max(physicalCopies, names.length)) + pendingBytes
       const orphan = !!(storeStat && storeStat.nlink === 1)
       const publicBlob = {
         hash, size: blob.size || 0, orphan, nlink,
-        sharing_locations: liveNames,
         names, apps: [...apps], source_urls: blob.source_urls || []
       }
       blobs.push(publicBlob)
@@ -1803,8 +1682,7 @@ class Vault {
       const source = this.sourceForPath(p, location.source_id)
       const index = registry.scanIndex.get(p)
       const storeStat = storeStats.get(entry.hash)
-      const shareable = !!(source && source.shareable && storeStat && !entry.unverified &&
-        !entry.unavailable_reason &&
+      const shareable = !!(source && source.shareable && storeStat && !entry.unavailable_reason &&
         (!index || index.dev === undefined || index.dev === storeStat.dev))
       let unavailableReason = entry.unavailable_reason || null
       if (!shareable && !unavailableReason) {
@@ -1816,8 +1694,7 @@ class Vault {
       const match = blob ? blob.names.find((name) => name.path !== p) || null : null
       duplicates.push(Object.assign({
         path: p, hash: entry.hash, size: entry.size || 0, app: entry.app || null,
-        shareable, unverified: !!entry.unverified,
-        unavailable_reason: entry.unverified ? "unavailable" : unavailableReason, match
+        shareable, unavailable_reason: unavailableReason, match
       }, location))
     }
     const events = (await registry.readEvents()).reverse()
@@ -1850,64 +1727,64 @@ class Vault {
       excluded.push(Object.assign({
         path: p,
         ts: meta.ts || null,
-        size: Number(meta.size) || 0,
-        unverified: !!meta.unverified
+        size: Number(meta.size) || 0
       }, this.locationForPath(p, meta.source_id)))
     }
     const publicSources = this._sources.filter((source) => !scopeId || source.id === scopeId).map((source) => ({
       id: source.id, kind: source.kind, label: source.label, root: source.root,
-      display_path: source.root,
+      display_path: source.kind === "pinokio" ? source.root : (source.mount_path || source.root),
       target_path: source.kind === "external" ? source.root : null,
       parent_id: scopeId ? null : source.parent_id, app: source.app || null,
       available: source.available !== false, shareable: source.kind === "virtual" ? null : !!source.shareable
     }))
-    const lastComplete = registry.scanFor(scopeId)
-    const lastAttempt = registry.scanAttemptFor(scopeId)
-    const inScope = (entry) => !scopeId || entry.source_id === scopeId
-    const hasUnavailableSource = !scopeId && this._sources.some((source) =>
-      source.kind === "external" && source.available === false)
-    const hasUnverified = hasUnavailableSource || [...registry.links.values()].some((entry) =>
-      inScope(entry) && entry.unverified) ||
-      [...registry.duplicates.values()].some((entry) =>
-        inScope(entry) && entry.unverified) ||
-      [...registry.excluded.values()].some((entry) =>
-        inScope(entry) && entry.unverified)
-    const incomplete = hasUnverified || !!(
-      lastAttempt && lastAttempt.complete === false &&
-      (!lastComplete || (lastAttempt.ts || 0) >= (lastComplete.ts || 0))
-    )
-    const metricsExact = !!lastComplete && !incomplete
-    const beforeBytes = metricsExact && Number.isFinite(lastComplete.bytes_total)
-      ? Math.max(0, lastComplete.bytes_total)
-      : null
-    const afterBytes = beforeBytes === null
-      ? null
-      : Math.max(0, beforeBytes - savedBySharing)
     const result = {
       enabled: true,
       mode: this.mode,
-      candidate_min_bytes: this.sizeThreshold,
-      candidate_size_options: CANDIDATE_SIZE_OPTIONS,
       scan,
-      file_action: this.fileActionStatus(scopeId),
-      file_actions: this.fileActionStatuses(scopeId),
-      action_sequence: responseActionSequence,
-      last_scan: lastComplete,
-      last_attempt: lastAttempt,
-      incomplete,
-      metrics_exact: metricsExact,
-      bytes_on_disk: afterBytes,
-      bytes_without_sharing: beforeBytes,
-      saved_by_sharing: savedBySharing,
+      last_scan: registry.scanFor(scopeId),
+      bytes_on_disk: bytesOnDisk,
+      bytes_without_sharing: wouldBe,
+      saved_by_sharing: wouldBe - bytesOnDisk,
+      lifetime_bytes_saved: registry.totals.lifetime_bytes_saved,
       reclaimable: blobs.filter((b) => b.orphan).reduce((sum, b) => sum + b.size, 0),
       pending_bytes: duplicates.filter((d) => d.shareable).reduce((sum, d) => sum + d.size, 0),
+      file_action: this.fileActionStatus(scopeId),
       activity_error: registry.eventError,
       cloud_sync_warning: this.cloudSyncProvider(),
       sources: publicSources, blobs, duplicates, excluded, events,
       undo_batches: undoBatches
     }
     if (scopeId) {
+      const duplicateBytes = duplicates.reduce((sum, item) => sum + item.size, 0)
+      const excludedBytes = excluded.reduce((sum, item) => sum + item.size, 0)
+      let linkedBytes = 0
+      let effectiveLinkedBytes = 0
+      let sharedBytes = 0
+      for (const blob of blobs) {
+        const scopedNames = blob.names.filter((name) => name.source_id === scopeId)
+        const scopedLinks = scopedNames.filter((name) => name.mode === "link").length
+        const scopedCopies = scopedNames.length - scopedLinks
+        const registeredLinks = blob.names.filter((name) => name.mode === "link").length
+        // The store name is one hardlink but not a user-visible location.
+        // Registry count prevents stale filesystem metadata from over-attributing the inode.
+        const filesystemLinks = Number.isFinite(blob.nlink) ? Math.max(0, blob.nlink - 1) : 0
+        const sharingLocations = Math.max(1, registeredLinks, filesystemLinks)
+        linkedBytes += blob.size * scopedNames.length
+        effectiveLinkedBytes += (blob.size * scopedCopies) +
+          (blob.size * scopedLinks / sharingLocations)
+        if (registeredLinks >= 2) sharedBytes += blob.size * scopedLinks
+      }
+      const trackedBytes = linkedBytes + duplicateBytes + excludedBytes
+      const effectiveTrackedBytes = effectiveLinkedBytes + duplicateBytes + excludedBytes
+      const folderBytes = result.last_scan && Number.isFinite(result.last_scan.bytes_total)
+        ? result.last_scan.bytes_total
+        : null
       result.scope_id = scopeId
+      result.tracked_bytes = trackedBytes
+      result.effective_bytes = folderBytes === null
+        ? null
+        : Math.max(0, folderBytes - trackedBytes) + effectiveTrackedBytes
+      result.shared_bytes = sharedBytes
       result.reclaimable = 0
     }
     return result
@@ -1922,176 +1799,34 @@ class Vault {
     return Object.assign({}, state, {
       current_file: sweeper.currentHash ? path.basename(sweeper.currentHash.path) : null,
       pending,
-      error: this.scanError,
-      persistence_warning: this.scanPersistenceWarning &&
-        !!(this.registry && this.registry.persistDirty)
+      error: this.scanError
     })
   }
+  fileActionStatus(scopeId = null) {
+    const progress = this.fileActionProgress
+    if (!progress) return null
+    if (scopeId) {
+      if (progress.scope_id && progress.scope_id !== scopeId) return null
+      if (progress.path) {
+        const source = this.sourceForPath(progress.path)
+        if (!source || source.id !== scopeId) return null
+      }
+    }
+    return Object.assign({}, progress)
+  }
   progressStatus(scopeId = null) {
     return {
       enabled: !!this.enabled,
-      candidate_min_bytes: this.sizeThreshold,
-      candidate_size_options: CANDIDATE_SIZE_OPTIONS,
       scan: this.scanStatus(),
       file_action: this.fileActionStatus(scopeId),
-      file_actions: this.fileActionStatuses(scopeId),
-      action_sequence: this.actionSequence,
-      last_scan: this.registry ? this.registry.scanFor(scopeId) : null,
-      last_attempt: this.registry ? this.registry.scanAttemptFor(scopeId) : null
-    }
-  }
-  fileActionStatus(scopeId = null) {
-    const action = this.fileAction
-    if (!action || (scopeId && action.source_id !== scopeId)) return null
-    return {
-      id: action.id,
-      kind: action.kind,
-      phase: action.phase,
-      path: action.path,
-      source_id: action.source_id,
-      bytes_copied: action.bytes_copied,
-      bytes_total: action.bytes_total,
-      files_completed: action.files_completed,
-      files_total: action.files_total
-    }
-  }
-  fileActionStatuses(scopeId = null) {
-    return [...this.fileActions.values()]
-      .filter((action) => !scopeId || action.source_id === scopeId)
-      .map((action) => ({
-        id: action.id,
-        kind: action.kind,
-        phase: action.phase,
-        path: action.path,
-        source_id: action.source_id,
-        bytes_copied: action.bytes_copied,
-        bytes_total: action.bytes_total,
-        files_completed: action.files_completed,
-        files_total: action.files_total
-      }))
-  }
-  navigationStatus(scopeId = null) {
-    if (!this.enabled || !this.initialized || !this.registry) {
-      return {
-        any_scan: false,
-        scanned: false,
-        scanning: false,
-        pending_bytes: 0
-      }
-    }
-    const scan = this.scanStatus()
-    const active = !!(scan && (scan.pending || scan.active || scan.queued > 0))
-    const sources = new Map(this._sources.map((source) => [source.id, source]))
-    let pendingBytes = 0
-    for (const entry of this.registry.duplicates.values()) {
-      if (scopeId && entry.source_id !== scopeId) continue
-      const source = sources.get(entry.source_id)
-      if (!source || source.available === false || !source.shareable ||
-          entry.unverified || entry.unavailable_reason ||
-          !this.registry.blobs.has(entry.hash)) continue
-      pendingBytes += Math.max(0, Number(entry.size) || 0)
-    }
-    const lastComplete = this.registry.scanFor(scopeId)
-    const lastAttempt = this.registry.scanAttemptFor(scopeId)
-    const hasUnavailableSource = !scopeId && this._sources.some((source) =>
-      source.kind === "external" && source.available === false)
-    const hasUnverified = hasUnavailableSource || [...this.registry.links.values()].some((entry) =>
-      (!scopeId || entry.source_id === scopeId) && entry.unverified) ||
-      [...this.registry.duplicates.values()].some((entry) =>
-        (!scopeId || entry.source_id === scopeId) && entry.unverified) ||
-      [...this.registry.excluded.values()].some((entry) =>
-        (!scopeId || entry.source_id === scopeId) && entry.unverified)
-    const incomplete = hasUnverified || !!(
-      lastAttempt && lastAttempt.complete === false &&
-      (!lastComplete || (lastAttempt.ts || 0) >= (lastComplete.ts || 0))
-    )
-    return {
-      any_scan: !!this.registry.lastScanAttempt || this.registry.sourceScanAttempts.size > 0,
-      scanned: !!lastAttempt,
-      scanning: active && (!scopeId || scan.scope_id === scopeId),
-      pending_bytes: pendingBytes,
-      incomplete
-    }
-  }
-  navigationStatusForApp(appName) {
-    return this.navigationStatus(sourceId("app", appName))
-  }
-  async preflightCopyCapacity(targets) {
-    if (!targets.length) return { ok: true }
-    if (!fs.promises.statfs) return { ok: false, status: "capacity-unavailable" }
-    const byDevice = new Map()
-    try {
-      for (const target of targets) {
-        const st = await fs.promises.lstat(target.path)
-        const key = String(st.dev)
-        if (!byDevice.has(key)) {
-          byDevice.set(key, { path: path.dirname(target.path), bytes: 0 })
-        }
-        byDevice.get(key).bytes += Math.max(0, Number(target.bytes) || 0)
-      }
-      for (const group of byDevice.values()) {
-        const stat = await fs.promises.statfs(group.path)
-        const blockSize = BigInt(stat.bsize)
-        const availableBlocks = BigInt(stat.bavail)
-        const available = blockSize * availableBlocks
-        if (available < BigInt(Math.ceil(group.bytes))) {
-          return { ok: false, status: "insufficient-space" }
-        }
-      }
-      return { ok: true }
-    } catch (error) {
-      return { ok: false, status: "capacity-unavailable" }
+      last_scan: this.registry ? this.registry.scanFor(scopeId) : null
     }
   }
   async copyOut(filePath, sourcePath, expectedTarget, expectedSource = expectedTarget, options = {}) {
     const tmp = filePath + TMP_SUFFIX
     let copiedStat = null
     try {
-      if (options.onProgress) {
-        let sourceHandle = null
-        let targetHandle = null
-        try {
-          sourceHandle = await fs.promises.open(sourcePath, "r")
-          const sourceStat = await sourceHandle.stat()
-          targetHandle = await fs.promises.open(tmp,
-            fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL,
-            sourceStat.mode & 0o7777)
-          copiedStat = await targetHandle.stat()
-          const buffer = Buffer.allocUnsafe(COPY_PROGRESS_CHUNK_SIZE)
-          let offset = 0
-          options.onProgress(0, sourceStat.size)
-          while (offset < sourceStat.size) {
-            const length = Math.min(buffer.length, sourceStat.size - offset)
-            const { bytesRead } = await sourceHandle.read(buffer, 0, length, offset)
-            if (!bytesRead) {
-              const error = new Error("Source file ended while copying.")
-              error.code = "EIO"
-              throw error
-            }
-            let written = 0
-            while (written < bytesRead) {
-              const result = await targetHandle.write(
-                buffer, written, bytesRead - written, offset + written)
-              if (!result.bytesWritten) {
-                const error = new Error("Could not write the independent copy.")
-                error.code = "EIO"
-                throw error
-              }
-              written += result.bytesWritten
-            }
-            offset += bytesRead
-            options.onProgress(offset, sourceStat.size)
-          }
-          await targetHandle.chmod(sourceStat.mode & 0o7777)
-        } finally {
-          await Promise.all([
-            sourceHandle && sourceHandle.close(),
-            targetHandle && targetHandle.close()
-          ].filter(Boolean))
-        }
-      } else {
-        await fs.promises.copyFile(sourcePath, tmp, fs.constants.COPYFILE_EXCL)
-      }
+      await fs.promises.copyFile(sourcePath, tmp, fs.constants.COPYFILE_EXCL)
       copiedStat = await fs.promises.lstat(tmp)
       if (options.canReplace && !options.canReplace()) {
         await unlinkIfSame(tmp, copiedStat)
@@ -2110,12 +1845,9 @@ class Vault {
       try {
         finalStat = await lstatIfPresent(filePath)
       } catch (error) {
-        // rename() committed the independent copy, but its pre-rename ctime is
-        // not final metadata. Keep only stable identity fields and require a
-        // later scan to verify the name.
-        const committedStat = copiedStat
-        copiedStat = null
-        return { status: "copied", stat: committedStat, unverified: true }
+        // The independent copy was committed by rename(). Preserve that
+        // completed action when only the post-commit metadata read failed.
+        finalStat = copiedStat
       }
       if (!finalStat || finalStat.dev !== copiedStat.dev || finalStat.ino !== copiedStat.ino) {
         return { status: "stale" }
@@ -2129,100 +1861,54 @@ class Vault {
       throw error
     }
   }
-  // detach: undo sharing for one linked name and restore it as a pending
-  // duplicate.
-  async detach(filePath, queuedAction = null) {
+  // detach: make one name an independent copy again ("go back"), and pin it
+  // so future scans neither re-list nor re-share it. Works on linked names
+  // (copies bytes out) and on pending duplicates (just ignores them).
+  async detach(filePath) {
     if (!this.enabled) return { status: "disabled" }
     await this.refreshSources()
     const entry = this.registry.links.get(filePath)
     if (entry) {
-      if (entry.unverified) return { status: "unavailable" }
       const source = this.sourceForPath(filePath, entry.source_id)
       if (!source || !await this.canonicalPathIsWithinSource(filePath, source)) {
         return { status: "stale" }
       }
-      if (this.sourceAppIsRunning(source)) return { status: "locked" }
-      const before = await lstatIfPresent(filePath)
-      if (!before || !before.isFile() || before.dev !== entry.dev || before.ino !== entry.ino) return { status: "stale" }
-      const capacity = await this.preflightCopyCapacity([{ path: filePath, bytes: before.size }])
-      if (!capacity.ok) return { status: capacity.status }
-      const action = queuedAction || {
-        kind: "detach", path: filePath, source_id: entry.source_id || null,
-        bytes_copied: 0, bytes_total: before.size
-      }
-      action.bytes_total = before.size
-      const ownsAction = !queuedAction
-      if (ownsAction) this.fileAction = action
-      try {
-        const copied = await this.copyOut(filePath, filePath, fileSnapshot(before), fileSnapshot(before), {
-          canReplace: () => !this.sourceAppIsRunning(source),
-          onProgress: (bytesCopied, bytesTotal) => {
-            action.bytes_copied = bytesCopied
-            action.bytes_total = bytesTotal
-          }
-        })
-        if (copied.status !== "copied") return copied
-        const st = copied.stat
-        const baseEntry = {
-          hash: entry.hash, size: st.size, source_id: entry.source_id || null,
-          dev: st.dev, ino: st.ino
-        }
-        const scanEntry = copied.unverified ? null : Object.assign({}, baseEntry, {
-          mtime: st.mtimeMs, ctime: st.ctimeMs
+      if (entry.mode === "copy") {
+        const st = await lstatIfPresent(filePath)
+        if (!st || !st.isFile() || st.dev !== entry.dev || st.ino !== entry.ino) return { status: "stale" }
+        this.registry.exclude(filePath, {
+          ts: Date.now(), source_id: entry.source_id || null, size: st.size
         })
-        this.registry.setDuplicate(filePath, Object.assign({
-          app: entry.app || null, discovered: Date.now(),
-          unverified: !!copied.unverified
-        }, scanEntry || baseEntry), scanEntry)
-        if (copied.unverified) this.registry.scanIndex.delete(filePath)
-        await this.refreshLinkSnapshots(entry.hash, entry.dev, entry.ino)
         await this.recordEvent({
-          kind: "detach", hash: entry.hash, path: filePath,
-          app: entry.app || null, source_id: entry.source_id || null,
-          size: st.size, bytes_saved: st.size
+          kind: "skip", hash: entry.hash, path: filePath,
+          app: entry.app || null, source_id: entry.source_id || null, size: st.size
         })
-        return { status: "detached" }
-      } finally {
-        if (ownsAction && this.fileAction === action) this.fileAction = null
+        return { status: "ignored" }
       }
-    }
-    return { status: "not-found" }
-  }
-  async skip(filePath) {
-    if (!this.enabled) return { status: "disabled" }
-    const duplicate = this.registry.duplicates.get(filePath)
-    if (!duplicate) return { status: "not-found" }
-    if (duplicate.unverified) return { status: "unavailable" }
-    this.registry.exclude(filePath, {
-      ts: Date.now(),
-      source_id: duplicate.source_id || null,
-      size: duplicate.size || 0
-    })
-    await this.recordEvent({
-      kind: "skip",
-      hash: duplicate.hash,
-      path: filePath,
-      app: duplicate.app || null,
-      source_id: duplicate.source_id || null,
-      size: duplicate.size || 0
-    })
-    return { status: "ignored" }
-  }
-  // reshare: un-pin a skipped path; the next scan may list it again.
-  async reshare(filePath) {
-    if (!this.enabled) return { status: "disabled" }
-    const current = this.registry.excluded.get(filePath)
-    if (current && current.unverified) return { status: "unavailable" }
-    const excluded = this.registry.allowSharing(filePath)
-    if (excluded) {
-      await this.recordEvent({ kind: "reshare", path: filePath, source_id: excluded && excluded.source_id ? excluded.source_id : null })
-      return { status: "resharable" }
+      if (this.sourceAppIsRunning(source)) return { status: "locked" }
+      const before = await lstatIfPresent(filePath)
+      if (!before || !before.isFile() || before.dev !== entry.dev || before.ino !== entry.ino) return { status: "stale" }
+      const copied = await this.copyOut(filePath, filePath, fileSnapshot(before), fileSnapshot(before), {
+        canReplace: () => !this.sourceAppIsRunning(source)
+      })
+      if (copied.status !== "copied") return copied
+      const st = copied.stat
+      this.registry.exclude(filePath, { ts: Date.now(), source_id: entry.source_id || null, size: st.size })
+      await this.refreshLinkSnapshots(entry.hash, entry.dev, entry.ino)
+      await this.recordEvent({ kind: "detach", hash: entry.hash, path: filePath, app: entry.app || null, source_id: entry.source_id || null, size: st.size })
+      return { status: "detached" }
+    }
+    if (this.registry.duplicates.has(filePath)) {
+      const dup = this.registry.duplicates.get(filePath)
+      this.registry.exclude(filePath, { ts: Date.now(), source_id: dup.source_id || null, size: dup.size || 0 })
+      await this.recordEvent({ kind: "skip", hash: dup.hash, path: filePath, app: dup.app || null, source_id: dup.source_id || null, size: dup.size || 0 })
+      return { status: "ignored" }
     }
     return { status: "not-found" }
   }
   // Undo a conversion batch: replace each converted name with an independent
   // copy of the bytes (spec, UX contract surface 3).
-  async undoBatch(batchId, queuedAction = null) {
+  async undoBatch(batchId) {
     if (!this.enabled || !batchId) return { undone: 0 }
     await this.refreshSources()
     const events = await this.registry.readEvents()
@@ -2234,16 +1920,11 @@ class Vault {
       if (entry.batch_id === batchId) targets.add(filePath)
     }
     const summary = { undone: 0, bytes: 0, failed: 0 }
-    const prepared = []
     for (const filePath of targets) {
       const event = conversionEvents.get(filePath) || {}
       const entry = this.registry.links.get(filePath)
       if (!entry || (entry.batch_id && entry.batch_id !== batchId) ||
           (event.hash && entry.hash !== event.hash)) continue
-      if (entry.unverified) {
-        summary.failed += 1
-        continue
-      }
       const storePath = this.storePathFor(entry.hash)
       try {
         const source = this.sourceForPath(filePath, entry.source_id || event.source_id)
@@ -2266,34 +1947,8 @@ class Vault {
           summary.failed += 1
           continue
         }
-        prepared.push({ filePath, event, entry, source, storePath, st, storeStat })
-      } catch (e) {
-        summary.failed += 1
-      }
-    }
-    const capacity = await this.preflightCopyCapacity(prepared.map((target) => ({
-      path: target.filePath,
-      bytes: target.storeStat.size
-    })))
-    if (!capacity.ok) {
-      return Object.assign(summary, { status: capacity.status })
-    }
-    const action = queuedAction || {
-      kind: "undo", path: null, source_id: null,
-      bytes_copied: 0, bytes_total: 0
-    }
-    action.bytes_total = prepared.reduce((sum, target) => sum + target.storeStat.size, 0)
-    let completedBytes = 0
-    for (const target of prepared) {
-      const { filePath, event, entry, source, storePath, st, storeStat } = target
-      try {
-        action.path = filePath
-        action.source_id = entry.source_id || event.source_id || null
         const copied = await this.copyOut(filePath, storePath, fileSnapshot(st), fileSnapshot(storeStat), {
-          canReplace: () => !this.sourceAppIsRunning(source),
-          onProgress: (bytesCopied) => {
-            action.bytes_copied = completedBytes + bytesCopied
-          }
+          canReplace: () => !this.sourceAppIsRunning(source)
         })
         if (copied.status !== "copied") {
           summary.failed += 1
@@ -2304,18 +1959,19 @@ class Vault {
           hash: entry.hash, size: storeStat.size, app: entry.app || null,
           source_id: entry.source_id || event.source_id || null, discovered: Date.now(),
           dev: independentStat.dev, ino: independentStat.ino,
-          unverified: !!copied.unverified
+          mtime: independentStat.mtimeMs, ctime: independentStat.ctimeMs
         }
-        const scanEntry = copied.unverified ? null : {
+        const scanEntry = {
           hash: entry.hash, size: independentStat.size,
           dev: independentStat.dev, ino: independentStat.ino,
           mtime: independentStat.mtimeMs, ctime: independentStat.ctimeMs,
           source_id: entry.source_id || event.source_id || null
         }
         this.registry.setDuplicate(filePath, duplicateEntry, scanEntry)
-        if (copied.unverified) this.registry.scanIndex.delete(filePath)
         await this.refreshLinkSnapshots(entry.hash, entry.dev, entry.ino)
         const bytesSaved = event.bytes_saved || storeStat.size
+        this.registry.totals.lifetime_bytes_saved = Math.max(0,
+          this.registry.totals.lifetime_bytes_saved - bytesSaved)
         await this.recordEvent({
           kind: "undo", hash: entry.hash, path: filePath,
           source_id: entry.source_id || event.source_id || null, batch_id: batchId,
@@ -2323,8 +1979,6 @@ class Vault {
         })
         summary.undone += 1
         summary.bytes += storeStat.size
-        completedBytes += storeStat.size
-        action.bytes_copied = completedBytes
       } catch (e) {
         summary.failed += 1
       }
@@ -2336,10 +1990,14 @@ class Vault {
     if (!this.enabled) return { reclaimed: 0, bytes_freed: 0 }
     const summary = { reclaimed: 0, bytes_freed: 0, failed: 0 }
     const removedHashes = new Set()
+    const copyHashes = new Set([...this.registry.links.values()]
+      .filter((entry) => entry.mode === "copy")
+      .map((entry) => entry.hash))
     try {
       for (const [hash] of [...this.registry.blobs]) {
         const result = await this.reclaim(hash, {
-          deferRegistry: true
+          deferRegistry: true,
+          hasCopyNames: copyHashes.has(hash)
         })
         if (result.remove_hash) removedHashes.add(hash)
         if (result.status === "reclaimed") {