docs: record the owner's answers, the history rewrite and Task 18 in the Proton Drive handoff

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/DECISIONS.md

@@ -5,6 +5,20 @@ it with a new one that links back. One entry per decision a future maintainer
 would otherwise have to reverse-engineer.
 No index: `grep -n '^## ' docs/DECISIONS.md` lists every entry.
 
+## 2026-11-12 - Test-account usernames removed from git history by force-push
+
+**Status:** accepted
+**Context:** The first Proton Drive handoff commit contained the two
+test-account usernames (no passwords or tokens); a later commit removed
+them from the file but they stayed in history on the Gitea remote.
+**Decision:** On the owner's explicit instruction, that commit was
+rebuilt without the usernames, the following commits were replayed with
+identical trees and metadata, and `master` was force-pushed once with
+`--force-with-lease`. The rule against force-pushing still stands.
+**Consequences:** Commit hashes from `901d7fd5b` onward changed (mapping
+in the handoff's "Open questions" section). The old objects may stay
+reachable on the server until Gitea garbage-collects the repository.
+
 ## 2026-11-12 - test_all shares one protonfake session across test processes
 
 **Status:** accepted

docs/TODO.md

@@ -132,6 +132,10 @@ Small, specific, independently actionable. Remove only when actually done.
   `TestBudgetUpload` and `TestBudgetMkdir` (a folder re-listed per new
   file). A cache shared by the `Fs` of one account would fix them, but
   is package state, which the spec rules out: owner decision.
+  Related and wider: with no cache expiry and no events (M5), a long
+  `rclone mount` never sees changes made by other clients (web app,
+  another rclone) to folders it has already listed. A listing TTL would
+  bound that but would not fix the five tests above.
 - [ ] protondrive: `cmd/gitannex` is in `ignoretests` for
   `TestProtonDriveFake:` because its remote name check
   (`cmd/gitannex/configparse.go`, `config.GetRemoteNames`) sees remotes

docs/plans/001-protondrive-tier1-HANDOFF.md

@@ -52,8 +52,8 @@ pause. Last code commit: `9c90998f7`. Plan base (for a whole-branch diff):
 
 | Tasks | State |
 |---|---|
-| 1-17 | Implemented, each independently reviewed, all findings of Critical or Important severity fixed and re-reviewed |
-| 18-21 | Not started |
+| 1-18 | Implemented, each independently reviewed, all findings of Critical or Important severity fixed and re-reviewed |
+| 19-21 | Not started (resumed 2026-11-12; see the ledger for current state) |
 | Final whole-branch review | Not run |
 
 What exists now:
@@ -238,22 +238,30 @@ single-request upload), M7 (upstream path, deferred by the owner).
 
 ## Open questions for the owner
 
-Ask these before the work they block; none has been answered.
+Answered by the owner on 2026-11-12:
+
+1. **Usernames in git history:** remove them. Done: commit `901d7fd5b`
+   was rewritten without the usernames (as `31f6aafd9`), the later
+   commits replayed unchanged, and `master` on Gitea force-pushed once
+   (`85f6b2f0e` -> `4282540e0`). A one-off; the no-force-push rule stands.
+   Old hashes in this file and the ledger written before that date
+   (`901d7fd5b`, `85f6b2f0e`, `d211b45e6`, `28f1aaf8a`) now map to
+   `31f6aafd9`, `4282540e0`, `65840bdc5`, `5afbe9e4f`.
+2. **Gitea Actions:** a runner exists but is slow and limited; keep
+   `.gitea/workflows/ci.yml` light (no `test_all` in CI).
+3. **Official client interop (Task 21):** allowed - install a released
+   Proton client and use the web app, preferably inside a Docker
+   container, signed in only to the test accounts.
+
+Still open:
 
-1. **Usernames in git history.** The first handoff commit, `901d7fd5b`,
-   contained the two test-account usernames (no passwords or tokens). The
-   next commit, `85f6b2f0e`, removed them from the file, but they remain in
-   that commit's history on the Gitea remote. Removing them means
-   rewriting `master` from `901d7fd5b` onward and force-pushing, which the
-   repository's rules forbid and which was not done. The owner was asked
-   on 2026-11-11 whether they want that; no answer yet. Do not force-push
-   without an explicit yes.
-2. **Gitea Actions.** Does the owner's Gitea have an Actions runner? Task
-   18 adds `.gitea/workflows/ci.yml`, which cannot be verified locally.
-3. **Official CLI interop (Task 21).** Install a released Proton client
-   for it, or limit interop to the web app as done so far?
 4. **Rulings.** Section 7 lists 28 decisions made on the owner's behalf;
    they were reported in summary and not confirmed one by one.
+5. **Cross-`Fs` cache staleness (Task 18).** Five `test_all` tests are
+   ignored because each `Fs` has its own node cache; a mount never sees
+   other clients' changes. Fix options (shared per-account cache = package
+   state the spec forbids; listing TTL; events in M5) are in
+   `docs/TODO.md`. Current ruling: leave for M5.
 
 ## 5. Test accounts and machine setup