Merge pull request #479 from EdouardVanbelle/feat/drive-impl

feat/drive impl

src/application/dtos/drive_dto.rs

@@ -0,0 +1,82 @@
+//! DTOs for the `/api/drives` endpoint surface.
+//!
+//! D0 surfaces only the read-only list. Mutating endpoints
+//! (`POST /api/drives` for shared-drive creation, `PATCH` for rename /
+//! policy edits, membership APIs) land in D2/D3.
+
+use serde::{Deserialize, Serialize};
+use utoipa::ToSchema;
+use uuid::Uuid;
+
+use crate::domain::entities::drive::DriveKind;
+use crate::domain::repositories::drive_repository::DriveWithRootName;
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, ToSchema, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+pub enum DriveKindDto {
+    Personal,
+    Shared,
+}
+
+impl From<DriveKind> for DriveKindDto {
+    fn from(k: DriveKind) -> Self {
+        match k {
+            DriveKind::Personal => DriveKindDto::Personal,
+            DriveKind::Shared => DriveKindDto::Shared,
+        }
+    }
+}
+
+/// One row in `GET /api/drives` — a drive the caller can read.
+///
+/// `default_for_user` is `Some(<caller_id>)` for the caller's default
+/// Personal drive and `None` otherwise. The picker UI uses this to put
+/// the default at the top of the list and mark it as "your home".
+#[derive(Debug, Clone, Serialize, ToSchema)]
+pub struct DriveDto {
+    pub id: Uuid,
+    /// Display name. Sourced from `storage.folders.name` of the row
+    /// pointed at by `root_folder_id` (drives have no `name` column —
+    /// see docs/plan/drive.md §3). The wire shape is unchanged from
+    /// the client's perspective.
+    pub name: String,
+    pub kind: DriveKindDto,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub default_for_user: Option<Uuid>,
+    /// The drive's mount-point folder. Folder API calls
+    /// (`POST /api/folders { parent_id: <root_folder_id> }`,
+    /// `PATCH /api/folders/<root_folder_id>` to rename) use this id —
+    /// no polymorphic "create at drive root" surface needed.
+    pub root_folder_id: Uuid,
+    /// Storage cap in bytes. `None` means "no quota" (admin override /
+    /// future system drives). Mutation is OxiCloud-admin only — drive
+    /// owners cannot self-grant capacity.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub quota_bytes: Option<i64>,
+    /// Running total of bytes consumed. Maintained incrementally in D4;
+    /// on D0 this reflects the backfilled baseline.
+    pub used_bytes: i64,
+    /// Capability-flag bag — clients render UI affordances based on
+    /// known keys (`forbid_public_links`, `include_in_photo_index`,
+    /// `forbid_music_index`, …). Unknown keys preserved verbatim.
+    pub policies: serde_json::Value,
+    pub created_at: chrono::DateTime<chrono::Utc>,
+    pub updated_at: chrono::DateTime<chrono::Utc>,
+}
+
+impl From<DriveWithRootName> for DriveDto {
+    fn from(d: DriveWithRootName) -> Self {
+        Self {
+            id: d.drive.id,
+            name: d.root_folder_name,
+            kind: d.drive.kind.into(),
+            default_for_user: d.drive.default_for_user,
+            root_folder_id: d.drive.root_folder_id,
+            quota_bytes: d.drive.quota_bytes,
+            used_bytes: d.drive.used_bytes,
+            policies: d.drive.policies,
+            created_at: d.drive.created_at,
+            updated_at: d.drive.updated_at,
+        }
+    }
+}

src/application/dtos/file_dto.rs

@@ -3,6 +3,7 @@ use std::sync::Arc;
 use crate::domain::entities::file::File;
 use serde::{Deserialize, Serialize};
 use utoipa::ToSchema;
+use uuid::Uuid;
 
 use super::display_helpers::{
     category_for, format_file_size, icon_class_for, icon_special_class_for,
@@ -75,6 +76,19 @@ pub struct FileDto {
     /// through `If-Match` / `If-None-Match` on download / mutation
     /// endpoints without a separate HEAD round-trip.
     pub etag: String,
+
+    /// §14 provenance: user that originally created this file.
+    /// `None` when the referenced user has been deleted (FK is
+    /// `ON DELETE SET NULL`) or for stub/legacy files.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub created_by: Option<Uuid>,
+
+    /// §14 provenance: user that performed the most recent mutation
+    /// that bumped `updated_at`. Authorship signal — distinct from
+    /// `owner_id`. `None` when the referenced user is deleted or for
+    /// stub/legacy files.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub updated_by: Option<Uuid>,
 }
 
 impl From<File> for FileDto {
@@ -114,6 +128,8 @@ impl From<File> for FileDto {
             sort_date: None,
             content_hash,
             etag,
+            created_by: parts.created_by,
+            updated_by: parts.updated_by,
         }
     }
 }
@@ -171,6 +187,8 @@ impl FileDto {
             content_hash: String::new(),
             etag: String::new(),
             sort_date: None,
+            created_by: None,
+            updated_by: None,
         }
     }
 }

src/application/dtos/folder_dto.rs

@@ -52,6 +52,12 @@ pub struct FolderDto {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub owner_id: Option<String>,
 
+    /// Drive that owns this folder. The scope axis for path-based
+    /// lookups across REST / WebDAV / NextCloud / CalDAV / CardDAV.
+    /// Post-D0 `storage.folders.drive_id` is `NOT NULL`; stub /
+    /// DTO-reconstructed folders carry `Uuid::nil()`.
+    pub drive_id: Uuid,
+
     /// Creation timestamp
     pub created_at: u64,
 
@@ -80,6 +86,19 @@ pub struct FolderDto {
     /// pass it back through `If-Match` on rename / move endpoints
     /// without a separate HEAD round-trip.
     pub etag: String,
+
+    /// §14 provenance: user that originally created this folder.
+    /// `None` when the referenced user has been deleted (FK is
+    /// `ON DELETE SET NULL`) or for stub/legacy folders.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub created_by: Option<Uuid>,
+
+    /// §14 provenance: user that performed the most recent mutation
+    /// that bumped `updated_at`. Authorship signal — distinct from
+    /// `owner_id`. `None` when the referenced user is deleted or for
+    /// stub/legacy folders.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub updated_by: Option<Uuid>,
 }
 
 impl From<Folder> for FolderDto {
@@ -93,6 +112,7 @@ impl From<Folder> for FolderDto {
             path: folder.path_string().to_string(),
             parent_id: folder.parent_id().map(String::from),
             owner_id: folder.owner_id().map(|u| u.to_string()),
+            drive_id: folder.drive_id(),
             created_at: folder.created_at(),
             modified_at: folder.modified_at(),
             is_root,
@@ -100,6 +120,8 @@ impl From<Folder> for FolderDto {
             icon_special_class: Arc::from("folder-icon"),
             category: Arc::from("Folder"),
             etag,
+            created_by: folder.created_by(),
+            updated_by: folder.updated_by(),
         }
     }
 }
@@ -144,6 +166,7 @@ impl FolderDto {
             path: "/stub/path".to_string(),
             parent_id: None,
             owner_id: None,
+            drive_id: Uuid::nil(),
             created_at: 0,
             modified_at: 0,
             is_root: true,
@@ -151,6 +174,8 @@ impl FolderDto {
             icon_special_class: Arc::from("folder-icon"),
             category: Arc::from("Folder"),
             etag: String::new(),
+            created_by: None,
+            updated_by: None,
         }
     }
 }

src/application/dtos/grant_dto.rs

@@ -58,6 +58,7 @@ impl From<Subject> for SubjectDto {
 pub enum ResourceTypeDto {
     Folder,
     File,
+    Drive,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
@@ -72,6 +73,7 @@ impl From<ResourceDto> for Resource {
         match dto.kind {
             ResourceTypeDto::Folder => Resource::Folder(dto.id),
             ResourceTypeDto::File => Resource::File(dto.id),
+            ResourceTypeDto::Drive => Resource::Drive(dto.id),
         }
     }
 }
@@ -81,6 +83,7 @@ impl From<Resource> for ResourceDto {
         let (kind, id) = match r {
             Resource::Folder(id) => (ResourceTypeDto::Folder, id),
             Resource::File(id) => (ResourceTypeDto::File, id),
+            Resource::Drive(id) => (ResourceTypeDto::Drive, id),
         };
         ResourceDto { kind, id }
     }

src/application/dtos/mod.rs

@@ -6,6 +6,7 @@ pub mod calendar_dto;
 pub mod contact_dto;
 pub mod device_auth_dto;
 pub mod display_helpers;
+pub mod drive_dto;
 pub mod favorites_dto;
 pub mod file_dto;
 pub mod folder_dto;

src/application/ports/authorization_ports.rs

@@ -61,6 +61,7 @@ pub trait AuthorizationEngine: Send + Sync + 'static {
             let (kind, id) = match resource {
                 Resource::Folder(id) => ("Folder", id),
                 Resource::File(id) => ("File", id),
+                Resource::Drive(id) => ("Drive", id),
             };
             // Audit-worthy: denials are the interesting signal. Routed
             // through the `audit` tracing target so log aggregators can

src/application/ports/content_index_ports.rs

@@ -35,14 +35,26 @@ pub struct ContentHitDto {
 /// holds an `Option<Arc<dyn ContentIndexPort>>` (the feature is toggleable).
 #[async_trait]
 pub trait ContentIndexPort: Send + Sync + 'static {
-    /// Search indexed file names + content for `query`, scoped to `user_id`.
+    /// Search indexed file names + content for `query`, scoped to the drives
+    /// the caller can read.
     ///
-    /// Returns up to `limit` hits sorted by BM25 score descending. Matching is
-    /// tokenized (not substring): exact terms, typo-tolerant fuzzy terms
-    /// (edit distance 1) and prefix expansion on the last query token.
+    /// The filter is applied as an `Occur::Must` set-membership clause on
+    /// the `drive_id` field — Tantivy's collector only ever sees documents
+    /// in one of the accessible drives, so counts, snippets, and
+    /// pagination cursors all reflect the filtered set (no anti-
+    /// enumeration leak — see `docs/plan/drive.md` §11). Pass the
+    /// caller's full accessible-drive set; the engine already expands
+    /// group-mediated drive grants before this is called.
+    ///
+    /// An empty `accessible_drive_ids` returns no hits — same semantics
+    /// as "no drives, no search" (e.g. external users with grants only).
+    /// Returns up to `limit` hits sorted by BM25 score descending.
+    /// Matching is tokenized (not substring): exact terms, typo-tolerant
+    /// fuzzy terms (edit distance 1) and prefix expansion on the last
+    /// query token.
     async fn search_content(
         &self,
-        user_id: Uuid,
+        accessible_drive_ids: &[Uuid],
         query: &str,
         limit: usize,
     ) -> Result<Vec<ContentHitDto>, DomainError>;

src/application/ports/file_ports.rs

@@ -44,24 +44,45 @@ pub trait FileUploadUseCase: Send + Sync + 'static {
     /// Register a new file row pointing at an already-ingested blob.
     ///
     /// Takes ownership of the blob's reference (released on failure).
+    ///
+    /// `caller_id` is plumbed down into
+    /// `FileWritePort::save_file_with_blob` so the §14 `created_by` /
+    /// `updated_by` columns record the principal performing the upload —
+    /// not the parent folder's owner. D2 shared drives surface this
+    /// most clearly: Adam upload into Alice's folder must record
+    /// `created_by = adam.id`.
     async fn upload_file_streaming(
         &self,
         name: String,
         folder_id: Option<String>,
         content_type: String,
         blob: StoredBlob,
+        caller_id: Uuid,
     ) -> Result<FileDto, DomainError>;
 
     /// Replace the content of the file at `path` with an already-ingested
     /// blob, or create the file when it doesn't exist (WebDAV/WOPI PUT).
     ///
     /// Takes ownership of the blob's reference (released on failure).
+    ///
+    /// `drive_id` scopes both the existence probe (`find_file_by_path`)
+    /// and the parent-folder resolution (`get_parent_folder_id`) — the
+    /// handler is responsible for deriving it from its protocol context
+    /// (NC chroot, native default-drive lookup, WOPI default-drive).
+    ///
+    /// `caller_id` is plumbed down into
+    /// `FileWritePort::update_file_content_with_blob` so the §14
+    /// `updated_by` column reflects the principal that performed the
+    /// PUT — not the file's existing owner (D2 shared drives let
+    /// non-owners overwrite content).
     async fn update_file_streaming(
         &self,
         path: &str,
+        drive_id: Uuid,
         blob: StoredBlob,
         content_type: &str,
         modified_at: Option<i64>,
+        caller_id: Uuid,
     ) -> Result<FileDto, DomainError>;
 }
 
@@ -104,8 +125,13 @@ pub trait FileRetrievalUseCase: Send + Sync + 'static {
         caller_id: Uuid,
     ) -> Result<FileDto, DomainError>;
 
-    /// Gets a file by its path (for WebDAV)
-    async fn get_file_by_path(&self, path: &str) -> Result<FileDto, DomainError>;
+    /// Gets a file by its path (for WebDAV), scoped to a drive.
+    ///
+    /// Post-D0, `storage.files.path` is unique only within a single
+    /// drive. The `drive_id` filter scopes the lookup to a specific
+    /// drive (caller derives it from its protocol context: NC chroot,
+    /// native default-drive lookup, WOPI default-drive lookup).
+    async fn get_file_by_path(&self, path: &str, drive_id: Uuid) -> Result<FileDto, DomainError>;
 
     /// Lists files in a folder
     async fn list_files(&self, folder_id: Option<&str>) -> Result<Vec<FileDto>, DomainError>;

src/application/ports/folder_ports.rs

@@ -36,8 +36,20 @@ pub trait FolderUseCase: Send + Sync + 'static {
         caller_id: Uuid,
     ) -> Result<FolderDto, DomainError>;
 
-    /// Gets a folder by its path
-    async fn get_folder_by_path(&self, path: &str) -> Result<FolderDto, DomainError>;
+    /// Gets a folder by its path within the caller's tree.
+    ///
+    /// Scoped by `drive_id` because `storage.folders.path` is unique
+    /// only within a single drive after D0 — multiple drives (whether
+    /// owned by the same user or different users) share names like
+    /// `"Personal"` for their root folder (docs/plan/drive.md §10).
+    /// Pre-D0 the wrapper name embedded the username; post-D0 the
+    /// caller derives a `drive_id` from its protocol context (NC
+    /// chroot, native default-drive lookup, WOPI default-drive).
+    async fn get_folder_by_path(
+        &self,
+        path: &str,
+        drive_id: Uuid,
+    ) -> Result<FolderDto, DomainError>;
 
     /// Lists folders within a parent folder
     async fn list_folders(&self, parent_id: Option<&str>) -> Result<Vec<FolderDto>, DomainError>;
@@ -84,13 +96,6 @@ pub trait FolderUseCase: Send + Sync + 'static {
     /// Deletes a folder (ownership verified against caller_id)
     async fn delete_folder_with_perms(&self, id: &str, caller_id: Uuid) -> Result<(), DomainError>;
 
-    /// Creates a root-level home folder for a user during registration.
-    async fn create_home_folder(
-        &self,
-        user_id: Uuid,
-        name: String,
-    ) -> Result<FolderDto, DomainError>;
-
     /// Lists every folder in a subtree rooted at `folder_id` (inclusive),
     /// ordered by path.  Uses ltree `<@` — single GiST-indexed query.
     ///

src/application/ports/storage_ports.rs

@@ -82,11 +82,25 @@ pub trait FileReadPort: Send + Sync + 'static {
     /// Gets the logical storage path of a file.
     async fn get_file_path(&self, id: &str) -> Result<StoragePath, DomainError>;
 
-    /// Gets the parent folder ID from a path (WebDAV).
-    async fn get_parent_folder_id(&self, path: &str) -> Result<String, DomainError>;
+    /// Gets the parent folder ID from a path (WebDAV), scoped to a drive.
+    ///
+    /// Post-D0, `storage.folders.path` is unique only within a single
+    /// drive. The `drive_id` filter scopes the lookup to a specific
+    /// drive (caller derives it from its protocol context: NC chroot,
+    /// native default-drive lookup, WOPI default-drive lookup).
+    async fn get_parent_folder_id(&self, path: &str, drive_id: Uuid)
+    -> Result<String, DomainError>;
 
-    /// Gets a folder ID by its path.
-    async fn get_folder_id_by_path(&self, folder_path: &str) -> Result<String, DomainError>;
+    /// Gets a folder ID by its path, scoped to a drive.
+    ///
+    /// Post-D0 same scoping rule as `get_parent_folder_id` — names like
+    /// `"Personal"` repeat across drives, so the `drive_id` filter is
+    /// required to disambiguate.
+    async fn get_folder_id_by_path(
+        &self,
+        folder_path: &str,
+        drive_id: Uuid,
+    ) -> Result<String, DomainError>;
 
     /// Gets the content-addressable blob hash for a file (O(1) DB lookup).
     ///
@@ -94,11 +108,22 @@ pub trait FileReadPort: Send + Sync + 'static {
     /// Used for dedup reference tracking without loading file content.
     async fn get_blob_hash(&self, file_id: &str) -> Result<String, DomainError>;
 
-    /// Find a file by its logical path (folder_name/.../file_name).
+    /// Find a file by its logical path (folder_name/.../file_name),
+    /// scoped to a drive.
+    ///
+    /// Post-D0 `storage.files.path` is unique only within a single
+    /// drive. The `drive_id` filter prevents non-deterministic
+    /// resolution when the same path exists in multiple drives.
     ///
     /// The default implementation falls back to `list_files(None)` + linear
-    /// scan (O(N)). Repositories should override with a direct SQL query.
-    async fn find_file_by_path(&self, path: &str) -> Result<Option<File>, DomainError> {
+    /// scan (O(N)) and ignores the drive filter — only used by stubs.
+    /// Repositories should override with a direct SQL query that applies
+    /// the filter.
+    async fn find_file_by_path(
+        &self,
+        path: &str,
+        _drive_id: Uuid,
+    ) -> Result<Option<File>, DomainError> {
         let path = path.trim_start_matches('/').trim_end_matches('/');
         let all_files = self.list_files(None).await?;
         for file in all_files {
@@ -259,6 +284,13 @@ pub trait FileWritePort: Send + Sync + 'static {
     ///
     /// Takes ownership of one blob reference: on any failure the reference
     /// is released before the error is returned.
+    ///
+    /// `caller_id` is stamped into both `created_by` and `updated_by`
+    /// (§14 provenance — authorship belongs to the caller, not to the
+    /// parent folder's owner). In D2 shared drives, a non-owner member
+    /// can upload into a folder owned by someone else; the previous
+    /// `created_by = parent.user_id` would have silently recorded the
+    /// wrong principal.
     async fn save_file_with_blob(
         &self,
         name: String,
@@ -266,17 +298,29 @@ pub trait FileWritePort: Send + Sync + 'static {
         content_type: String,
         blob_hash: &str,
         size: u64,
+        caller_id: Uuid,
     ) -> Result<File, DomainError>;
 
-    /// Moves a file to another folder.
+    /// Moves a file to another folder. `caller_id` is stamped into
+    /// `updated_by` alongside the `updated_at = NOW()` bump
+    /// (§14 provenance — authorship belongs to the caller, not to
+    /// the destination folder's owner).
     async fn move_file(
         &self,
         file_id: &str,
         target_folder_id: Option<String>,
+        caller_id: Uuid,
     ) -> Result<File, DomainError>;
 
-    /// Renames a file (same folder, different name).
-    async fn rename_file(&self, file_id: &str, new_name: &str) -> Result<File, DomainError>;
+    /// Renames a file (same folder, different name). `caller_id` is
+    /// stamped into `updated_by` alongside the `updated_at = NOW()`
+    /// bump (§14 provenance).
+    async fn rename_file(
+        &self,
+        file_id: &str,
+        new_name: &str,
+        caller_id: Uuid,
+    ) -> Result<File, DomainError>;
 
     /// Deletes a file.
     async fn delete_file(&self, id: &str) -> Result<(), DomainError>;
@@ -290,24 +334,32 @@ pub trait FileWritePort: Send + Sync + 'static {
     /// Returns `(new_blob_hash, updated_at_epoch)` — everything a caller
     /// needs to rebuild the fresh entity/ETag from a `File` it already
     /// holds, without re-reading the row it just updated.
+    ///
+    /// `caller_id` is stamped into `updated_by` alongside the
+    /// `updated_at` bump (§14 provenance).
     async fn update_file_content_with_blob(
         &self,
         file_id: &str,
         blob_hash: &str,
         size: u64,
         modified_at: Option<i64>,
+        caller_id: Uuid,
     ) -> Result<(String, i64), DomainError>;
 
     /// Registers file metadata WITHOUT writing content to disk (write-behind).
     ///
     /// Returns `(File, PathBuf)` where `PathBuf` is the destination path for the
     /// deferred write that the `WriteBehindCache` will perform.
+    ///
+    /// `caller_id` is stamped into both `created_by` and `updated_by`
+    /// (§14 provenance — see `save_file_with_blob`).
     async fn register_file_deferred(
         &self,
         name: String,
         folder_id: Option<String>,
         content_type: String,
         size: u64,
+        caller_id: Uuid,
     ) -> Result<(File, PathBuf), DomainError>;
 
     /// Copies a file to a (possibly different) folder.
@@ -319,11 +371,16 @@ pub trait FileWritePort: Send + Sync + 'static {
     /// the same folder always collides on the source's filename. WebDAV
     /// COPY uses this for the "same folder, different name" case (the
     /// classic `COPY /a.txt → /b.txt` pattern).
+    ///
+    /// `caller_id` is stamped into both `created_by` and `updated_by`
+    /// on the new row (§14 provenance — the caller authored this copy,
+    /// not the destination folder's owner).
     async fn copy_file(
         &self,
         file_id: &str,
         target_folder_id: Option<String>,
         new_name: Option<&str>,
+        caller_id: Uuid,
     ) -> Result<File, DomainError>;
 
     /// Copies an entire folder subtree atomically using ltree.
@@ -350,14 +407,17 @@ pub trait FileWritePort: Send + Sync + 'static {
 
     // ── Trash operations ──
 
-    /// Moves a file to the trash
-    async fn move_to_trash(&self, file_id: &str) -> Result<(), DomainError>;
+    /// Moves a file to the trash. `caller_id` is stamped into
+    /// `updated_by` (§14 provenance).
+    async fn move_to_trash(&self, file_id: &str, caller_id: Uuid) -> Result<(), DomainError>;
 
-    /// Restores a file from the trash to its original location
+    /// Restores a file from the trash to its original location.
+    /// `caller_id` is stamped into `updated_by` (§14 provenance).
     async fn restore_from_trash(
         &self,
         file_id: &str,
         original_path: &str,
+        caller_id: Uuid,
     ) -> Result<(), DomainError>;
 
     /// Permanently deletes a file (used by the trash)

src/application/ports/user_lifecycle.rs

@@ -127,7 +127,7 @@ pub enum LogoutReason {
 
 /// How aggressively `on_user_deleted` cleanup should run. Today both
 /// variants are equivalent (only `AuditLifecycleHook` exists, and it logs
-/// regardless). The split exists so PR 4's `HomeFolderLifecycleHook` can
+/// regardless). The split exists so PR 4's `PersonalDriveLifecycleHook` can
 /// trash on `AdminDelete` but hard-delete on `GdprPurge`.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum DeletionMode {

src/application/services/auth_application_service.rs

@@ -124,7 +124,7 @@ pub struct AuthApplicationService {
     token_service: Arc<JwtTokenService>,
     /// Dispatcher for user-lifecycle events. `None` only in tests that don't
     /// exercise the lifecycle path; production DI always wires this.
-    /// HomeFolderLifecycleHook (registered on this dispatcher) owns the
+    /// PersonalDriveLifecycleHook (registered on this dispatcher) owns the
     /// per-user folder provisioning that AuthApplicationService used to do
     /// inline pre-PR 3.
     user_lifecycle: Option<Arc<UserLifecycleService>>,
@@ -404,7 +404,7 @@ impl AuthApplicationService {
         // Save user
         let created_user = self.user_storage.create_user(user).await?;
 
-        // Lifecycle: HomeFolderLifecycleHook handles personal-folder
+        // Lifecycle: PersonalDriveLifecycleHook handles personal-folder
         // creation (was inlined here pre-PR 3); audit log + future
         // provisioning steps land here too.
         if let Some(lc) = &self.user_lifecycle {
@@ -506,8 +506,8 @@ impl AuthApplicationService {
         let created_user = self.user_storage.create_user(user).await?;
 
         // Lifecycle: notify hooks. PR 3 moves home-folder creation into
-        // HomeFolderLifecycleHook fired here.
-        // Lifecycle: HomeFolderLifecycleHook provisions the admin's
+        // PersonalDriveLifecycleHook fired here.
+        // Lifecycle: PersonalDriveLifecycleHook provisions the admin's
         // home folder. Audit logs the creation event.
         if let Some(lc) = &self.user_lifecycle {
             lc.dispatch_created(&created_user).await;
@@ -654,7 +654,7 @@ impl AuthApplicationService {
     ///    A second redemption attempt receives `Ok(false)` and is rejected
     ///    as `AccessDenied`.
     /// 3. Load the user, verify they're active.
-    /// 4. Dispatch `on_user_login` (so HomeFolderLifecycleHook can
+    /// 4. Dispatch `on_user_login` (so PersonalDriveLifecycleHook can
     ///    safety-net any internal user whose first credential happens
     ///    to be a magic link — externals short-circuit by `is_external()`).
     /// 5. Register login + persist + issue session in the same pipeline
@@ -1722,7 +1722,7 @@ impl AuthApplicationService {
                 .await?;
         }
 
-        // Lifecycle: HomeFolderLifecycleHook handles the home-folder
+        // Lifecycle: PersonalDriveLifecycleHook handles the home-folder
         // provisioning (idempotent + short-circuits on is_external).
         // Audit logs the creation event.
         if let Some(lc) = &self.user_lifecycle {
@@ -1785,7 +1785,7 @@ impl AuthApplicationService {
     /// Runs the whole flow in a single transaction so the lifecycle
     /// hooks (`SessionRevocationLifecycleHook` revoking sessions with
     /// audit, `AuthzCacheLifecycleHook` invalidating the Moka cache,
-    /// `HomeFolderLifecycleHook` for future trash policy, …) can do
+    /// `PersonalDriveLifecycleHook` for future trash policy, …) can do
     /// their work atomically with the user DELETE. If any hook returns
     /// `Err`, the transaction rolls back and the user remains intact.
     pub async fn delete_user_admin(&self, user_id: Uuid) -> Result<(), DomainError> {
@@ -2260,7 +2260,7 @@ impl AuthApplicationService {
                 // Lifecycle: created (audit + home-folder provisioning) +
                 // login (no register_login() for a fresh OIDC user means
                 // `last_login_at` is naturally None → first-login detection
-                // works). HomeFolderLifecycleHook creates the home folder.
+                // works). PersonalDriveLifecycleHook creates the home folder.
                 if let Some(lc) = &self.user_lifecycle {
                     lc.dispatch_created(&created_user).await;
                     lc.dispatch_login(&created_user).await;
@@ -2362,7 +2362,7 @@ impl AuthApplicationService {
 
     // `create_personal_folder` was removed in PR 3 of the
     // UserLifecycleHook migration — home-folder provisioning is now
-    // owned by `HomeFolderLifecycleHook` in folder_service.rs and runs
+    // owned by `PersonalDriveLifecycleHook` in folder_service.rs and runs
     // via `dispatch_created` / `dispatch_login`.
 }
 

src/application/services/delta_upload_service.rs

@@ -623,6 +623,7 @@ impl DeltaUploadService {
                         Some(folder_id.clone()),
                         content_type,
                         blob,
+                        caller_id,
                     )
                     .await
             }

src/application/services/file_management_service.rs

@@ -98,6 +98,7 @@ impl FileManagementService {
         &self,
         file_id: &str,
         folder_id: Option<String>,
+        caller_id: Uuid,
     ) -> Result<FileDto, DomainError> {
         info!(
             "Moving file with ID: {} to folder: {:?}",
@@ -106,7 +107,7 @@ impl FileManagementService {
 
         let moved_file = self
             .file_repository
-            .move_file(file_id, folder_id)
+            .move_file(file_id, folder_id, caller_id)
             .await
             .map_err(|e| {
                 error!("Error moving file (ID: {}): {}", file_id, e);
@@ -128,6 +129,7 @@ impl FileManagementService {
         file_id: &str,
         target_folder_id: Option<String>,
         new_name: Option<&str>,
+        caller_id: Uuid,
     ) -> Result<FileDto, DomainError> {
         info!(
             "Copying file with ID: {} to folder: {:?} as {:?}",
@@ -136,7 +138,7 @@ impl FileManagementService {
 
         let copied_file = self
             .file_repository
-            .copy_file(file_id, target_folder_id, new_name)
+            .copy_file(file_id, target_folder_id, new_name, caller_id)
             .await
             .map_err(|e| {
                 error!("Error copying file (ID: {}): {}", file_id, e);
@@ -157,7 +159,12 @@ impl FileManagementService {
         Ok(dto)
     }
 
-    async fn rename_file(&self, file_id: &str, new_name: &str) -> Result<FileDto, DomainError> {
+    async fn rename_file(
+        &self,
+        file_id: &str,
+        new_name: &str,
+        caller_id: Uuid,
+    ) -> Result<FileDto, DomainError> {
         if let Err(reason) = validate_storage_name(new_name) {
             return Err(DomainError::validation_error(format!(
                 "Invalid file name '{new_name}': {reason}"
@@ -168,7 +175,7 @@ impl FileManagementService {
 
         let renamed_file = self
             .file_repository
-            .rename_file(file_id, new_name)
+            .rename_file(file_id, new_name, caller_id)
             .await
             .map_err(|e| {
                 error!("Error renaming file (ID: {}): {}", file_id, e);
@@ -253,7 +260,7 @@ impl FileManagementUseCase for FileManagementService {
             .await?;
         self.require_target_folder_perm(folder_id.as_deref(), Permission::Create, caller_id)
             .await?;
-        self.move_file(file_id, folder_id).await
+        self.move_file(file_id, folder_id, caller_id).await
     }
 
     async fn copy_file_with_perms(
@@ -268,7 +275,7 @@ impl FileManagementUseCase for FileManagementService {
             .await?;
         self.require_target_folder_perm(target_folder_id.as_deref(), Permission::Create, caller_id)
             .await?;
-        self.copy_file(file_id, target_folder_id, new_name.as_deref())
+        self.copy_file(file_id, target_folder_id, new_name.as_deref(), caller_id)
             .await
     }
 
@@ -280,7 +287,7 @@ impl FileManagementUseCase for FileManagementService {
     ) -> Result<FileDto, DomainError> {
         self.require_file_perm(file_id, Permission::Update, caller_id)
             .await?;
-        self.rename_file(file_id, new_name).await
+        self.rename_file(file_id, new_name, caller_id).await
     }
 
     async fn delete_file_with_perms(&self, id: &str, caller_id: Uuid) -> Result<(), DomainError> {

src/application/services/file_retrieval_service.rs

@@ -286,13 +286,16 @@ impl FileRetrievalUseCase for FileRetrievalService {
     }
 
     // FIXME no authorisation at all
-    async fn get_file_by_path(&self, path: &str) -> Result<FileDto, DomainError> {
+    async fn get_file_by_path(&self, path: &str, drive_id: Uuid) -> Result<FileDto, DomainError> {
         // Direct SQL lookup — O(folder_depth) queries instead of O(total_files)
         // NOTE: This method does NOT perform any authorization check. Callers
         // that surface its result to a user-driven request MUST resolve the
         // file via get_file_owned afterwards, or call authz.require directly.
         // (Tracked in the audit punch-list under "path-based lookups".)
-        if let Some(file) = self.file_read.find_file_by_path(path).await? {
+        // `drive_id` scope axis prevents cross-drive resolution — without
+        // it, `find_file_by_path` would return a non-deterministic row
+        // when the same path exists in multiple drives.
+        if let Some(file) = self.file_read.find_file_by_path(path, drive_id).await? {
             return Ok(FileDto::from(file));
         }
 

src/application/services/file_upload_service.rs

@@ -209,6 +209,7 @@ impl FileUploadService {
                     size: metadata.size,
                     is_new_blob: false,
                 },
+                caller_id,
             )
             .await?;
 
@@ -255,7 +256,7 @@ impl FileUploadService {
         let file = file_read.get_file(file_id).await?;
         let (new_hash, updated_at) = self
             .file_write
-            .update_file_content_with_blob(file_id, &blob.hash, blob.size, None)
+            .update_file_content_with_blob(file_id, &blob.hash, blob.size, None, caller_id)
             .await?;
         // The file maps to a different blob now — stale cached content must
         // never be served for the rest of its TTI window.
@@ -326,10 +327,18 @@ impl FileUploadUseCase for FileUploadService {
         folder_id: Option<String>,
         content_type: String,
         blob: StoredBlob,
+        caller_id: Uuid,
     ) -> Result<FileDto, DomainError> {
         let file = self
             .file_write
-            .save_file_with_blob(name.clone(), folder_id, content_type, &blob.hash, blob.size)
+            .save_file_with_blob(
+                name.clone(),
+                folder_id,
+                content_type,
+                &blob.hash,
+                blob.size,
+                caller_id,
+            )
             .await?;
         let dto = FileDto::from(file);
         info!(
@@ -348,18 +357,26 @@ impl FileUploadUseCase for FileUploadService {
     async fn update_file_streaming(
         &self,
         path: &str,
+        drive_id: Uuid,
         blob: StoredBlob,
         content_type: &str,
         modified_at: Option<i64>,
+        caller_id: Uuid,
     ) -> Result<FileDto, DomainError> {
         // Try to find the existing file first
         if let Some(file_read) = &self.file_read
-            && let Some(file) = file_read.find_file_by_path(path).await?
+            && let Some(file) = file_read.find_file_by_path(path, drive_id).await?
         {
             let file_id = file.id().to_string();
             let (new_hash, updated_at) = self
                 .file_write
-                .update_file_content_with_blob(&file_id, &blob.hash, blob.size, modified_at)
+                .update_file_content_with_blob(
+                    &file_id,
+                    &blob.hash,
+                    blob.size,
+                    modified_at,
+                    caller_id,
+                )
                 .await?;
             // Invalidate content cache — file content has changed.
             if let Some(cc) = &self.content_cache {
@@ -402,9 +419,15 @@ impl FileUploadUseCase for FileUploadService {
 
         // get_parent_folder_id expects the full file path — it strips the
         // last segment (filename) internally to find the parent folder.
+        // `drive_id` scopes the parent lookup to the same drive as the
+        // incoming write (post-D0 `storage.folders.path` repeats across
+        // drives).
         let parent_id = if path_normalized.contains('/') {
             if let Some(file_read) = &self.file_read {
-                file_read.get_parent_folder_id(path_normalized).await.ok()
+                file_read
+                    .get_parent_folder_id(path_normalized, drive_id)
+                    .await
+                    .ok()
             } else {
                 None
             }
@@ -421,6 +444,7 @@ impl FileUploadUseCase for FileUploadService {
                 content_type.to_string(),
                 &blob.hash,
                 blob.size,
+                caller_id,
             )
             .await?;
         let dto = FileDto::from(created);

src/application/services/folder_service.rs

@@ -82,7 +82,11 @@ impl FolderService {
                 Ok(FolderDto::empty())
             }
 
-            async fn get_folder_by_path(&self, _path: &str) -> Result<FolderDto, DomainError> {
+            async fn get_folder_by_path(
+                &self,
+                _path: &str,
+                _drive_id: Uuid,
+            ) -> Result<FolderDto, DomainError> {
                 Ok(FolderDto::empty())
             }
 
@@ -163,14 +167,6 @@ impl FolderService {
             ) -> Result<(), DomainError> {
                 Ok(())
             }
-
-            async fn create_home_folder(
-                &self,
-                _user_id: Uuid,
-                _name: String,
-            ) -> Result<FolderDto, DomainError> {
-                Ok(FolderDto::empty())
-            }
         }
 
         FolderServiceStub
@@ -229,31 +225,11 @@ impl FolderUseCase for FolderService {
 
         let folder = self
             .folder_storage
-            .create_folder(dto.name, dto.parent_id)
+            .create_folder(dto.name, dto.parent_id, caller_id)
             .await?;
         Ok(FolderDto::from(folder))
     }
 
-    /// Creates a root-level home folder for a user during registration.
-    async fn create_home_folder(
-        &self,
-        user_id: Uuid,
-        name: String,
-    ) -> Result<FolderDto, DomainError> {
-        let folder = self
-            .folder_storage
-            .create_home_folder(user_id, name)
-            .await
-            .map_err(|e| {
-                DomainError::internal_error(
-                    "FolderStorage",
-                    format!("Failed to create home folder: {}", e),
-                )
-            })?;
-
-        Ok(FolderDto::from(folder))
-    }
-
     async fn list_subtree_folders(&self, folder_id: &str) -> Result<Vec<FolderDto>, DomainError> {
         let folders = self.folder_storage.list_subtree_folders(folder_id).await?;
         Ok(folders.into_iter().map(FolderDto::from).collect())
@@ -288,14 +264,17 @@ impl FolderUseCase for FolderService {
         self.get_folder(id).await
     }
 
-    /// Gets a folder by its path
-    async fn get_folder_by_path(&self, path: &str) -> Result<FolderDto, DomainError> {
-        // Convert the string path to StoragePath
+    /// Gets a folder by its path, scoped to a drive.
+    async fn get_folder_by_path(
+        &self,
+        path: &str,
+        drive_id: Uuid,
+    ) -> Result<FolderDto, DomainError> {
         let storage_path = StoragePath::from_string(path);
 
         let folder = self
             .folder_storage
-            .get_folder_by_path(&storage_path)
+            .get_folder_by_path(&storage_path, drive_id)
             .await
             .map_err(|e| {
                 DomainError::internal_error(
@@ -329,7 +308,7 @@ impl FolderUseCase for FolderService {
     ///
     /// **Note (post PR 3):** the self-heal block that auto-created a
     /// home folder when listing returned empty has been removed.
-    /// `HomeFolderLifecycleHook` (registered on `UserLifecycleService`)
+    /// `PersonalDriveLifecycleHook` (registered on `UserLifecycleService`)
     /// now provisions the folder on `on_user_created` / `on_user_login`,
     /// idempotently, so the listing path no longer needs to self-heal.
     async fn list_folders_with_perms(
@@ -477,7 +456,7 @@ impl FolderUseCase for FolderService {
 
         let folder = self
             .folder_storage
-            .rename_folder(id, dto.name)
+            .rename_folder(id, dto.name, caller_id)
             .await
             .map_err(|e| {
                 DomainError::internal_error(
@@ -529,7 +508,7 @@ impl FolderUseCase for FolderService {
         let parent_ref = dto.parent_id.as_deref();
         let folder = self
             .folder_storage
-            .move_folder(id, parent_ref)
+            .move_folder(id, parent_ref, caller_id)
             .await
             .map_err(|e| {
                 DomainError::internal_error(
@@ -614,62 +593,6 @@ impl FolderService {
 
         Ok((rows, next_cursor))
     }
-
-    /// Idempotently provision a home folder for a user.
-    ///
-    /// Returns `Ok(true)` if a folder was newly created, `Ok(false)` if the
-    /// user already had at least one root folder.
-    ///
-    /// **System-level operation** — bypasses authz because this runs on
-    /// the user's own behalf (during creation or login provisioning) at a
-    /// point where the caller may be the engine itself, not an HTTP user.
-    /// Callers must be inside trusted code paths (lifecycle hooks).
-    ///
-    /// Used by [`HomeFolderLifecycleHook`] on `on_user_created` and
-    /// `on_user_login`. Replaces the old self-heal at the listing path
-    /// and the four eager `create_personal_folder` calls in
-    /// `AuthApplicationService` (removed in the same PR).
-    pub async fn ensure_home_folder(
-        &self,
-        user_id: Uuid,
-        username: Option<&str>,
-    ) -> Result<bool, DomainError> {
-        let existing = self
-            .folder_storage
-            .list_folders_by_owner(None, user_id)
-            .await
-            .map_err(|e| {
-                DomainError::internal_error(
-                    "FolderStorage",
-                    format!("ensure_home_folder: list root folders: {}", e),
-                )
-            })?;
-        if !existing.is_empty() {
-            return Ok(false);
-        }
-
-        let folder_name = match username {
-            Some(u) => format!("My Folder - {}", u),
-            None => format!("My Folder - {}", user_id),
-        };
-        self.folder_storage
-            .create_home_folder(user_id, folder_name.clone())
-            .await
-            .map_err(|e| {
-                DomainError::internal_error(
-                    "FolderStorage",
-                    format!("ensure_home_folder: create: {}", e),
-                )
-            })?;
-        tracing::info!(
-            target: "user_lifecycle",
-            hook = "home_folder",
-            user_id = %user_id,
-            folder_name = %folder_name,
-            "Home folder provisioned"
-        );
-        Ok(true)
-    }
 }
 
 /// Build the next-page cursor from the last row of the current page.
@@ -725,7 +648,7 @@ fn build_folder_resource_cursor(
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
-// HomeFolderLifecycleHook
+// PersonalDriveLifecycleHook
 //
 // Owns home-folder provisioning policy. Replaces:
 //   - the 4 eager `create_personal_folder` calls in AuthApplicationService
@@ -743,36 +666,115 @@ use async_trait::async_trait;
 use crate::application::ports::user_lifecycle::{DeletionMode, LogoutReason, UserLifecycleHook};
 use crate::domain::entities::user::User;
 
-/// Lifecycle hook: provisions and (in PR 4) deprovisions a user's home folder.
-pub struct HomeFolderLifecycleHook {
-    folder_service: Arc<FolderService>,
+/// Lifecycle hook: provisions a user's default Personal drive at first
+/// login (replaces the legacy `My Folder - <username>` wrapper as of D0).
+///
+/// Two writes happen on first provisioning:
+///   1. A row in `storage.drives` with `kind='personal'`,
+///      `default_for_user=<uid>`, and the user's quota carried over from
+///      `auth.users.storage_quota_bytes`.
+///   2. An Owner role grant in `storage.role_grants` so the user can
+///      read/write/manage their own drive (the engine's owner short-
+///      circuit applies to folders/files but not drives — see
+///      `pg_acl_engine::check_inner` D0-6 rewrite).
+///
+/// Both writes are idempotent: `find_default_for_user` short-circuits
+/// when the drive already exists; `set_role` is an UPSERT that no-ops
+/// when the Owner row is already present.
+pub struct PersonalDriveLifecycleHook {
+    drive_repo: Arc<dyn crate::domain::repositories::drive_repository::DriveRepository>,
+    // The `AuthorizationEngine` trait isn't `dyn`-compatible (native
+    // async-fn-in-trait methods are not object-safe), so we hold the
+    // concrete engine. This matches the convention already used by
+    // `AppState.authorization`. Only the idempotent-rerun path uses it
+    // now; the create path goes through the repo's atomic CTE which
+    // writes the role_grant inline.
+    authorization: Arc<crate::infrastructure::services::pg_acl_engine::PgAclEngine>,
 }
 
-impl HomeFolderLifecycleHook {
-    pub fn new(folder_service: Arc<FolderService>) -> Self {
-        Self { folder_service }
+impl PersonalDriveLifecycleHook {
+    pub fn new(
+        drive_repo: Arc<dyn crate::domain::repositories::drive_repository::DriveRepository>,
+        authorization: Arc<crate::infrastructure::services::pg_acl_engine::PgAclEngine>,
+    ) -> Self {
+        Self {
+            drive_repo,
+            authorization,
+        }
     }
 
     /// Idempotent provisioning shared by `on_user_created` and
     /// `on_user_login`. External users are skipped per tip #2 in the
-    /// trait docstring.
+    /// trait docstring — they have no resources of their own, only
+    /// grants on other users' resources.
     async fn provision_if_needed(&self, user: &User) -> Result<(), DomainError> {
+        use crate::domain::repositories::drive_repository::DriveRepositoryError;
+        use crate::domain::services::authorization::{Resource, Role, Subject};
+
         if user.is_external() {
             return Ok(());
         }
-        // `ensure_home_folder` handles the "does the user already have a
-        // root folder?" check internally and is a no-op if so.
-        self.folder_service
-            .ensure_home_folder(user.id(), user.username())
+
+        // Idempotent shortcut: if the user already has a default drive,
+        // the atomic CTE already ran on a prior turn. The CTE writes
+        // the Owner role_grant inline, so there's nothing to repair —
+        // but we still re-emit the grant via `set_role` (UPSERT-safe)
+        // to cover the historical case where a pre-CTE provisioning
+        // path partially completed (drive created, grant missing).
+        match self.drive_repo.find_default_for_user(user.id()).await {
+            Ok(drive_with_name) => {
+                self.authorization
+                    .set_role(
+                        user.id(),
+                        Subject::User(user.id()),
+                        Role::Owner,
+                        Resource::Drive(drive_with_name.drive.id),
+                        None,
+                    )
+                    .await
+                    .map(|_grant| ())?;
+                return Ok(());
+            }
+            Err(DriveRepositoryError::NotFound(_)) => { /* fall through to create */ }
+            Err(e) => {
+                return Err(DomainError::internal_error(
+                    "PersonalDriveHook",
+                    format!("find_default lookup: {e}"),
+                ));
+            }
+        }
+
+        // One atomic CTE — drive row + root folder ("Personal",
+        // parent_id=NULL, drive_id pinned) + drives.root_folder_id
+        // wire-up + Owner role_grant. Single SQL statement, atomic
+        // against server crash mid-sequence (docs/plan/drive.md §3).
+        let drive_with_name = self
+            .drive_repo
+            .create_personal_drive_atomic(user.id(), Some(user.storage_quota_bytes()))
             .await
-            .map(|_created| ())
+            .map_err(|e| {
+                DomainError::internal_error(
+                    "PersonalDriveHook",
+                    format!("create_personal_drive_atomic: {e}"),
+                )
+            })?;
+
+        tracing::info!(
+            target: "user_lifecycle",
+            hook = "personal_drive",
+            user_id = %user.id(),
+            drive_id = %drive_with_name.drive.id,
+            root_folder_id = %drive_with_name.drive.root_folder_id,
+            "Default personal drive + root folder + owner grant provisioned (atomic CTE)"
+        );
+        Ok(())
     }
 }
 
 #[async_trait]
-impl UserLifecycleHook for HomeFolderLifecycleHook {
+impl UserLifecycleHook for PersonalDriveLifecycleHook {
     fn name(&self) -> &'static str {
-        "home_folder"
+        "personal_drive"
     }
 
     async fn on_user_created(&self, user: &User) -> Result<(), DomainError> {
@@ -787,7 +789,7 @@ impl UserLifecycleHook for HomeFolderLifecycleHook {
     }
 
     async fn on_user_logout(&self, _user: &User, _reason: LogoutReason) -> Result<(), DomainError> {
-        // Folders don't react to logout. Explicit no-op per the
+        // Drives don't react to logout. Explicit no-op per the
         // "no defaults" convention.
         Ok(())
     }
@@ -798,24 +800,22 @@ impl UserLifecycleHook for HomeFolderLifecycleHook {
         mode: DeletionMode,
         _tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
     ) -> Result<(), DomainError> {
-        // For both DeletionMode variants today the FK CASCADE on
-        // `storage.folders.user_id` (and downstream files/blobs)
-        // removes the home folder + contents when the user row goes.
+        // `storage.drives.default_for_user` has ON DELETE CASCADE
+        // referencing `auth.users(id)`, and `storage.folders.drive_id`
+        // / `storage.files.drive_id` both have ON DELETE CASCADE on
+        // `storage.drives(id)` (M3). So a user delete cascades:
+        // user → drive → folders → files in one transaction.
+        //
         // The hook emits a per-mode tracing event so audit can tell
         // AdminDelete (currently recoverable only via DB-level rollback
         // before commit) from GdprPurge (no sweeper exists yet — the
         // variant is reserved for a future PR that adds retention).
-        //
-        // The `tx` is provided per the trait contract but unused here:
-        // emitting a tracing event doesn't require DB access. Future
-        // policy (trash with retention) would write to `storage.trash`
-        // inside this same tx.
         tracing::info!(
             target: "user_lifecycle",
-            hook = "home_folder",
+            hook = "personal_drive",
             user_id = %user.id(),
             mode = ?mode,
-            "Home folder will be removed via FK CASCADE on user delete"
+            "Personal drive (and tree) will be removed via FK CASCADE on user delete"
         );
         Ok(())
     }

src/application/services/idor_protection_test.rs

@@ -101,7 +101,11 @@ impl FileReadPort for MockFileReadPort {
         unimplemented!()
     }
 
-    async fn get_parent_folder_id(&self, _path: &str) -> Result<String, DomainError> {
+    async fn get_parent_folder_id(
+        &self,
+        _path: &str,
+        _drive_id: Uuid,
+    ) -> Result<String, DomainError> {
         unimplemented!()
     }
 
@@ -127,7 +131,11 @@ impl FileReadPort for MockFileReadPort {
         Ok(0)
     }
 
-    async fn get_folder_id_by_path(&self, _folder_path: &str) -> Result<String, DomainError> {
+    async fn get_folder_id_by_path(
+        &self,
+        _folder_path: &str,
+        _drive_id: Uuid,
+    ) -> Result<String, DomainError> {
         unimplemented!()
     }
 
@@ -176,6 +184,7 @@ impl FileWritePort for MockFileWritePort {
         _content_type: String,
         _blob_hash: &str,
         _size: u64,
+        _caller_id: Uuid,
     ) -> Result<File, DomainError> {
         unimplemented!()
     }
@@ -184,6 +193,7 @@ impl FileWritePort for MockFileWritePort {
         &self,
         file_id: &str,
         _target_folder_id: Option<String>,
+        _caller_id: Uuid,
     ) -> Result<File, DomainError> {
         let files = self.files.lock().unwrap();
         files
@@ -192,7 +202,12 @@ impl FileWritePort for MockFileWritePort {
             .ok_or_else(|| DomainError::not_found("File", file_id.to_string()))
     }
 
-    async fn rename_file(&self, file_id: &str, _new_name: &str) -> Result<File, DomainError> {
+    async fn rename_file(
+        &self,
+        file_id: &str,
+        _new_name: &str,
+        _caller_id: Uuid,
+    ) -> Result<File, DomainError> {
         let files = self.files.lock().unwrap();
         files
             .get(file_id)
@@ -210,6 +225,7 @@ impl FileWritePort for MockFileWritePort {
         _blob_hash: &str,
         _size: u64,
         _modified_at: Option<i64>,
+        _caller_id: Uuid,
     ) -> Result<(String, i64), DomainError> {
         Ok((String::new(), 0))
     }
@@ -220,6 +236,7 @@ impl FileWritePort for MockFileWritePort {
         _folder_id: Option<String>,
         _content_type: String,
         _size: u64,
+        _caller_id: Uuid,
     ) -> Result<(File, PathBuf), DomainError> {
         unimplemented!()
     }
@@ -229,11 +246,12 @@ impl FileWritePort for MockFileWritePort {
         _file_id: &str,
         _target_folder_id: Option<String>,
         _new_name: Option<&str>,
+        _caller_id: Uuid,
     ) -> Result<File, DomainError> {
         unimplemented!()
     }
 
-    async fn move_to_trash(&self, _file_id: &str) -> Result<(), DomainError> {
+    async fn move_to_trash(&self, _file_id: &str, _caller_id: Uuid) -> Result<(), DomainError> {
         Ok(())
     }
 
@@ -241,6 +259,7 @@ impl FileWritePort for MockFileWritePort {
         &self,
         _file_id: &str,
         _original_path: &str,
+        _caller_id: Uuid,
     ) -> Result<(), DomainError> {
         Ok(())
     }

src/application/services/magic_link_invite_service.rs

@@ -307,6 +307,23 @@ impl MagicLinkInviteService {
         let (kind, resource_id) = match resource {
             Resource::Folder(id) => (MagicLinkResourceKind::Folder, id),
             Resource::File(id) => (MagicLinkResourceKind::File, id),
+            // Drive sharing — and therefore drive magic-link invitations —
+            // land in D2. The grant DTOs accept `Resource::Drive` from the
+            // wire today (see ResourceTypeDto) but no public API path
+            // actually grants on a drive in D0, so this arm is
+            // defensively unreachable. Treating it as an audit-logged
+            // no-op (grant is in place, mail suppressed) matches the
+            // ineligible-recipient branch above.
+            Resource::Drive(_) => {
+                tracing::info!(
+                    target: "audit",
+                    event = "magic_link.invitation_suppressed",
+                    reason = "drive_resource_unsupported",
+                    user_id = %recipient.id(),
+                    "📭 magic-link invitation suppressed: drive resources aren't invitable until D2",
+                );
+                return Ok(());
+            }
         };
         // Invitation tokens are cross-device by design (recipient has
         // no prior browser context with the server) — no challenge
@@ -329,6 +346,11 @@ impl MagicLinkInviteService {
         let kind_key = match resource {
             Resource::Folder(_) => "server.magic_link.email.kind_folder",
             Resource::File(_) => "server.magic_link.email.kind_file",
+            // Unreachable — the early-return above exits before we get
+            // here for a Drive resource. The arm exists only to satisfy
+            // exhaustiveness; if you find this firing, the early-return
+            // was bypassed.
+            Resource::Drive(_) => "server.magic_link.email.kind_folder",
         };
         // PR C: render in the recipient's preferred locale (set by UI
         // switcher, OIDC JIT claim, or inviter inheritance at row
@@ -731,6 +753,15 @@ impl From<ResourceKind> for MagicLinkResourceKind {
         match kind {
             ResourceKind::Folder => Self::Folder,
             ResourceKind::File => Self::File,
+            // Drives aren't a magic-link invite target in D0. The
+            // grant DTO surface accepts drive resources, but the
+            // grant_handler doesn't issue magic-links for them
+            // (drive sharing lands in D2). Mapping Drive → Folder
+            // gives a non-panicking fallback that would still emit a
+            // valid token shape if the path were ever reached; the
+            // runtime branches above suppress drive invitations
+            // before reaching this conversion.
+            ResourceKind::Drive => Self::Folder,
         }
     }
 }

src/application/services/nextcloud_login_flow_service.rs

@@ -3,6 +3,7 @@ use std::sync::{Arc, Mutex};
 use std::time::{Duration, Instant};
 
 use rand_core::RngCore;
+use uuid::Uuid;
 
 /// Maximum number of concurrent pending login flows to prevent memory exhaustion.
 const MAX_PENDING_FLOWS: usize = 1000;
@@ -30,6 +31,13 @@ pub struct LoginResult {
 struct PendingFlow {
     created_at: Instant,
     poll_token: String,
+    /// Set after the user authenticates on the login page **and** has more
+    /// than one root drive — the flow is paused until the user picks a
+    /// drive on the picker page. Consumed by `take_pending_user` when the
+    /// picker submission arrives, so the second step is single-use even
+    /// if the flow token leaks. `None` for single-drive accounts (legacy
+    /// path goes straight to `completed`).
+    pending_user_id: Option<Uuid>,
     completed: Option<LoginResult>,
 }
 
@@ -80,6 +88,7 @@ impl NextcloudLoginFlowService {
             PendingFlow {
                 created_at: Instant::now(),
                 poll_token: poll_token.clone(),
+                pending_user_id: None,
                 completed: None,
             },
         );
@@ -101,6 +110,39 @@ impl NextcloudLoginFlowService {
         state.flows.contains_key(flow_token)
     }
 
+    /// Stash a verified user_id on the flow so a follow-up drive-pick
+    /// request can prove "this browser just authenticated" without
+    /// asking for the password again. Returns `false` if the flow
+    /// token is unknown or expired.
+    ///
+    /// Only used on multi-drive accounts — single-drive logins go
+    /// straight to [`complete`](Self::complete).
+    pub fn mark_awaiting_drive(&self, flow_token: &str, user_id: Uuid) -> bool {
+        let mut state = self.state.lock().unwrap_or_else(|e| e.into_inner());
+        prune_expired(&mut state, self.ttl);
+        match state.flows.get_mut(flow_token) {
+            Some(pending) => {
+                pending.pending_user_id = Some(user_id);
+                true
+            }
+            None => false,
+        }
+    }
+
+    /// Consume the stashed user_id (single-use). Returns the user_id
+    /// when the flow is in "awaiting drive choice" state, or `None`
+    /// when the flow is unknown, expired, or was never marked. Single-
+    /// use semantics make this safe even if the flow token leaks: the
+    /// second drive-pick attempt finds nothing to consume.
+    pub fn take_pending_user(&self, flow_token: &str) -> Option<Uuid> {
+        let mut state = self.state.lock().unwrap_or_else(|e| e.into_inner());
+        prune_expired(&mut state, self.ttl);
+        state
+            .flows
+            .get_mut(flow_token)
+            .and_then(|pending| pending.pending_user_id.take())
+    }
+
     pub fn complete(
         &self,
         flow_token: &str,
@@ -257,6 +299,35 @@ mod tests {
         assert!(svc.poll(&info.poll_token).is_none());
     }
 
+    #[test]
+    fn test_mark_awaiting_drive_then_take_pending_user() {
+        let svc = service();
+        let info = svc.initiate("https://cloud.example.com").unwrap();
+        let flow_token = info.login_url.rsplit('/').next().unwrap();
+        let uid = Uuid::new_v4();
+
+        assert!(svc.mark_awaiting_drive(flow_token, uid));
+        // First take consumes the slot.
+        assert_eq!(svc.take_pending_user(flow_token), Some(uid));
+        // Second take must return None (single-use).
+        assert_eq!(svc.take_pending_user(flow_token), None);
+    }
+
+    #[test]
+    fn test_mark_awaiting_drive_unknown_flow_returns_false() {
+        let svc = service();
+        assert!(!svc.mark_awaiting_drive("nonexistent", Uuid::new_v4()));
+    }
+
+    #[test]
+    fn test_take_pending_user_without_mark_returns_none() {
+        let svc = service();
+        let info = svc.initiate("https://cloud.example.com").unwrap();
+        let flow_token = info.login_url.rsplit('/').next().unwrap();
+        // Flow exists but mark_awaiting_drive was never called.
+        assert_eq!(svc.take_pending_user(flow_token), None);
+    }
+
     #[test]
     fn test_max_pending_flows_cap() {
         let svc = NextcloudLoginFlowService::new(Duration::from_secs(600));

src/application/services/people_service.rs

@@ -199,7 +199,7 @@ impl PeopleService {
                 })
             })
             .collect();
-        out.sort_by(|a, b| b.face_count.cmp(&a.face_count));
+        out.sort_by_key(|p| std::cmp::Reverse(p.face_count));
         Ok(out)
     }
 

src/application/services/recipient_notification_service.rs

@@ -472,6 +472,11 @@ impl RecipientNotificationService {
         let kind_key = match resource {
             Resource::Folder(_) => "server.magic_link.email.kind_folder",
             Resource::File(_) => "server.magic_link.email.kind_file",
+            // Drives don't generate share notifications in D0 — drive
+            // sharing lands in D2 and gets its own template key. Fall
+            // back to the folder label so any path that does reach
+            // here produces a readable, if generic, mail body.
+            Resource::Drive(_) => "server.magic_link.email.kind_folder",
         };
         let kind_label = self.i18n_or(kind_key, &locale, &[]).await;
         // Short form for the subject, long form (with email) for the

src/application/services/search_service.rs

@@ -50,6 +50,20 @@ pub struct SearchService {
     /// matches; hits are hydrated and re-filtered through SQL before use.
     content_index: Option<Arc<dyn ContentIndexPort>>,
 
+    /// Optional authorization engine — needed to resolve the caller's
+    /// accessible drive set before querying the content index, and to
+    /// re-verify each Tantivy hit against `engine.check(Read, File(id))`
+    /// as a defense-in-depth measure (catches index staleness and
+    /// per-file grants that the drive-only Tantivy filter misses; see
+    /// `docs/plan/drive.md` §11). `None` short-circuits the content
+    /// index (the cheapest safe degradation).
+    authorization: Option<Arc<crate::infrastructure::services::pg_acl_engine::PgAclEngine>>,
+
+    /// Optional drive repository — used in tandem with the authorization
+    /// engine to resolve the caller's accessible drives for the Tantivy
+    /// filter. `None` short-circuits the content index.
+    drive_repo: Option<Arc<dyn crate::domain::repositories::drive_repository::DriveRepository>>,
+
     /// Lock-free concurrent cache with automatic TTL and LRU eviction (moka).
     /// Values are `Arc<SearchResultsDto>` so cache insert/hit is a single
     /// atomic ref-count increment (~1 ns) instead of cloning thousands of Strings.
@@ -151,6 +165,8 @@ impl SearchService {
         file_repository: Arc<FileBlobReadRepository>,
         folder_repository: Arc<FolderDbRepository>,
         content_index: Option<Arc<dyn ContentIndexPort>>,
+        authorization: Option<Arc<crate::infrastructure::services::pg_acl_engine::PgAclEngine>>,
+        drive_repo: Option<Arc<dyn crate::domain::repositories::drive_repository::DriveRepository>>,
         cache_ttl: u64,
         max_cache_size: usize,
     ) -> Self {
@@ -163,6 +179,8 @@ impl SearchService {
             file_repository,
             folder_repository,
             content_index,
+            authorization,
+            drive_repo,
             search_cache,
         }
     }
@@ -250,9 +268,18 @@ impl SearchService {
         criteria: &SearchCriteriaDto,
         user_id: Uuid,
     ) -> Vec<ContentHitDto> {
+        use crate::application::ports::authorization_ports::AuthorizationEngine;
+        use crate::domain::services::authorization::{Permission, Resource, Subject};
+
         let Some(index) = &self.content_index else {
             return Vec::new();
         };
+        let Some(authz) = &self.authorization else {
+            return Vec::new();
+        };
+        let Some(drive_repo) = &self.drive_repo else {
+            return Vec::new();
+        };
         if criteria.offset != 0 {
             return Vec::new();
         }
@@ -265,16 +292,78 @@ impl SearchService {
             return Vec::new();
         };
 
-        match index
-            .search_content(user_id, query, CONTENT_HITS_LIMIT)
+        // Resolve the caller's accessible drive set via the engine
+        // (handles group-mediated drive grants) + the repo lookup.
+        let caller = Subject::User(user_id);
+        let (subject_types, subject_ids) = match authz.expand_subject_for_listing(caller).await {
+            Ok(pair) => pair,
+            Err(e) => {
+                tracing::warn!("Content-index: subject expansion failed — degrading to empty: {e}");
+                return Vec::new();
+            }
+        };
+        let accessible_drives: Vec<Uuid> = match drive_repo
+            .list_for_subjects(&subject_types, &subject_ids)
+            .await
+        {
+            Ok(drives) => drives.into_iter().map(|d| d.drive.id).collect(),
+            Err(e) => {
+                tracing::warn!("Content-index: drive lookup failed — degrading to empty: {e}");
+                return Vec::new();
+            }
+        };
+
+        // Tantivy filter (Must drive_id ∈ accessible_drives) handles
+        // the cross-drive isolation. Empty drive list short-circuits
+        // inside `search_content`.
+        let hits = match index
+            .search_content(&accessible_drives, query, CONTENT_HITS_LIMIT)
             .await
         {
             Ok(hits) => hits,
             Err(e) => {
                 tracing::warn!("Content-index lookup failed — returning name-only results: {e}");
-                Vec::new()
+                return Vec::new();
+            }
+        };
+
+        // Defense in depth: re-verify each hit through the engine.
+        // Catches two cases the drive_id filter can't:
+        //   * Index staleness — the file just moved drives and the
+        //     worker hasn't caught up.
+        //   * Per-file grants — ReBAC can grant a single file inside a
+        //     drive the caller doesn't otherwise have. The Tantivy
+        //     filter is drive-only; this re-check restores per-file
+        //     resolution.
+        // Failures degrade conservatively (drop the hit, log it) —
+        // never leak.
+        let mut verified = Vec::with_capacity(hits.len());
+        for hit in hits {
+            let file_uuid = match Uuid::parse_str(&hit.file_id) {
+                Ok(u) => u,
+                Err(_) => {
+                    tracing::warn!("Content-index hit had non-UUID file_id: {}", hit.file_id);
+                    continue;
+                }
+            };
+            match authz
+                .check(caller, Permission::Read, Resource::File(file_uuid))
+                .await
+            {
+                Ok(true) => verified.push(hit),
+                Ok(false) => {
+                    tracing::debug!(
+                        target: "oxicloud::search",
+                        file_id = %file_uuid,
+                        "dropping content-index hit: ReBAC denies Read after Tantivy filter",
+                    );
+                }
+                Err(e) => {
+                    tracing::warn!("ReBAC re-check failed for {file_uuid}: {e}");
+                }
             }
         }
+        verified
     }
 
     /// Merge content-index hits into the name-search result page:

src/application/services/share_service.rs

@@ -838,11 +838,19 @@ mod tests {
             unimplemented!()
         }
 
-        async fn get_parent_folder_id(&self, _path: &str) -> Result<String, DomainError> {
+        async fn get_parent_folder_id(
+            &self,
+            _path: &str,
+            _drive_id: uuid::Uuid,
+        ) -> Result<String, DomainError> {
             unimplemented!()
         }
 
-        async fn get_folder_id_by_path(&self, _folder_path: &str) -> Result<String, DomainError> {
+        async fn get_folder_id_by_path(
+            &self,
+            _folder_path: &str,
+            _drive_id: uuid::Uuid,
+        ) -> Result<String, DomainError> {
             unimplemented!()
         }
 
@@ -898,6 +906,7 @@ mod tests {
             &self,
             _name: String,
             _parent_id: Option<String>,
+            _caller_id: uuid::Uuid,
         ) -> Result<crate::domain::entities::folder::Folder, DomainError> {
             unimplemented!()
         }
@@ -925,6 +934,7 @@ mod tests {
         async fn get_folder_by_path(
             &self,
             _storage_path: &crate::domain::services::path_service::StoragePath,
+            _drive_id: uuid::Uuid,
         ) -> Result<crate::domain::entities::folder::Folder, DomainError> {
             unimplemented!()
         }
@@ -971,6 +981,7 @@ mod tests {
             &self,
             _id: &str,
             _new_name: String,
+            _caller_id: Uuid,
         ) -> Result<crate::domain::entities::folder::Folder, DomainError> {
             unimplemented!()
         }
@@ -979,6 +990,7 @@ mod tests {
             &self,
             _id: &str,
             _new_parent_id: Option<&str>,
+            _caller_id: Uuid,
         ) -> Result<crate::domain::entities::folder::Folder, DomainError> {
             unimplemented!()
         }
@@ -990,6 +1002,7 @@ mod tests {
         async fn folder_exists(
             &self,
             _storage_path: &crate::domain::services::path_service::StoragePath,
+            _drive_id: uuid::Uuid,
         ) -> Result<bool, DomainError> {
             unimplemented!()
         }
@@ -1001,7 +1014,11 @@ mod tests {
             unimplemented!()
         }
 
-        async fn move_to_trash(&self, _folder_id: &str) -> Result<(), DomainError> {
+        async fn move_to_trash(
+            &self,
+            _folder_id: &str,
+            _caller_id: Uuid,
+        ) -> Result<(), DomainError> {
             unimplemented!()
         }
 
@@ -1009,6 +1026,7 @@ mod tests {
             &self,
             _folder_id: &str,
             _original_path: &str,
+            _caller_id: Uuid,
         ) -> Result<(), DomainError> {
             unimplemented!()
         }
@@ -1016,14 +1034,6 @@ mod tests {
         async fn delete_folder_permanently(&self, _folder_id: &str) -> Result<(), DomainError> {
             unimplemented!()
         }
-
-        async fn create_home_folder(
-            &self,
-            _user_id: Uuid,
-            _name: String,
-        ) -> Result<crate::domain::entities::folder::Folder, DomainError> {
-            unimplemented!()
-        }
     }
 
     struct MockShareRepository {

src/application/services/trash_service.rs

@@ -253,9 +253,10 @@ impl TrashUseCase for TrashService {
                     }
                 };
 
-                // Then physically move the file to trash
+                // Then physically move the file to trash.
+                // §14: caller_id stamps `updated_by` on the trashed row.
                 info!("Physically moving file to trash: {}", item_id);
-                match self.file_write_port.move_to_trash(item_id).await {
+                match self.file_write_port.move_to_trash(item_id, user_id).await {
                     Ok(_) => {
                         debug!("File physically moved to trash successfully: {}", item_id);
                     }
@@ -320,9 +321,10 @@ impl TrashUseCase for TrashService {
                     }
                 };
 
-                // Then physically move the folder to trash
+                // Then physically move the folder to trash.
+                // §14: caller_id stamps `updated_by` on every cascade-trashed row.
                 self.folder_storage_port
-                    .move_to_trash(item_id)
+                    .move_to_trash(item_id, user_id)
                     .await
                     .map_err(|e| {
                         DomainError::new(
@@ -391,7 +393,7 @@ impl TrashUseCase for TrashService {
                         );
                         match self
                             .file_write_port
-                            .restore_from_trash(&file_id, &original_path)
+                            .restore_from_trash(&file_id, &original_path, user_id)
                             .await
                         {
                             Ok(_) => {
@@ -431,7 +433,7 @@ impl TrashUseCase for TrashService {
                         );
                         match self
                             .folder_storage_port
-                            .restore_from_trash(&folder_id, &original_path)
+                            .restore_from_trash(&folder_id, &original_path, user_id)
                             .await
                         {
                             Ok(_) => {
@@ -821,12 +823,19 @@ fn row_to_item_dto(row: TrashResourceRow) -> TrashResourceItemDto {
             path,
             parent_id: row.parent_id.map(|u| u.to_string()),
             owner_id: Some(row.owner_id.to_string()),
+            // Trash listing — drive_id is informational and the trash
+            // row doesn't currently SELECT it. Path-based lookups
+            // never enter this code path.
+            drive_id: uuid::Uuid::nil(),
             created_at: row.resource_created_at.timestamp() as u64,
             modified_at: row.modified_at.timestamp() as u64,
             is_root: false,
             icon_class: std::sync::Arc::from("fas fa-folder"),
             icon_special_class: std::sync::Arc::from("folder-icon"),
             category: std::sync::Arc::from("Folder"),
+            // §14 provenance not selected by the trash listing query.
+            created_by: None,
+            updated_by: None,
         };
         TrashResourceItemDto {
             resource_type: ResourceTypeDto::Folder,
@@ -867,6 +876,9 @@ fn row_to_item_dto(row: TrashResourceRow) -> TrashResourceItemDto {
             sort_date: None,
             content_hash,
             etag,
+            // §14 provenance not selected by the trash listing query.
+            created_by: None,
+            updated_by: None,
         };
         TrashResourceItemDto {
             resource_type: ResourceTypeDto::File,

src/application/services/trash_service_test.rs

@@ -139,7 +139,7 @@ where
                         )
                     })?;
                 self.file_write_port
-                    .move_to_trash(item_id)
+                    .move_to_trash(item_id, user_id)
                     .await
                     .map_err(|e| {
                         DomainError::new(
@@ -181,7 +181,7 @@ where
                         )
                     })?;
                 self.folder_storage_port
-                    .move_to_trash(item_id)
+                    .move_to_trash(item_id, user_id)
                     .await
                     .map_err(|e| {
                         DomainError::new(
@@ -215,7 +215,7 @@ where
                         let original_path = item.original_path().to_string();
                         let result = self
                             .file_write_port
-                            .restore_from_trash(&file_id, &original_path)
+                            .restore_from_trash(&file_id, &original_path, user_id)
                             .await;
                         if let Err(e) = result
                             && !format!("{}", e).contains("not found")
@@ -232,7 +232,7 @@ where
                         let original_path = item.original_path().to_string();
                         let result = self
                             .folder_storage_port
-                            .restore_from_trash(&folder_id, &original_path)
+                            .restore_from_trash(&folder_id, &original_path, user_id)
                             .await;
                         if let Err(e) = result
                             && !format!("{}", e).contains("not found")
@@ -500,13 +500,18 @@ impl FileReadPort for MockFileRepository {
         unimplemented!()
     }
 
-    async fn get_parent_folder_id(&self, _path: &str) -> std::result::Result<String, DomainError> {
+    async fn get_parent_folder_id(
+        &self,
+        _path: &str,
+        _drive_id: Uuid,
+    ) -> std::result::Result<String, DomainError> {
         unimplemented!()
     }
 
     async fn get_folder_id_by_path(
         &self,
         _folder_path: &str,
+        _drive_id: Uuid,
     ) -> std::result::Result<String, DomainError> {
         unimplemented!()
     }
@@ -561,6 +566,7 @@ impl FileWritePort for MockFileRepository {
         _content_type: String,
         _blob_hash: &str,
         _size: u64,
+        _caller_id: Uuid,
     ) -> std::result::Result<File, DomainError> {
         unimplemented!()
     }
@@ -569,6 +575,7 @@ impl FileWritePort for MockFileRepository {
         &self,
         _file_id: &str,
         _target_folder_id: Option<String>,
+        _caller_id: Uuid,
     ) -> std::result::Result<File, DomainError> {
         unimplemented!()
     }
@@ -577,6 +584,7 @@ impl FileWritePort for MockFileRepository {
         &self,
         _file_id: &str,
         _new_name: &str,
+        _caller_id: Uuid,
     ) -> std::result::Result<File, DomainError> {
         unimplemented!()
     }
@@ -591,6 +599,7 @@ impl FileWritePort for MockFileRepository {
         _blob_hash: &str,
         _size: u64,
         _modified_at: Option<i64>,
+        _caller_id: Uuid,
     ) -> std::result::Result<(String, i64), DomainError> {
         Ok((String::new(), 0))
     }
@@ -601,6 +610,7 @@ impl FileWritePort for MockFileRepository {
         _folder_id: Option<String>,
         _content_type: String,
         _size: u64,
+        _caller_id: Uuid,
     ) -> std::result::Result<(File, PathBuf), DomainError> {
         unimplemented!()
     }
@@ -610,11 +620,16 @@ impl FileWritePort for MockFileRepository {
         _file_id: &str,
         _target_folder_id: Option<String>,
         _new_name: Option<&str>,
+        _caller_id: Uuid,
     ) -> std::result::Result<File, DomainError> {
         unimplemented!()
     }
 
-    async fn move_to_trash(&self, id: &str) -> std::result::Result<(), DomainError> {
+    async fn move_to_trash(
+        &self,
+        id: &str,
+        _caller_id: Uuid,
+    ) -> std::result::Result<(), DomainError> {
         let mut files = self.files.lock().unwrap();
         let mut trashed = self.trashed_files.lock().unwrap();
 
@@ -630,6 +645,7 @@ impl FileWritePort for MockFileRepository {
         &self,
         id: &str,
         _original_path: &str,
+        _caller_id: Uuid,
     ) -> std::result::Result<(), DomainError> {
         let mut files = self.files.lock().unwrap();
         let mut trashed = self.trashed_files.lock().unwrap();
@@ -693,6 +709,7 @@ impl FolderRepository for MockFolderRepository {
         &self,
         _name: String,
         _parent_id: Option<String>,
+        _caller_id: Uuid,
     ) -> std::result::Result<Folder, DomainError> {
         unimplemented!()
     }
@@ -709,6 +726,7 @@ impl FolderRepository for MockFolderRepository {
     async fn get_folder_by_path(
         &self,
         _storage_path: &StoragePath,
+        _drive_id: Uuid,
     ) -> std::result::Result<Folder, DomainError> {
         unimplemented!()
     }
@@ -753,6 +771,7 @@ impl FolderRepository for MockFolderRepository {
         &self,
         _id: &str,
         _new_name: String,
+        _caller_id: Uuid,
     ) -> std::result::Result<Folder, DomainError> {
         unimplemented!()
     }
@@ -761,6 +780,7 @@ impl FolderRepository for MockFolderRepository {
         &self,
         _id: &str,
         _new_parent_id: Option<&str>,
+        _caller_id: Uuid,
     ) -> std::result::Result<Folder, DomainError> {
         unimplemented!()
     }
@@ -772,6 +792,7 @@ impl FolderRepository for MockFolderRepository {
     async fn folder_exists(
         &self,
         _storage_path: &StoragePath,
+        _drive_id: Uuid,
     ) -> std::result::Result<bool, DomainError> {
         Ok(false)
     }
@@ -780,7 +801,11 @@ impl FolderRepository for MockFolderRepository {
         Ok(StoragePath::from_string("/"))
     }
 
-    async fn move_to_trash(&self, id: &str) -> std::result::Result<(), DomainError> {
+    async fn move_to_trash(
+        &self,
+        id: &str,
+        _caller_id: Uuid,
+    ) -> std::result::Result<(), DomainError> {
         let mut folders = self.folders.lock().unwrap();
         let mut trashed = self.trashed_folders.lock().unwrap();
 
@@ -796,6 +821,7 @@ impl FolderRepository for MockFolderRepository {
         &self,
         id: &str,
         _original_path: &str,
+        _caller_id: Uuid,
     ) -> std::result::Result<(), DomainError> {
         let mut folders = self.folders.lock().unwrap();
         let mut trashed = self.trashed_folders.lock().unwrap();
@@ -822,14 +848,6 @@ impl FolderRepository for MockFolderRepository {
             ))
         }
     }
-
-    async fn create_home_folder(
-        &self,
-        _user_id: Uuid,
-        _name: String,
-    ) -> std::result::Result<Folder, DomainError> {
-        Ok(Folder::default())
-    }
 }
 
 #[cfg(integration_tests)]

src/application/services/user_lifecycle_service.rs

@@ -132,7 +132,7 @@ impl UserLifecycleService {
 //
 // Always-on observer. Emits one structured `tracing::info!(target: "audit",
 // ...)` line per event. The only hook registered in PR 1; subsequent PRs
-// add HomeFolderLifecycleHook, AuthzCacheLifecycleHook, etc., each living
+// add PersonalDriveLifecycleHook, AuthzCacheLifecycleHook, etc., each living
 // next to the service it works for.
 // ─────────────────────────────────────────────────────────────────────────────
 

src/bin/load-seed.rs

@@ -218,10 +218,41 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     // Two parallel subtrees off root: one for the user-grant scenario, one for
     // the group-grant scenario. Each has its own depth/fanout shape so a single
     // grant cascades over a known fixed number of descendants.
-    let shared_subtree =
-        build_subtree(&pool, admin.id, "shared_root", args.depth, args.fanout).await?;
-    let group_subtree =
-        build_subtree(&pool, admin.id, "group_root", args.depth, args.fanout).await?;
+    // Post-D0: every folder needs a drive_id (NOT NULL) and root folders
+    // (parent_id IS NULL) are reserved for the atomic drive-creation
+    // transaction. The load-seed subtrees nest under admin's default
+    // personal drive's root folder ("Personal") — they're a workload
+    // shape, not their own drives. Look it up once and pass to both
+    // build_subtree calls so they share the same parent.
+    let admin_root: (Uuid,) = sqlx::query_as(
+        "SELECT f.id FROM storage.folders f
+           JOIN storage.drives d ON d.root_folder_id = f.id
+          WHERE d.default_for_user = $1
+          LIMIT 1",
+    )
+    .bind(admin.id)
+    .fetch_one(&pool)
+    .await?;
+    let admin_root_id = admin_root.0;
+
+    let shared_subtree = build_subtree(
+        &pool,
+        admin.id,
+        admin_root_id,
+        "shared_root",
+        args.depth,
+        args.fanout,
+    )
+    .await?;
+    let group_subtree = build_subtree(
+        &pool,
+        admin.id,
+        admin_root_id,
+        "group_root",
+        args.depth,
+        args.fanout,
+    )
+    .await?;
 
     let total_folders = shared_subtree.all_ids.len() as u64 + group_subtree.all_ids.len() as u64;
     let total_leaves = shared_subtree.leaves.len() + group_subtree.leaves.len();
@@ -463,7 +494,14 @@ struct Subtree {
     leaves: Vec<Uuid>,
 }
 
-/// Build a folder tree under `parent=NULL` rooted at `root_name`.
+/// Build a folder tree under `parent_id = mount_under` rooted at `root_name`.
+///
+/// `mount_under` is an existing folder UUID (post-D0: the user's default
+/// drive's root folder, since root folders — `parent_id IS NULL` — are
+/// reserved for the atomic drive-creation transaction and would trip
+/// the no-orphan-root-folder constraint trigger). Every level's
+/// `drive_id` is derived from the parent folder so the NOT NULL column
+/// is satisfied automatically.
 ///
 /// Inserts level-by-level so `trg_folders_path` resolves `path`/`lpath` from
 /// the already-committed parent rows. Returns the root, a depth-4 sample, the
@@ -471,6 +509,7 @@ struct Subtree {
 async fn build_subtree(
     pool: &PgPool,
     user_id: Uuid,
+    mount_under: Uuid,
     root_name: &str,
     depth: u32,
     fanout: u32,
@@ -485,14 +524,19 @@ async fn build_subtree(
         root_name, predicted
     );
 
-    // Level 0 — the root folder.
+    // Level 0 — the subtree's "root" sits inside `mount_under`, not at
+    // parent_id=NULL. drive_id is inherited from the mount point.
     let root: (Uuid,) = sqlx::query_as(
-        "INSERT INTO storage.folders (name, parent_id, user_id)
-         VALUES ($1, NULL, $2)
+        "INSERT INTO storage.folders
+            (name, parent_id, user_id, drive_id, created_by, updated_by)
+         SELECT $1, parent.id, $2, parent.drive_id, $2, $2
+           FROM storage.folders parent
+          WHERE parent.id = $3::uuid
          RETURNING id",
     )
     .bind(root_name)
     .bind(user_id)
+    .bind(mount_under)
     .fetch_one(pool)
     .await?;
     let root_id = root.0;
@@ -523,10 +567,16 @@ async fn build_subtree(
             parents.len()
         );
 
+        // drive_id derives from the parent folder — same pattern as
+        // file_blob_write_repository's resolve_owner_and_drive helper.
+        // Every parent in `current_level` already has a drive_id set,
+        // so the JOIN is guaranteed to find one.
         let rows: Vec<(Uuid,)> = sqlx::query_as(
-            "INSERT INTO storage.folders (name, parent_id, user_id)
-             SELECT f.name, f.parent_id, $1
+            "INSERT INTO storage.folders
+                (name, parent_id, user_id, drive_id, created_by, updated_by)
+             SELECT f.name, f.parent_id, $1, parent.drive_id, $1, $1
                FROM UNNEST($2::uuid[], $3::text[]) AS f(parent_id, name)
+               JOIN storage.folders parent ON parent.id = f.parent_id
              RETURNING id",
         )
         .bind(user_id)
@@ -601,10 +651,17 @@ async fn insert_files(
         .flat_map(|li| (0..files_per_leaf).map(move |fi| format!("file_{}_{}.txt", li, fi)))
         .collect();
 
+    // Post-D0: storage.files.drive_id is NOT NULL — derive it from the
+    // parent folder (same pattern as file_blob_write_repository's
+    // INSERTs and the resolve_owner_and_drive helper). The folder's
+    // drive_id was set during the M2 backfill or by the lifecycle hook
+    // for users provisioned after D0.
     sqlx::query(
-        "INSERT INTO storage.files (name, folder_id, user_id, blob_hash, size, mime_type)
-         SELECT f.name, f.folder_id, $1, $2, 0, 'text/plain'
-           FROM UNNEST($3::uuid[], $4::text[]) AS f(folder_id, name)",
+        "INSERT INTO storage.files
+            (name, folder_id, user_id, drive_id, blob_hash, size, mime_type)
+         SELECT f.name, f.folder_id, $1, fo.drive_id, $2, 0, 'text/plain'
+           FROM UNNEST($3::uuid[], $4::text[]) AS f(folder_id, name)
+           JOIN storage.folders fo ON fo.id = f.folder_id",
     )
     .bind(user_id)
     .bind(blob_hash)

src/common/di.rs

@@ -454,6 +454,7 @@ impl AppServiceFactory {
         repos: &RepositoryServices,
         trash_service: Option<Arc<TrashService>>,
         authz: &Arc<PgAclEngine>,
+        drive_repo: &Arc<crate::infrastructure::repositories::pg::DrivePgRepository>,
         storage_usage: &Arc<StorageUsageService>,
         content_index: Option<Arc<TantivyContentIndex>>,
         plugin_dispatch: Option<
@@ -540,6 +541,8 @@ impl AppServiceFactory {
             repos.file_read_repository.clone(),
             repos.folder_repository.clone(),
             content_index_port,
+            Some(authz.clone()),
+            Some(drive_repo.clone()),
             300,  // Cache TTL in seconds (5 minutes)
             1000, // Maximum cache entries
         )));
@@ -1050,6 +1053,12 @@ impl AppServiceFactory {
             subject_group_repo.clone(),
         );
 
+        // Drive repository — needed both by the lifecycle hook (when auth
+        // is enabled) and by `GET /api/drives` on the final `AppState`,
+        // so declared at the outer scope.
+        let drive_repo =
+            Arc::new(crate::infrastructure::repositories::pg::DrivePgRepository::new(pool.clone()));
+
         // 3b. Trash service (needed before application services)
         let trash_service = self
             .create_trash_service(&repos, &core, &authorization)
@@ -1078,6 +1087,7 @@ impl AppServiceFactory {
             &repos,
             trash_service.clone(),
             &authorization,
+            &drive_repo,
             &storage_usage,
             content_index.as_ref().map(|(idx, _)| idx.clone()),
             plugin_dispatch.clone(),
@@ -1147,7 +1157,7 @@ impl AppServiceFactory {
             //                                       audit event is recorded
             //                                       even if a later hook
             //                                       errors out.
-            //   2. HomeFolderLifecycleHook        — provisions the user's
+            //   2. PersonalDriveLifecycleHook        — provisions the user's
             //                                       home folder on
             //                                       created/login (no-op
             //                                       for external users).
@@ -1190,8 +1200,9 @@ impl AppServiceFactory {
                         crate::application::services::user_lifecycle_service::AuditLifecycleHook,
                     ))
                     .with_hook(Arc::new(
-                        crate::application::services::folder_service::HomeFolderLifecycleHook::new(
-                            apps.folder_service_concrete.clone(),
+                        crate::application::services::folder_service::PersonalDriveLifecycleHook::new(
+                            drive_repo.clone(),
+                            authorization.clone(),
                         ),
                     ))
                     .with_hook(Arc::new(
@@ -1224,7 +1235,7 @@ impl AppServiceFactory {
 
             // Auth services. Folder service no longer threaded here —
             // PR 3 moved home-folder provisioning into
-            // HomeFolderLifecycleHook, which already holds an Arc to the
+            // PersonalDriveLifecycleHook, which already holds an Arc to the
             // folder service via the user_lifecycle dispatcher.
             if self.config.features.enable_auth {
                 let services = crate::infrastructure::auth_factory::create_auth_services(
@@ -1379,6 +1390,7 @@ impl AppServiceFactory {
             webdav_lock_store:
                 crate::infrastructure::services::webdav_lock_service::create_webdav_lock_store(),
             authorization,
+            drive_repo: drive_repo.clone(),
             subject_group_service: Some(Arc::new(
                 crate::application::services::subject_group_service::SubjectGroupService::new(
                     subject_group_repo.clone(),
@@ -1839,6 +1851,12 @@ pub struct AppState {
     /// an enum dispatcher or `Arc<dyn AuthorizationEngine>` (with
     /// `async_trait` boxing).
     pub authorization: Arc<crate::infrastructure::services::pg_acl_engine::PgAclEngine>,
+    /// Drive entity repository — `GET /api/drives`, the personal-drive
+    /// lifecycle hook, and (post-D2) shared-drive creation flow all read
+    /// through this. Backing table is `storage.drives`; membership is
+    /// resolved through `role_grants` not a separate `drive_members`
+    /// table (see `docs/plan/drive.md` §3).
+    pub drive_repo: Arc<crate::infrastructure::repositories::pg::DrivePgRepository>,
     /// ReBAC subject-group management (CRUD + membership). `None` when the
     /// auth subsystem is not configured.
     pub subject_group_service:

src/common/stubs.rs

@@ -101,11 +101,19 @@ impl FileReadPort for StubFileReadPort {
         Ok(StoragePath::from_string("/"))
     }
 
-    async fn get_parent_folder_id(&self, _path: &str) -> Result<String, DomainError> {
+    async fn get_parent_folder_id(
+        &self,
+        _path: &str,
+        _drive_id: Uuid,
+    ) -> Result<String, DomainError> {
         Ok("root".to_string())
     }
 
-    async fn get_folder_id_by_path(&self, _folder_path: &str) -> Result<String, DomainError> {
+    async fn get_folder_id_by_path(
+        &self,
+        _folder_path: &str,
+        _drive_id: Uuid,
+    ) -> Result<String, DomainError> {
         Ok("stub-folder-id".to_string())
     }
 
@@ -157,6 +165,7 @@ impl FileWritePort for StubFileWritePort {
         _content_type: String,
         _blob_hash: &str,
         _size: u64,
+        _caller_id: Uuid,
     ) -> Result<File, DomainError> {
         Ok(File::default())
     }
@@ -165,6 +174,7 @@ impl FileWritePort for StubFileWritePort {
         &self,
         _file_id: &str,
         _target_folder_id: Option<String>,
+        _caller_id: Uuid,
     ) -> Result<File, DomainError> {
         Ok(File::default())
     }
@@ -174,11 +184,17 @@ impl FileWritePort for StubFileWritePort {
         _file_id: &str,
         _target_folder_id: Option<String>,
         _new_name: Option<&str>,
+        _caller_id: Uuid,
     ) -> Result<File, DomainError> {
         Ok(File::default())
     }
 
-    async fn rename_file(&self, _file_id: &str, _new_name: &str) -> Result<File, DomainError> {
+    async fn rename_file(
+        &self,
+        _file_id: &str,
+        _new_name: &str,
+        _caller_id: Uuid,
+    ) -> Result<File, DomainError> {
         Ok(File::default())
     }
 
@@ -192,6 +208,7 @@ impl FileWritePort for StubFileWritePort {
         _blob_hash: &str,
         _size: u64,
         _modified_at: Option<i64>,
+        _caller_id: Uuid,
     ) -> Result<(String, i64), DomainError> {
         Ok((String::new(), 0))
     }
@@ -202,11 +219,12 @@ impl FileWritePort for StubFileWritePort {
         _folder_id: Option<String>,
         _content_type: String,
         _size: u64,
+        _caller_id: Uuid,
     ) -> Result<(File, PathBuf), DomainError> {
         Ok((File::default(), PathBuf::from("/tmp/dummy")))
     }
 
-    async fn move_to_trash(&self, _file_id: &str) -> Result<(), DomainError> {
+    async fn move_to_trash(&self, _file_id: &str, _caller_id: Uuid) -> Result<(), DomainError> {
         Ok(())
     }
 
@@ -214,6 +232,7 @@ impl FileWritePort for StubFileWritePort {
         &self,
         _file_id: &str,
         _original_path: &str,
+        _caller_id: Uuid,
     ) -> Result<(), DomainError> {
         Ok(())
     }
@@ -234,6 +253,7 @@ impl FolderRepository for StubFolderStoragePort {
         &self,
         _name: String,
         _parent_id: Option<String>,
+        _caller_id: Uuid,
     ) -> Result<Folder, DomainError> {
         Ok(Folder::default())
     }
@@ -242,7 +262,11 @@ impl FolderRepository for StubFolderStoragePort {
         Ok(Folder::default())
     }
 
-    async fn get_folder_by_path(&self, _storage_path: &StoragePath) -> Result<Folder, DomainError> {
+    async fn get_folder_by_path(
+        &self,
+        _storage_path: &StoragePath,
+        _drive_id: Uuid,
+    ) -> Result<Folder, DomainError> {
         Ok(Folder::default())
     }
 
@@ -279,7 +303,12 @@ impl FolderRepository for StubFolderStoragePort {
         Ok((Vec::new(), Some(0)))
     }
 
-    async fn rename_folder(&self, _id: &str, _new_name: String) -> Result<Folder, DomainError> {
+    async fn rename_folder(
+        &self,
+        _id: &str,
+        _new_name: String,
+        _caller_id: Uuid,
+    ) -> Result<Folder, DomainError> {
         Ok(Folder::default())
     }
 
@@ -287,6 +316,7 @@ impl FolderRepository for StubFolderStoragePort {
         &self,
         _id: &str,
         _new_parent_id: Option<&str>,
+        _caller_id: Uuid,
     ) -> Result<Folder, DomainError> {
         Ok(Folder::default())
     }
@@ -295,7 +325,11 @@ impl FolderRepository for StubFolderStoragePort {
         Ok(())
     }
 
-    async fn folder_exists(&self, _storage_path: &StoragePath) -> Result<bool, DomainError> {
+    async fn folder_exists(
+        &self,
+        _storage_path: &StoragePath,
+        _drive_id: Uuid,
+    ) -> Result<bool, DomainError> {
         Ok(false)
     }
 
@@ -303,7 +337,7 @@ impl FolderRepository for StubFolderStoragePort {
         Ok(StoragePath::from_string("/"))
     }
 
-    async fn move_to_trash(&self, _folder_id: &str) -> Result<(), DomainError> {
+    async fn move_to_trash(&self, _folder_id: &str, _caller_id: Uuid) -> Result<(), DomainError> {
         Ok(())
     }
 
@@ -311,6 +345,7 @@ impl FolderRepository for StubFolderStoragePort {
         &self,
         _folder_id: &str,
         _original_path: &str,
+        _caller_id: Uuid,
     ) -> Result<(), DomainError> {
         Ok(())
     }
@@ -318,14 +353,6 @@ impl FolderRepository for StubFolderStoragePort {
     async fn delete_folder_permanently(&self, _folder_id: &str) -> Result<(), DomainError> {
         Ok(())
     }
-
-    async fn create_home_folder(
-        &self,
-        _user_id: Uuid,
-        _name: String,
-    ) -> Result<Folder, DomainError> {
-        Ok(Folder::default())
-    }
 }
 
 // ---------------------------------------------------------------------------
@@ -397,7 +424,11 @@ impl FolderUseCase for StubFolderUseCase {
         Ok(FolderDto::default())
     }
 
-    async fn get_folder_by_path(&self, _path: &str) -> Result<FolderDto, DomainError> {
+    async fn get_folder_by_path(
+        &self,
+        _path: &str,
+        _drive_id: Uuid,
+    ) -> Result<FolderDto, DomainError> {
         Ok(FolderDto::default())
     }
 
@@ -455,14 +486,6 @@ impl FolderUseCase for StubFolderUseCase {
     ) -> Result<(), DomainError> {
         Ok(())
     }
-
-    async fn create_home_folder(
-        &self,
-        _user_id: Uuid,
-        _name: String,
-    ) -> Result<FolderDto, DomainError> {
-        Ok(FolderDto::default())
-    }
 }
 
 // ---------------------------------------------------------------------------
@@ -478,6 +501,7 @@ impl FileUploadUseCase for StubFileUploadUseCase {
         _folder_id: Option<String>,
         _content_type: String,
         _blob: StoredBlob,
+        _caller_id: Uuid,
     ) -> Result<FileDto, DomainError> {
         Ok(FileDto::default())
     }
@@ -485,9 +509,11 @@ impl FileUploadUseCase for StubFileUploadUseCase {
     async fn update_file_streaming(
         &self,
         _path: &str,
+        _drive_id: Uuid,
         _blob: StoredBlob,
         _content_type: &str,
         _modified_at: Option<i64>,
+        _caller_id: Uuid,
     ) -> Result<FileDto, DomainError> {
         Ok(FileDto::default())
     }
@@ -567,7 +593,7 @@ impl FileRetrievalUseCase for StubFileRetrievalUseCase {
         Ok(Box::new(empty_stream))
     }
 
-    async fn get_file_by_path(&self, _path: &str) -> Result<FileDto, DomainError> {
+    async fn get_file_by_path(&self, _path: &str, _drive_id: Uuid) -> Result<FileDto, DomainError> {
         Err(DomainError::not_found("File", "stub"))
     }
 

src/domain/entities/drive.rs

@@ -0,0 +1,136 @@
+//! Drive — the top-level container that owns a tree of folders/files.
+//!
+//! Drives replaced the per-user `My Folder - <username>` wrapper at D0.
+//! Every folder and file row carries a `drive_id` (added by D0's
+//! migration); a drive is the natural unit of quota, sharing, and
+//! lifecycle. Membership is expressed through `storage.role_grants` rows
+//! with `resource_type='drive'` — there is no separate `drive_members`
+//! table.
+//!
+//! ## Kinds
+//!
+//! Two kinds today; the discriminant is the `kind` column with a CHECK
+//! constraint.
+//!
+//! - **`personal`** — single-user, single-owner. The owner is captured
+//!   by `default_for_user` (for the default Personal drive) or by an
+//!   Owner role_grant on a secondary personal drive. Personal drives
+//!   refuse `add_member`, `remove_member`, and `delete_drive` (when
+//!   it's the user's only or default drive). A user can have multiple
+//!   personal drives — one is marked default (`default_for_user =
+//!   <uid>`), the others are secondaries (`default_for_user = NULL`,
+//!   one Owner row in role_grants pinning them to the same user).
+//!
+//! - **`shared`** — multi-member, group-aware, full role roster
+//!   (viewer / commenter / contributor / editor / owner). Members
+//!   come from role_grants; group subjects expand transitively via
+//!   the existing `subject_groups` machinery. Last-owner protection
+//!   applies on member removal and drive deletion. Quota is set by
+//!   the drive owner (or admin); `used_bytes` tracks consumption.
+//!
+//! Future kinds (e.g. `system` for built-in scratch space) drop in by
+//! extending the CHECK + the `DriveKind` enum.
+//!
+//! ## Policies
+//!
+//! `policies` is a JSONB bag carrying feature flags / capability toggles
+//! that drive owners can flip without a schema change. Known keys live in
+//! `docs/plan/drive.md` §8 and §15 (e.g. `forbid_public_links`,
+//! `include_in_photo_index`, `forbid_music_index`). Unknown keys are
+//! preserved by the application — the schema is intentionally permissive
+//! so future capability flags can land without a migration.
+
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+/// Drive kind discriminant. Mirrors the `storage.drives.kind` CHECK
+/// constraint values.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum DriveKind {
+    /// Single-owner storage compartment. Cannot have members added or
+    /// removed via the membership API; the owner is fixed for the drive's
+    /// lifetime.
+    Personal,
+    /// Multi-member drive supporting the full role roster. Membership is
+    /// open to admin/owner-driven changes through the membership API.
+    Shared,
+}
+
+impl DriveKind {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            DriveKind::Personal => "personal",
+            DriveKind::Shared => "shared",
+        }
+    }
+
+    pub fn parse(s: &str) -> Option<Self> {
+        match s {
+            "personal" => Some(DriveKind::Personal),
+            "shared" => Some(DriveKind::Shared),
+            _ => None,
+        }
+    }
+}
+
+/// Domain entity for a row in `storage.drives`.
+///
+/// Drives are pure metadata under the D0 design (docs/plan/drive.md §3):
+/// no `name` column — the display name lives on the root folder pointed
+/// at by `root_folder_id`. Code that needs the name pairs this struct
+/// with a JOIN through `storage.folders`; see the repository's
+/// `DriveWithRootName` view-model.
+///
+/// Field-level constraints are enforced at the SQL layer (CHECK on
+/// `kind`, partial UNIQUE on `default_for_user`). The struct mirrors
+/// the column set 1:1; behaviour beyond field access lives in
+/// `DriveRepository` and `DriveService` (post-D0).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Drive {
+    /// Stable identifier. Generated server-side at creation.
+    pub id: Uuid,
+    /// Discriminant — see [`DriveKind`].
+    pub kind: DriveKind,
+    /// Set iff this is the user's default personal drive (UNIQUE in SQL
+    /// via a partial index `WHERE default_for_user IS NOT NULL`). NULL
+    /// on shared drives and on secondary personal drives.
+    pub default_for_user: Option<Uuid>,
+    /// The drive's mount-point folder. The column is NULLable in SQL
+    /// only because the atomic creation CTE writes it mid-statement
+    /// (a column-level `NOT NULL` would refuse the initial drive INSERT
+    /// — see docs/plan/drive.md §3). After any successful creation path,
+    /// this is populated; code reading `Drive` may treat it as `Uuid`,
+    /// not `Option<Uuid>`. A NULL at read time is a data-invariant bug.
+    pub root_folder_id: Uuid,
+    /// Soft cap on this drive's storage usage, in bytes. `None` means
+    /// "no quota" (rare; reserved for admin overrides). The default
+    /// initial quota for a fresh personal drive is taken from the
+    /// owner's `auth.users.storage_quota_bytes` at creation time.
+    /// **Mutation is OxiCloud-admin only** (docs/plan/drive.md §7) —
+    /// not in the drive `owner` role bundle.
+    pub quota_bytes: Option<i64>,
+    /// Running total of bytes consumed. Maintained incrementally by
+    /// upload/delete paths in D4; on D0 still reflects the pre-Drive
+    /// per-user counters via the backfill.
+    pub used_bytes: i64,
+    /// Capability flags / feature toggles. Extensible JSONB — see
+    /// `docs/plan/drive.md` §8 and §15 for the known keys.
+    pub policies: serde_json::Value,
+    pub created_at: chrono::DateTime<chrono::Utc>,
+    pub updated_at: chrono::DateTime<chrono::Utc>,
+}
+
+impl Drive {
+    /// `true` for the user's default personal drive (the only drive for
+    /// which `default_for_user` is set to that user's id).
+    pub fn is_default_for(&self, user_id: Uuid) -> bool {
+        self.default_for_user == Some(user_id)
+    }
+
+    /// `true` if this drive is a personal drive of any kind (default or
+    /// secondary). Encapsulates the kind check at the call site.
+    pub fn is_personal(&self) -> bool {
+        matches!(self.kind, DriveKind::Personal)
+    }
+}

src/domain/entities/file.rs

@@ -25,6 +25,10 @@ pub struct FileParts {
     pub owner_id: Option<Uuid>,
     /// BLAKE3 content hash. See [`File::content_hash`] for semantics.
     pub blob_hash: String,
+    /// §14 provenance: original creator. See [`File::created_by`].
+    pub created_by: Option<Uuid>,
+    /// §14 provenance: most recent mutator. See [`File::updated_by`].
+    pub updated_by: Option<Uuid>,
 }
 
 /**
@@ -77,6 +81,18 @@ pub struct File {
     /// ETag (the ETag formula may grow to include `modified_at` etc.,
     /// but `content_hash` remains the raw hash).
     blob_hash: String,
+
+    /// User that originally created this file (§14 provenance).
+    /// Stamped at INSERT and never updated thereafter. `None` when
+    /// the referenced user has been deleted (FK is `ON DELETE SET
+    /// NULL`) or for stub/DTO-reconstructed files.
+    created_by: Option<Uuid>,
+
+    /// User that performed the most recent mutation that bumped
+    /// `updated_at` (rename, move, content overwrite, trash, restore).
+    /// Authorship signal — distinct from ownership. `None` when the
+    /// referenced user is deleted or for stub/DTO-reconstructed files.
+    updated_by: Option<Uuid>,
 }
 
 // We no longer need this module, now we use a String directly
@@ -95,6 +111,8 @@ impl Default for File {
             modified_at: 0,
             owner_id: None,
             blob_hash: String::new(),
+            created_by: None,
+            updated_by: None,
         }
     }
 }
@@ -134,6 +152,8 @@ impl File {
             modified_at: now,
             owner_id: None,
             blob_hash: String::new(),
+            created_by: None,
+            updated_by: None,
         })
     }
 
@@ -166,6 +186,8 @@ impl File {
             modified_at,
             owner_id: None,
             blob_hash: String::new(),
+            created_by: None,
+            updated_by: None,
         })
     }
 
@@ -207,6 +229,40 @@ impl File {
         modified_at: u64,
         owner_id: Option<Uuid>,
         blob_hash: String,
+    ) -> FileResult<Self> {
+        Self::with_timestamps_blob_hash_and_provenance(
+            id,
+            name,
+            storage_path,
+            size,
+            mime_type,
+            folder_id,
+            created_at,
+            modified_at,
+            owner_id,
+            blob_hash,
+            None,
+            None,
+        )
+    }
+
+    /// Full constructor including the §14 provenance columns
+    /// (`created_by` / `updated_by`). PG-row callers use this to
+    /// preserve authorship across reconstruction.
+    #[allow(clippy::too_many_arguments)]
+    pub fn with_timestamps_blob_hash_and_provenance(
+        id: String,
+        name: String,
+        storage_path: StoragePath,
+        size: u64,
+        mime_type: String,
+        folder_id: Option<String>,
+        created_at: u64,
+        modified_at: u64,
+        owner_id: Option<Uuid>,
+        blob_hash: String,
+        created_by: Option<Uuid>,
+        updated_by: Option<Uuid>,
     ) -> FileResult<Self> {
         let name = normalize_storage_name(&name);
         if let Err(reason) = validate_storage_name(&name) {
@@ -228,6 +284,8 @@ impl File {
             modified_at,
             owner_id,
             blob_hash,
+            created_by,
+            updated_by,
         })
     }
 
@@ -248,6 +306,8 @@ impl File {
             modified_at: self.modified_at,
             owner_id: self.owner_id,
             blob_hash: self.blob_hash,
+            created_by: self.created_by,
+            updated_by: self.updated_by,
         }
     }
 
@@ -351,6 +411,21 @@ impl File {
         self.owner_id
     }
 
+    /// User that originally created this file (§14 provenance).
+    /// `None` when the referenced user has been deleted
+    /// (FK is `ON DELETE SET NULL`) or for stub/DTO entities.
+    pub fn created_by(&self) -> Option<Uuid> {
+        self.created_by
+    }
+
+    /// User that performed the most recent mutation that bumped
+    /// `updated_at`. Authorship signal — distinct from ownership.
+    /// `None` when the referenced user is deleted or for
+    /// stub/DTO entities.
+    pub fn updated_by(&self) -> Option<Uuid> {
+        self.updated_by
+    }
+
     #[allow(clippy::too_many_arguments)]
     pub fn from_dto(
         id: String,
@@ -382,6 +457,10 @@ impl File {
             modified_at,
             owner_id: None,
             blob_hash: String::new(),
+            // DTO round-trips don't carry provenance; callers needing
+            // it must reload from the repository.
+            created_by: None,
+            updated_by: None,
         }
     }
 

src/domain/entities/folder.rs

@@ -29,6 +29,13 @@ pub struct Folder {
     /// `None` only for legacy/stub folders; real folders always have an owner.
     owner_id: Option<Uuid>,
 
+    /// Drive that owns this folder. Post-D0 every `storage.folders` row
+    /// has `drive_id NOT NULL` (M3 migration). Path-based lookups scope
+    /// by this axis (not by `user_id`, which is dropped in D7).
+    /// `Uuid::nil()` only for stub/legacy in-memory folders that never
+    /// touched the DB.
+    drive_id: Uuid,
+
     /// Creation timestamp
     created_at: u64,
 
@@ -43,6 +50,20 @@ pub struct Folder {
     /// HTTP ETag emitted in PROPFIND/GET/HEAD responses — see
     /// [`Folder::etag`] for the formula and rationale.
     tree_modified_at: u64,
+
+    /// User that originally created this folder. Stamped at INSERT
+    /// from the caller's id and never updated afterwards (provenance,
+    /// not ownership — see §14 of the Drive plan). `None` when the
+    /// referenced user is later deleted (FK is `ON DELETE SET NULL`)
+    /// or for stub/DTO-reconstructed folders that never touched the DB.
+    created_by: Option<Uuid>,
+
+    /// User that performed the most recent mutation that touched
+    /// `updated_at` (rename, move, trash, restore, content overwrite).
+    /// Authorship signal — does NOT propagate via the tree-ETag flush
+    /// trigger. `None` when the referenced user is deleted or for
+    /// stub/DTO-reconstructed folders.
+    updated_by: Option<Uuid>,
 }
 
 // We no longer need this module, now we use a String directly
@@ -56,9 +77,12 @@ impl Default for Folder {
             path_string: "/".to_string(),
             parent_id: None,
             owner_id: None,
+            drive_id: Uuid::nil(),
             created_at: 0,
             modified_at: 0,
             tree_modified_at: 0,
+            created_by: None,
+            updated_by: None,
         }
     }
 }
@@ -103,9 +127,18 @@ impl Folder {
             path_string,
             parent_id,
             owner_id,
+            // In-memory constructor: callers that don't supply a
+            // drive_id are by definition stub/legacy paths (tests,
+            // pre-D0 fixtures, DTO round-trips). Real DB-backed
+            // folders flow through `with_timestamps_and_tree`.
+            drive_id: Uuid::nil(),
             created_at: now,
             modified_at: now,
             tree_modified_at: now,
+            // Provenance is unknown for in-memory construction; the DB
+            // reconstruction path supplies real values.
+            created_by: None,
+            updated_by: None,
         })
     }
 
@@ -128,6 +161,7 @@ impl Folder {
             storage_path,
             parent_id,
             None,
+            Uuid::nil(),
             created_at,
             modified_at,
             modified_at,
@@ -154,6 +188,7 @@ impl Folder {
             storage_path,
             parent_id,
             owner_id,
+            Uuid::nil(),
             created_at,
             modified_at,
             modified_at,
@@ -162,7 +197,12 @@ impl Folder {
 
     /// Full constructor used by the PG repository when reading rows.
     /// `tree_modified_at` comes from the trigger-maintained column on
-    /// `storage.folders` and feeds [`Folder::etag`].
+    /// `storage.folders` and feeds [`Folder::etag`]. `drive_id` is the
+    /// post-D0 `storage.folders.drive_id NOT NULL` column — every
+    /// path-based lookup scopes by this axis. `created_by` /
+    /// `updated_by` are the §14 provenance columns; both are nullable
+    /// because the M1 FK is `ON DELETE SET NULL` (a deleted user
+    /// leaves authored rows in place).
     #[allow(clippy::too_many_arguments)]
     pub fn with_timestamps_and_tree(
         id: String,
@@ -170,9 +210,42 @@ impl Folder {
         storage_path: StoragePath,
         parent_id: Option<String>,
         owner_id: Option<Uuid>,
+        drive_id: Uuid,
         created_at: u64,
         modified_at: u64,
         tree_modified_at: u64,
+    ) -> FolderResult<Self> {
+        Self::with_timestamps_tree_and_provenance(
+            id,
+            name,
+            storage_path,
+            parent_id,
+            owner_id,
+            drive_id,
+            created_at,
+            modified_at,
+            tree_modified_at,
+            None,
+            None,
+        )
+    }
+
+    /// Full constructor including the §14 provenance columns
+    /// (`created_by` / `updated_by`). Direct PG-row callers use this
+    /// to preserve authorship through the entity layer.
+    #[allow(clippy::too_many_arguments)]
+    pub fn with_timestamps_tree_and_provenance(
+        id: String,
+        name: String,
+        storage_path: StoragePath,
+        parent_id: Option<String>,
+        owner_id: Option<Uuid>,
+        drive_id: Uuid,
+        created_at: u64,
+        modified_at: u64,
+        tree_modified_at: u64,
+        created_by: Option<Uuid>,
+        updated_by: Option<Uuid>,
     ) -> FolderResult<Self> {
         let name = normalize_storage_name(&name);
         if let Err(reason) = validate_storage_name(&name) {
@@ -188,9 +261,12 @@ impl Folder {
             path_string,
             parent_id,
             owner_id,
+            drive_id,
             created_at,
             modified_at,
             tree_modified_at,
+            created_by,
+            updated_by,
         })
     }
 
@@ -227,6 +303,29 @@ impl Folder {
         self.owner_id
     }
 
+    /// Drive that owns this folder. Path-based lookups scope by
+    /// this axis (post-D0 invariant: `storage.folders.drive_id`
+    /// is `NOT NULL`).
+    pub fn drive_id(&self) -> Uuid {
+        self.drive_id
+    }
+
+    /// User that originally created this folder (§14 provenance).
+    /// `None` when the referenced user has been deleted
+    /// (FK is `ON DELETE SET NULL`) or for in-memory/DTO-reconstructed
+    /// entities.
+    pub fn created_by(&self) -> Option<Uuid> {
+        self.created_by
+    }
+
+    /// User that performed the most recent mutation that bumped
+    /// `updated_at`. Authorship signal — distinct from ownership.
+    /// `None` when the referenced user has been deleted or for
+    /// in-memory/DTO-reconstructed entities.
+    pub fn updated_by(&self) -> Option<Uuid> {
+        self.updated_by
+    }
+
     /// Latest descendant-write timestamp. Statement-level Postgres
     /// triggers enqueue every file/folder write into
     /// `storage.tree_etag_dirty`; the background `TreeEtagFlushService`
@@ -314,9 +413,18 @@ impl Folder {
             path_string: path,
             parent_id,
             owner_id: None,
+            // DTO round-trips lose drive_id (FolderDto carries it,
+            // but the legacy `from_dto` signature predates this
+            // change). Callers that need real scoping must reload
+            // through the repository.
+            drive_id: Uuid::nil(),
             created_at,
             modified_at,
             tree_modified_at: modified_at,
+            // DTO round-trips through this constructor lose
+            // provenance; callers that need it reload through the repo.
+            created_by: None,
+            updated_by: None,
         }
     }
 
@@ -353,12 +461,17 @@ impl Folder {
             path_string: new_path_string,
             parent_id: self.parent_id.clone(),
             owner_id: self.owner_id,
+            drive_id: self.drive_id,
             created_at: self.created_at,
             modified_at: now,
             // Renaming bumps both self and descendant rollup —
             // ancestors' listings now show a new name, so the
             // collection has materially changed.
             tree_modified_at: now,
+            // Provenance is preserved across the in-memory rebuild;
+            // real persisted updates re-read from the DB.
+            created_by: self.created_by,
+            updated_by: self.updated_by,
         })
     }
 
@@ -389,9 +502,12 @@ impl Folder {
             path_string: new_path_string,
             parent_id,
             owner_id: self.owner_id,
+            drive_id: self.drive_id,
             created_at: self.created_at,
             modified_at: now,
             tree_modified_at: now,
+            created_by: self.created_by,
+            updated_by: self.updated_by,
         })
     }
 
@@ -478,6 +594,7 @@ mod tests {
             StoragePath::from_string("/folder"),
             None,
             None,
+            Uuid::nil(),
             1_000,
             2_000,
             5_000,
@@ -499,6 +616,7 @@ mod tests {
             StoragePath::from_string("/a"),
             None,
             None,
+            Uuid::nil(),
             0,
             0,
             42,
@@ -510,6 +628,7 @@ mod tests {
             StoragePath::from_string("/b"),
             None,
             None,
+            Uuid::nil(),
             0,
             0,
             42,
@@ -532,6 +651,7 @@ mod tests {
             StoragePath::from_string("/folder"),
             None,
             None,
+            Uuid::nil(),
             1_000,
             2_000,
             3_000,
@@ -543,6 +663,7 @@ mod tests {
             StoragePath::from_string("/folder"),
             None,
             None,
+            Uuid::nil(),
             1_000,
             2_000,
             4_000,

src/domain/entities/mod.rs

@@ -3,6 +3,7 @@ pub mod calendar;
 pub mod calendar_event;
 pub mod contact;
 pub mod device_code;
+pub mod drive;
 pub mod entity_errors;
 pub mod face;
 pub mod file;

src/domain/repositories/drive_repository.rs

@@ -0,0 +1,173 @@
+//! Repository for [`Drive`] entities backed by `storage.drives`.
+//!
+//! Drives have no separate membership table — owner/editor/viewer
+//! membership lives in `storage.role_grants` with
+//! `resource_type='drive'`. That means **listing the drives a user can
+//! reach goes through the role-grant query, not through this
+//! repository**. This repo handles:
+//!
+//!   * Creating a drive (used by the user-creation lifecycle hook and
+//!     by D3's shared-drive flow).
+//!   * Looking up a single drive by id (used by the engine's owner_of /
+//!     check paths, by `/api/drives/{id}`, and by the drive picker).
+//!   * Finding the caller's default drive (used by the Photos / Music
+//!     endpoints and by D1's redirect-from-`/` logic).
+//!
+//! Membership-flavoured queries (e.g. "list every drive user X can
+//! read") live in `DriveListingService` (post-D0) which reads
+//! `role_grants` and resolves the matching drive rows here.
+
+use thiserror::Error;
+use uuid::Uuid;
+
+use crate::domain::entities::drive::{Drive, DriveKind};
+
+#[derive(Debug, Error)]
+pub enum DriveRepositoryError {
+    #[error("Drive not found: {0}")]
+    NotFound(String),
+    /// A user already has a default drive set — partial unique index on
+    /// `default_for_user` rejects a second one. Surfaces the constraint
+    /// explicitly so the lifecycle hook can no-op idempotently.
+    #[error("User already has a default drive: {0}")]
+    DefaultDriveAlreadyExists(String),
+    #[error("Invalid drive kind: {0}")]
+    InvalidKind(String),
+    #[error("Storage error: {0}")]
+    StorageError(String),
+}
+
+/// A drive paired with the display name from its root folder.
+///
+/// `storage.drives` has no `name` column under the D0 design
+/// (docs/plan/drive.md §3) — the display name lives on
+/// `storage.folders.name` of the row pointed at by `drive.root_folder_id`.
+/// Read paths join the two tables and hand callers this view-model so the
+/// API surface can continue to expose a single "drive with name" shape
+/// without a follow-up query per drive.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct DriveWithRootName {
+    pub drive: Drive,
+    /// The drive's display name. Sourced from `storage.folders.name`
+    /// of the root folder via JOIN at read time.
+    pub root_folder_name: String,
+}
+
+#[async_trait::async_trait]
+pub trait DriveRepository: Send + Sync + 'static {
+    /// Atomically create a personal drive together with its root folder
+    /// and the owner role_grant — all four DB writes in a single SQL
+    /// statement (docs/plan/drive.md §3 "Atomic creation"). The
+    /// statement runs as its own implicit transaction in autocommit mode
+    /// so a server crash mid-statement leaves no half-row state.
+    ///
+    /// The root folder is created with name `"Personal"` (the canonical
+    /// default) and `parent_id IS NULL`. The drive's `root_folder_id`
+    /// is wired to point at it before the statement commits.
+    ///
+    /// Returns `DefaultDriveAlreadyExists` when the owner already has a
+    /// default drive — relies on the partial UNIQUE index on
+    /// `default_for_user`.
+    async fn create_personal_drive_atomic(
+        &self,
+        owner_id: Uuid,
+        quota_bytes: Option<i64>,
+    ) -> Result<DriveWithRootName, DriveRepositoryError>;
+
+    /// Fetch a drive by id together with its display name. `NotFound`
+    /// when no row matches.
+    async fn get_by_id(&self, id: Uuid) -> Result<DriveWithRootName, DriveRepositoryError>;
+
+    /// Return the caller's default personal drive paired with its
+    /// display name, or `NotFound` if they don't have one (e.g.
+    /// external users; users created before the lifecycle hook fired).
+    /// Drives the Photos timeline scope, the `/api/recent/*` scope, and
+    /// D1's redirect-from-`/`.
+    async fn find_default_for_user(
+        &self,
+        user_id: Uuid,
+    ) -> Result<DriveWithRootName, DriveRepositoryError>;
+
+    /// Canonical "what is this user's home root folder id?" lookup.
+    ///
+    /// Returns `Some(uuid)` for any internal user with a default personal
+    /// drive (the lifecycle hook provisions one at registration), and
+    /// `None` for users who have no default drive (external users; users
+    /// created before the hook existed). The id identifies the user's
+    /// home **by drive ownership** (`default_for_user == user_id`),
+    /// never by folder name — users can rename their home, so any code
+    /// that wants to ask "is this folder the user's home?" must compare
+    /// folder ids, not names.
+    ///
+    /// Storage errors (DB unreachable, etc.) bubble up as `Err`; the
+    /// "user simply has no home" case is `Ok(None)`, not an error.
+    async fn home_root_folder_id_for(
+        &self,
+        user_id: Uuid,
+    ) -> Result<Option<Uuid>, DriveRepositoryError> {
+        match self.find_default_for_user(user_id).await {
+            Ok(d) => Ok(Some(d.drive.root_folder_id)),
+            Err(DriveRepositoryError::NotFound(_)) => Ok(None),
+            Err(e) => Err(e),
+        }
+    }
+
+    /// List drives the caller can read, resolved via `role_grants` for
+    /// `resource_type='drive'`. The caller's group memberships are
+    /// expanded by the engine's `subject_match_set`; that expanded set
+    /// is what this method's `subject_ids` argument carries.
+    ///
+    /// Returns rows in a stable order: default drive first (if any),
+    /// then by display name. The `/api/drives` handler relies on that
+    /// order for the picker UI without a follow-up sort.
+    async fn list_for_subjects(
+        &self,
+        subject_types: &[&str],
+        subject_ids: &[Uuid],
+    ) -> Result<Vec<DriveWithRootName>, DriveRepositoryError>;
+}
+
+/// Convenience: convert the canonical kind discriminator from its SQL
+/// form into the typed enum. Mirrored on the entity for symmetry.
+impl DriveKind {
+    pub fn from_sql(s: &str) -> Result<Self, DriveRepositoryError> {
+        DriveKind::parse(s).ok_or_else(|| DriveRepositoryError::InvalidKind(s.to_owned()))
+    }
+}
+
+/// Locate the user's home root folder within a generic list of items,
+/// identifying it by **drive ownership** (never by folder name — users
+/// can rename their home).
+///
+/// `id_fn` extracts a candidate `Uuid` from each item. The callsite
+/// commonly works with `FolderDto` (whose `id` is a `String`); the
+/// closure is `|f| Uuid::parse_str(&f.id).ok()`. Items whose ids can't
+/// be parsed are simply skipped — `position` ignores them.
+///
+/// Defined as a free function (not a trait method) so the
+/// `DriveRepository` trait stays `dyn`-compatible. Generic over both
+/// the repo (`R`) and the item shape (`T`); accepts both concrete repo
+/// types and `&dyn DriveRepository`.
+///
+/// Returns `None` when:
+///   * The user has no default drive (external users, pre-hook accounts).
+///   * The user's home root folder id isn't present in `items`.
+///   * The repo lookup errored (storage error is swallowed to None —
+///     callers wanting fail-loud semantics should call
+///     `home_root_folder_id_for` directly).
+pub async fn position_of_user_home_root_folder<R, T>(
+    drive_repo: &R,
+    user_id: Uuid,
+    items: &[T],
+    id_fn: impl Fn(&T) -> Option<Uuid>,
+) -> Option<usize>
+where
+    R: DriveRepository + ?Sized,
+{
+    let home_id = drive_repo
+        .home_root_folder_id_for(user_id)
+        .await
+        .ok()
+        .flatten()?;
+    items.iter().position(|item| id_fn(item) == Some(home_id))
+}

src/domain/repositories/file_repository.rs

@@ -12,6 +12,7 @@ use std::path::PathBuf;
 
 use bytes::Bytes;
 use futures::Stream;
+use uuid::Uuid;
 
 use crate::common::errors::DomainError;
 use crate::domain::entities::file::File;
@@ -49,8 +50,12 @@ pub trait FileReadRepository: Send + Sync + 'static {
     /// Gets the logical storage path of a file.
     async fn get_file_path(&self, id: &str) -> Result<StoragePath, DomainError>;
 
-    /// Gets the parent folder ID from a path (WebDAV).
-    async fn get_parent_folder_id(&self, path: &str) -> Result<String, DomainError>;
+    /// Gets the parent folder ID from a path (WebDAV), scoped to a drive.
+    ///
+    /// Post-D0, `storage.folders.path` is unique only within a single
+    /// drive — the `drive_id` filter scopes the lookup.
+    async fn get_parent_folder_id(&self, path: &str, drive_id: Uuid)
+    -> Result<String, DomainError>;
 }
 
 // ─────────────────────────────────────────────────────
@@ -73,6 +78,9 @@ pub trait FileWriteRepository: Send + Sync + 'static {
 
     /// Registers a file row pointing at a blob already stored in the
     /// content-addressable chunk store (one blob reference is consumed).
+    ///
+    /// `caller_id` stamps both `created_by` and `updated_by`
+    /// (§14 provenance).
     async fn save_file_with_blob(
         &self,
         name: String,
@@ -80,17 +88,26 @@ pub trait FileWriteRepository: Send + Sync + 'static {
         content_type: String,
         blob_hash: &str,
         size: u64,
+        caller_id: Uuid,
     ) -> Result<File, DomainError>;
 
-    /// Moves a file to another folder.
+    /// Moves a file to another folder. `caller_id` stamps `updated_by`
+    /// in the same UPDATE that bumps `updated_at` (§14 provenance).
     async fn move_file(
         &self,
         file_id: &str,
         target_folder_id: Option<String>,
+        caller_id: Uuid,
     ) -> Result<File, DomainError>;
 
-    /// Renames a file (same folder, different name).
-    async fn rename_file(&self, file_id: &str, new_name: &str) -> Result<File, DomainError>;
+    /// Renames a file (same folder, different name). `caller_id`
+    /// stamps `updated_by` in the same UPDATE (§14 provenance).
+    async fn rename_file(
+        &self,
+        file_id: &str,
+        new_name: &str,
+        caller_id: Uuid,
+    ) -> Result<File, DomainError>;
 
     /// Deletes a file.
     async fn delete_file(&self, id: &str) -> Result<(), DomainError>;
@@ -103,24 +120,31 @@ pub trait FileWriteRepository: Send + Sync + 'static {
     ///
     /// Returns `(File, PathBuf)` where `PathBuf` is the destination path for
     /// the deferred write that the `WriteBehindCache` will perform.
+    ///
+    /// `caller_id` stamps both `created_by` and `updated_by`
+    /// (§14 provenance).
     async fn register_file_deferred(
         &self,
         name: String,
         folder_id: Option<String>,
         content_type: String,
         size: u64,
+        caller_id: Uuid,
     ) -> Result<(File, PathBuf), DomainError>;
 
     // ── Trash operations ──
 
-    /// Moves a file to the trash
-    async fn move_to_trash(&self, file_id: &str) -> Result<(), DomainError>;
+    /// Moves a file to the trash. `caller_id` stamps `updated_by`
+    /// (§14 provenance).
+    async fn move_to_trash(&self, file_id: &str, caller_id: Uuid) -> Result<(), DomainError>;
 
-    /// Restores a file from the trash to its original location
+    /// Restores a file from the trash to its original location.
+    /// `caller_id` stamps `updated_by` (§14 provenance).
     async fn restore_from_trash(
         &self,
         file_id: &str,
         original_path: &str,
+        caller_id: Uuid,
     ) -> Result<(), DomainError>;
 
     /// Permanently deletes a file (used by the trash)

src/domain/repositories/folder_repository.rs

@@ -18,18 +18,35 @@ use uuid::Uuid;
 /// Defines the CRUD and management operations required for
 /// the Folder entity in the storage system.
 pub trait FolderRepository: Send + Sync + 'static {
-    /// Creates a new folder
+    /// Creates a new folder.
+    ///
+    /// `caller_id` is stamped into `created_by` and `updated_by`
+    /// (D0 §14 provenance — authorship belongs to whoever issued the
+    /// create, not to the parent folder's owner). Pre-D2 they're
+    /// silently equivalent (only the owner can write); D2 ships
+    /// shared drives where this distinction matters.
     async fn create_folder(
         &self,
         name: String,
         parent_id: Option<String>,
+        caller_id: Uuid,
     ) -> Result<Folder, DomainError>;
 
     /// Gets a folder by its ID
     async fn get_folder(&self, id: &str) -> Result<Folder, DomainError>;
 
-    /// Gets a folder by its storage path
-    async fn get_folder_by_path(&self, storage_path: &StoragePath) -> Result<Folder, DomainError>;
+    /// Gets a folder by its storage path within a drive's tree.
+    ///
+    /// Post-D0, `storage.folders.path` is unique only within a single
+    /// drive — root-folder names like `"Personal"` repeat across drives.
+    /// The `drive_id` filter scopes the lookup to a specific drive
+    /// (caller derives it from its protocol context: NC chroot, native
+    /// default-drive lookup, WOPI default-drive lookup).
+    async fn get_folder_by_path(
+        &self,
+        storage_path: &StoragePath,
+        drive_id: Uuid,
+    ) -> Result<Folder, DomainError>;
 
     /// Lists folders within a parent folder
     async fn list_folders(&self, parent_id: Option<&str>) -> Result<Vec<Folder>, DomainError>;
@@ -64,44 +81,61 @@ pub trait FolderRepository: Send + Sync + 'static {
         include_total: bool,
     ) -> Result<(Vec<Folder>, Option<usize>), DomainError>;
 
-    /// Renames a folder
-    async fn rename_folder(&self, id: &str, new_name: String) -> Result<Folder, DomainError>;
+    /// Renames a folder. `caller_id` is stamped into `updated_by`
+    /// alongside the `updated_at = NOW()` bump (§14 provenance).
+    async fn rename_folder(
+        &self,
+        id: &str,
+        new_name: String,
+        caller_id: Uuid,
+    ) -> Result<Folder, DomainError>;
 
-    /// Moves a folder to another parent
+    /// Moves a folder to another parent. `caller_id` is stamped into
+    /// `updated_by` alongside the `updated_at = NOW()` bump
+    /// (§14 provenance).
     async fn move_folder(
         &self,
         id: &str,
         new_parent_id: Option<&str>,
+        caller_id: Uuid,
     ) -> Result<Folder, DomainError>;
 
     /// Deletes a folder
     async fn delete_folder(&self, id: &str) -> Result<(), DomainError>;
 
-    /// Checks if a folder exists at the given path
-    async fn folder_exists(&self, storage_path: &StoragePath) -> Result<bool, DomainError>;
+    /// Checks if a folder exists at the given path within a drive.
+    ///
+    /// Post-D0 `storage.folders.path` is unique only within a single
+    /// drive — the `drive_id` filter scopes the existence check.
+    async fn folder_exists(
+        &self,
+        storage_path: &StoragePath,
+        drive_id: Uuid,
+    ) -> Result<bool, DomainError>;
 
     /// Gets the path of a folder
     async fn get_folder_path(&self, id: &str) -> Result<StoragePath, DomainError>;
 
     // ── Trash operations ──
 
-    /// Moves a folder to the trash
-    async fn move_to_trash(&self, folder_id: &str) -> Result<(), DomainError>;
+    /// Moves a folder to the trash. `caller_id` is stamped into
+    /// `updated_by` for the root row and every cascade-trashed
+    /// descendant (§14 provenance).
+    async fn move_to_trash(&self, folder_id: &str, caller_id: Uuid) -> Result<(), DomainError>;
 
-    /// Restores a folder from the trash to its original location
+    /// Restores a folder from the trash to its original location.
+    /// `caller_id` is stamped into `updated_by` for the root row and
+    /// every cascade-restored descendant (§14 provenance).
     async fn restore_from_trash(
         &self,
         folder_id: &str,
         original_path: &str,
+        caller_id: Uuid,
     ) -> Result<(), DomainError>;
 
     /// Permanently deletes a folder (used by the trash)
     async fn delete_folder_permanently(&self, folder_id: &str) -> Result<(), DomainError>;
 
-    /// Creates a root-level home folder for a user.
-    /// This is used during user registration to create the user's personal folder.
-    async fn create_home_folder(&self, user_id: Uuid, name: String) -> Result<Folder, DomainError>;
-
     /// Lists every folder in a subtree rooted at `folder_id` (inclusive).
     ///
     /// Uses ltree `<@` for a single GiST-indexed scan.  The result is

src/domain/repositories/mod.rs

@@ -2,6 +2,7 @@ pub mod address_book_repository;
 pub mod calendar_event_repository;
 pub mod calendar_repository;
 pub mod contact_repository;
+pub mod drive_repository;
 pub mod file_repository;
 pub mod folder_repository;
 pub mod magic_link_token_repository;

src/domain/services/authorization.rs

@@ -74,6 +74,10 @@ impl fmt::Display for Subject {
 pub enum Resource {
     Folder(Uuid),
     File(Uuid),
+    /// A drive — root scope for a tree of folders/files plus its own
+    /// membership and policy bag. Added in D0; membership lives in
+    /// `storage.role_grants` (no separate `drive_members` table).
+    Drive(Uuid),
     // Reserved for future use:
     // Calendar(Uuid),
     // Reserved for future use:
@@ -87,6 +91,7 @@ impl Resource {
         match self {
             Resource::Folder(_) => "folder",
             Resource::File(_) => "file",
+            Resource::Drive(_) => "drive",
             //Resource::Calendar(_) => "calendar",
             //Resource::AddressBook(_) => "adressbook",
             //Resource::Playlist(_) => "playlist",
@@ -95,12 +100,10 @@ impl Resource {
 
     pub fn id(&self) -> Uuid {
         match self {
-            Resource::Folder(id)
-            | Resource::File(id)
+            Resource::Folder(id) | Resource::File(id) | Resource::Drive(id) => *id,
             //| Resource::Calendar(id)
             //| Resource::AddressBook(id)
             //| Resource::Playlist(id)
-            => *id,
         }
     }
 
@@ -108,6 +111,7 @@ impl Resource {
         match resource_type {
             "folder" => Some(Resource::Folder(id)),
             "file" => Some(Resource::File(id)),
+            "drive" => Some(Resource::Drive(id)),
             //"calendar" => Some(Resource::Calendar(id)),
             //"adressbook" => Some(Resource::AddressBook(id)),
             //"playlist" => Some(Resource::Playlist(id)),
@@ -351,6 +355,7 @@ impl Grant {
 pub enum ResourceKind {
     File,
     Folder,
+    Drive,
     // Future: Calendar, AddressBook, Playlist, …
 }
 
@@ -359,6 +364,7 @@ impl ResourceKind {
         match self {
             ResourceKind::File => "file",
             ResourceKind::Folder => "folder",
+            ResourceKind::Drive => "drive",
         }
     }
 
@@ -366,6 +372,7 @@ impl ResourceKind {
         match s {
             "file" => Some(ResourceKind::File),
             "folder" => Some(ResourceKind::Folder),
+            "drive" => Some(ResourceKind::Drive),
             _ => None,
         }
     }

src/infrastructure/auth_factory.rs

@@ -47,7 +47,7 @@ pub async fn create_auth_services(
     );
 
     // Wire the user-lifecycle dispatcher. Home-folder provisioning is
-    // now handled by HomeFolderLifecycleHook (registered on the
+    // now handled by PersonalDriveLifecycleHook (registered on the
     // dispatcher in DI) — AuthApplicationService no longer needs a
     // direct FolderService dependency for that path.
     auth_app_service = auth_app_service.with_user_lifecycle(user_lifecycle);

src/infrastructure/db.rs

@@ -200,6 +200,25 @@ async fn run_migrations(pool: &PgPool) -> Result<()> {
 
     match sqlx::migrate!().run(pool).await {
         Ok(()) => Ok(()),
-        Err(e) => Err(DbError(format!("Migration error: {}", e))),
+        Err(e) => Err(DbError(format_error_chain("Migration error", &e))),
     }
 }
+
+/// Format an error and every wrapped `source()` cause on a single line.
+///
+/// sqlx's `MigrateError::Execute` wraps the underlying `sqlx::Error::Database`
+/// which in turn carries the PG `DETAIL` (e.g. `Key (version)=(20260803000000)`
+/// for a duplicate-key on `_sqlx_migrations_pkey`). The default `Display`
+/// only renders the outermost layer, so the operationally-critical hint
+/// gets buried. Walking the chain surfaces it without needing to bump
+/// `RUST_LOG` to debug.
+fn format_error_chain(prefix: &str, e: &(dyn std::error::Error + 'static)) -> String {
+    let mut out = format!("{prefix}: {e}");
+    let mut cur = e.source();
+    while let Some(c) = cur {
+        out.push_str(" -> ");
+        out.push_str(&c.to_string());
+        cur = c.source();
+    }
+    out
+}

src/infrastructure/repositories/pg/drive_pg_repository.rs

@@ -0,0 +1,271 @@
+//! PostgreSQL implementation of [`DriveRepository`].
+//!
+//! The repo deals only with the `storage.drives` table itself. Drive
+//! membership lives in `storage.role_grants` (`resource_type='drive'`)
+//! and is queried through the engine's existing grant paths;
+//! `list_for_subjects` below resolves `role_grants` → `storage.drives`
+//! via a single join.
+//!
+//! See `migrations/20260802000000_drives_schema_additive.sql` for the
+//! schema and `docs/plan/drive.md` §3 / §15 for the locked design.
+
+use std::sync::Arc;
+
+use sqlx::{PgPool, Row, types::Uuid};
+
+use crate::domain::entities::drive::{Drive, DriveKind};
+use crate::domain::repositories::drive_repository::{
+    DriveRepository, DriveRepositoryError, DriveWithRootName,
+};
+
+pub struct DrivePgRepository {
+    pool: Arc<PgPool>,
+}
+
+impl DrivePgRepository {
+    pub fn new(pool: Arc<PgPool>) -> Self {
+        Self { pool }
+    }
+
+    fn map_sqlx_err(context: &'static str, e: sqlx::Error) -> DriveRepositoryError {
+        if let sqlx::Error::Database(ref dberr) = e
+            && let Some(code) = dberr.code()
+            && code.as_ref() == "23505"
+        {
+            // unique_violation. With drives, the only relevant unique is
+            // the partial index `idx_drives_default_for_user_unique` —
+            // surface the typed variant so the lifecycle hook can detect
+            // idempotent re-runs (D0-9 calls create_personal_drive_atomic
+            // during user provisioning).
+            return DriveRepositoryError::DefaultDriveAlreadyExists(dberr.to_string());
+        }
+        DriveRepositoryError::StorageError(format!("{context}: {e}"))
+    }
+
+    /// Map a row carrying both the drive's columns AND a `root_folder_name`
+    /// column (sourced via JOIN with `storage.folders`) into the view-model.
+    fn row_to_drive_with_name(
+        row: &sqlx::postgres::PgRow,
+    ) -> Result<DriveWithRootName, DriveRepositoryError> {
+        let kind_str: String = row.get("kind");
+        let kind = DriveKind::from_sql(&kind_str)?;
+        let drive = Drive {
+            id: row.get("id"),
+            kind,
+            default_for_user: row.get("default_for_user"),
+            root_folder_id: row.get("root_folder_id"),
+            quota_bytes: row.get("quota_bytes"),
+            used_bytes: row.get("used_bytes"),
+            policies: row.get("policies"),
+            created_at: row.get("created_at"),
+            updated_at: row.get("updated_at"),
+        };
+        Ok(DriveWithRootName {
+            drive,
+            root_folder_name: row.get("root_folder_name"),
+        })
+    }
+}
+
+#[async_trait::async_trait]
+impl DriveRepository for DrivePgRepository {
+    async fn create_personal_drive_atomic(
+        &self,
+        owner_id: Uuid,
+        quota_bytes: Option<i64>,
+    ) -> Result<DriveWithRootName, DriveRepositoryError> {
+        // Four writes wrapped in a single transaction so either all
+        // commit or none does (docs/plan/drive.md §3). A single CTE
+        // statement would be cleaner on paper but doesn't work in
+        // PostgreSQL: CTE sub-statements share an MVCC snapshot, so
+        // `UPDATE storage.drives WHERE id = …` cannot match a row
+        // inserted by an earlier CTE branch. We use plain sequential
+        // statements inside `pool.begin()` instead — each statement
+        // sees the prior ones' writes (transaction-local visibility),
+        // and FK constraints are satisfied at insert time because the
+        // referenced rows already exist.
+        //
+        // Rollback semantics: any error before `tx.commit()` (FK
+        // violation, unique_violation on `default_for_user`, server
+        // crash) discards every partial write. No orphan drive, no
+        // folder without a drive, no drive without an owner.
+        let mut tx = self
+            .pool
+            .begin()
+            .await
+            .map_err(|e| Self::map_sqlx_err("create_personal_drive_atomic.begin", e))?;
+
+        // 1. Drive row (root_folder_id NULL — populated in step 3).
+        let drive_id: Uuid = sqlx::query_scalar(
+            r#"
+            INSERT INTO storage.drives
+                (kind, default_for_user, quota_bytes, policies)
+            VALUES ('personal', $1, $2, '{}'::jsonb)
+            RETURNING id
+            "#,
+        )
+        .bind(owner_id)
+        .bind(quota_bytes)
+        .fetch_one(&mut *tx)
+        .await
+        .map_err(|e| Self::map_sqlx_err("create_personal_drive_atomic.drive", e))?;
+
+        // 2. Root folder. `parent_id IS NULL` makes it a root in the
+        //    drive; `drive_id` closes the FK in this direction.
+        let folder_id: Uuid = sqlx::query_scalar(
+            r#"
+            INSERT INTO storage.folders
+                (name, parent_id, user_id, drive_id, created_by, updated_by)
+            VALUES ('Personal', NULL, $1, $2, $1, $1)
+            RETURNING id
+            "#,
+        )
+        .bind(owner_id)
+        .bind(drive_id)
+        .fetch_one(&mut *tx)
+        .await
+        .map_err(|e| Self::map_sqlx_err("create_personal_drive_atomic.folder", e))?;
+
+        // 3. Close the other side of the circular reference.
+        sqlx::query(r#"UPDATE storage.drives SET root_folder_id = $1 WHERE id = $2"#)
+            .bind(folder_id)
+            .bind(drive_id)
+            .execute(&mut *tx)
+            .await
+            .map_err(|e| Self::map_sqlx_err("create_personal_drive_atomic.wire", e))?;
+
+        // 4. Owner role_grant — the caller becomes the drive's sole
+        //    owner (single-user invariant on personal drives, §2).
+        sqlx::query(
+            r#"
+            INSERT INTO storage.role_grants
+                (subject_type, subject_id, resource_type, resource_id,
+                 role, granted_by)
+            VALUES ('user', $1, 'drive', $2, 'owner', $1)
+            "#,
+        )
+        .bind(owner_id)
+        .bind(drive_id)
+        .execute(&mut *tx)
+        .await
+        .map_err(|e| Self::map_sqlx_err("create_personal_drive_atomic.grant", e))?;
+
+        // Fetch the row in its final state so the caller gets a
+        // consistent view (including DB-computed defaults like
+        // `created_at`, `used_bytes`).
+        let row = sqlx::query(
+            r#"
+            SELECT d.id, d.kind, d.default_for_user, d.root_folder_id,
+                   d.quota_bytes, d.used_bytes, d.policies,
+                   d.created_at, d.updated_at,
+                   f.name AS root_folder_name
+              FROM storage.drives d
+              JOIN storage.folders f ON f.id = d.root_folder_id
+             WHERE d.id = $1
+            "#,
+        )
+        .bind(drive_id)
+        .fetch_one(&mut *tx)
+        .await
+        .map_err(|e| Self::map_sqlx_err("create_personal_drive_atomic.read", e))?;
+
+        tx.commit()
+            .await
+            .map_err(|e| Self::map_sqlx_err("create_personal_drive_atomic.commit", e))?;
+
+        Self::row_to_drive_with_name(&row)
+    }
+
+    async fn get_by_id(&self, id: Uuid) -> Result<DriveWithRootName, DriveRepositoryError> {
+        let row = sqlx::query(
+            r#"
+            SELECT d.id, d.kind, d.default_for_user, d.root_folder_id,
+                   d.quota_bytes, d.used_bytes, d.policies,
+                   d.created_at, d.updated_at,
+                   f.name AS root_folder_name
+              FROM storage.drives d
+              JOIN storage.folders f ON f.id = d.root_folder_id
+             WHERE d.id = $1
+            "#,
+        )
+        .bind(id)
+        .fetch_optional(self.pool.as_ref())
+        .await
+        .map_err(|e| Self::map_sqlx_err("get_by_id", e))?
+        .ok_or_else(|| DriveRepositoryError::NotFound(id.to_string()))?;
+
+        Self::row_to_drive_with_name(&row)
+    }
+
+    async fn find_default_for_user(
+        &self,
+        user_id: Uuid,
+    ) -> Result<DriveWithRootName, DriveRepositoryError> {
+        let row = sqlx::query(
+            r#"
+            SELECT d.id, d.kind, d.default_for_user, d.root_folder_id,
+                   d.quota_bytes, d.used_bytes, d.policies,
+                   d.created_at, d.updated_at,
+                   f.name AS root_folder_name
+              FROM storage.drives d
+              JOIN storage.folders f ON f.id = d.root_folder_id
+             WHERE d.default_for_user = $1
+            "#,
+        )
+        .bind(user_id)
+        .fetch_optional(self.pool.as_ref())
+        .await
+        .map_err(|e| Self::map_sqlx_err("find_default_for_user", e))?
+        .ok_or_else(|| DriveRepositoryError::NotFound(user_id.to_string()))?;
+
+        Self::row_to_drive_with_name(&row)
+    }
+
+    async fn list_for_subjects(
+        &self,
+        subject_types: &[&str],
+        subject_ids: &[Uuid],
+    ) -> Result<Vec<DriveWithRootName>, DriveRepositoryError> {
+        // Joining role_grants → drives → folders returns every drive the
+        // expanded subject set can read, paired with its display name.
+        // ORDER BY puts default drives first (so the picker UI doesn't
+        // need a follow-up sort), then alphabetical by name. GROUP BY
+        // collapses duplicate role_grants on the same drive (direct +
+        // group-mediated) and sidesteps PostgreSQL's "ORDER BY
+        // expression must appear in select list" rule that SELECT
+        // DISTINCT imposes.
+        let rows = sqlx::query(
+            r#"
+            SELECT d.id, d.kind, d.default_for_user, d.root_folder_id,
+                   d.quota_bytes, d.used_bytes, d.policies,
+                   d.created_at, d.updated_at,
+                   f.name AS root_folder_name
+              FROM storage.drives d
+              JOIN storage.folders f ON f.id = d.root_folder_id
+              JOIN storage.role_grants g
+                ON g.resource_type = 'drive'
+               AND g.resource_id   = d.id
+             WHERE g.subject_type = ANY($1)
+               AND g.subject_id   = ANY($2)
+               AND (g.expires_at IS NULL OR g.expires_at > NOW())
+             GROUP BY d.id, d.kind, d.default_for_user, d.root_folder_id,
+                      d.quota_bytes, d.used_bytes, d.policies,
+                      d.created_at, d.updated_at, f.name
+             ORDER BY (d.default_for_user IS NULL) ASC,
+                      LOWER(f.name) ASC
+            "#,
+        )
+        .bind(
+            subject_types
+                .iter()
+                .map(|s| s.to_string())
+                .collect::<Vec<_>>(),
+        )
+        .bind(subject_ids)
+        .fetch_all(self.pool.as_ref())
+        .await
+        .map_err(|e| Self::map_sqlx_err("list_for_subjects", e))?;
+
+        rows.iter().map(Self::row_to_drive_with_name).collect()
+    }
+}

src/infrastructure/repositories/pg/file_blob_read_repository.rs

@@ -19,6 +19,8 @@ type MediaFileRow = (
     i64,            // updated_at
     String,         // blob_hash
     Option<Uuid>,   // user_id
+    Option<Uuid>,   // created_by (§14 provenance)
+    Option<Uuid>,   // updated_by (§14 provenance)
     i64,            // sort_date
     Option<i32>,    // width
     Option<i32>,    // height
@@ -42,7 +44,9 @@ use crate::infrastructure::services::dedup_service::DedupService;
 use uuid::Uuid;
 
 /// Type alias for file metadata rows from SQL queries.
-/// Fields: id, name, folder_id, folder_path, size, mime_type, created_at, updated_at, blob_hash, user_id
+/// Fields: id, name, folder_id, folder_path, size, mime_type,
+/// created_at, updated_at, blob_hash, user_id, created_by, updated_by.
+/// `created_by` / `updated_by` are the §14 provenance columns.
 type FileRow = (
     String,
     String,
@@ -54,6 +58,8 @@ type FileRow = (
     i64,
     String,
     Option<Uuid>,
+    Option<Uuid>,
+    Option<Uuid>,
 );
 
 /// Append the optional type/date/size filters from `criteria` to
@@ -228,7 +234,8 @@ impl FileBlobReadRepository {
                     EXTRACT(EPOCH FROM fi.created_at)::bigint, \
                     EXTRACT(EPOCH FROM fi.updated_at)::bigint, \
                     fi.blob_hash, \
-                    fi.user_id \
+                    fi.user_id, \
+                    fi.created_by, fi.updated_by \
                FROM storage.files fi \
                LEFT JOIN storage.folders fo ON fo.id = fi.folder_id \
               WHERE {where_clause}"
@@ -248,8 +255,10 @@ impl FileBlobReadRepository {
 
         rows.into_iter()
             .map(
-                |(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid)| {
-                    Self::row_to_file(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid)
+                |(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub)| {
+                    Self::row_to_file(
+                        id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub,
+                    )
                 },
             )
             .collect::<Result<Vec<_>, _>>()
@@ -277,7 +286,8 @@ impl FileBlobReadRepository {
                     EXTRACT(EPOCH FROM fi.created_at)::bigint, \
                     EXTRACT(EPOCH FROM fi.updated_at)::bigint, \
                     fi.blob_hash, \
-                    fi.user_id \
+                    fi.user_id, \
+                    fi.created_by, fi.updated_by \
                FROM storage.files fi \
                LEFT JOIN storage.folders fo ON fo.id = fi.folder_id \
               WHERE fi.id = ANY($1) AND NOT fi.is_trashed",
@@ -291,8 +301,10 @@ impl FileBlobReadRepository {
 
         rows.into_iter()
             .map(
-                |(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid)| {
-                    Self::row_to_file(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid)
+                |(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub)| {
+                    Self::row_to_file(
+                        id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub,
+                    )
                 },
             )
             .collect::<Result<Vec<_>, _>>()
@@ -357,9 +369,11 @@ impl FileBlobReadRepository {
         modified_at: i64,
         blob_hash: String,
         owner_id: Option<Uuid>,
+        created_by: Option<Uuid>,
+        updated_by: Option<Uuid>,
     ) -> Result<File, DomainError> {
         let storage_path = Self::make_file_path(folder_path.as_deref(), &name);
-        File::with_timestamps_and_blob_hash(
+        File::with_timestamps_blob_hash_and_provenance(
             id,
             name,
             storage_path,
@@ -370,6 +384,8 @@ impl FileBlobReadRepository {
             modified_at as u64,
             owner_id,
             blob_hash,
+            created_by,
+            updated_by,
         )
         .map_err(|e| DomainError::internal_error("FileBlobRead", format!("entity: {e}")))
     }
@@ -428,6 +444,7 @@ impl FileBlobReadRepository {
                    EXTRACT(EPOCH FROM fi.updated_at)::bigint,
                    fi.blob_hash,
                    fi.user_id,
+                   fi.created_by, fi.updated_by,
                    EXTRACT(EPOCH FROM fi.media_sort_date)::bigint AS sort_date,
                    fm.width, fm.height
               FROM storage.files fi
@@ -453,9 +470,9 @@ impl FileBlobReadRepository {
         let mut sort_dates = Vec::with_capacity(rows.len());
         let mut dims = Vec::with_capacity(rows.len());
 
-        for (id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, sd, w, h) in rows {
+        for (id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub, sd, w, h) in rows {
             files.push(Self::row_to_file(
-                id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid,
+                id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub,
             )?);
             sort_dates.push(sd);
             dims.push((w, h));
@@ -530,6 +547,8 @@ impl FileReadPort for FileBlobReadRepository {
                 i64,            // updated_at
                 String,         // blob_hash
                 Option<Uuid>,   // user_id (owner)
+                Option<Uuid>,   // created_by (§14)
+                Option<Uuid>,   // updated_by (§14)
             ),
         >(
             r#"
@@ -538,7 +557,8 @@ impl FileReadPort for FileBlobReadRepository {
                    EXTRACT(EPOCH FROM fi.created_at)::bigint,
                    EXTRACT(EPOCH FROM fi.updated_at)::bigint,
                    fi.blob_hash,
-                   fi.user_id
+                   fi.user_id,
+                   fi.created_by, fi.updated_by
               FROM storage.files fi
               LEFT JOIN storage.folders fo ON fo.id = fi.folder_id
              WHERE fi.id = $1::uuid AND NOT fi.is_trashed
@@ -555,7 +575,7 @@ impl FileReadPort for FileBlobReadRepository {
         self.hash_cache.insert(id.to_string(), row.8.clone());
 
         Self::row_to_file(
-            row.0, row.1, row.2, row.3, row.4, row.5, row.6, row.7, row.8, row.9,
+            row.0, row.1, row.2, row.3, row.4, row.5, row.6, row.7, row.8, row.9, row.10, row.11,
         )
     }
 
@@ -576,6 +596,8 @@ impl FileReadPort for FileBlobReadRepository {
                 i64,
                 String,
                 Option<Uuid>,
+                Option<Uuid>, // created_by (§14)
+                Option<Uuid>, // updated_by (§14)
             ),
         >(
             r#"
@@ -584,7 +606,8 @@ impl FileReadPort for FileBlobReadRepository {
                    EXTRACT(EPOCH FROM fi.created_at)::bigint,
                    EXTRACT(EPOCH FROM fi.updated_at)::bigint,
                    fi.blob_hash,
-                   fi.user_id
+                   fi.user_id,
+                   fi.created_by, fi.updated_by
               FROM storage.files fi
               LEFT JOIN storage.folders fo ON fo.id = fi.folder_id
              WHERE fi.id = $1::uuid
@@ -598,7 +621,7 @@ impl FileReadPort for FileBlobReadRepository {
 
         self.hash_cache.insert(id.to_string(), row.8.clone());
         Self::row_to_file(
-            row.0, row.1, row.2, row.3, row.4, row.5, row.6, row.7, row.8, row.9,
+            row.0, row.1, row.2, row.3, row.4, row.5, row.6, row.7, row.8, row.9, row.10, row.11,
         )
     }
 
@@ -616,6 +639,8 @@ impl FileReadPort for FileBlobReadRepository {
                 i64,            // updated_at
                 String,         // blob_hash
                 Option<Uuid>,   // user_id (owner)
+                Option<Uuid>,   // created_by (§14)
+                Option<Uuid>,   // updated_by (§14)
             ),
         >(
             r#"
@@ -624,7 +649,8 @@ impl FileReadPort for FileBlobReadRepository {
                    EXTRACT(EPOCH FROM fi.created_at)::bigint,
                    EXTRACT(EPOCH FROM fi.updated_at)::bigint,
                    fi.blob_hash,
-                   fi.user_id
+                   fi.user_id,
+                   fi.created_by, fi.updated_by
               FROM storage.files fi
               LEFT JOIN storage.folders fo ON fo.id = fi.folder_id
              WHERE fi.id = $1::uuid
@@ -643,7 +669,7 @@ impl FileReadPort for FileBlobReadRepository {
         self.hash_cache.insert(id.to_string(), row.8.clone());
 
         Self::row_to_file(
-            row.0, row.1, row.2, row.3, row.4, row.5, row.6, row.7, row.8, row.9,
+            row.0, row.1, row.2, row.3, row.4, row.5, row.6, row.7, row.8, row.9, row.10, row.11,
         )
     }
 
@@ -657,7 +683,8 @@ impl FileReadPort for FileBlobReadRepository {
                        EXTRACT(EPOCH FROM fi.created_at)::bigint,
                        EXTRACT(EPOCH FROM fi.updated_at)::bigint,
                        fi.blob_hash,
-                       fi.user_id
+                       fi.user_id,
+                   fi.created_by, fi.updated_by
                   FROM storage.files fi
                   LEFT JOIN storage.folders fo ON fo.id = fi.folder_id
                  WHERE fi.folder_id = $1::uuid AND NOT fi.is_trashed
@@ -675,7 +702,8 @@ impl FileReadPort for FileBlobReadRepository {
                        EXTRACT(EPOCH FROM fi.created_at)::bigint,
                        EXTRACT(EPOCH FROM fi.updated_at)::bigint,
                        fi.blob_hash,
-                       fi.user_id
+                       fi.user_id,
+                   fi.created_by, fi.updated_by
                   FROM storage.files fi
                   LEFT JOIN storage.folders fo ON fo.id = fi.folder_id
                  WHERE fi.folder_id IS NULL AND NOT fi.is_trashed
@@ -689,8 +717,10 @@ impl FileReadPort for FileBlobReadRepository {
 
         rows.into_iter()
             .map(
-                |(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid)| {
-                    Self::row_to_file(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid)
+                |(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub)| {
+                    Self::row_to_file(
+                        id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub,
+                    )
                 },
             )
             .collect()
@@ -711,7 +741,8 @@ impl FileReadPort for FileBlobReadRepository {
                        EXTRACT(EPOCH FROM fi.created_at)::bigint,
                        EXTRACT(EPOCH FROM fi.updated_at)::bigint,
                        fi.blob_hash,
-                       fi.user_id
+                       fi.user_id,
+                   fi.created_by, fi.updated_by
                   FROM storage.files fi
                   LEFT JOIN storage.folders fo ON fo.id = fi.folder_id
                  WHERE fi.folder_id = $1::uuid AND NOT fi.is_trashed
@@ -731,7 +762,8 @@ impl FileReadPort for FileBlobReadRepository {
                        EXTRACT(EPOCH FROM fi.created_at)::bigint,
                        EXTRACT(EPOCH FROM fi.updated_at)::bigint,
                        fi.blob_hash,
-                       fi.user_id
+                       fi.user_id,
+                   fi.created_by, fi.updated_by
                   FROM storage.files fi
                   LEFT JOIN storage.folders fo ON fo.id = fi.folder_id
                  WHERE fi.folder_id IS NULL AND NOT fi.is_trashed
@@ -747,8 +779,10 @@ impl FileReadPort for FileBlobReadRepository {
 
         rows.into_iter()
             .map(
-                |(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid)| {
-                    Self::row_to_file(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid)
+                |(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub)| {
+                    Self::row_to_file(
+                        id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub,
+                    )
                 },
             )
             .collect()
@@ -777,7 +811,8 @@ impl FileReadPort for FileBlobReadRepository {
                        EXTRACT(EPOCH FROM fi.created_at)::bigint,
                        EXTRACT(EPOCH FROM fi.updated_at)::bigint,
                        fi.blob_hash,
-                       fi.user_id
+                       fi.user_id,
+                   fi.created_by, fi.updated_by
                   FROM storage.files fi
                   LEFT JOIN storage.folders fo ON fo.id = fi.folder_id
                  WHERE fi.folder_id = $1::uuid AND NOT fi.is_trashed
@@ -798,7 +833,8 @@ impl FileReadPort for FileBlobReadRepository {
                        EXTRACT(EPOCH FROM fi.created_at)::bigint,
                        EXTRACT(EPOCH FROM fi.updated_at)::bigint,
                        fi.blob_hash,
-                       fi.user_id
+                       fi.user_id,
+                   fi.created_by, fi.updated_by
                   FROM storage.files fi
                   LEFT JOIN storage.folders fo ON fo.id = fi.folder_id
                  WHERE fi.folder_id IS NULL AND NOT fi.is_trashed
@@ -815,8 +851,10 @@ impl FileReadPort for FileBlobReadRepository {
 
         rows.into_iter()
             .map(
-                |(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid)| {
-                    Self::row_to_file(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid)
+                |(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub)| {
+                    Self::row_to_file(
+                        id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub,
+                    )
                 },
             )
             .collect()
@@ -839,7 +877,8 @@ impl FileReadPort for FileBlobReadRepository {
                        EXTRACT(EPOCH FROM fi.created_at)::bigint,
                        EXTRACT(EPOCH FROM fi.updated_at)::bigint,
                        fi.blob_hash,
-                       fi.user_id
+                       fi.user_id,
+                   fi.created_by, fi.updated_by
                   FROM storage.files fi
                   LEFT JOIN storage.folders fo ON fo.id = fi.folder_id
                  WHERE fi.folder_id = $1::uuid AND NOT fi.is_trashed
@@ -862,7 +901,8 @@ impl FileReadPort for FileBlobReadRepository {
                        EXTRACT(EPOCH FROM fi.created_at)::bigint,
                        EXTRACT(EPOCH FROM fi.updated_at)::bigint,
                        fi.blob_hash,
-                       fi.user_id
+                       fi.user_id,
+                   fi.created_by, fi.updated_by
                   FROM storage.files fi
                   LEFT JOIN storage.folders fo ON fo.id = fi.folder_id
                  WHERE fi.folder_id IS NULL AND NOT fi.is_trashed
@@ -883,8 +923,10 @@ impl FileReadPort for FileBlobReadRepository {
 
         rows.into_iter()
             .map(
-                |(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid)| {
-                    Self::row_to_file(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid)
+                |(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub)| {
+                    Self::row_to_file(
+                        id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub,
+                    )
                 },
             )
             .collect()
@@ -935,7 +977,11 @@ impl FileReadPort for FileBlobReadRepository {
         Ok(Self::make_file_path(row.1.as_deref(), &row.0))
     }
 
-    async fn get_parent_folder_id(&self, path: &str) -> Result<String, DomainError> {
+    async fn get_parent_folder_id(
+        &self,
+        path: &str,
+        drive_id: Uuid,
+    ) -> Result<String, DomainError> {
         let path = path.trim_start_matches('/').trim_end_matches('/');
         let segments: Vec<&str> = path.split('/').filter(|s| !s.is_empty()).collect();
 
@@ -955,29 +1001,49 @@ impl FileReadPort for FileBlobReadRepository {
             ));
         }
 
-        self.get_folder_id_by_path(&folder_path).await
+        self.get_folder_id_by_path(&folder_path, drive_id).await
     }
 
-    async fn get_folder_id_by_path(&self, folder_path: &str) -> Result<String, DomainError> {
+    async fn get_folder_id_by_path(
+        &self,
+        folder_path: &str,
+        drive_id: Uuid,
+    ) -> Result<String, DomainError> {
         let folder_path = folder_path.trim_start_matches('/').trim_end_matches('/');
 
         if folder_path.is_empty() {
             return Err(DomainError::not_found("Folder", "empty path"));
         }
 
+        // Post-D0 `storage.folders.path` repeats across drives —
+        // filter by `drive_id` to scope the lookup.
         sqlx::query_scalar::<_, String>(
-            "SELECT id::text FROM storage.folders WHERE path = $1 AND NOT is_trashed",
+            "SELECT id::text FROM storage.folders \
+             WHERE path = $1 AND drive_id = $2 AND NOT is_trashed",
         )
         .bind(folder_path)
+        .bind(drive_id)
         .fetch_optional(self.pool.as_ref())
         .await
         .map_err(|e| DomainError::internal_error("FileBlobRead", format!("folder lookup: {e}")))?
         .ok_or_else(|| DomainError::not_found("Folder", format!("path: {folder_path}")))
     }
 
-    /// Direct SQL lookup using materialized folder paths.
+    /// Direct SQL lookup using materialized folder paths, scoped to a drive.
     /// O(1) query instead of O(depth) folder walk.
-    async fn find_file_by_path(&self, path: &str) -> Result<Option<File>, DomainError> {
+    ///
+    /// Post-D0 `storage.folders.path` repeats across drives (each drive
+    /// has its own root with a name like `"Personal"`). Without the
+    /// `drive_id` filter the lookup would be non-deterministic. The
+    /// root-level branch filters on `fi.drive_id`; the nested branch
+    /// filters on the parent folder's `fo.drive_id` (which closes the
+    /// leak cleanly and matches the path semantics — see Step 2 of
+    /// the path-lookup refactor).
+    async fn find_file_by_path(
+        &self,
+        path: &str,
+        drive_id: Uuid,
+    ) -> Result<Option<File>, DomainError> {
         let path = path.trim_start_matches('/').trim_end_matches('/');
         let segments: Vec<&str> = path.split('/').filter(|s| !s.is_empty()).collect();
 
@@ -996,7 +1062,8 @@ impl FileReadPort for FileBlobReadRepository {
         let folder_path = segments[..segments.len() - 1].join("/");
 
         let row = if folder_path.is_empty() {
-            // File at root level (no parent folder)
+            // File at root level (no parent folder) — filter on
+            // `fi.drive_id` because there's no folder row to join through.
             sqlx::query_as::<
                 _,
                 (
@@ -1010,6 +1077,8 @@ impl FileReadPort for FileBlobReadRepository {
                     i64,
                     String,
                     Option<Uuid>,
+                    Option<Uuid>, // created_by (§14)
+                    Option<Uuid>, // updated_by (§14)
                 ),
             >(
                 r#"
@@ -1018,17 +1087,23 @@ impl FileReadPort for FileBlobReadRepository {
                        EXTRACT(EPOCH FROM fi.created_at)::bigint,
                        EXTRACT(EPOCH FROM fi.updated_at)::bigint,
                        fi.blob_hash,
-                       fi.user_id
+                       fi.user_id,
+                   fi.created_by, fi.updated_by
                   FROM storage.files fi
                   LEFT JOIN storage.folders fo ON fo.id = fi.folder_id
-                 WHERE fi.name = $1 AND fi.folder_id IS NULL AND NOT fi.is_trashed
+                 WHERE fi.name = $1 AND fi.folder_id IS NULL
+                   AND fi.drive_id = $2 AND NOT fi.is_trashed
                 "#,
             )
             .bind(filename)
+            .bind(drive_id)
             .fetch_optional(self.pool.as_ref())
             .await
         } else {
-            // File inside a folder — look up by folder path + filename
+            // File inside a folder — look up by folder path + filename,
+            // filtered by the parent folder's drive_id (path semantics
+            // are folder-scoped, so this also catches mis-pointed file
+            // rows during D0/D7's dual-write window).
             sqlx::query_as::<
                 _,
                 (
@@ -1042,6 +1117,8 @@ impl FileReadPort for FileBlobReadRepository {
                     i64,
                     String,
                     Option<Uuid>,
+                    Option<Uuid>, // created_by (§14)
+                    Option<Uuid>, // updated_by (§14)
                 ),
             >(
                 r#"
@@ -1050,14 +1127,17 @@ impl FileReadPort for FileBlobReadRepository {
                        EXTRACT(EPOCH FROM fi.created_at)::bigint,
                        EXTRACT(EPOCH FROM fi.updated_at)::bigint,
                        fi.blob_hash,
-                       fi.user_id
+                       fi.user_id,
+                   fi.created_by, fi.updated_by
                   FROM storage.files fi
                   JOIN storage.folders fo ON fo.id = fi.folder_id
-                 WHERE fo.path = $1 AND fi.name = $2 AND NOT fi.is_trashed
+                 WHERE fo.path = $1 AND fi.name = $2
+                   AND fo.drive_id = $3 AND NOT fi.is_trashed
                 "#,
             )
             .bind(&folder_path)
             .bind(filename)
+            .bind(drive_id)
             .fetch_optional(self.pool.as_ref())
             .await
         }
@@ -1065,7 +1145,7 @@ impl FileReadPort for FileBlobReadRepository {
 
         match row {
             Some(r) => Ok(Some(Self::row_to_file(
-                r.0, r.1, r.2, r.3, r.4, r.5, r.6, r.7, r.8, r.9,
+                r.0, r.1, r.2, r.3, r.4, r.5, r.6, r.7, r.8, r.9, r.10, r.11,
             )?)),
             None => Ok(None),
         }
@@ -1086,6 +1166,7 @@ impl FileReadPort for FileBlobReadRepository {
             let mut row_stream = sqlx::query_as::<_, (
                 String, String, Option<String>, Option<String>,
                 i64, String, i64, i64, String, Option<Uuid>,
+                Option<Uuid>, Option<Uuid>,
             )>(
                 r#"
                 SELECT fi.id::text, fi.name, fi.folder_id::text, fo.path,
@@ -1093,7 +1174,8 @@ impl FileReadPort for FileBlobReadRepository {
                        EXTRACT(EPOCH FROM fi.created_at)::bigint,
                        EXTRACT(EPOCH FROM fi.updated_at)::bigint,
                        fi.blob_hash,
-                       fi.user_id
+                       fi.user_id,
+                   fi.created_by, fi.updated_by
                   FROM storage.files fi
                   JOIN storage.folders fo ON fo.id = fi.folder_id
                  WHERE fo.lpath <@ (SELECT lpath FROM storage.folders WHERE id = $1::uuid)
@@ -1107,9 +1189,9 @@ impl FileReadPort for FileBlobReadRepository {
             while let Some(row) = row_stream.try_next().await.map_err(|e| {
                 DomainError::internal_error("FileBlobRead", format!("subtree stream: {e}"))
             })? {
-                let (id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid) = row;
+                let (id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub) = row;
                 let file = FileBlobReadRepository::row_to_file(
-                    id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid,
+                    id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub,
                 )?;
                 yield file;
             }
@@ -1173,6 +1255,7 @@ impl FileReadPort for FileBlobReadRepository {
                     EXTRACT(EPOCH FROM fi.updated_at)::bigint, \
                     fi.blob_hash, \
                     fi.user_id, \
+                    fi.created_by, fi.updated_by, \
                     COUNT(*) OVER() AS total_count \
                FROM storage.files fi \
                LEFT JOIN storage.folders fo ON fo.id = fi.folder_id \
@@ -1195,6 +1278,8 @@ impl FileReadPort for FileBlobReadRepository {
                 i64,
                 String,
                 Option<Uuid>,
+                Option<Uuid>, // created_by (§14)
+                Option<Uuid>, // updated_by (§14)
                 i64,
             ),
         >(&sql)
@@ -1217,13 +1302,15 @@ impl FileReadPort for FileBlobReadRepository {
             .map_err(|e| DomainError::internal_error("FileBlobRead", format!("search: {e}")))?;
 
         // total_count is the same in every row; 0 when result set is empty.
-        let total_count = rows.first().map_or(0, |r| r.10) as usize;
+        let total_count = rows.first().map_or(0, |r| r.12) as usize;
 
         let files = rows
             .into_iter()
             .map(
-                |(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, _total)| {
-                    Self::row_to_file(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid)
+                |(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub, _total)| {
+                    Self::row_to_file(
+                        id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub,
+                    )
                 },
             )
             .collect::<Result<Vec<_>, _>>()
@@ -1299,6 +1386,7 @@ impl FileReadPort for FileBlobReadRepository {
                     EXTRACT(EPOCH FROM fi.updated_at)::bigint, \
                     fi.blob_hash, \
                     fi.user_id, \
+                    fi.created_by, fi.updated_by, \
                     COUNT(*) OVER() AS total_count \
                FROM storage.files fi \
                JOIN storage.folders fo ON fo.id = fi.folder_id \
@@ -1321,6 +1409,8 @@ impl FileReadPort for FileBlobReadRepository {
                 i64,
                 String,
                 Option<Uuid>,
+                Option<Uuid>, // created_by (§14)
+                Option<Uuid>, // updated_by (§14)
                 i64,
             ),
         >(&sql)
@@ -1341,13 +1431,15 @@ impl FileReadPort for FileBlobReadRepository {
             DomainError::internal_error("FileBlobRead", format!("subtree search: {e}"))
         })?;
 
-        let total_count = rows.first().map_or(0, |r| r.10) as usize;
+        let total_count = rows.first().map_or(0, |r| r.12) as usize;
 
         let files = rows
             .into_iter()
             .map(
-                |(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, _total)| {
-                    Self::row_to_file(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid)
+                |(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub, _total)| {
+                    Self::row_to_file(
+                        id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub,
+                    )
                 },
             )
             .collect::<Result<Vec<_>, _>>()
@@ -1389,7 +1481,8 @@ impl FileReadPort for FileBlobReadRepository {
                        EXTRACT(EPOCH FROM fi.created_at)::bigint,
                        EXTRACT(EPOCH FROM fi.updated_at)::bigint,
                        fi.blob_hash,
-                       fi.user_id
+                       fi.user_id,
+                   fi.created_by, fi.updated_by
                   FROM storage.files fi
                   LEFT JOIN storage.folders fo ON fo.id = fi.folder_id
                  WHERE fi.folder_id = $1::uuid
@@ -1418,7 +1511,8 @@ impl FileReadPort for FileBlobReadRepository {
                        EXTRACT(EPOCH FROM fi.created_at)::bigint,
                        EXTRACT(EPOCH FROM fi.updated_at)::bigint,
                        fi.blob_hash,
-                       fi.user_id
+                       fi.user_id,
+                   fi.created_by, fi.updated_by
                   FROM storage.files fi
                   LEFT JOIN storage.folders fo ON fo.id = fi.folder_id
                  WHERE fi.folder_id IS NULL
@@ -1443,8 +1537,10 @@ impl FileReadPort for FileBlobReadRepository {
 
         rows.into_iter()
             .map(
-                |(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid)| {
-                    Self::row_to_file(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid)
+                |(id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub)| {
+                    Self::row_to_file(
+                        id, name, fid, fpath, size, mime, ca, ma, blob_hash, uid, cb, ub,
+                    )
                 },
             )
             .collect()

src/infrastructure/repositories/pg/file_blob_write_repository.rs

@@ -27,6 +27,10 @@ use crate::infrastructure::services::dedup_service::DedupService;
 pub struct FileBlobWriteRepository {
     pool: Arc<PgPool>,
     dedup: Arc<DedupService>,
+    /// Retained on the struct after D0-8 inlined parent-folder lookups
+    /// directly via SQL; kept for now so D0's diff stays scoped to drive_id
+    /// + provenance plumbing. Slated for removal in a follow-up cleanup.
+    #[allow(dead_code)]
     folder_repo: Arc<FolderDbRepository>,
     /// Shared handle to `FileBlobReadRepository`'s file_id → blob_hash
     /// cache. Content swaps and hard deletes invalidate the mapping here
@@ -111,9 +115,11 @@ impl FileBlobWriteRepository {
         modified_at: i64,
         owner_id: Option<Uuid>,
         blob_hash: String,
+        created_by: Option<Uuid>,
+        updated_by: Option<Uuid>,
     ) -> Result<File, DomainError> {
         let storage_path = Self::make_file_path(folder_path.as_deref(), &name);
-        File::with_timestamps_and_blob_hash(
+        File::with_timestamps_blob_hash_and_provenance(
             id,
             name,
             storage_path,
@@ -124,14 +130,33 @@ impl FileBlobWriteRepository {
             modified_at as u64,
             owner_id,
             blob_hash,
+            created_by,
+            updated_by,
         )
         .map_err(|e| DomainError::internal_error("FileBlobWrite", format!("entity: {e}")))
     }
 
-    /// Derive user_id from the parent folder, or error if folder_id is None.
-    async fn resolve_user_id(&self, folder_id: Option<&str>) -> Result<Uuid, DomainError> {
+    /// Derive `(user_id, drive_id)` from the parent folder. Both are
+    /// needed during the D0 dual-write window: `user_id` for the legacy
+    /// column (dropped in D7) and `drive_id` for the new owning-drive
+    /// reference.
+    async fn resolve_owner_and_drive(
+        &self,
+        folder_id: Option<&str>,
+    ) -> Result<(Uuid, Uuid), DomainError> {
         match folder_id {
-            Some(fid) => self.folder_repo.get_folder_user_id(fid).await,
+            Some(fid) => {
+                let row: Option<(Uuid, Uuid)> = sqlx::query_as::<_, (Uuid, Uuid)>(
+                    "SELECT user_id, drive_id FROM storage.folders WHERE id = $1::uuid",
+                )
+                .bind(fid)
+                .fetch_optional(self.pool.as_ref())
+                .await
+                .map_err(|e| {
+                    DomainError::internal_error("FileBlobWrite", format!("parent lookup: {e}"))
+                })?;
+                row.ok_or_else(|| DomainError::not_found("Folder", fid))
+            }
             None => Err(DomainError::internal_error(
                 "FileBlobWrite",
                 "folder_id is required to determine file owner",
@@ -150,12 +175,18 @@ impl FileBlobWriteRepository {
     /// `(new_hash, updated_at_epoch)` on success — the effective timestamp
     /// is returned so callers can rebuild the fresh entity without
     /// re-reading the row.
+    ///
+    /// §14: `updated_by = $5` (caller_id). The caller mutated this
+    /// row — not the row's owner. D2 shared drives let non-owners
+    /// overwrite content; the previous `updated_by = f.user_id` would
+    /// have silently recorded the wrong principal.
     async fn swap_blob_hash(
         &self,
         file_id: &str,
         new_hash: &str,
         new_size: i64,
         modified_at: Option<i64>,
+        caller_id: Uuid,
     ) -> Result<(String, i64), DomainError> {
         // Atomic CTE: capture old hash then update in one round-trip, no TOCTOU.
         // Deadlock victims (40P01) retry before the compensation below runs —
@@ -168,7 +199,8 @@ impl FileBlobWriteRepository {
                 )
                 UPDATE storage.files f
                    SET blob_hash = $1, size = $2,
-                       updated_at = COALESCE(to_timestamp($4), NOW())
+                       updated_at = COALESCE(to_timestamp($4), NOW()),
+                       updated_by = $5
                   FROM old
                  WHERE f.id = old.id
                 RETURNING old.blob_hash, EXTRACT(EPOCH FROM f.updated_at)::bigint
@@ -178,6 +210,7 @@ impl FileBlobWriteRepository {
             .bind(new_size)
             .bind(file_id)
             .bind(modified_at.map(|t| t as f64))
+            .bind(caller_id)
             .fetch_optional(self.pool.as_ref())
         })
         .await
@@ -223,6 +256,12 @@ impl FileBlobWriteRepository {
     /// Register a file row pointing at a blob already stored in the chunk
     /// store (the upload-ingest layer streamed the content in). Consumes the
     /// caller's blob reference: any failure releases it before returning.
+    ///
+    /// §14: `created_by = $7 = updated_by = caller_id` — authorship
+    /// belongs to the principal performing the upload, not to the parent
+    /// folder's owner. In D2 shared drives a non-owner member can upload
+    /// into a folder Alice owns; binding `parent.user_id` would have
+    /// silently recorded Alice as the author.
     async fn save_file_with_blob_impl(
         &self,
         name: String,
@@ -230,6 +269,7 @@ impl FileBlobWriteRepository {
         content_type: String,
         blob_hash: &str,
         size: u64,
+        caller_id: Uuid,
     ) -> Result<File, DomainError> {
         // Root files have no parent folder to derive an owner from — keep the
         // previous resolve_user_id(None) contract (release the ref, error out).
@@ -260,19 +300,24 @@ impl FileBlobWriteRepository {
         // (a retried INSERT can legitimately lose to a concurrent identical
         // upload).
         let result = retry_on_deadlock("files.insert", || {
-            sqlx::query_as::<_, (String, Uuid, String, i64, i64)>(
+            sqlx::query_as::<_, (String, Uuid, String, i64, i64, Option<Uuid>, Option<Uuid>)>(
                 r#"
                 WITH parent AS (
-                    SELECT id, user_id, path FROM storage.folders WHERE id = $2::uuid
+                    SELECT id, user_id, drive_id, path FROM storage.folders WHERE id = $2::uuid
                 )
                 INSERT INTO storage.files
-                    (name, folder_id, user_id, blob_hash, size, mime_type, category_order)
-                SELECT $1, parent.id, parent.user_id, $3, $4, $5, $6 FROM parent
+                    (name, folder_id, user_id, drive_id, blob_hash, size,
+                     mime_type, category_order, created_by, updated_by)
+                SELECT $1, parent.id, parent.user_id, parent.drive_id, $3, $4,
+                       $5, $6, $7, $7
+                  FROM parent
                 RETURNING id::text,
                           user_id,
                           (SELECT path FROM parent),
                           EXTRACT(EPOCH FROM created_at)::bigint,
-                          EXTRACT(EPOCH FROM updated_at)::bigint
+                          EXTRACT(EPOCH FROM updated_at)::bigint,
+                          created_by,
+                          updated_by
                 "#,
             )
             .bind(&name)
@@ -281,44 +326,46 @@ impl FileBlobWriteRepository {
             .bind(size as i64)
             .bind(&content_type)
             .bind(category_order_for(&name, &content_type))
+            .bind(caller_id)
             .fetch_optional(self.pool.as_ref())
         })
         .await;
 
-        let (id, user_id, folder_path, created_at, updated_at) = match result {
-            Ok(Some(row)) => row,
-            Ok(None) => {
-                if let Err(rollback_err) = self.dedup.remove_reference(blob_hash).await {
-                    tracing::error!(
-                        "Blob orphaned after missing parent folder — hash: {}, err: {}",
-                        &blob_hash[..12],
-                        rollback_err
-                    );
+        let (id, user_id, folder_path, created_at, updated_at, created_by, updated_by) =
+            match result {
+                Ok(Some(row)) => row,
+                Ok(None) => {
+                    if let Err(rollback_err) = self.dedup.remove_reference(blob_hash).await {
+                        tracing::error!(
+                            "Blob orphaned after missing parent folder — hash: {}, err: {}",
+                            &blob_hash[..12],
+                            rollback_err
+                        );
+                    }
+                    return Err(DomainError::not_found("Folder", fid));
                 }
-                return Err(DomainError::not_found("Folder", fid));
-            }
-            Err(e) => {
-                if let Err(rollback_err) = self.dedup.remove_reference(blob_hash).await {
-                    tracing::error!(
-                        "Blob orphaned after failed INSERT — hash: {}, err: {}",
-                        &blob_hash[..12],
-                        rollback_err
-                    );
-                }
-                if let sqlx::Error::Database(ref db_err) = e
-                    && db_err.code().as_deref() == Some("23505")
-                {
-                    return Err(DomainError::already_exists(
-                        "File",
-                        format!("'{name}' already exists in this folder"),
+                Err(e) => {
+                    if let Err(rollback_err) = self.dedup.remove_reference(blob_hash).await {
+                        tracing::error!(
+                            "Blob orphaned after failed INSERT — hash: {}, err: {}",
+                            &blob_hash[..12],
+                            rollback_err
+                        );
+                    }
+                    if let sqlx::Error::Database(ref db_err) = e
+                        && db_err.code().as_deref() == Some("23505")
+                    {
+                        return Err(DomainError::already_exists(
+                            "File",
+                            format!("'{name}' already exists in this folder"),
+                        ));
+                    }
+                    return Err(DomainError::internal_error(
+                        "FileBlobWrite",
+                        format!("insert: {e}"),
                     ));
                 }
-                return Err(DomainError::internal_error(
-                    "FileBlobWrite",
-                    format!("insert: {e}"),
-                ));
-            }
-        };
+            };
 
         tracing::info!(
             "📡 STREAMING WRITE: {} ({} bytes, hash: {})",
@@ -338,6 +385,8 @@ impl FileBlobWriteRepository {
             updated_at,
             Some(user_id),
             blob_hash.to_string(),
+            created_by,
+            updated_by,
         )
     }
 }
@@ -350,8 +399,9 @@ impl FileWritePort for FileBlobWriteRepository {
         content_type: String,
         blob_hash: &str,
         size: u64,
+        caller_id: Uuid,
     ) -> Result<File, DomainError> {
-        self.save_file_with_blob_impl(name, folder_id, content_type, blob_hash, size)
+        self.save_file_with_blob_impl(name, folder_id, content_type, blob_hash, size, caller_id)
             .await
     }
 
@@ -359,20 +409,50 @@ impl FileWritePort for FileBlobWriteRepository {
         &self,
         file_id: &str,
         target_folder_id: Option<String>,
+        caller_id: Uuid,
     ) -> Result<File, DomainError> {
-        // If moving to a different folder, get the new user_id (must be same user)
-        let row = sqlx::query_as::<_, (String, String, Option<String>, i64, String, i64, i64)>(
+        // If moving to a different folder, get the new user_id (must be same user).
+        //
+        // §14: `updated_by = $3` (caller_id) — the caller mutated this
+        // row. The previous COALESCE derived authorship from the
+        // destination folder's owner, which is wrong: dest's user_id
+        // has no claim to authorship of the file's content. D2 shared
+        // drives surface this most starkly (Alice moves Bob's file
+        // into Charlie's drive — `updated_by` must be Alice).
+        let row = sqlx::query_as::<
+            _,
+            (
+                String,
+                String,
+                Option<String>,
+                i64,
+                String,
+                i64,
+                i64,
+                Option<Uuid>,
+                Option<Uuid>,
+            ),
+        >(
             r#"
-            UPDATE storage.files
-               SET folder_id = $1::uuid, updated_at = NOW()
-             WHERE id = $2::uuid AND NOT is_trashed
-            RETURNING id::text, name, folder_id::text, size, mime_type,
-                      EXTRACT(EPOCH FROM created_at)::bigint,
-                      EXTRACT(EPOCH FROM updated_at)::bigint
+            WITH dest AS (
+                SELECT user_id, drive_id FROM storage.folders WHERE id = $1::uuid
+            )
+            UPDATE storage.files f
+               SET folder_id = $1::uuid,
+                   user_id   = COALESCE((SELECT user_id  FROM dest), f.user_id),
+                   drive_id  = COALESCE((SELECT drive_id FROM dest), f.drive_id),
+                   updated_at = NOW(),
+                   updated_by = $3
+             WHERE f.id = $2::uuid AND NOT f.is_trashed
+            RETURNING f.id::text, f.name, f.folder_id::text, f.size, f.mime_type,
+                      EXTRACT(EPOCH FROM f.created_at)::bigint,
+                      EXTRACT(EPOCH FROM f.updated_at)::bigint,
+                      f.created_by, f.updated_by
             "#,
         )
         .bind(&target_folder_id)
         .bind(file_id)
+        .bind(caller_id)
         .fetch_optional(self.pool.as_ref())
         .await
         .map_err(|e| DomainError::internal_error("FileBlobWrite", format!("move: {e}")))?
@@ -390,6 +470,8 @@ impl FileWritePort for FileBlobWriteRepository {
             row.6,
             None,
             String::new(),
+            row.7,
+            row.8,
         )
     }
 
@@ -398,9 +480,16 @@ impl FileWritePort for FileBlobWriteRepository {
         file_id: &str,
         target_folder_id: Option<String>,
         new_name: Option<&str>,
+        caller_id: Uuid,
     ) -> Result<File, DomainError> {
         // Atomic CTE: read source file → insert new row with same blob_hash → increment ref_count.
         // Single round-trip; blob content is NOT copied (dedup makes this zero-copy).
+        //
+        // §14: `created_by = $4 = updated_by = caller_id` — the caller
+        // authored this copy. The previous binding used
+        // `dest_folder.user_id` which silently recorded the destination
+        // folder's owner as the author when Adam copied a file into
+        // Alice's folder.
         let target_fid = target_folder_id.clone();
         let rename_to = new_name.map(|s| s.to_string());
 
@@ -416,6 +505,8 @@ impl FileWritePort for FileBlobWriteRepository {
                     i64,
                     i64,
                     String,
+                    Option<Uuid>,
+                    Option<Uuid>,
                 ),
             >(
                 r#"
@@ -424,20 +515,39 @@ impl FileWritePort for FileBlobWriteRepository {
                       FROM storage.files
                      WHERE id = $1::uuid AND NOT is_trashed
                 ),
+                -- The destination folder may differ from the source's
+                -- folder (when $2 is set); derive drive_id from the
+                -- DESTINATION so cross-drive copies land in the right
+                -- drive. Files in personal drives only copy within the
+                -- same drive today, but the join makes the migration
+                -- future-proof for D2's cross-drive copy story.
+                dest_folder AS (
+                    SELECT id, user_id, drive_id
+                      FROM storage.folders
+                     WHERE id = COALESCE($2::uuid,
+                                         (SELECT folder_id FROM src))
+                ),
                 new_file AS (
-                    INSERT INTO storage.files (name, folder_id, user_id, blob_hash, size, mime_type, category_order)
-                    SELECT COALESCE($3::text, name),
-                           COALESCE($2::uuid, folder_id),
-                           user_id,
-                           blob_hash,
-                           size,
-                           mime_type,
-                           category_order
-                      FROM src
+                    INSERT INTO storage.files
+                        (name, folder_id, user_id, drive_id, blob_hash, size,
+                         mime_type, category_order, created_by, updated_by)
+                    SELECT COALESCE($3::text, src.name),
+                           dest_folder.id,
+                           dest_folder.user_id,
+                           dest_folder.drive_id,
+                           src.blob_hash,
+                           src.size,
+                           src.mime_type,
+                           src.category_order,
+                           $4,
+                           $4
+                      FROM src, dest_folder
                     RETURNING id::text, name, folder_id::text, size, mime_type,
                               EXTRACT(EPOCH FROM created_at)::bigint,
                               EXTRACT(EPOCH FROM updated_at)::bigint,
-                              blob_hash
+                              blob_hash,
+                              created_by,
+                              updated_by
                 )
                 SELECT * FROM new_file
                 "#,
@@ -445,6 +555,7 @@ impl FileWritePort for FileBlobWriteRepository {
             .bind(file_id)
             .bind(&target_fid)
             .bind(&rename_to)
+            .bind(caller_id)
             .fetch_optional(self.pool.as_ref())
         })
         .await
@@ -490,22 +601,45 @@ impl FileWritePort for FileBlobWriteRepository {
             row.6,
             None,
             row.7,
+            row.8,
+            row.9,
         )
     }
 
-    async fn rename_file(&self, file_id: &str, new_name: &str) -> Result<File, DomainError> {
-        let row = sqlx::query_as::<_, (String, String, Option<String>, i64, String, i64, i64)>(
+    async fn rename_file(
+        &self,
+        file_id: &str,
+        new_name: &str,
+        caller_id: Uuid,
+    ) -> Result<File, DomainError> {
+        // §14: `updated_by = $3` (caller_id), see move_file.
+        let row = sqlx::query_as::<
+            _,
+            (
+                String,
+                String,
+                Option<String>,
+                i64,
+                String,
+                i64,
+                i64,
+                Option<Uuid>,
+                Option<Uuid>,
+            ),
+        >(
             r#"
             UPDATE storage.files
-               SET name = $1, updated_at = NOW()
+               SET name = $1, updated_at = NOW(), updated_by = $3
              WHERE id = $2::uuid AND NOT is_trashed
             RETURNING id::text, name, folder_id::text, size, mime_type,
                       EXTRACT(EPOCH FROM created_at)::bigint,
-                      EXTRACT(EPOCH FROM updated_at)::bigint
+                      EXTRACT(EPOCH FROM updated_at)::bigint,
+                      created_by, updated_by
             "#,
         )
         .bind(new_name)
         .bind(file_id)
+        .bind(caller_id)
         .fetch_optional(self.pool.as_ref())
         .await
         .map_err(|e| {
@@ -530,6 +664,8 @@ impl FileWritePort for FileBlobWriteRepository {
             row.6,
             None,
             String::new(),
+            row.7,
+            row.8,
         )
     }
 
@@ -559,12 +695,13 @@ impl FileWritePort for FileBlobWriteRepository {
         blob_hash: &str,
         size: u64,
         modified_at: Option<i64>,
+        caller_id: Uuid,
     ) -> Result<(String, i64), DomainError> {
         // The content was already ingested into the chunk store by the
         // upload-ingest layer; swap_blob_hash consumes its reference and
         // releases it on failure.
         let swapped = self
-            .swap_blob_hash(file_id, blob_hash, size as i64, modified_at)
+            .swap_blob_hash(file_id, blob_hash, size as i64, modified_at, caller_id)
             .await?;
         // The file now maps to a different blob — drop the read-side cache
         // entry so streaming downloads cannot serve the previous content
@@ -579,30 +716,41 @@ impl FileWritePort for FileBlobWriteRepository {
         folder_id: Option<String>,
         content_type: String,
         size: u64,
+        caller_id: Uuid,
     ) -> Result<(File, PathBuf), DomainError> {
-        let user_id = self.resolve_user_id(folder_id.as_deref()).await?;
+        let (user_id, drive_id) = self.resolve_owner_and_drive(folder_id.as_deref()).await?;
 
         // For deferred registration we use a placeholder hash.
         // The write-behind cache will call update_file_content later.
         let placeholder_hash = "0000000000000000000000000000000000000000000000000000000000000000";
 
+        // §14: `created_by = $9 = updated_by = caller_id`. The legacy
+        // `user_id` column (dropped in D7) stays bound to the parent
+        // folder's owner; only the two provenance columns flip to the
+        // caller — see save_file_with_blob_impl.
         let row = retry_on_deadlock("files.insert_deferred", || {
-            sqlx::query_as::<_, (String, i64, i64)>(
+            sqlx::query_as::<_, (String, i64, i64, Option<Uuid>, Option<Uuid>)>(
                 r#"
-                INSERT INTO storage.files (name, folder_id, user_id, blob_hash, size, mime_type, category_order)
-                VALUES ($1, $2::uuid, $3, $4, $5, $6, $7)
+                INSERT INTO storage.files
+                    (name, folder_id, user_id, drive_id, blob_hash, size,
+                     mime_type, category_order, created_by, updated_by)
+                VALUES ($1, $2::uuid, $3, $4, $5, $6, $7, $8, $9, $9)
                 RETURNING id::text,
                           EXTRACT(EPOCH FROM created_at)::bigint,
-                          EXTRACT(EPOCH FROM updated_at)::bigint
+                          EXTRACT(EPOCH FROM updated_at)::bigint,
+                          created_by,
+                          updated_by
                 "#,
             )
             .bind(&name)
             .bind(&folder_id)
             .bind(user_id)
+            .bind(drive_id)
             .bind(placeholder_hash)
             .bind(size as i64)
             .bind(&content_type)
             .bind(category_order_for(&name, &content_type))
+            .bind(caller_id)
             .fetch_one(self.pool.as_ref())
         })
         .await
@@ -620,6 +768,8 @@ impl FileWritePort for FileBlobWriteRepository {
             row.2,
             Some(user_id),
             String::new(),
+            row.3,
+            row.4,
         )?;
 
         // The target_path is not meaningful for blob storage (content goes to .blobs/)
@@ -631,18 +781,21 @@ impl FileWritePort for FileBlobWriteRepository {
 
     // ── Trash operations ──
 
-    async fn move_to_trash(&self, file_id: &str) -> Result<(), DomainError> {
+    async fn move_to_trash(&self, file_id: &str, caller_id: Uuid) -> Result<(), DomainError> {
+        // §14: `updated_by = $2` (caller_id), see move_file.
         let result = sqlx::query(
             r#"
             UPDATE storage.files
                SET is_trashed = TRUE,
                    trashed_at = NOW(),
                    original_folder_id = folder_id,
-                   updated_at = NOW()
+                   updated_at = NOW(),
+                   updated_by = $2
              WHERE id = $1::uuid AND NOT is_trashed
             "#,
         )
         .bind(file_id)
+        .bind(caller_id)
         .execute(self.pool.as_ref())
         .await
         .map_err(|e| DomainError::internal_error("FileBlobWrite", format!("trash: {e}")))?;
@@ -657,7 +810,9 @@ impl FileWritePort for FileBlobWriteRepository {
         &self,
         file_id: &str,
         _original_path: &str,
+        caller_id: Uuid,
     ) -> Result<(), DomainError> {
+        // §14: `updated_by = $2` (caller_id), see move_file.
         let result = sqlx::query(
             r#"
             UPDATE storage.files
@@ -665,11 +820,13 @@ impl FileWritePort for FileBlobWriteRepository {
                    trashed_at = NULL,
                    folder_id = COALESCE(original_folder_id, folder_id),
                    original_folder_id = NULL,
-                   updated_at = NOW()
+                   updated_at = NOW(),
+                   updated_by = $2
              WHERE id = $1::uuid AND is_trashed
             "#,
         )
         .bind(file_id)
+        .bind(caller_id)
         .execute(self.pool.as_ref())
         .await
         .map_err(|e| DomainError::internal_error("FileBlobWrite", format!("restore: {e}")))?;

src/infrastructure/repositories/pg/folder_db_repository.rs

@@ -21,36 +21,58 @@ use crate::domain::services::authorization::ResourceKind;
 use crate::domain::services::path_service::StoragePath;
 
 /// Type alias for folder metadata rows from SQL queries.
-/// Tuple order: id, name, path, parent_id, user_id, created_at,
-/// modified_at, tree_modified_at. The trailing `tree_modified_at`
-/// feeds [`Folder::etag`] — every SELECT here must include
-/// `EXTRACT(EPOCH FROM tree_modified_at)::bigint`.
-type FolderRow = (String, String, String, Option<String>, Uuid, i64, i64, i64);
+/// Tuple order: id, name, path, parent_id, user_id, drive_id,
+/// created_at, modified_at, tree_modified_at, created_by, updated_by.
+/// The trailing `tree_modified_at` feeds [`Folder::etag`] — every
+/// SELECT here must include `EXTRACT(EPOCH FROM tree_modified_at)::bigint`.
+/// `drive_id` is the post-D0 `NOT NULL` scope axis for path-based
+/// lookups. `created_by` / `updated_by` are the §14 provenance
+/// columns, nullable because the FK is `ON DELETE SET NULL`.
+type FolderRow = (
+    String,
+    String,
+    String,
+    Option<String>,
+    Uuid,
+    Uuid,
+    i64,
+    i64,
+    i64,
+    Option<Uuid>,
+    Option<Uuid>,
+);
 
 /// Type alias for paginated folder rows (includes total_count as
-/// the last element after `tree_modified_at`).
+/// the last element after the §14 provenance columns).
 type FolderRowPaginated = (
     String,
     String,
     String,
     Option<String>,
     Uuid,
+    Uuid,
     i64,
     i64,
     i64,
+    Option<Uuid>,
+    Option<Uuid>,
     i64,
 );
 
 /// Type alias for folder rows with optional user_id.
+/// Includes the §14 provenance columns `created_by` / `updated_by`.
 type FolderRowOptUser = (
     String,
     String,
     String,
     Option<String>,
     Option<Uuid>,
+    Uuid,
     i64,
     i64,
     i64,
+    Option<Uuid>,
+    Option<Uuid>,
 );
 
 /// PostgreSQL-backed folder repository.
@@ -84,7 +106,9 @@ impl FolderDbRepository {
     /// Convert a database row into a `Folder` domain entity.
     ///
     /// The `path` comes directly from the materialized `path` column — no
-    /// extra queries needed.
+    /// extra queries needed. `created_by` / `updated_by` carry the
+    /// §14 provenance signal through the entity layer; both are
+    /// `Option<Uuid>` because the FK is `ON DELETE SET NULL`.
     #[allow(clippy::too_many_arguments)]
     fn row_to_folder(
         id: String,
@@ -92,20 +116,26 @@ impl FolderDbRepository {
         path: String,
         parent_id: Option<String>,
         user_id: Option<Uuid>,
+        drive_id: Uuid,
         created_at: i64,
         modified_at: i64,
         tree_modified_at: i64,
+        created_by: Option<Uuid>,
+        updated_by: Option<Uuid>,
     ) -> Result<Folder, DomainError> {
         let storage_path = StoragePath::from_string(&path);
-        Folder::with_timestamps_and_tree(
+        Folder::with_timestamps_tree_and_provenance(
             id,
             name,
             storage_path,
             parent_id,
             user_id,
+            drive_id,
             created_at as u64,
             modified_at as u64,
             tree_modified_at as u64,
+            created_by,
+            updated_by,
         )
         .map_err(|e| DomainError::internal_error("FolderDb", format!("entity: {e}")))
     }
@@ -123,10 +153,11 @@ impl FolderDbRepository {
 
         let rows = sqlx::query_as::<_, FolderRow>(
             r#"
-            SELECT id::text, name, path, parent_id::text, user_id,
+            SELECT id::text, name, path, parent_id::text, user_id, drive_id,
                    EXTRACT(EPOCH FROM created_at)::bigint,
                    EXTRACT(EPOCH FROM updated_at)::bigint,
-                   EXTRACT(EPOCH FROM tree_modified_at)::bigint
+                   EXTRACT(EPOCH FROM tree_modified_at)::bigint,
+                   created_by, updated_by
               FROM storage.folders
              WHERE id = ANY($1) AND NOT is_trashed
             "#,
@@ -137,7 +168,9 @@ impl FolderDbRepository {
         .map_err(|e| DomainError::internal_error("FolderDb", format!("get_folders_by_ids: {e}")))?;
 
         rows.into_iter()
-            .map(|r| Self::row_to_folder(r.0, r.1, r.2, r.3, Some(r.4), r.5, r.6, r.7))
+            .map(|r| {
+                Self::row_to_folder(r.0, r.1, r.2, r.3, Some(r.4), r.5, r.6, r.7, r.8, r.9, r.10)
+            })
             .collect()
     }
 }
@@ -147,40 +180,59 @@ impl FolderRepository for FolderDbRepository {
         &self,
         name: String,
         parent_id: Option<String>,
+        caller_id: Uuid,
     ) -> Result<Folder, DomainError> {
-        // Derive user_id from parent folder.  Root-level folders require the
-        // caller to have set up the home folder beforehand (done during user
-        // registration).
-        let user_id: Uuid = if let Some(ref pid) = parent_id {
-            sqlx::query_scalar::<_, Uuid>("SELECT user_id FROM storage.folders WHERE id = $1::uuid")
-                .bind(pid)
-                .fetch_optional(self.pool())
-                .await
-                .map_err(|e| {
-                    DomainError::internal_error("FolderDb", format!("parent lookup: {e}"))
-                })?
-                .ok_or_else(|| DomainError::not_found("Folder", pid))?
+        // Derive (user_id, drive_id) from parent folder in one round-trip.
+        // Root-level folders require the caller to have set up the home
+        // drive beforehand (done during user registration via the
+        // lifecycle hook).
+        let (user_id, drive_id): (Uuid, Uuid) = if let Some(ref pid) = parent_id {
+            sqlx::query_as::<_, (Uuid, Uuid)>(
+                "SELECT user_id, drive_id FROM storage.folders WHERE id = $1::uuid",
+            )
+            .bind(pid)
+            .fetch_optional(self.pool())
+            .await
+            .map_err(|e| DomainError::internal_error("FolderDb", format!("parent lookup: {e}")))?
+            .ok_or_else(|| DomainError::not_found("Folder", pid))?
         } else {
             return Err(DomainError::internal_error(
                 "FolderDb",
-                "Cannot create root folder without user_id — use create_home_folder instead",
+                "Cannot create root folder — root folders are reserved for the \
+                 atomic drive-creation transaction in DrivePgRepository::\
+                 create_personal_drive_atomic (docs/plan/drive.md §3). The \
+                 no-orphan-root-folder trigger enforces this at the DB level.",
             ));
         };
 
-        let row = sqlx::query_as::<_, (String, String, i64, i64, i64)>(
+        // D0 dual-write: drive_id alongside user_id (drops in D7); plus
+        // §14 provenance — `created_by` / `updated_by` bind to the caller
+        // ($5), NOT to the parent folder's `user_id`. Pre-D2 they're
+        // silently equivalent (only the parent's owner can write); the
+        // distinction matters once shared drives let an Editor mutate
+        // a folder owned by someone else.
+        //
+        // RETURNING also surfaces the two provenance columns so the
+        // built entity / DTO carries fresh values without a re-read.
+        let row = sqlx::query_as::<_, (String, String, i64, i64, i64, Option<Uuid>, Option<Uuid>)>(
             r#"
-            INSERT INTO storage.folders (name, parent_id, user_id)
-            VALUES ($1, $2::uuid, $3)
+            INSERT INTO storage.folders
+                (name, parent_id, user_id, drive_id, created_by, updated_by)
+            VALUES ($1, $2::uuid, $3, $4, $5, $5)
             RETURNING id::text,
                       path,
                       EXTRACT(EPOCH FROM created_at)::bigint,
                       EXTRACT(EPOCH FROM updated_at)::bigint,
-                      EXTRACT(EPOCH FROM tree_modified_at)::bigint
+                      EXTRACT(EPOCH FROM tree_modified_at)::bigint,
+                      created_by,
+                      updated_by
             "#,
         )
         .bind(&name)
         .bind(&parent_id)
         .bind(user_id)
+        .bind(drive_id)
+        .bind(caller_id)
         .fetch_one(self.pool())
         .await
         .map_err(|e| {
@@ -201,19 +253,24 @@ impl FolderRepository for FolderDbRepository {
             row.1,
             parent_id,
             Some(user_id),
+            drive_id,
             row.2,
             row.3,
             row.4,
+            // Fresh from RETURNING — caller_id was bound to both columns.
+            row.5,
+            row.6,
         )
     }
 
     async fn get_folder(&self, id: &str) -> Result<Folder, DomainError> {
         let row = sqlx::query_as::<_, FolderRow>(
             r#"
-            SELECT id::text, name, path, parent_id::text, user_id,
+            SELECT id::text, name, path, parent_id::text, user_id, drive_id,
                    EXTRACT(EPOCH FROM created_at)::bigint,
                    EXTRACT(EPOCH FROM updated_at)::bigint,
-                   EXTRACT(EPOCH FROM tree_modified_at)::bigint
+                   EXTRACT(EPOCH FROM tree_modified_at)::bigint,
+                     created_by, updated_by
               FROM storage.folders
              WHERE id = $1::uuid AND NOT is_trashed
             "#,
@@ -224,10 +281,26 @@ impl FolderRepository for FolderDbRepository {
         .map_err(|e| DomainError::internal_error("FolderDb", format!("get: {e}")))?
         .ok_or_else(|| DomainError::not_found("Folder", id))?;
 
-        Self::row_to_folder(row.0, row.1, row.2, row.3, Some(row.4), row.5, row.6, row.7)
+        Self::row_to_folder(
+            row.0,
+            row.1,
+            row.2,
+            row.3,
+            Some(row.4),
+            row.5,
+            row.6,
+            row.7,
+            row.8,
+            row.9,
+            row.10,
+        )
     }
 
-    async fn get_folder_by_path(&self, storage_path: &StoragePath) -> Result<Folder, DomainError> {
+    async fn get_folder_by_path(
+        &self,
+        storage_path: &StoragePath,
+        drive_id: Uuid,
+    ) -> Result<Folder, DomainError> {
         let path_str = storage_path.to_string();
         // Strip leading '/' if present — DB stores "Home - user/Docs", not "/Home - user/Docs"
         let lookup = path_str.strip_prefix('/').unwrap_or(&path_str);
@@ -236,23 +309,44 @@ impl FolderRepository for FolderDbRepository {
             return Err(DomainError::not_found("Folder", "empty path"));
         }
 
+        // Scoped by drive_id: post-D0 `storage.folders.path` is unique
+        // only within a single drive. Root-folder names like
+        // `"Personal"` repeat across drives, so without the drive_id
+        // filter the planner returns a non-deterministic row — which
+        // breaks owner-short-circuit checks and crosses drive
+        // boundaries (the AuthZ axis that replaces the old per-user
+        // wrapper scoping post-D0).
         let row = sqlx::query_as::<_, FolderRow>(
             r#"
-            SELECT id::text, name, path, parent_id::text, user_id,
+            SELECT id::text, name, path, parent_id::text, user_id, drive_id,
                    EXTRACT(EPOCH FROM created_at)::bigint,
                    EXTRACT(EPOCH FROM updated_at)::bigint,
-                       EXTRACT(EPOCH FROM tree_modified_at)::bigint
+                       EXTRACT(EPOCH FROM tree_modified_at)::bigint,
+                     created_by, updated_by
               FROM storage.folders
-             WHERE path = $1 AND NOT is_trashed
+             WHERE path = $1 AND drive_id = $2 AND NOT is_trashed
             "#,
         )
         .bind(lookup)
+        .bind(drive_id)
         .fetch_optional(self.pool())
         .await
         .map_err(|e| DomainError::internal_error("FolderDb", format!("path lookup: {e}")))?
         .ok_or_else(|| DomainError::not_found("Folder", lookup))?;
 
-        Self::row_to_folder(row.0, row.1, row.2, row.3, Some(row.4), row.5, row.6, row.7)
+        Self::row_to_folder(
+            row.0,
+            row.1,
+            row.2,
+            row.3,
+            Some(row.4),
+            row.5,
+            row.6,
+            row.7,
+            row.8,
+            row.9,
+            row.10,
+        )
     }
 
     #[allow(clippy::type_complexity)]
@@ -260,10 +354,11 @@ impl FolderRepository for FolderDbRepository {
         let rows: Vec<FolderRow> = if let Some(pid) = parent_id {
             sqlx::query_as(
                 r#"
-                SELECT id::text, name, path, parent_id::text, user_id,
+                SELECT id::text, name, path, parent_id::text, user_id, drive_id,
                        EXTRACT(EPOCH FROM created_at)::bigint,
                        EXTRACT(EPOCH FROM updated_at)::bigint,
-                       EXTRACT(EPOCH FROM tree_modified_at)::bigint
+                       EXTRACT(EPOCH FROM tree_modified_at)::bigint,
+                         created_by, updated_by
                   FROM storage.folders
                  WHERE parent_id = $1::uuid AND NOT is_trashed
                  ORDER BY name
@@ -275,10 +370,11 @@ impl FolderRepository for FolderDbRepository {
         } else {
             sqlx::query_as(
                 r#"
-                SELECT id::text, name, path, parent_id::text, user_id,
+                SELECT id::text, name, path, parent_id::text, user_id, drive_id,
                        EXTRACT(EPOCH FROM created_at)::bigint,
                        EXTRACT(EPOCH FROM updated_at)::bigint,
-                       EXTRACT(EPOCH FROM tree_modified_at)::bigint
+                       EXTRACT(EPOCH FROM tree_modified_at)::bigint,
+                         created_by, updated_by
                   FROM storage.folders
                  WHERE parent_id IS NULL AND NOT is_trashed
                  ORDER BY name
@@ -290,8 +386,8 @@ impl FolderRepository for FolderDbRepository {
         .map_err(|e| DomainError::internal_error("FolderDb", format!("list: {e}")))?;
 
         rows.into_iter()
-            .map(|(id, name, path, pid, uid, ca, ma, tma)| {
-                Self::row_to_folder(id, name, path, pid, Some(uid), ca, ma, tma)
+            .map(|(id, name, path, pid, uid, did, ca, ma, tma, cb, ub)| {
+                Self::row_to_folder(id, name, path, pid, Some(uid), did, ca, ma, tma, cb, ub)
             })
             .collect()
     }
@@ -305,10 +401,11 @@ impl FolderRepository for FolderDbRepository {
         let rows: Vec<FolderRow> = if let Some(pid) = parent_id {
             sqlx::query_as(
                 r#"
-                SELECT id::text, name, path, parent_id::text, user_id,
+                SELECT id::text, name, path, parent_id::text, user_id, drive_id,
                        EXTRACT(EPOCH FROM created_at)::bigint,
                        EXTRACT(EPOCH FROM updated_at)::bigint,
-                       EXTRACT(EPOCH FROM tree_modified_at)::bigint
+                       EXTRACT(EPOCH FROM tree_modified_at)::bigint,
+                         created_by, updated_by
                   FROM storage.folders
                  WHERE parent_id = $1::uuid AND user_id = $2 AND NOT is_trashed
                  ORDER BY name
@@ -321,10 +418,11 @@ impl FolderRepository for FolderDbRepository {
         } else {
             sqlx::query_as(
                 r#"
-                SELECT id::text, name, path, parent_id::text, user_id,
+                SELECT id::text, name, path, parent_id::text, user_id, drive_id,
                        EXTRACT(EPOCH FROM created_at)::bigint,
                        EXTRACT(EPOCH FROM updated_at)::bigint,
-                       EXTRACT(EPOCH FROM tree_modified_at)::bigint
+                       EXTRACT(EPOCH FROM tree_modified_at)::bigint,
+                         created_by, updated_by
                   FROM storage.folders
                  WHERE parent_id IS NULL AND user_id = $1 AND NOT is_trashed
                  ORDER BY name
@@ -337,8 +435,8 @@ impl FolderRepository for FolderDbRepository {
         .map_err(|e| DomainError::internal_error("FolderDb", format!("list_by_owner: {e}")))?;
 
         rows.into_iter()
-            .map(|(id, name, path, pid, uid, ca, ma, tma)| {
-                Self::row_to_folder(id, name, path, pid, Some(uid), ca, ma, tma)
+            .map(|(id, name, path, pid, uid, did, ca, ma, tma, cb, ub)| {
+                Self::row_to_folder(id, name, path, pid, Some(uid), did, ca, ma, tma, cb, ub)
             })
             .collect()
     }
@@ -357,10 +455,11 @@ impl FolderRepository for FolderDbRepository {
         let rows: Vec<FolderRowPaginated> = if let Some(pid) = parent_id {
             sqlx::query_as(
                 r#"
-                SELECT id::text, name, path, parent_id::text, user_id,
+                SELECT id::text, name, path, parent_id::text, user_id, drive_id,
                        EXTRACT(EPOCH FROM created_at)::bigint,
                        EXTRACT(EPOCH FROM updated_at)::bigint,
                        EXTRACT(EPOCH FROM tree_modified_at)::bigint,
+                       created_by, updated_by,
                        COUNT(*) OVER() AS total_count
                   FROM storage.folders
                  WHERE parent_id = $1::uuid AND NOT is_trashed
@@ -376,10 +475,11 @@ impl FolderRepository for FolderDbRepository {
         } else {
             sqlx::query_as(
                 r#"
-                SELECT id::text, name, path, parent_id::text, user_id,
+                SELECT id::text, name, path, parent_id::text, user_id, drive_id,
                        EXTRACT(EPOCH FROM created_at)::bigint,
                        EXTRACT(EPOCH FROM updated_at)::bigint,
                        EXTRACT(EPOCH FROM tree_modified_at)::bigint,
+                       created_by, updated_by,
                        COUNT(*) OVER() AS total_count
                   FROM storage.folders
                  WHERE parent_id IS NULL AND NOT is_trashed
@@ -396,16 +496,18 @@ impl FolderRepository for FolderDbRepository {
 
         // total_count is identical in every row; 0 when the result set is empty.
         let total = if include_total {
-            Some(rows.first().map_or(0, |r| r.8) as usize)
+            Some(rows.first().map_or(0, |r| r.11) as usize)
         } else {
             None
         };
 
         let folders: Result<Vec<Folder>, DomainError> = rows
             .into_iter()
-            .map(|(id, name, path, pid, uid, ca, ma, tma, _total)| {
-                Self::row_to_folder(id, name, path, pid, Some(uid), ca, ma, tma)
-            })
+            .map(
+                |(id, name, path, pid, uid, did, ca, ma, tma, cb, ub, _total)| {
+                    Self::row_to_folder(id, name, path, pid, Some(uid), did, ca, ma, tma, cb, ub)
+                },
+            )
             .collect();
         Ok((folders?, total))
     }
@@ -424,10 +526,11 @@ impl FolderRepository for FolderDbRepository {
         let rows: Vec<FolderRowPaginated> = if let Some(pid) = parent_id {
             sqlx::query_as(
                 r#"
-                SELECT id::text, name, path, parent_id::text, user_id,
+                SELECT id::text, name, path, parent_id::text, user_id, drive_id,
                        EXTRACT(EPOCH FROM created_at)::bigint,
                        EXTRACT(EPOCH FROM updated_at)::bigint,
                        EXTRACT(EPOCH FROM tree_modified_at)::bigint,
+                       created_by, updated_by,
                        COUNT(*) OVER() AS total_count
                   FROM storage.folders
                  WHERE parent_id = $1::uuid AND user_id = $2 AND NOT is_trashed
@@ -444,10 +547,11 @@ impl FolderRepository for FolderDbRepository {
         } else {
             sqlx::query_as(
                 r#"
-                SELECT id::text, name, path, parent_id::text, user_id,
+                SELECT id::text, name, path, parent_id::text, user_id, drive_id,
                        EXTRACT(EPOCH FROM created_at)::bigint,
                        EXTRACT(EPOCH FROM updated_at)::bigint,
                        EXTRACT(EPOCH FROM tree_modified_at)::bigint,
+                       created_by, updated_by,
                        COUNT(*) OVER() AS total_count
                   FROM storage.folders
                  WHERE parent_id IS NULL AND user_id = $1 AND NOT is_trashed
@@ -464,41 +568,55 @@ impl FolderRepository for FolderDbRepository {
         .map_err(|e| DomainError::internal_error("FolderDb", format!("paginate_by_owner: {e}")))?;
 
         let total = if include_total {
-            Some(rows.first().map_or(0, |r| r.8) as usize)
+            Some(rows.first().map_or(0, |r| r.11) as usize)
         } else {
             None
         };
 
         let folders: Result<Vec<Folder>, DomainError> = rows
             .into_iter()
-            .map(|(id, name, path, pid, uid, ca, ma, tma, _total)| {
-                Self::row_to_folder(id, name, path, pid, Some(uid), ca, ma, tma)
-            })
+            .map(
+                |(id, name, path, pid, uid, did, ca, ma, tma, cb, ub, _total)| {
+                    Self::row_to_folder(id, name, path, pid, Some(uid), did, ca, ma, tma, cb, ub)
+                },
+            )
             .collect();
         Ok((folders?, total))
     }
 
-    async fn rename_folder(&self, id: &str, new_name: String) -> Result<Folder, DomainError> {
+    async fn rename_folder(
+        &self,
+        id: &str,
+        new_name: String,
+        caller_id: Uuid,
+    ) -> Result<Folder, DomainError> {
         // The BEFORE UPDATE trigger recomputes path/lpath for this row;
         // the AFTER UPDATE cascade trigger then batch-updates all
         // descendants in a single UPDATE using the GiST lpath index.
         // That multi-row rewrite can deadlock against the tree-ETag
         // flusher's id-ordered ancestor bump — retry instead of failing
         // the user's operation (40P01 only; 23505 still maps below).
+        //
+        // §14: `updated_by = $3` (caller_id) — the caller mutated this
+        // row, not the row's owner. In D2 a shared-drive member can
+        // rename a row they don't own; the previous `updated_by = user_id`
+        // would have silently recorded the wrong principal.
         let row = retry_on_deadlock("folders.rename", || {
             sqlx::query_as::<_, FolderRow>(
                 r#"
                 UPDATE storage.folders
-                   SET name = $1, updated_at = NOW()
+                   SET name = $1, updated_at = NOW(), updated_by = $3
                  WHERE id = $2::uuid AND NOT is_trashed
-                RETURNING id::text, name, path, parent_id::text, user_id,
+                RETURNING id::text, name, path, parent_id::text, user_id, drive_id,
                           EXTRACT(EPOCH FROM created_at)::bigint,
                           EXTRACT(EPOCH FROM updated_at)::bigint,
-                           EXTRACT(EPOCH FROM tree_modified_at)::bigint
+                           EXTRACT(EPOCH FROM tree_modified_at)::bigint,
+                             created_by, updated_by
                 "#,
             )
             .bind(&new_name)
             .bind(id)
+            .bind(caller_id)
             .fetch_optional(self.pool())
         })
         .await
@@ -512,39 +630,68 @@ impl FolderRepository for FolderDbRepository {
         })?
         .ok_or_else(|| DomainError::not_found("Folder", id))?;
 
-        Self::row_to_folder(row.0, row.1, row.2, row.3, Some(row.4), row.5, row.6, row.7)
+        Self::row_to_folder(
+            row.0,
+            row.1,
+            row.2,
+            row.3,
+            Some(row.4),
+            row.5,
+            row.6,
+            row.7,
+            row.8,
+            row.9,
+            row.10,
+        )
     }
 
     async fn move_folder(
         &self,
         id: &str,
         new_parent_id: Option<&str>,
+        caller_id: Uuid,
     ) -> Result<Folder, DomainError> {
         // The BEFORE UPDATE trigger recomputes path/lpath for this row;
         // the AFTER UPDATE cascade trigger then batch-updates all
         // descendants in a single UPDATE using the GiST lpath index.
         // Retried on deadlock vs the tree-ETag flusher (see rename_folder).
+        //
+        // §14: `updated_by = $3` (caller_id), see rename_folder.
         let row = retry_on_deadlock("folders.move", || {
             sqlx::query_as::<_, FolderRow>(
                 r#"
                 UPDATE storage.folders
-                   SET parent_id = $1::uuid, updated_at = NOW()
+                   SET parent_id = $1::uuid, updated_at = NOW(), updated_by = $3
                  WHERE id = $2::uuid AND NOT is_trashed
-                RETURNING id::text, name, path, parent_id::text, user_id,
+                RETURNING id::text, name, path, parent_id::text, user_id, drive_id,
                           EXTRACT(EPOCH FROM created_at)::bigint,
                           EXTRACT(EPOCH FROM updated_at)::bigint,
-                           EXTRACT(EPOCH FROM tree_modified_at)::bigint
+                           EXTRACT(EPOCH FROM tree_modified_at)::bigint,
+                             created_by, updated_by
                 "#,
             )
             .bind(new_parent_id)
             .bind(id)
+            .bind(caller_id)
             .fetch_optional(self.pool())
         })
         .await
         .map_err(|e| DomainError::internal_error("FolderDb", format!("move: {e}")))?
         .ok_or_else(|| DomainError::not_found("Folder", id))?;
 
-        Self::row_to_folder(row.0, row.1, row.2, row.3, Some(row.4), row.5, row.6, row.7)
+        Self::row_to_folder(
+            row.0,
+            row.1,
+            row.2,
+            row.3,
+            Some(row.4),
+            row.5,
+            row.6,
+            row.7,
+            row.8,
+            row.9,
+            row.10,
+        )
     }
 
     async fn delete_folder(&self, id: &str) -> Result<(), DomainError> {
@@ -582,14 +729,22 @@ impl FolderRepository for FolderDbRepository {
         Ok(())
     }
 
-    async fn folder_exists(&self, storage_path: &StoragePath) -> Result<bool, DomainError> {
+    async fn folder_exists(
+        &self,
+        storage_path: &StoragePath,
+        drive_id: Uuid,
+    ) -> Result<bool, DomainError> {
         let path_str = storage_path.to_string();
         let lookup = path_str.strip_prefix('/').unwrap_or(&path_str);
 
+        // Post-D0 `storage.folders.path` repeats across drives —
+        // filter by `drive_id` to scope the existence check.
         let exists: bool = sqlx::query_scalar(
-            "SELECT EXISTS(SELECT 1 FROM storage.folders WHERE path = $1 AND NOT is_trashed)",
+            "SELECT EXISTS(SELECT 1 FROM storage.folders \
+             WHERE path = $1 AND drive_id = $2 AND NOT is_trashed)",
         )
         .bind(lookup)
+        .bind(drive_id)
         .fetch_one(self.pool())
         .await
         .map_err(|e| DomainError::internal_error("FolderDb", format!("exists: {e}")))?;
@@ -611,7 +766,7 @@ impl FolderRepository for FolderDbRepository {
 
     // ── Trash operations ──
 
-    async fn move_to_trash(&self, folder_id: &str) -> Result<(), DomainError> {
+    async fn move_to_trash(&self, folder_id: &str, caller_id: Uuid) -> Result<(), DomainError> {
         // Soft-delete the whole subtree in one statement: the root flips
         // `is_trashed` and records `original_parent_id` so restore knows
         // where to put it back; every descendant (folder or file) that
@@ -626,6 +781,10 @@ impl FolderRepository for FolderDbRepository {
         // `/g9-tree/file.txt` still resolved 207 even though the parent
         // collection was gone) — a class of data-integrity drift that
         // confused desktop-sync tree walks.
+        //
+        // §14: all three CTE branches stamp `updated_by = $2`
+        // (caller_id). The cascade is "the caller trashed this
+        // subtree", not "each owner trashed their own row".
         let result = retry_on_deadlock("folders.trash", || {
             sqlx::query_scalar::<_, i64>(
                 r#"
@@ -634,7 +793,8 @@ impl FolderRepository for FolderDbRepository {
                        SET is_trashed = TRUE,
                            trashed_at = NOW(),
                            original_parent_id = parent_id,
-                           updated_at = NOW()
+                           updated_at = NOW(),
+                           updated_by = $2
                      WHERE id = $1::uuid AND NOT is_trashed
                     RETURNING id, lpath
                 ),
@@ -642,7 +802,8 @@ impl FolderRepository for FolderDbRepository {
                     UPDATE storage.folders f
                        SET is_trashed = TRUE,
                            trashed_at = NOW(),
-                           updated_at = NOW()
+                           updated_at = NOW(),
+                           updated_by = $2
                       FROM trash_root tr
                      WHERE f.lpath <@ tr.lpath
                        AND f.id != tr.id
@@ -653,7 +814,8 @@ impl FolderRepository for FolderDbRepository {
                     UPDATE storage.files fi
                        SET is_trashed = TRUE,
                            trashed_at = NOW(),
-                           updated_at = NOW()
+                           updated_at = NOW(),
+                           updated_by = $2
                       FROM trash_root tr
                       JOIN storage.folders f ON f.lpath <@ tr.lpath
                      WHERE fi.folder_id = f.id
@@ -664,6 +826,7 @@ impl FolderRepository for FolderDbRepository {
                 "#,
             )
             .bind(folder_id)
+            .bind(caller_id)
             .fetch_one(self.pool())
         })
         .await
@@ -680,6 +843,7 @@ impl FolderRepository for FolderDbRepository {
         &self,
         folder_id: &str,
         _original_path: &str,
+        caller_id: Uuid,
     ) -> Result<(), DomainError> {
         // Inverse of the cascade in `move_to_trash`: restore the root
         // (BEFORE UPDATE trigger recomputes path/lpath via the parent_id
@@ -689,6 +853,10 @@ impl FolderRepository for FolderDbRepository {
         // *before* this folder went to trash have `original_*` set, so
         // they correctly stay in trash and continue to show up as
         // top-level trash entries via `storage.trash_items`.
+        //
+        // §14: all three CTE branches stamp `updated_by = $2`
+        // (caller_id). Restoration is "the caller restored this
+        // subtree", regardless of who originally owned each row.
         let result = retry_on_deadlock("folders.restore", || {
             sqlx::query_scalar::<_, i64>(
                 r#"
@@ -698,7 +866,8 @@ impl FolderRepository for FolderDbRepository {
                            trashed_at = NULL,
                            parent_id = COALESCE(original_parent_id, parent_id),
                            original_parent_id = NULL,
-                           updated_at = NOW()
+                           updated_at = NOW(),
+                           updated_by = $2
                      WHERE id = $1::uuid AND is_trashed
                     RETURNING id, lpath
                 ),
@@ -706,7 +875,8 @@ impl FolderRepository for FolderDbRepository {
                     UPDATE storage.folders f
                        SET is_trashed = FALSE,
                            trashed_at = NULL,
-                           updated_at = NOW()
+                           updated_at = NOW(),
+                           updated_by = $2
                       FROM restore_root rr
                      WHERE f.lpath <@ rr.lpath
                        AND f.id != rr.id
@@ -718,7 +888,8 @@ impl FolderRepository for FolderDbRepository {
                     UPDATE storage.files fi
                        SET is_trashed = FALSE,
                            trashed_at = NULL,
-                           updated_at = NOW()
+                           updated_at = NOW(),
+                           updated_by = $2
                       FROM restore_root rr
                       JOIN storage.folders f ON f.lpath <@ rr.lpath
                      WHERE fi.folder_id = f.id
@@ -730,6 +901,7 @@ impl FolderRepository for FolderDbRepository {
                 "#,
             )
             .bind(folder_id)
+            .bind(caller_id)
             .fetch_one(self.pool())
         })
         .await
@@ -775,61 +947,6 @@ impl FolderRepository for FolderDbRepository {
         Ok(())
     }
 
-    async fn create_home_folder(&self, user_id: Uuid, name: String) -> Result<Folder, DomainError> {
-        let row = sqlx::query_as::<_, (String, String, i64, i64, i64)>(
-            r#"
-            INSERT INTO storage.folders (name, parent_id, user_id)
-            VALUES ($1, NULL, $2)
-            ON CONFLICT DO NOTHING
-            RETURNING id::text,
-                      path,
-                      EXTRACT(EPOCH FROM created_at)::bigint,
-                      EXTRACT(EPOCH FROM updated_at)::bigint,
-                       EXTRACT(EPOCH FROM tree_modified_at)::bigint
-            "#,
-        )
-        .bind(&name)
-        .bind(user_id)
-        .fetch_optional(self.pool())
-        .await
-        .map_err(|e| DomainError::internal_error("FolderDb", format!("home folder: {e}")))?;
-
-        match row {
-            Some((id, path, ca, ma, tma)) => {
-                Self::row_to_folder(id, name.clone(), path, None, Some(user_id), ca, ma, tma)
-            }
-            None => {
-                // Already exists — fetch it
-                let existing = sqlx::query_as::<_, (String, String, i64, i64, i64)>(
-                    r#"
-                    SELECT id::text,
-                           path,
-                           EXTRACT(EPOCH FROM created_at)::bigint,
-                           EXTRACT(EPOCH FROM updated_at)::bigint,
-                           EXTRACT(EPOCH FROM tree_modified_at)::bigint
-                      FROM storage.folders
-                     WHERE name = $1 AND user_id = $2 AND parent_id IS NULL
-                    "#,
-                )
-                .bind(&name)
-                .bind(user_id)
-                .fetch_one(self.pool())
-                .await
-                .map_err(|e| DomainError::internal_error("FolderDb", format!("home fetch: {e}")))?;
-                Self::row_to_folder(
-                    existing.0,
-                    name,
-                    existing.1,
-                    None,
-                    Some(user_id),
-                    existing.2,
-                    existing.3,
-                    existing.4,
-                )
-            }
-        }
-    }
-
     /// Lists every folder in a subtree rooted at `folder_id` (inclusive).
     ///
     /// Single GiST-indexed query: `fo.lpath <@ (root's lpath)`.
@@ -837,10 +954,11 @@ impl FolderRepository for FolderDbRepository {
     #[allow(clippy::type_complexity)]
     async fn list_subtree_folders(&self, folder_id: &str) -> Result<Vec<Folder>, DomainError> {
         let sql = "SELECT fo.id::text, fo.name, fo.path, fo.parent_id::text, \
-                          fo.user_id, \
+                          fo.user_id, fo.drive_id, \
                           EXTRACT(EPOCH FROM fo.created_at)::bigint, \
                           EXTRACT(EPOCH FROM fo.updated_at)::bigint, \
-                          EXTRACT(EPOCH FROM fo.tree_modified_at)::bigint \
+                          EXTRACT(EPOCH FROM fo.tree_modified_at)::bigint, \
+                        fo.created_by, fo.updated_by \
                      FROM storage.folders fo \
                     WHERE fo.is_trashed = false \
                       AND fo.lpath <@ (SELECT lpath FROM storage.folders WHERE id = $1::uuid) \
@@ -855,8 +973,8 @@ impl FolderRepository for FolderDbRepository {
             })?;
 
         rows.into_iter()
-            .map(|(id, name, path, pid, uid, ca, ma, tma)| {
-                Self::row_to_folder(id, name, path, pid, uid, ca, ma, tma)
+            .map(|(id, name, path, pid, uid, did, ca, ma, tma, cb, ub)| {
+                Self::row_to_folder(id, name, path, pid, uid, did, ca, ma, tma, cb, ub)
             })
             .collect()
     }
@@ -900,10 +1018,11 @@ impl FolderRepository for FolderDbRepository {
             // Recursive, no folder scope → ALL user folders
             let sql = format!(
                 "SELECT fo.id::text, fo.name, fo.path, fo.parent_id::text, \
-                        fo.user_id, \
+                        fo.user_id, fo.drive_id, \
                         EXTRACT(EPOCH FROM fo.created_at)::bigint, \
                         EXTRACT(EPOCH FROM fo.updated_at)::bigint, \
-                          EXTRACT(EPOCH FROM fo.tree_modified_at)::bigint \
+                          EXTRACT(EPOCH FROM fo.tree_modified_at)::bigint, \
+                      fo.created_by, fo.updated_by \
                    FROM storage.folders fo \
                   WHERE fo.user_id = $1 \
                     AND fo.is_trashed = false \
@@ -927,8 +1046,8 @@ impl FolderRepository for FolderDbRepository {
 
             return rows
                 .into_iter()
-                .map(|(id, name, path, pid, uid, ca, ma, tma)| {
-                    Self::row_to_folder(id, name, path, pid, uid, ca, ma, tma)
+                .map(|(id, name, path, pid, uid, did, ca, ma, tma, cb, ub)| {
+                    Self::row_to_folder(id, name, path, pid, uid, did, ca, ma, tma, cb, ub)
                 })
                 .collect();
         }
@@ -937,10 +1056,11 @@ impl FolderRepository for FolderDbRepository {
         let sql = if parent_id.is_some() {
             format!(
                 "SELECT fo.id::text, fo.name, fo.path, fo.parent_id::text, \
-                        fo.user_id, \
+                        fo.user_id, fo.drive_id, \
                         EXTRACT(EPOCH FROM fo.created_at)::bigint, \
                         EXTRACT(EPOCH FROM fo.updated_at)::bigint, \
-                          EXTRACT(EPOCH FROM fo.tree_modified_at)::bigint \
+                          EXTRACT(EPOCH FROM fo.tree_modified_at)::bigint, \
+                      fo.created_by, fo.updated_by \
                    FROM storage.folders fo \
                   WHERE fo.parent_id = $1::uuid \
                     AND fo.user_id = $2 \
@@ -956,10 +1076,11 @@ impl FolderRepository for FolderDbRepository {
             };
             format!(
                 "SELECT fo.id::text, fo.name, fo.path, fo.parent_id::text, \
-                        fo.user_id, \
+                        fo.user_id, fo.drive_id, \
                         EXTRACT(EPOCH FROM fo.created_at)::bigint, \
                         EXTRACT(EPOCH FROM fo.updated_at)::bigint, \
-                          EXTRACT(EPOCH FROM fo.tree_modified_at)::bigint \
+                          EXTRACT(EPOCH FROM fo.tree_modified_at)::bigint, \
+                      fo.created_by, fo.updated_by \
                    FROM storage.folders fo \
                   WHERE fo.parent_id IS NULL \
                     AND fo.user_id = $1 \
@@ -999,8 +1120,8 @@ impl FolderRepository for FolderDbRepository {
         .map_err(|e| DomainError::internal_error("FolderDb", format!("search_folders: {e}")))?;
 
         rows.into_iter()
-            .map(|(id, name, path, pid, uid, ca, ma, tma)| {
-                Self::row_to_folder(id, name, path, pid, uid, ca, ma, tma)
+            .map(|(id, name, path, pid, uid, did, ca, ma, tma, cb, ub)| {
+                Self::row_to_folder(id, name, path, pid, uid, did, ca, ma, tma, cb, ub)
             })
             .collect()
     }
@@ -1025,10 +1146,11 @@ impl FolderRepository for FolderDbRepository {
 
         let sql = format!(
             "SELECT fo.id::text, fo.name, fo.path, fo.parent_id::text, \
-                    fo.user_id, \
+                    fo.user_id, fo.drive_id, \
                     EXTRACT(EPOCH FROM fo.created_at)::bigint, \
                     EXTRACT(EPOCH FROM fo.updated_at)::bigint, \
-                          EXTRACT(EPOCH FROM fo.tree_modified_at)::bigint \
+                          EXTRACT(EPOCH FROM fo.tree_modified_at)::bigint, \
+                  fo.created_by, fo.updated_by \
                FROM storage.folders fo \
               WHERE fo.user_id = $1 \
                 AND fo.is_trashed = false \
@@ -1055,8 +1177,8 @@ impl FolderRepository for FolderDbRepository {
         .map_err(|e| DomainError::internal_error("FolderDb", format!("descendant search: {e}")))?;
 
         rows.into_iter()
-            .map(|(id, name, path, pid, uid, ca, ma, tma)| {
-                Self::row_to_folder(id, name, path, pid, uid, ca, ma, tma)
+            .map(|(id, name, path, pid, uid, did, ca, ma, tma, cb, ub)| {
+                Self::row_to_folder(id, name, path, pid, uid, did, ca, ma, tma, cb, ub)
             })
             .collect()
     }
@@ -1074,10 +1196,11 @@ impl FolderRepository for FolderDbRepository {
         let rows: Vec<FolderRow> = if let Some(pid) = parent_id {
             sqlx::query_as(
                 r#"
-                SELECT id::text, name, path, parent_id::text, user_id,
+                SELECT id::text, name, path, parent_id::text, user_id, drive_id,
                        EXTRACT(EPOCH FROM created_at)::bigint,
                        EXTRACT(EPOCH FROM updated_at)::bigint,
-                       EXTRACT(EPOCH FROM tree_modified_at)::bigint
+                       EXTRACT(EPOCH FROM tree_modified_at)::bigint,
+                         created_by, updated_by
                   FROM storage.folders
                  WHERE parent_id = $1::uuid
                    AND NOT is_trashed
@@ -1100,10 +1223,11 @@ impl FolderRepository for FolderDbRepository {
         } else {
             sqlx::query_as(
                 r#"
-                SELECT id::text, name, path, parent_id::text, user_id,
+                SELECT id::text, name, path, parent_id::text, user_id, drive_id,
                        EXTRACT(EPOCH FROM created_at)::bigint,
                        EXTRACT(EPOCH FROM updated_at)::bigint,
-                       EXTRACT(EPOCH FROM tree_modified_at)::bigint
+                       EXTRACT(EPOCH FROM tree_modified_at)::bigint,
+                         created_by, updated_by
                   FROM storage.folders
                  WHERE parent_id IS NULL
                    AND NOT is_trashed
@@ -1126,8 +1250,8 @@ impl FolderRepository for FolderDbRepository {
         .map_err(|e| DomainError::internal_error("FolderDb", format!("suggest: {e}")))?;
 
         rows.into_iter()
-            .map(|(id, name, path, pid, uid, ca, ma, tma)| {
-                Self::row_to_folder(id, name, path, pid, Some(uid), ca, ma, tma)
+            .map(|(id, name, path, pid, uid, did, ca, ma, tma, cb, ub)| {
+                Self::row_to_folder(id, name, path, pid, Some(uid), did, ca, ma, tma, cb, ub)
             })
             .collect()
     }

src/infrastructure/repositories/pg/mod.rs

@@ -6,6 +6,7 @@ mod contact_group_pg_repository;
 mod contact_persistence_dto;
 mod contact_pg_repository;
 mod device_code_pg_repository;
+mod drive_pg_repository;
 mod face_pg_repository;
 mod favorites_pg_repository;
 pub mod file_metadata_repository;
@@ -34,6 +35,7 @@ pub use contact_group_pg_repository::ContactGroupPgRepository;
 pub use contact_persistence_dto::*;
 pub use contact_pg_repository::ContactPgRepository;
 pub use device_code_pg_repository::DeviceCodePgRepository;
+pub use drive_pg_repository::DrivePgRepository;
 pub use face_pg_repository::FacePgRepository;
 pub use favorites_pg_repository::FavoritesPgRepository;
 pub use file_blob_read_repository::FileBlobReadRepository;

src/infrastructure/services/dedup_service.rs

@@ -1927,7 +1927,7 @@ impl DedupService {
                               OR b.orphaned_at < now() - ($2::int * interval '1 second'))
                          AND NOT EXISTS (
                              SELECT 1 FROM storage.chunk_manifests m
-                              WHERE m.chunk_hashes @> ARRAY[b.hash]
+                              WHERE m.chunk_hashes @> ARRAY[b.hash::text]
                          )
                          AND NOT EXISTS (
                              SELECT 1 FROM storage.files f
@@ -2776,12 +2776,22 @@ mod rechunk_integration_tests {
         Arc::new(pool)
     }
 
-    async fn seed_user(pool: &PgPool) -> Uuid {
-        sqlx::query("SELECT id FROM auth.users LIMIT 1")
-            .fetch_one(pool)
-            .await
-            .map(|r| r.get::<Uuid, _>("id"))
-            .expect("auth.users must be seeded (init-test-schema.sh)")
+    /// Returns `(user_id, drive_id)`. Post-D0 every internal user has a
+    /// default Personal drive (provisioned by `PersonalDriveLifecycleHook`
+    /// during init-test-schema.sh's user seeding); the JOIN below picks
+    /// the user-drive pair atomically so test fixtures can insert into
+    /// `storage.files` with both `user_id` and `drive_id` populated.
+    async fn seed_user(pool: &PgPool) -> (Uuid, Uuid) {
+        sqlx::query(
+            "SELECT u.id AS user_id, d.id AS drive_id
+               FROM auth.users u
+               JOIN storage.drives d ON d.default_for_user = u.id
+              LIMIT 1",
+        )
+        .fetch_one(pool)
+        .await
+        .map(|r| (r.get::<Uuid, _>("user_id"), r.get::<Uuid, _>("drive_id")))
+        .expect("auth.users + storage.drives must be seeded (init-test-schema.sh)")
     }
 
     /// Plain local backend in a fresh temp dir.
@@ -2848,7 +2858,7 @@ mod rechunk_integration_tests {
         .await
         .expect("insert legacy blob row");
 
-        let user_id = seed_user(pool).await;
+        let (user_id, drive_id) = seed_user(pool).await;
         let mut file_ids = Vec::new();
         for i in 0..n_files {
             let name = format!(
@@ -2856,11 +2866,12 @@ mod rechunk_integration_tests {
                 &Uuid::new_v4().to_string()[..8]
             );
             let id: Uuid = sqlx::query_scalar(
-                "INSERT INTO storage.files (name, user_id, blob_hash, size)
-                 VALUES ($1, $2, $3, $4) RETURNING id",
+                "INSERT INTO storage.files (name, user_id, drive_id, blob_hash, size)
+                 VALUES ($1, $2, $3, $4, $5) RETURNING id",
             )
             .bind(&name)
             .bind(user_id)
+            .bind(drive_id)
             .bind(&hash)
             .bind(data.len() as i64)
             .fetch_one(pool)
@@ -3121,12 +3132,20 @@ mod delta_upload_integration_tests {
         Arc::new(pool)
     }
 
-    async fn seed_user(pool: &PgPool) -> Uuid {
-        sqlx::query("SELECT id FROM auth.users LIMIT 1")
-            .fetch_one(pool)
-            .await
-            .map(|r| r.get::<Uuid, _>("id"))
-            .expect("auth.users must be seeded (init-test-schema.sh)")
+    /// Returns `(user_id, drive_id)` — same shape as the rechunk tests'
+    /// `seed_user`. Post-D0 every internal user has a default Personal
+    /// drive provisioned by `PersonalDriveLifecycleHook`.
+    async fn seed_user(pool: &PgPool) -> (Uuid, Uuid) {
+        sqlx::query(
+            "SELECT u.id AS user_id, d.id AS drive_id
+               FROM auth.users u
+               JOIN storage.drives d ON d.default_for_user = u.id
+              LIMIT 1",
+        )
+        .fetch_one(pool)
+        .await
+        .map(|r| (r.get::<Uuid, _>("user_id"), r.get::<Uuid, _>("drive_id")))
+        .expect("auth.users + storage.drives must be seeded (init-test-schema.sh)")
     }
 
     async fn local_svc(pool: &Arc<PgPool>, dir: &TempDir) -> DedupService {
@@ -3141,6 +3160,7 @@ mod delta_upload_integration_tests {
         svc: &DedupService,
         pool: &PgPool,
         user_id: Uuid,
+        drive_id: Uuid,
         data: &[u8],
         label: &str,
     ) -> (String, Vec<String>, Uuid) {
@@ -3159,14 +3179,15 @@ mod delta_upload_integration_tests {
         .expect("chunks");
 
         let file_id: Uuid = sqlx::query_scalar(
-            "INSERT INTO storage.files (name, user_id, blob_hash, size)
-             VALUES ($1, $2, $3, $4) RETURNING id",
+            "INSERT INTO storage.files (name, user_id, drive_id, blob_hash, size)
+             VALUES ($1, $2, $3, $4, $5) RETURNING id",
         )
         .bind(format!(
             "rust-test-delta-{label}-{}",
             &Uuid::new_v4().to_string()[..8]
         ))
         .bind(user_id)
+        .bind(drive_id)
         .bind(&file_hash)
         .bind(data.len() as i64)
         .fetch_one(pool)
@@ -3226,13 +3247,13 @@ mod delta_upload_integration_tests {
         let pool = test_pool().await;
         let dir = TempDir::new().unwrap();
         let svc = local_svc(&pool, &dir).await;
-        let user = seed_user(&pool).await;
+        let (user, drive_id) = seed_user(&pool).await;
 
         // Owned content (multi-chunk), one foreign chunk (ref 1, no file
         // row for this user), one orphan (ref 0), one unknown hash.
         let data = content(3 * 1024 * 1024, 21);
         let (file_hash, owned_chunks, file_id) =
-            seed_owned_content(&svc, &pool, user, &data, "claim").await;
+            seed_owned_content(&svc, &pool, user, drive_id, &data, "claim").await;
         assert!(owned_chunks.len() >= 3, "3 MiB must split into ≥3 chunks");
 
         let foreign = blake3::hash(format!("foreign-{}", Uuid::new_v4()).as_bytes())
@@ -3316,12 +3337,12 @@ mod delta_upload_integration_tests {
         let pool = test_pool().await;
         let dir = TempDir::new().unwrap();
         let svc = local_svc(&pool, &dir).await;
-        let user = seed_user(&pool).await;
+        let (user, drive_id) = seed_user(&pool).await;
 
         // An owned chunk that the client redundantly re-uploads.
         let data = content(100 * 1024, 22);
         let (file_hash, owned_chunks, file_id) =
-            seed_owned_content(&svc, &pool, user, &data, "loose").await;
+            seed_owned_content(&svc, &pool, user, drive_id, &data, "loose").await;
         let owned_chunk_bytes = {
             let mut stream = svc.read_blob_stream(&file_hash).await.expect("stream");
             let mut out = Vec::new();
@@ -3373,7 +3394,7 @@ mod delta_upload_integration_tests {
         let pool = test_pool().await;
         let dir = TempDir::new().unwrap();
         let svc = local_svc(&pool, &dir).await;
-        let user = seed_user(&pool).await;
+        let (user, drive_id) = seed_user(&pool).await;
 
         // (A) An aged orphan (orphaned well past the grace window) with no
         //     references → must be collected (row + backing file).
@@ -3412,7 +3433,7 @@ mod delta_upload_integration_tests {
         //     stale ref_count must never delete referenced content.
         let data = content(3 * 1024 * 1024, 71);
         let (file_hash, owned_chunks, file_id) =
-            seed_owned_content(&svc, &pool, user, &data, "gc").await;
+            seed_owned_content(&svc, &pool, user, drive_id, &data, "gc").await;
         let referenced = owned_chunks[0].clone();
         sqlx::query(
             "UPDATE storage.blobs
@@ -3470,12 +3491,12 @@ mod delta_upload_integration_tests {
         let pool = test_pool().await;
         let dir = TempDir::new().unwrap();
         let svc = local_svc(&pool, &dir).await;
-        let user = seed_user(&pool).await;
+        let (user, drive_id) = seed_user(&pool).await;
 
         // Single-owner multi-chunk CDC file → its chunks are uniquely owned.
         let data = content(3 * 1024 * 1024, 91);
         let (file_hash, chunks, file_id) =
-            seed_owned_content(&svc, &pool, user, &data, "deref").await;
+            seed_owned_content(&svc, &pool, user, drive_id, &data, "deref").await;
         assert!(chunks.len() >= 3, "3 MiB must split into ≥3 chunks");
 
         // The delete_file_permanently sequence: drop the file row (PG trigger)
@@ -3540,11 +3561,11 @@ mod delta_upload_integration_tests {
         let pool = test_pool().await;
         let dir = TempDir::new().unwrap();
         let svc = local_svc(&pool, &dir).await;
-        let user = seed_user(&pool).await;
+        let (user, drive_id) = seed_user(&pool).await;
 
         let data = content(2 * 1024 * 1024 + 137, 24);
         let (file_hash, _chunks, file_id) =
-            seed_owned_content(&svc, &pool, user, &data, "verify").await;
+            seed_owned_content(&svc, &pool, user, drive_id, &data, "verify").await;
 
         let manifest: (Vec<String>, Vec<i64>) = sqlx::query_as(
             "SELECT chunk_hashes, chunk_sizes FROM storage.chunk_manifests WHERE file_hash = $1",

src/infrastructure/services/path_resolver_service.rs

@@ -64,6 +64,7 @@ impl PathResolverService {
                 String,         // path
                 Option<String>, // parent_id
                 Option<String>, // user_id
+                Uuid,           // drive_id
                 i64,            // created_at
                 i64,            // modified_at
                 Option<i64>,    // size
@@ -72,7 +73,7 @@ impl PathResolverService {
             ),
         >(
             r#"
-            SELECT resource_type, id, name, path, parent_id, user_id,
+            SELECT resource_type, id, name, path, parent_id, user_id, drive_id,
                    created_at, modified_at, size, mime_type, folder_id
               FROM (
                 SELECT 'folder'::text       AS resource_type,
@@ -81,6 +82,7 @@ impl PathResolverService {
                        fo.path,
                        fo.parent_id::text,
                        fo.user_id::text,
+                       fo.drive_id,
                        EXTRACT(EPOCH FROM fo.created_at)::bigint AS created_at,
                        EXTRACT(EPOCH FROM fo.updated_at)::bigint AS modified_at,
                        NULL::bigint         AS size,
@@ -102,6 +104,7 @@ impl PathResolverService {
                        END                  AS path,
                        NULL::text           AS parent_id,
                        fi.user_id::text,
+                       fi.drive_id,
                        EXTRACT(EPOCH FROM fi.created_at)::bigint AS created_at,
                        EXTRACT(EPOCH FROM fi.updated_at)::bigint AS modified_at,
                        fi.size,
@@ -136,6 +139,7 @@ impl PathResolverService {
             res_path,
             parent_id,
             uid,
+            drive_id,
             created_at,
             modified_at,
             size,
@@ -151,12 +155,19 @@ impl PathResolverService {
                 path: res_path,
                 parent_id,
                 owner_id: uid,
+                drive_id,
                 created_at: created_at as u64,
                 modified_at: modified_at as u64,
                 is_root: false,
                 icon_class: Arc::from("fas fa-folder"),
                 icon_special_class: Arc::from("folder-icon"),
                 category: Arc::from("Folder"),
+                // §14 provenance not selected by this resolver path —
+                // it's used for existence/type discrimination, not
+                // detailed DTO emission. Callers that need provenance
+                // reload through the repo.
+                created_by: None,
+                updated_by: None,
             })),
             _ => {
                 let mime = mime_type.unwrap_or_else(|| "application/octet-stream".to_string());
@@ -183,6 +194,9 @@ impl PathResolverService {
                     sort_date: None,
                     content_hash: String::new(),
                     etag: String::new(),
+                    // §14 provenance not selected by this resolver path
+                    created_by: None,
+                    updated_by: None,
                 }))
             }
         }

src/infrastructure/services/pg_acl_engine.rs

@@ -259,11 +259,32 @@ impl PgAclEngine {
         }
     }
 
+    /// Public wrapper around `subject_match_set` for callers that need
+    /// the expanded `(subject_types, subject_ids)` pair without invoking
+    /// the engine's full `check`/`require` pipeline. Used by
+    /// `GET /api/drives` (and future drive-aware listing surfaces) to
+    /// ask the `DriveRepository` for every drive the caller can read,
+    /// reusing the engine's cached group-expansion logic.
+    pub async fn expand_subject_for_listing(
+        &self,
+        subject: Subject,
+    ) -> Result<(Vec<&'static str>, Vec<Uuid>), DomainError> {
+        let counters = QueryCounters::default();
+        self.subject_match_set(subject, &counters).await
+    }
+
     /// Returns the owner UUID for any resource type.
     async fn owner_of(&self, resource: Resource) -> Result<Uuid, DomainError> {
         match resource {
             Resource::Folder(id) => self.folder_repo.get_folder_user_id(&id.to_string()).await,
             Resource::File(id) => self.file_repo.get_file_user_id(&id.to_string()).await,
+            // Drive owner resolution wires up in D0-6 once `DriveRepository`
+            // lands (D0-5). Drive entity carries `default_for_user` for
+            // `kind='personal'`; shared drives resolve through role_grants
+            // (Owner role). Returning NotFound here means a permission
+            // check that reached owner_of on a Drive falls through to the
+            // grant-lookup path — safe default during D0-1.
+            Resource::Drive(_) => Err(DomainError::not_found("Drive", resource.id().to_string())),
         }
     }
 
@@ -389,6 +410,43 @@ impl PgAclEngine {
         Ok(exists.is_some())
     }
 
+    /// Direct grant lookup for a drive — no ltree cascade (drives have
+    /// no ancestors). Mirrors the cascade helpers above but with a
+    /// straight `resource_type='drive' AND resource_id=$4` filter.
+    async fn drive_grant_exists(
+        &self,
+        subject_types: &[&str],
+        subject_ids: &[Uuid],
+        permission: Permission,
+        drive_id: Uuid,
+        counters: &QueryCounters,
+    ) -> Result<bool, DomainError> {
+        counters.sql_queries.fetch_add(1, Ordering::Relaxed);
+        let roles = Self::roles_implying_strings(permission);
+        let exists: Option<i32> = sqlx::query_scalar(
+            r#"
+            SELECT 1
+              FROM storage.role_grants g
+             WHERE g.subject_type  = ANY($1)
+               AND g.subject_id    = ANY($2)
+               AND g.role          = ANY($3::storage.grant_role[])
+               AND g.resource_type = 'drive'
+               AND g.resource_id   = $4
+               AND (g.expires_at IS NULL OR g.expires_at > NOW())
+             LIMIT 1
+            "#,
+        )
+        .bind(subject_types)
+        .bind(subject_ids)
+        .bind(&roles)
+        .bind(drive_id)
+        .fetch_optional(self.pool.as_ref())
+        .await
+        .map_err(|e| DomainError::internal_error("PgAcl", format!("drive grant: {e}")))?;
+
+        Ok(exists.is_some())
+    }
+
     /// Look up a single role grant by id, returning the actors a revoke /
     /// notify handler needs to make a decision without a second round-trip.
     /// Returns `(subject, resource, granted_by)` or `None` if no such row.
@@ -488,7 +546,12 @@ impl PgAclEngine {
     ) -> Result<bool, DomainError> {
         // Owner short-circuit (only for User subjects — groups/tokens/external
         // are never owners of resources).
-        if let Subject::User(uid) = subject {
+        // Owner short-circuit applies to Folder/File only — they carry a
+        // single-owner `user_id` column in their respective tables. Drives
+        // model ownership through the `Owner` role in `role_grants`, so
+        // there's no analogous fast path: the grant lookup below resolves
+        // a drive owner via the same query that resolves any drive role.
+        if let (Subject::User(uid), Resource::Folder(_) | Resource::File(_)) = (subject, resource) {
             counters.sql_queries.fetch_add(1, Ordering::Relaxed);
             match self.owner_of(resource).await {
                 Ok(owner) if owner == uid => return Ok(true),
@@ -529,6 +592,10 @@ impl PgAclEngine {
                 )
                 .await
             }
+            Resource::Drive(id) => {
+                self.drive_grant_exists(&subject_types, &subject_ids, permission, id, counters)
+                    .await
+            }
         }
     }
 }

src/infrastructure/services/search_index/content_index_worker.rs

@@ -242,14 +242,15 @@ impl ContentIndexWorker {
 
         // Authoritative state re-read: a queued 'upsert' whose row vanished
         // or got trashed in the meantime becomes a delete.
-        let files: Vec<(Uuid, String, String, String, String, i64)> =
+        let files: Vec<(Uuid, String, String, String, String, String, i64)> =
             if upsert_candidates.is_empty() {
                 Vec::new()
             } else {
                 sqlx::query_as(
-                    "SELECT fi.id, fi.user_id::text, fi.name, fi.blob_hash, fi.mime_type, fi.size
-                   FROM storage.files fi
-                  WHERE fi.id = ANY($1) AND NOT fi.is_trashed",
+                    "SELECT fi.id, fi.user_id::text, fi.drive_id::text, fi.name,
+                            fi.blob_hash, fi.mime_type, fi.size
+                       FROM storage.files fi
+                      WHERE fi.id = ANY($1) AND NOT fi.is_trashed",
                 )
                 .bind(&upsert_candidates)
                 .fetch_all(self.maintenance_pool.as_ref())
@@ -261,10 +262,10 @@ impl ContentIndexWorker {
         // Per-blob text: batch-read the extraction cache, extract misses.
         let wanted_hashes: Vec<String> = files
             .iter()
-            .filter(|(_, _, name, _, mime, size)| {
+            .filter(|(_, _, _, name, _, mime, size)| {
                 text_extractor::supports(name, mime) && *size as u64 <= self.max_extract_file_bytes
             })
-            .map(|f| f.3.clone())
+            .map(|f| f.4.clone())
             .collect();
         let mut text_by_hash: HashMap<String, Option<String>> = HashMap::new();
         if !wanted_hashes.is_empty() {
@@ -281,7 +282,7 @@ impl ContentIndexWorker {
         }
 
         let mut records = Vec::with_capacity(files.len());
-        for (file_id, user_id, name, blob_hash, mime, size) in files {
+        for (file_id, user_id, drive_id, name, blob_hash, mime, size) in files {
             let supported = text_extractor::supports(&name, &mime);
             let content = if !supported {
                 None
@@ -301,6 +302,7 @@ impl ContentIndexWorker {
             records.push(IndexDocRecord {
                 file_id: file_id.to_string(),
                 user_id,
+                drive_id,
                 name,
                 content,
                 preview,

src/infrastructure/services/search_index/tantivy_content_index.rs

@@ -37,7 +37,15 @@ use crate::common::errors::DomainError;
 /// Bump whenever the Tantivy schema OR the text extractor output changes in a
 /// way that requires re-indexing. A mismatch with the on-disk marker wipes the
 /// index directory and reseeds the dirty queue with every live file.
-pub const INDEX_SCHEMA_VERSION: &str = "1";
+///
+/// Version history:
+///   1 — initial schema (file_id, user_id, name, content, preview)
+///   2 — D0 added `drive_id` field; query filter pivots from user_id
+///       to a `drive_id ∈ accessible_drives` set membership clause. On
+///       deploy, every operator's index is wiped and reseeded against
+///       the post-D0 schema (the worker drains the dirty queue with
+///       drive_id-aware records).
+pub const INDEX_SCHEMA_VERSION: &str = "2";
 
 /// Recorded in `storage.blob_extracted_text.extractor`; rows from another
 /// version are dropped at worker startup (the reseed re-extracts them).
@@ -73,6 +81,11 @@ const PREFIX_MIN_CHARS: usize = 3;
 pub struct IndexDocRecord {
     pub file_id: String,
     pub user_id: String,
+    /// Owning drive — written verbatim into the `drive_id` STRING field
+    /// for set-membership filtering at query time. The user_id field is
+    /// kept during the D0 dual-write window for rollback safety; the
+    /// query filter no longer reads it.
+    pub drive_id: String,
     pub name: String,
     pub content: Option<String>,
     pub preview: Option<String>,
@@ -82,6 +95,7 @@ pub struct IndexDocRecord {
 struct IndexFields {
     file_id: Field,
     user_id: Field,
+    drive_id: Field,
     name: Field,
     content: Field,
     preview: Field,
@@ -105,6 +119,7 @@ impl TantivyContentIndex {
         let fields = IndexFields {
             file_id: builder.add_text_field("file_id", STRING | STORED),
             user_id: builder.add_text_field("user_id", STRING),
+            drive_id: builder.add_text_field("drive_id", STRING),
             name: builder.add_text_field("name", TEXT),
             content: builder.add_text_field("content", TEXT),
             preview: builder.add_text_field("preview", STORED),
@@ -197,6 +212,7 @@ impl TantivyContentIndex {
             let mut document = doc!(
                 self.fields.file_id => record.file_id,
                 self.fields.user_id => record.user_id,
+                self.fields.drive_id => record.drive_id,
                 self.fields.name => record.name,
             );
             if let Some(content) = record.content {
@@ -234,15 +250,26 @@ impl TantivyContentIndex {
 
     /// Build the scored query: every token must match (in name OR content,
     /// exact OR fuzzy OR — for the last token — prefix), and the whole thing
-    /// is `Must`-scoped to the user.
-    fn build_query(fields: IndexFields, user_id: &str, tokens: &[String]) -> Box<dyn Query> {
-        let mut clauses: Vec<(Occur, Box<dyn Query>)> = vec![(
-            Occur::Must,
-            Box::new(TermQuery::new(
-                Term::from_field_text(fields.user_id, user_id),
-                IndexRecordOption::Basic,
-            )),
-        )];
+    /// is `Must`-scoped to the caller's accessible drives.
+    ///
+    /// The drive filter is expressed as a BoolQuery with `Should` arms —
+    /// at least one drive_id must match — wrapped under an outer `Must`.
+    /// Equivalent to a TermSetQuery; this form avoids the API churn of
+    /// rebuilding the same shape across Tantivy versions.
+    fn build_query(fields: IndexFields, drive_ids: &[String], tokens: &[String]) -> Box<dyn Query> {
+        // Drive-membership Must clause: union of Term(drive_id = $each).
+        let drive_alternatives: Vec<(Occur, Box<dyn Query>)> = drive_ids
+            .iter()
+            .map(|d| {
+                let q: Box<dyn Query> = Box::new(TermQuery::new(
+                    Term::from_field_text(fields.drive_id, d),
+                    IndexRecordOption::Basic,
+                ));
+                (Occur::Should, q)
+            })
+            .collect();
+        let mut clauses: Vec<(Occur, Box<dyn Query>)> =
+            vec![(Occur::Must, Box::new(BooleanQuery::new(drive_alternatives)))];
 
         let last = tokens.len().saturating_sub(1);
         for (i, token) in tokens.iter().enumerate() {
@@ -306,7 +333,7 @@ impl TantivyContentIndex {
         searcher: tantivy::Searcher,
         analyzer: TextAnalyzer,
         fields: IndexFields,
-        user_id: &str,
+        drive_ids: &[String],
         raw_query: &str,
         limit: usize,
     ) -> Result<Vec<ContentHitDto>, DomainError> {
@@ -315,7 +342,7 @@ impl TantivyContentIndex {
             return Ok(Vec::new());
         }
 
-        let query = Self::build_query(fields, user_id, &tokens);
+        let query = Self::build_query(fields, drive_ids, &tokens);
         let top_docs = searcher
             .search(&query, &TopDocs::with_limit(limit.max(1)).order_by_score())
             .map_err(|e| DomainError::internal_error("ContentIndex", format!("search: {e}")))?;
@@ -365,18 +392,25 @@ impl TantivyContentIndex {
 impl ContentIndexPort for TantivyContentIndex {
     async fn search_content(
         &self,
-        user_id: Uuid,
+        accessible_drive_ids: &[Uuid],
         query: &str,
         limit: usize,
     ) -> Result<Vec<ContentHitDto>, DomainError> {
+        // No accessible drives → no hits, no Tantivy work. Matches the
+        // anti-enumeration semantics (empty filter set returns empty
+        // results without any side channel).
+        if accessible_drive_ids.is_empty() {
+            return Ok(Vec::new());
+        }
+
         let searcher = self.reader.searcher();
         let analyzer = self.analyzer.clone();
         let fields = self.fields;
-        let user_id = user_id.to_string();
+        let drive_ids: Vec<String> = accessible_drive_ids.iter().map(|d| d.to_string()).collect();
         let query = query.to_owned();
 
         tokio::task::spawn_blocking(move || {
-            Self::search_blocking(searcher, analyzer, fields, &user_id, &query, limit)
+            Self::search_blocking(searcher, analyzer, fields, &drive_ids, &query, limit)
         })
         .await
         .map_err(|e| DomainError::internal_error("ContentIndex", format!("join: {e}")))?
@@ -391,6 +425,10 @@ mod tests {
         IndexDocRecord {
             file_id: file_id.to_owned(),
             user_id: user_id.to_owned(),
+            // Tests stamp a placeholder drive_id derived from user_id so the
+            // record satisfies the post-D0 schema. Query-side filtering by
+            // drive_id is exercised in D0-12's integration tests, not here.
+            drive_id: format!("{user_id}-drive"),
             name: name.to_owned(),
             content: content.map(str::to_owned),
             preview: content.map(str::to_owned),
@@ -401,11 +439,16 @@ mod tests {
         // Force a reader reload — OnCommitWithDelay is asynchronous and tests
         // must observe the commit immediately.
         index.reader.reload().unwrap();
+        // Test records derive `drive_id = format!("{user_id}-drive")` —
+        // the same convention used by `record()`. Filtering by that
+        // single drive id exercises the same path the production
+        // search uses.
+        let drive_ids = vec![format!("{user_id}-drive")];
         TantivyContentIndex::search_blocking(
             index.reader.searcher(),
             index.analyzer.clone(),
             index.fields,
-            user_id,
+            &drive_ids,
             query,
             32,
         )

src/infrastructure/services/tree_etag_flush_service.rs

@@ -113,13 +113,15 @@ impl TreeEtagFlushService {
                                         FROM storage.tree_etag_dirty
                                        ORDER BY id
                                        LIMIT $1)
-                        RETURNING lpath, folder_id
+                        RETURNING lpath, folder_id, drive_id
                     ),
                     targets AS (
                         -- Captured chain: covers target folders deleted or
                         -- moved away since enqueue (the old location's
-                        -- surviving ancestors still get their bump).
-                        SELECT lpath FROM drained
+                        -- surviving ancestors still get their bump). drive_id
+                        -- comes along so the victims walk can enforce
+                        -- cross-drive isolation (D0-13).
+                        SELECT lpath, drive_id FROM drained
                         UNION
                         -- Flush-time resolution: a folder MOVED since
                         -- enqueue had its subtree's lpaths rewritten, so
@@ -128,19 +130,29 @@ impl TreeEtagFlushService {
                         -- this, a bump queued just before a move would be
                         -- silently lost and sync clients would never
                         -- discover the change.
-                        SELECT fo.lpath
+                        SELECT fo.lpath, fo.drive_id
                           FROM storage.folders fo
                           JOIN drained d ON fo.id = d.folder_id
                     ),
                     victims AS (
                         -- `lpath @> target` = the target folder itself plus
-                        -- every ancestor (GiST-indexed). Folder rows deleted
-                        -- since enqueue simply don't match. Lock in id order
-                        -- so overlapping closures cannot deadlock.
+                        -- every ancestor (GiST-indexed). The `drive_id`
+                        -- predicate prevents a numerically-overlapping
+                        -- lpath in a SIBLING drive from spuriously matching
+                        -- (D0-13). Rows from old queue entries (pre-M4) have
+                        -- NULL `drive_id` — `IS NOT DISTINCT FROM` falls
+                        -- back to pure lpath matching for those, preserving
+                        -- the rollover semantics for any rows enqueued
+                        -- between this migration committing and the
+                        -- service restart.
                         SELECT f.id
                           FROM storage.folders f
-                         WHERE EXISTS (SELECT 1 FROM targets t
-                                        WHERE f.lpath @> t.lpath)
+                         WHERE EXISTS (
+                             SELECT 1 FROM targets t
+                              WHERE f.lpath @> t.lpath
+                                AND (t.drive_id IS NULL
+                                     OR f.drive_id = t.drive_id)
+                         )
                          ORDER BY f.id
                            FOR NO KEY UPDATE
                     ),

src/interfaces/api/handlers/chunked_upload_handler.rs

@@ -417,6 +417,7 @@ impl ChunkedUploadHandler {
                 parts.folder_id.clone(),
                 ingested.content_type.clone(),
                 ingested.stored(),
+                auth_user.id,
             )
             .await
         {

src/interfaces/api/handlers/drive_handler.rs

@@ -0,0 +1,72 @@
+//! `GET /api/drives` — list every drive the caller can read.
+//!
+//! D0 ships the read-only listing; D2 adds shared-drive membership
+//! mutations (`POST/DELETE/PUT /api/drives/{id}/members`), D3 adds the
+//! create-shared-drive flow, etc.
+//!
+//! The handler resolves the caller's expanded subject set through the
+//! engine (so group-mediated drive grants surface — the foundation for
+//! D2/D3) and asks the `DriveRepository` for every drive that set can
+//! read. Authorization is purely the subject-expansion step: no
+//! `require(...)` call here, because "your accessible drives" is a
+//! listing query, not a permission decision on a specific drive.
+
+use std::sync::Arc;
+
+use axum::{Json, extract::State, http::StatusCode, response::IntoResponse};
+use tracing::error;
+
+use crate::application::dtos::drive_dto::DriveDto;
+use crate::common::di::AppState;
+use crate::domain::repositories::drive_repository::DriveRepository;
+use crate::domain::services::authorization::Subject;
+use crate::interfaces::errors::AppError;
+use crate::interfaces::middleware::auth::AuthUser;
+
+#[utoipa::path(
+    get,
+    path = "/api/drives",
+    responses(
+        (status = 200, description = "Drives the caller can read", body = Vec<DriveDto>),
+        (status = 500, description = "Internal server error"),
+    ),
+    security(("bearerAuth" = [])),
+    tag = "drives"
+)]
+pub async fn list_drives(
+    State(state): State<Arc<AppState>>,
+    auth_user: AuthUser,
+) -> impl IntoResponse {
+    let caller_id = auth_user.id;
+
+    // Expand the caller's `Subject::User` into the `(types, ids)` pair
+    // that includes every group the user transitively belongs to. The
+    // engine caches this expansion in its Moka cache; if the caller
+    // just ran a permission check, this is a hit.
+    let (subject_types, subject_ids) = match state
+        .authorization
+        .expand_subject_for_listing(Subject::User(caller_id))
+        .await
+    {
+        Ok(pair) => pair,
+        Err(e) => {
+            error!("list_drives: subject expansion failed: {e}");
+            return AppError::from(e).into_response();
+        }
+    };
+
+    match state
+        .drive_repo
+        .list_for_subjects(&subject_types, &subject_ids)
+        .await
+    {
+        Ok(drives) => {
+            let dtos: Vec<DriveDto> = drives.into_iter().map(DriveDto::from).collect();
+            (StatusCode::OK, Json(dtos)).into_response()
+        }
+        Err(e) => {
+            error!("list_drives: repo lookup failed: {e}");
+            AppError::internal_error(format!("Failed to list drives: {e}")).into_response()
+        }
+    }
+}

src/interfaces/api/handlers/favorites_handler.rs

@@ -262,12 +262,20 @@ pub async fn list_favorites_resources(
                             path,
                             parent_id: row.parent_id.map(|u| u.to_string()),
                             owner_id: Some(row.owner_id.to_string()),
+                            // Listing handler — drive_id is informational
+                            // and the favorites row doesn't currently
+                            // SELECT it. Path-based lookups never enter
+                            // this code path.
+                            drive_id: uuid::Uuid::nil(),
                             created_at: row.resource_created_at.timestamp() as u64,
                             modified_at: row.modified_at.timestamp() as u64,
                             is_root: false,
                             icon_class: std::sync::Arc::from("fas fa-folder"),
                             icon_special_class: std::sync::Arc::from("folder-icon"),
                             category: std::sync::Arc::from("Folder"),
+                            // §14 provenance not selected by the favorites query.
+                            created_by: None,
+                            updated_by: None,
                         };
                         FavoritesResourceItemDto {
                             resource_type: ResourceTypeDto::Folder,
@@ -311,6 +319,9 @@ pub async fn list_favorites_resources(
                             sort_date: None,
                             content_hash,
                             etag,
+                            // §14 provenance not selected by the favorites query.
+                            created_by: None,
+                            updated_by: None,
                         };
                         FavoritesResourceItemDto {
                             resource_type: ResourceTypeDto::File,

src/interfaces/api/handlers/file_handler.rs

@@ -284,6 +284,7 @@ impl FileHandler {
                         folder_id,
                         ingested.content_type.clone(),
                         ingested.stored(),
+                        auth_user.id,
                     )
                     .await
                 {

src/interfaces/api/handlers/folder_handler.rs

@@ -753,12 +753,19 @@ pub async fn list_folder_resources(
                             path: String::new(), // cleared — share recipients must not see hierarchy
                             parent_id: row.parent_id.map(|u| u.to_string()),
                             owner_id: Some(row.owner_id.to_string()),
+                            // Resources listing — drive_id is informational
+                            // here; not selected by the underlying query.
+                            // Path-based lookups never enter this code path.
+                            drive_id: uuid::Uuid::nil(),
                             created_at: row.created_at.timestamp() as u64,
                             modified_at: row.modified_at.timestamp() as u64,
                             is_root: false,
                             icon_class: Arc::from("fas fa-folder"),
                             icon_special_class: Arc::from("folder-icon"),
                             category: Arc::from("Folder"),
+                            // §14 provenance not selected by the resources query.
+                            created_by: None,
+                            updated_by: None,
                         };
                         FolderResourceItemDto {
                             resource_type: ResourceTypeDto::Folder,
@@ -801,6 +808,9 @@ pub async fn list_folder_resources(
                             sort_date: None,
                             content_hash,
                             etag,
+                            // §14 provenance not selected by the resources query.
+                            created_by: None,
+                            updated_by: None,
                         };
                         FolderResourceItemDto {
                             resource_type: ResourceTypeDto::File,

src/interfaces/api/handlers/grant_handler.rs

@@ -719,6 +719,13 @@ pub async fn list_shared_with_me(
                     summary.resource_id
                 ),
             },
+            // Drive grants don't appear in the file/folder "Shared with me"
+            // listing — they're surfaced through `GET /api/drives` (D0).
+            // Silently skipping here is the right behaviour: a drive grant
+            // discovered by `list_incoming_resources_paged` is not a stale
+            // grant, just a different resource type with a different
+            // listing surface.
+            ResourceKind::Drive => continue,
         }
     }
 
@@ -953,6 +960,10 @@ pub async fn list_my_shares(
                     summary.resource_id
                 ),
             },
+            // Drive grants are surfaced via `GET /api/drives` (D0), not
+            // through the My Shares outgoing-resources surface. Silently
+            // skip — symmetric with the `list_shared_with_me` arm above.
+            ResourceKind::Drive => continue,
         }
     }
 

src/interfaces/api/handlers/mod.rs

@@ -9,6 +9,7 @@ pub mod contacts_handler;
 pub mod dedup_handler;
 pub mod delta_upload_handler;
 pub mod device_auth_handler;
+pub mod drive_handler;
 pub mod favorites_handler;
 pub mod file_handler;
 pub mod folder_handler;

src/interfaces/api/handlers/recent_handler.rs

@@ -292,12 +292,20 @@ pub async fn list_recent_resources(
                             path,
                             parent_id: row.parent_id.map(|u| u.to_string()),
                             owner_id: Some(row.owner_id.to_string()),
+                            // Listing handler — drive_id is informational
+                            // and the recents row doesn't currently SELECT
+                            // it. Path-based lookups never enter this code
+                            // path.
+                            drive_id: uuid::Uuid::nil(),
                             created_at: row.resource_created_at.timestamp() as u64,
                             modified_at: row.modified_at.timestamp() as u64,
                             is_root: false,
                             icon_class: std::sync::Arc::from("fas fa-folder"),
                             icon_special_class: std::sync::Arc::from("folder-icon"),
                             category: std::sync::Arc::from("Folder"),
+                            // §14 provenance not selected by the recents query.
+                            created_by: None,
+                            updated_by: None,
                         };
                         RecentResourceItemDto {
                             resource_type: ResourceTypeDto::Folder,
@@ -339,6 +347,9 @@ pub async fn list_recent_resources(
                             sort_date: None,
                             content_hash,
                             etag,
+                            // §14 provenance not selected by the recents query.
+                            created_by: None,
+                            updated_by: None,
                         };
                         RecentResourceItemDto {
                             resource_type: ResourceTypeDto::File,

src/interfaces/api/handlers/webdav_handler.rs

@@ -27,6 +27,7 @@ use crate::application::ports::storage_ports::StorageUsagePort;
 use crate::application::services::file_retrieval_service::FileRetrievalService;
 use crate::application::services::folder_service::FolderService;
 use crate::common::di::AppState;
+use crate::domain::repositories::drive_repository::DriveRepository;
 use crate::infrastructure::services::path_resolver_service::ResolvedResource;
 use crate::interfaces::errors::AppError;
 use crate::interfaces::middleware::auth::{AuthUser, CurrentUser};
@@ -247,6 +248,29 @@ async fn resolve_webdav_path(state: &Arc<AppState>, user_id: Uuid, path: &str) -
     }
 }
 
+/// Native WebDAV protocol entry: resolve the caller's default drive
+/// once per handler so every downstream path-based lookup
+/// (`get_folder_by_path`, `get_file_by_path`, `update_file_streaming`)
+/// can pass the same `drive_id` scope.
+///
+/// Post-D0 `storage.{folders,files}.path` repeats across drives — the
+/// scope is mandatory. Native WebDAV today lives in a single-drive
+/// surface (one default drive per user), so the lookup is unambiguous.
+/// Multi-drive support via path segments (`/webdav/drives/<uuid>/…`)
+/// is tracked separately and will derive `drive_id` directly from the
+/// URL instead of going through `find_default_for_user`.
+async fn resolve_drive_id_for_native_webdav(
+    state: &Arc<AppState>,
+    user_id: Uuid,
+) -> Result<Uuid, AppError> {
+    state
+        .drive_repo
+        .find_default_for_user(user_id)
+        .await
+        .map(|d| d.drive.id)
+        .map_err(|e| AppError::internal_error(format!("Failed to resolve default drive: {:?}", e)))
+}
+
 async fn handle_webdav_dispatch(
     state: Arc<AppState>,
     req: Request<Body>,
@@ -405,12 +429,18 @@ async fn handle_propfind(
             path: "".to_string(),
             parent_id: None,
             owner_id: None,
+            // Synthetic root folder for PROPFIND on `/`; not an
+            // actual DB row, so drive_id has no meaningful value.
+            drive_id: Uuid::nil(),
             created_at: Utc::now().timestamp() as u64,
             modified_at: Utc::now().timestamp() as u64,
             is_root: true,
             icon_class: Arc::from("fas fa-folder"),
             icon_special_class: Arc::from("folder-icon"),
             category: Arc::from("Folder"),
+            // §14 provenance not applicable to the synthetic root.
+            created_by: None,
+            updated_by: None,
         };
 
         return build_streaming_propfind_response(
@@ -468,8 +498,11 @@ async fn handle_propfind(
             Err(_) => {}
         }
     } else {
-        // Fallback: legacy double-query path when PathResolver is unavailable
-        if let Ok(folder) = folder_service.get_folder_by_path(&path).await {
+        // Fallback: legacy double-query path when PathResolver is unavailable.
+        // `drive_id` is mandatory post-D0 for path-based lookups — derive
+        // the caller's default drive once and reuse it for both probes.
+        let drive_id = resolve_drive_id_for_native_webdav(&state, user.id).await?;
+        if let Ok(folder) = folder_service.get_folder_by_path(&path, drive_id).await {
             assert_owner(folder.owner_id.as_deref(), &user.id.to_string(), &path)?;
             let folder_id = folder.id.clone();
             return build_streaming_propfind_response(
@@ -484,7 +517,10 @@ async fn handle_propfind(
             )
             .await;
         }
-        if let Ok(file) = file_retrieval_service.get_file_by_path(&path).await {
+        if let Ok(file) = file_retrieval_service
+            .get_file_by_path(&path, drive_id)
+            .await
+        {
             assert_owner(file.owner_id.as_deref(), &user.id.to_string(), &path)?;
             let mut buf = Vec::with_capacity(1024);
             {
@@ -656,7 +692,7 @@ async fn handle_proppatch(
     req: Request<Body>,
     path: String,
 ) -> Result<Response<Body>, AppError> {
-    let _user = extract_user(&req)?;
+    let user = extract_user(&req)?;
 
     // Active-lock guard (RFC 4918 §9.10.4): PROPPATCH writes properties,
     // so a lock on the target must release them via `If:`. Captured
@@ -688,10 +724,11 @@ async fn handle_proppatch(
     let is_collection = if path.is_empty() || path == "/" {
         true
     } else {
+        let drive_id = resolve_drive_id_for_native_webdav(&state, user.id).await?;
         state
             .applications
             .folder_service
-            .get_folder_by_path(&path)
+            .get_folder_by_path(&path, drive_id)
             .await
             .is_ok()
     };
@@ -776,9 +813,12 @@ async fn handle_get(
             }
         }
     } else {
-        // Legacy fallback — fetch + ownership check
+        // Legacy fallback — fetch + ownership check. `drive_id` is the
+        // path-lookup scope post-D0 (`storage.files.path` repeats across
+        // drives), derived once from the caller's default drive.
+        let drive_id = resolve_drive_id_for_native_webdav(&state, user.id).await?;
         let f = file_retrieval_service
-            .get_file_by_path(&path)
+            .get_file_by_path(&path, drive_id)
             .await
             .map_err(|_e| AppError::not_found(format!("File not found: {}", path)))?;
         assert_owner(f.owner_id.as_deref(), &user.id.to_string(), &path)?;
@@ -876,8 +916,11 @@ async fn handle_head(
         }
     }
 
-    // Fallback: legacy double-query path (with ownership check)
-    if let Ok(folder) = folder_service.get_folder_by_path(&path).await {
+    // Fallback: legacy double-query path (with ownership check).
+    // `drive_id` is the path-lookup scope post-D0 — derive once and
+    // reuse for both the folder and file probes.
+    let drive_id = resolve_drive_id_for_native_webdav(&state, user.id).await?;
+    if let Ok(folder) = folder_service.get_folder_by_path(&path, drive_id).await {
         assert_owner(folder.owner_id.as_deref(), &user.id.to_string(), &path)?;
         return Ok(Response::builder()
             .status(StatusCode::OK)
@@ -890,7 +933,7 @@ async fn handle_head(
 
     // Try as file — use metadata only, never load content for HEAD
     let file = file_retrieval_service
-        .get_file_by_path(&path)
+        .get_file_by_path(&path, drive_id)
         .await
         .map_err(|_e| AppError::not_found(format!("Resource not found: {}", path)))?;
     assert_owner(file.owner_id.as_deref(), &user.id.to_string(), &path)?;
@@ -939,15 +982,27 @@ async fn resolve_or_legacy(
         return Some(r);
     }
 
+    // Path-lookup scope post-D0 — derive the caller's default drive
+    // for both legacy probes. `find_default_for_user` returning Err
+    // (e.g. external user, or boot before the lifecycle hook fired)
+    // means no fallback resolution is possible: return None.
+    let drive_id = state
+        .drive_repo
+        .find_default_for_user(user_id)
+        .await
+        .ok()?
+        .drive
+        .id;
+
     let user_id_str = user_id.to_string();
     let folder_service = &state.applications.folder_service;
-    if let Ok(folder) = folder_service.get_folder_by_path(path).await
+    if let Ok(folder) = folder_service.get_folder_by_path(path, drive_id).await
         && folder.owner_id.as_deref() == Some(&user_id_str)
     {
         return Some(ResolvedResource::Folder(folder));
     }
     let file_retrieval = &state.applications.file_retrieval_service;
-    if let Ok(file) = file_retrieval.get_file_by_path(path).await
+    if let Ok(file) = file_retrieval.get_file_by_path(path, drive_id).await
         && file.owner_id.as_deref() == Some(&user_id_str)
     {
         return Some(ResolvedResource::File(file));
@@ -1143,8 +1198,16 @@ async fn handle_put(
 
     // ── Atomic store: swap the file row onto the ingested blob ──
     let content_type = ingested.content_type.clone();
+    let drive_id = resolve_drive_id_for_native_webdav(&state, user.id).await?;
     let result = file_upload_service
-        .update_file_streaming(&path, ingested.stored(), &content_type, None)
+        .update_file_streaming(
+            &path,
+            drive_id,
+            ingested.stored(),
+            &content_type,
+            None,
+            user.id,
+        )
         .await;
 
     match result {
@@ -1198,6 +1261,9 @@ async fn handle_mkcol(
     // Path is already translated by dispatch (e.g. "My Folder - jared/03/01").
     // Walk each segment: the first is the home folder (already exists),
     // subsequent segments are created as needed with proper parent_id.
+    // `drive_id` scopes each per-segment path probe to the caller's default
+    // drive (post-D0 invariant: `storage.folders.path` repeats across drives).
+    let drive_id = resolve_drive_id_for_native_webdav(&state, user.id).await?;
     let segments: Vec<&str> = path.split('/').filter(|s| !s.is_empty()).collect();
     let mut parent_id: Option<String> = None;
     let mut accumulated_path = String::new();
@@ -1208,7 +1274,10 @@ async fn handle_mkcol(
         }
         accumulated_path.push_str(segment);
 
-        match folder_service.get_folder_by_path(&accumulated_path).await {
+        match folder_service
+            .get_folder_by_path(&accumulated_path, drive_id)
+            .await
+        {
             Ok(existing) => {
                 parent_id = Some(existing.id);
             }
@@ -1392,6 +1461,11 @@ async fn handle_move(
     let file_management_service = &state.applications.file_management_service;
     let folder_service = &state.applications.folder_service;
 
+    // `drive_id` scopes every path-based lookup below to the caller's
+    // default drive (post-D0 invariant: `storage.{files,folders}.path`
+    // repeats across drives).
+    let drive_id = resolve_drive_id_for_native_webdav(&state, user.id).await?;
+
     // Check if destination already exists (for Overwrite header compliance)
     if !overwrite {
         let dest_exists = if let Some(resolver) = &state.path_resolver {
@@ -1401,11 +1475,11 @@ async fn handle_move(
                 .unwrap_or(false)
         } else {
             folder_service
-                .get_folder_by_path(&destination_path)
+                .get_folder_by_path(&destination_path, drive_id)
                 .await
                 .is_ok()
                 || file_retrieval_service
-                    .get_file_by_path(&destination_path)
+                    .get_file_by_path(&destination_path, drive_id)
                     .await
                     .is_ok()
         };
@@ -1443,7 +1517,9 @@ async fn handle_move(
             let move_dto = crate::application::dtos::folder_dto::MoveFolderDto {
                 parent_id: if dest_parent_path.is_empty() {
                     None
-                } else if let Ok(parent) = folder_service.get_folder_by_path(dest_parent_path).await
+                } else if let Ok(parent) = folder_service
+                    .get_folder_by_path(dest_parent_path, drive_id)
+                    .await
                 {
                     assert_owner(
                         parent.owner_id.as_deref(),
@@ -1483,7 +1559,7 @@ async fn handle_move(
                     None
                 } else {
                     let parent = folder_service
-                        .get_folder_by_path(dest_parent_path)
+                        .get_folder_by_path(dest_parent_path, drive_id)
                         .await
                         .map_err(|_| {
                             AppError::not_found(format!(
@@ -1601,6 +1677,11 @@ async fn handle_copy(
     let file_retrieval_service = &state.applications.file_retrieval_service;
     let folder_service = &state.applications.folder_service;
 
+    // `drive_id` scopes every path-based lookup below to the caller's
+    // default drive (post-D0 invariant: `storage.{files,folders}.path`
+    // repeats across drives).
+    let drive_id = resolve_drive_id_for_native_webdav(&state, user.id).await?;
+
     // Check if destination already exists (for Overwrite header compliance)
     if !overwrite {
         let dest_exists = if let Some(resolver) = &state.path_resolver {
@@ -1610,11 +1691,11 @@ async fn handle_copy(
                 .unwrap_or(false)
         } else {
             folder_service
-                .get_folder_by_path(&destination_path)
+                .get_folder_by_path(&destination_path, drive_id)
                 .await
                 .is_ok()
                 || file_retrieval_service
-                    .get_file_by_path(&destination_path)
+                    .get_file_by_path(&destination_path, drive_id)
                     .await
                     .is_ok()
         };
@@ -1644,7 +1725,10 @@ async fn handle_copy(
 
     let target_parent_id = if dest_parent_path.is_empty() {
         None
-    } else if let Ok(parent) = folder_service.get_folder_by_path(dest_parent_path).await {
+    } else if let Ok(parent) = folder_service
+        .get_folder_by_path(dest_parent_path, drive_id)
+        .await
+    {
         assert_owner(
             parent.owner_id.as_deref(),
             &user.id.to_string(),
@@ -1740,10 +1824,11 @@ async fn handle_lock(
     let is_collection = if path.is_empty() || path == "/" {
         true
     } else {
+        let drive_id = resolve_drive_id_for_native_webdav(&state, user.id).await?;
         state
             .applications
             .folder_service
-            .get_folder_by_path(&path)
+            .get_folder_by_path(&path, drive_id)
             .await
             .is_ok()
     };

src/interfaces/api/handlers/wopi_handler.rs

@@ -23,6 +23,7 @@ use std::sync::Arc;
 use crate::application::ports::file_ports::{FileRetrievalUseCase, FileUploadUseCase};
 use crate::application::services::wopi_lock_service::WopiLockService;
 use crate::application::services::wopi_token_service::WopiTokenService;
+use crate::domain::repositories::drive_repository::DriveRepository;
 use crate::infrastructure::services::wopi_discovery_service::WopiDiscoveryService;
 
 /// Shared state for WOPI handlers.
@@ -233,11 +234,38 @@ async fn put_file(
     };
 
     // ── Atomic store: swap the file row onto the ingested blob ──
+    // `drive_id` scopes the path-based lookups in `update_file_streaming`
+    // post-D0. WOPI tokens carry the user UUID in `claims.sub`; we resolve
+    // that to the caller's default drive (WOPI today is a single-drive
+    // editing surface — no drive marker travels in the token).
+    let claims_sub_uuid = match uuid::Uuid::parse_str(&claims.sub) {
+        Ok(u) => u,
+        Err(_) => return StatusCode::UNAUTHORIZED.into_response(),
+    };
+    let drive_id = match state
+        .app_state
+        .drive_repo
+        .find_default_for_user(claims_sub_uuid)
+        .await
+    {
+        Ok(d) => d.drive.id,
+        Err(e) => {
+            tracing::error!("WOPI PutFile: default-drive lookup failed: {:?}", e);
+            return StatusCode::INTERNAL_SERVER_ERROR.into_response();
+        }
+    };
     let result = state
         .app_state
         .applications
         .file_upload_service
-        .update_file_streaming(&file.path, ingested.stored(), &content_type, None)
+        .update_file_streaming(
+            &file.path,
+            drive_id,
+            ingested.stored(),
+            &content_type,
+            None,
+            claims_sub_uuid,
+        )
         .await;
 
     match result {

src/interfaces/api/mod.rs

@@ -13,6 +13,7 @@ use utoipa::{Modify, OpenApi};
 use crate::application::dtos::contact_dto::{
     AddressDto, ContactDto, ContactGroupDto, EmailDto, PhoneDto,
 };
+use crate::application::dtos::drive_dto::{DriveDto, DriveKindDto};
 use crate::application::dtos::favorites_dto::{
     BatchFavoritesResult, BatchFavoritesStats, FavoriteItemDto, FavoritesResourceItemDto,
 };
@@ -165,6 +166,8 @@ use crate::interfaces::api::handlers::file_handler::MoveFilePayload;
         // Photos handler (free function)
         handlers::photos_handler::list_photos,
         handlers::photos_handler::list_photos_geo,
+        // Drive handler (free function)
+        handlers::drive_handler::list_drives,
         // Batch handlers (free functions)
         handlers::batch_handler::move_files_batch,
         handlers::batch_handler::copy_files_batch,
@@ -359,6 +362,9 @@ use crate::interfaces::api::handlers::file_handler::MoveFilePayload;
             SharedWithMeDto,
             SharedWithMeItemDto,
             OutgoingResourceItemDto,
+            // Drive schemas
+            DriveDto,
+            DriveKindDto,
             // Subject-group (ReBAC named groups) schemas
             handlers::subject_group_handler::CreateGroupRequest,
             handlers::subject_group_handler::UpdateGroupRequest,

src/interfaces/api/routes.rs

@@ -440,6 +440,19 @@ pub fn create_api_routes(app_state: &Arc<AppState>) -> Router<Arc<AppState>> {
         router = router.nest("/photos", photos_router);
     }
 
+    // Drives — every drive the caller can read. D0 ships the read-only
+    // listing; D2 adds the membership API + shared-drive endpoints under
+    // `/api/drives/{id}/members`.
+    {
+        use crate::interfaces::api::handlers::drive_handler;
+
+        let drives_router = Router::new()
+            .route("/", get(drive_handler::list_drives))
+            .with_state(app_state.clone());
+
+        router = router.nest("/drives", drives_router);
+    }
+
     // People (faces) routes — mounted only when OXICLOUD_ENABLE_FACES is on.
     if app_state.people_service.is_some() {
         use crate::interfaces::api::handlers::people_handler;

src/interfaces/middleware/trace_span.rs

@@ -103,7 +103,8 @@ impl<B> MakeSpan<B> for ClientIpMakeSpan {
             method     = %request.method(),
             uri        = %request.uri().path(),
             user_id    = tracing::field::Empty,
-            // The Nextcloud chroot folder id, set by `basic_auth_middleware`.
+
+            // The Nextcloud chroot folder id, set by `basic_auth_middleware` (will be the Drive Id in the future).
             chroot_id  = tracing::field::Empty,
         )
     }

src/interfaces/nextcloud/avatar_handler.rs

@@ -101,6 +101,11 @@ pub async fn handle_avatar(
 ) -> Response {
     let size = size.clamp(16, 1024);
 
+    let username = match username.split_once("~") {
+        None => username,
+        Some((u, _)) => u.to_string(),
+    };
+
     // ── Stored profile image — preferred when present ───────────
     if let Some(auth_svc) = state.auth_service.as_ref()
         && let Ok(user) = auth_svc

src/interfaces/nextcloud/basic_auth_middleware.rs

@@ -59,9 +59,43 @@ pub async fn basic_auth_middleware(
             NextcloudAuthError::Unauthorized
         })?;
 
-    let (username, password) =
+    let (raw_username, password) =
         parse_basic_auth(auth_header).ok_or(NextcloudAuthError::Unauthorized)?;
 
+    // ── Multi-drive composite-username parse ────────────────────────
+    // POC wire shape: `{username}~{drive_marker}` may appear in the
+    // Basic Auth header. `~` was chosen because it needs no URL
+    // encoding and doesn't collide with UUID hyphens. The marker
+    // after `~` is a chroot SELECTOR (handled by `NcSession` via the
+    // URL `{user}` segment), NOT an auth credential — the password
+    // is verified against the username PREFIX. The middleware just
+    // peels the prefix off so the app-password lookup uses the
+    // canonical name. When no `~` is present, the request is a
+    // plain single-drive ("home") NC sync.
+    //
+    // Reject `name~` (empty marker) and `~marker` (empty username)
+    // at the auth boundary rather than treating them as "missing
+    // marker" — they are unambiguous typos that would otherwise
+    // silently fall into a different code path.
+    let (username, drive_marker): (String, Option<String>) = match raw_username.split_once('~') {
+        Some(("", _)) => {
+            tracing::warn!(
+                "[NC] 401 malformed composite username (empty prefix): {}",
+                raw_username
+            );
+            return Err(NextcloudAuthError::Unauthorized);
+        }
+        Some((_, "")) => {
+            tracing::warn!(
+                "[NC] 401 malformed composite username (empty marker): {}",
+                raw_username
+            );
+            return Err(NextcloudAuthError::Unauthorized);
+        }
+        Some((u, m)) => (u.to_string(), Some(m.to_string())),
+        None => (raw_username.clone(), None),
+    };
+
     // Check account lockout before attempting password verification (saves CPU).
     // The lockout is per (account, IP), see #323 for rationale.
     let client_ip = crate::interfaces::middleware::rate_limit::extract_client_ip(&request);
@@ -126,12 +160,81 @@ pub async fn basic_auth_middleware(
             // making it harder to correlate WebDAV / OCS activity to
             // a specific principal.
             tracing::Span::current().record("user_id", user_id.to_string());
-            request.extensions_mut().insert(Arc::new(CurrentUser {
+            let current_user = CurrentUser {
                 id: user_id,
                 username: uname,
                 email,
                 role,
-            }));
+            };
+
+            // ── Resolve chroot from the Basic Auth drive marker ─────
+            // No marker → caller's default personal drive's root folder
+            // (post-D0 every internal user has one — provisioned by the
+            // lifecycle hook via the atomic four-write transaction in
+            // §3 of docs/plan/drive.md). With a marker →
+            // `get_folder_with_perms` enforces per-folder access (404
+            // anti-enumeration on miss / no-read). Today this is the
+            // sole chroot source; tomorrow it'll come from the
+            // app-password row instead.
+            //
+            // Pre-D0 this lookup name-matched `"My Folder - <username>"`
+            // against the user's root folders; that broke after the
+            // wrapper was renamed to `"Personal"` and shared across all
+            // users — name-matching was the wrong axis. The drive lookup
+            // is the right one: name-independent, secondary-drive-safe.
+            use crate::application::ports::folder_ports::FolderUseCase;
+            use crate::domain::repositories::drive_repository::DriveRepository;
+            let chroot = match drive_marker.as_deref() {
+                None => {
+                    match state
+                        .drive_repo
+                        .find_default_for_user(current_user.id)
+                        .await
+                    {
+                        Ok(drive_with_name) => state
+                            .applications
+                            .folder_service
+                            .get_folder(&drive_with_name.drive.root_folder_id.to_string())
+                            .await
+                            .ok(),
+                        Err(_) => None,
+                    }
+                }
+                Some(folder_id) => state
+                    .applications
+                    .folder_service
+                    .get_folder_with_perms(folder_id, current_user.id)
+                    .await
+                    .ok(),
+            };
+            if chroot.is_none() {
+                tracing::warn!(
+                    "[NC] 404 chroot not resolvable: user={} marker={:?}",
+                    current_user.username,
+                    drive_marker
+                );
+                return Err(NextcloudAuthError::Unauthorized);
+            }
+
+            request
+                .extensions_mut()
+                .insert(Arc::new(current_user.clone()));
+            request.extensions_mut().insert(Arc::new(
+                crate::interfaces::nextcloud::session::NcSession {
+                    user: current_user,
+                    raw_username: raw_username.clone(),
+                    chroot,
+                },
+            ));
+            tracing::Span::current().record(
+                "chroot_id",
+                request
+                    .extensions()
+                    .get::<Arc<crate::interfaces::nextcloud::session::NcSession>>()
+                    .and_then(|s| s.chroot.as_ref())
+                    .map(|c| c.id.to_string())
+                    .unwrap_or_default(),
+            );
             Ok(next.run(request).await)
         }
         Err(_) => {

src/interfaces/nextcloud/login_v2_handler.rs

@@ -1,3 +1,4 @@
+use askama::Template;
 use axum::{
     extract::{Path, Query, State},
     http::{HeaderMap, StatusCode, header},
@@ -7,8 +8,32 @@ use serde_json::json;
 use std::collections::HashMap;
 use std::sync::Arc;
 
+use crate::application::ports::folder_ports::FolderUseCase;
 use crate::common::di::AppState;
 use crate::common::errors::DomainError;
+use crate::interfaces::middleware::auth::CurrentUser;
+
+/// Drive option rendered on the picker page. `name` is the folder's
+/// display name; `id` is the folder UUID that becomes the `~{marker}`
+/// half of the composite Basic-Auth username if the user picks
+/// anything other than the first (home) row.
+struct DriveOption {
+    id: String,
+    name: String,
+}
+
+#[derive(Template)]
+#[template(path = "nextcloud/drive_picker.html")]
+struct DrivePickerTemplate {
+    form_action: String,
+    drives: Vec<DriveOption>,
+}
+
+// Home identification is via `position_of_user_home_root_folder` from
+// `domain::repositories::drive_repository` — a generic helper that
+// keys off `drives.default_for_user == user_id` rather than folder
+// name, so user renames of the home folder don't silently break the
+// picker UX.
 
 /// Serve an HTML page with a Content-Security-Policy header as defense-in-depth.
 fn html_with_csp(html: &'static str) -> Response {
@@ -175,47 +200,294 @@ pub async fn handle_login_submit(
         Err(e) => return login_failed_response(e),
     };
 
-    let app_password = match nextcloud
-        .app_passwords
-        .create_nc(current_user.id, "Nextcloud")
+    // ── Multi-drive fork ─────────────────────────────────────────────
+    // List the user's root folders. By convention the first row is the
+    // user's home; additional rows are extra drives (POC seeded by
+    // direct DB insert until a drive admin surface exists). With 0 or
+    // 1 drive we go straight to the legacy one-shot completion path so
+    // the common case stays one click. With ≥2 drives we pause the
+    // flow, stash the user_id, and render the picker — drive selection
+    // resumes the flow via `handle_drive_pick`.
+    let mut drives = match state
+        .applications
+        .folder_service
+        .list_folders_with_perms(None, current_user.id)
         .await
     {
-        Ok((_id, password)) => password,
+        Ok(d) => d,
         Err(e) => {
-            tracing::error!(error = %e, user = %current_user.username, "Login Flow v2: failed to create app password");
+            tracing::error!(error = %e, user = %current_user.username, "Login Flow v2: failed to list drives");
             return StatusCode::INTERNAL_SERVER_ERROR.into_response();
         }
     };
 
-    let base_url = state.core.config.base_url();
-    let completed =
-        nextcloud
+    if drives.len() >= 2 {
+        // Reorder so home is at index 0. The picker template ties
+        // both the default-checked radio and the "Home" badge to
+        // `loop.first`, so placing home first is the single point
+        // that makes the picker UI line up with the home convention.
+        // Other drives keep their original alphabetical order.
+        if let Some(idx) =
+            crate::domain::repositories::drive_repository::position_of_user_home_root_folder(
+                state.drive_repo.as_ref(),
+                current_user.id,
+                &drives,
+                |f| uuid::Uuid::parse_str(&f.id).ok(),
+            )
+            .await
+            && idx != 0
+        {
+            let home = drives.remove(idx);
+            drives.insert(0, home);
+        }
+        // If no home matched the convention, we fall through with the
+        // raw alphabetical order. The picker will still work but the
+        // first row gets the badge by default — slightly wrong UX but
+        // never breaks the auth flow (`handle_drive_pick` re-runs
+        // `find_home_index` independently).
+
+        if !nextcloud
             .login_flow
-            .complete(&token, &current_user.username, &base_url, &app_password);
+            .mark_awaiting_drive(&token, current_user.id)
+        {
+            // Flow token vanished (TTL?) between password submit and
+            // here — extremely unlikely but treat the same as any
+            // session-expired case.
+            return axum::response::Redirect::to("/nextcloud-error.html?type=session-expired")
+                .into_response();
+        }
+        return render_drive_picker(&token, &drives);
+    }
+
+    complete_flow(&state, &nextcloud.login_flow, &token, &current_user, None).await
+}
+
+/// Render the drive picker page. The form posts to
+/// `/login/v2/flow/{token}/drive`, carrying only the chosen folder
+/// UUID — the authenticated user id is read from the flow's
+/// `pending_user_id` slot (consumed by `take_pending_user`).
+fn render_drive_picker(
+    token: &str,
+    drives: &[crate::application::dtos::folder_dto::FolderDto],
+) -> Response {
+    let template = DrivePickerTemplate {
+        form_action: format!("/login/v2/flow/{}/drive", token),
+        drives: drives
+            .iter()
+            .map(|f| DriveOption {
+                id: f.id.clone(),
+                name: f.name.clone(),
+            })
+            .collect(),
+    };
+
+    match template.render() {
+        Ok(html) => (
+            [(
+                header::CONTENT_SECURITY_POLICY,
+                "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; form-action 'self'",
+            )],
+            Html(html),
+        )
+            .into_response(),
+        Err(e) => {
+            tracing::error!(error = %e, "Login Flow v2: drive picker template render failed");
+            StatusCode::INTERNAL_SERVER_ERROR.into_response()
+        }
+    }
+}
+
+/// Mint an app password, complete the flow, and emit the `nc://` deep
+/// link. Shared by the single-drive path (called from
+/// `handle_login_submit`) and the post-picker path (called from
+/// `handle_drive_pick`).
+///
+/// `drive_id` is `None` for the single-drive shortcut and for the
+/// home-drive choice on the picker; `Some(uuid)` for any other drive,
+/// in which case the NC login name carries the `~{uuid}` marker.
+async fn complete_flow(
+    state: &Arc<AppState>,
+    login_flow: &crate::application::services::nextcloud_login_flow_service::NextcloudLoginFlowService,
+    token: &str,
+    user: &CurrentUser,
+    drive_id: Option<&str>,
+) -> Response {
+    let nextcloud = match state.nextcloud.as_ref() {
+        Some(nc) => nc,
+        None => return StatusCode::SERVICE_UNAVAILABLE.into_response(),
+    };
+
+    let app_password = match nextcloud
+        .app_passwords
+        .create_nc(user.id, "Nextcloud")
+        .await
+    {
+        Ok((_id, password)) => password,
+        Err(e) => {
+            tracing::error!(error = %e, user = %user.username, "Login Flow v2: failed to create app password");
+            return StatusCode::INTERNAL_SERVER_ERROR.into_response();
+        }
+    };
+
+    let login_name = match drive_id {
+        Some(uuid) => format!("{}~{}", user.username, uuid),
+        None => user.username.clone(),
+    };
+
+    let base_url = state.core.config.base_url();
+    let completed = login_flow.complete(token, &login_name, &base_url, &app_password);
 
     if completed {
         tracing::info!(
-            user = %current_user.username,
+            user = %user.username,
+            login_name = %login_name,
             base_url = %base_url,
             "Login Flow v2: flow completed successfully"
         );
-        // Redirect to nc:// deep link so the Nextcloud mobile app receives
-        // the credentials via Android/iOS intent.  Desktop clients use polling
-        // instead, so they will pick up the result from the poll endpoint.
         let nc_url = format!(
             "nc://login/server:{}&user:{}&password:{}",
-            base_url, current_user.username, app_password
+            base_url, login_name, app_password
         );
         axum::response::Redirect::to(&nc_url).into_response()
     } else {
         tracing::error!(
-            user = %current_user.username,
+            user = %user.username,
             "Login Flow v2: complete() returned false — flow token not found"
         );
         axum::response::Redirect::to("/nextcloud-error.html?type=session-expired").into_response()
     }
 }
 
+/// POST `/login/v2/flow/{token}/drive` — finalise a paused login flow
+/// after the user picks a drive on the picker page.
+///
+/// Auth model: the route is **public** (no Basic Auth — this is the
+/// browser-side leg of Login Flow v2, before the app password is
+/// issued). The proof of authentication is the single-use
+/// `pending_user_id` slot on the flow, set by `handle_login_submit`
+/// after password verification and consumed here. Replay is naturally
+/// blocked: a second POST finds nothing to consume.
+pub async fn handle_drive_pick(
+    State(state): State<Arc<AppState>>,
+    Path(token): Path<String>,
+    body: String,
+) -> Response {
+    let nextcloud = match state.nextcloud.as_ref() {
+        Some(nc) => nc,
+        None => return StatusCode::SERVICE_UNAVAILABLE.into_response(),
+    };
+
+    let drive_id = match parse_form_value(&body, "drive") {
+        Some(v) if !v.is_empty() => v,
+        _ => return StatusCode::BAD_REQUEST.into_response(),
+    };
+
+    let user_id = match nextcloud.login_flow.take_pending_user(&token) {
+        Some(uid) => uid,
+        None => {
+            tracing::warn!(
+                target: "audit",
+                event = "nc_login_flow.drive_pick_rejected",
+                reason = "no_pending_user",
+                "👮🏻‍♂️ NC drive pick rejected: flow has no pending user (replay or unknown token)"
+            );
+            return axum::response::Redirect::to("/nextcloud-error.html?type=session-expired")
+                .into_response();
+        }
+    };
+
+    // Resolve user (for username) and validate drive ownership in one
+    // service call each. `get_folder_with_perms` enforces that the
+    // caller can read the folder — covers "drive doesn't exist" and
+    // "drive belongs to someone else" with the same 404 to defeat
+    // enumeration. We additionally need to differentiate home vs.
+    // non-home so the NC login name carries `~{uuid}` only for
+    // non-home choices.
+    let auth = match state.auth_service.as_ref() {
+        Some(a) => a,
+        None => return StatusCode::SERVICE_UNAVAILABLE.into_response(),
+    };
+    let user_dto = match auth.auth_application_service.get_user_by_id(user_id).await {
+        Ok(u) => u,
+        Err(e) => {
+            tracing::error!(error = %e, %user_id, "Login Flow v2: failed to fetch user for drive pick");
+            return StatusCode::INTERNAL_SERVER_ERROR.into_response();
+        }
+    };
+    // Username must be present — only password-login users reach this
+    // branch, and password login requires a claimed username. Defensive
+    // check anyway: a username-less user here means an upstream invariant
+    // broke, not something to silently paper over.
+    let Some(username) = user_dto.username.clone() else {
+        tracing::error!(%user_id, "Login Flow v2: pending user has no username — invariant violated");
+        return StatusCode::INTERNAL_SERVER_ERROR.into_response();
+    };
+    let user = CurrentUser {
+        id: user_id,
+        username,
+        email: user_dto.email.clone(),
+        role: user_dto.role.clone(),
+    };
+
+    let _folder = match state
+        .applications
+        .folder_service
+        .get_folder_with_perms(&drive_id, user_id)
+        .await
+    {
+        Ok(f) => f,
+        Err(_) => {
+            tracing::warn!(
+                target: "audit",
+                event = "nc_login_flow.drive_pick_rejected",
+                reason = "drive_not_owned_or_missing",
+                %user_id,
+                drive_id = %drive_id,
+                "👮🏻‍♂️ NC drive pick rejected: folder missing or caller has no read access"
+            );
+            return StatusCode::NOT_FOUND.into_response();
+        }
+    };
+
+    // Determine if the pick is home. The previous "first row of
+    // list_folders_with_perms" heuristic was wrong: the underlying
+    // repo query orders by `name`, so any drive named alphabetically
+    // before "My Folder - {username}" stole the first slot and was
+    // mis-classified as home — `login_name` then dropped the `~uuid`
+    // marker and NC desktop rooted at the home folder regardless of
+    // the user's pick. `find_home_index` keys off the registered
+    // home-folder name, which extra drives (POC SQL-seeded) don't
+    // share, so it disambiguates cleanly.
+    let drives = match state
+        .applications
+        .folder_service
+        .list_folders_with_perms(None, user_id)
+        .await
+    {
+        Ok(d) => d,
+        Err(e) => {
+            tracing::error!(error = %e, %user_id, "Login Flow v2: failed to list drives for home detection");
+            return StatusCode::INTERNAL_SERVER_ERROR.into_response();
+        }
+    };
+    let home_id = crate::domain::repositories::drive_repository::position_of_user_home_root_folder(
+        state.drive_repo.as_ref(),
+        user.id,
+        &drives,
+        |f| uuid::Uuid::parse_str(&f.id).ok(),
+    )
+    .await
+    .map(|i| drives[i].id.as_str());
+    let is_home = home_id == Some(drive_id.as_str());
+    let drive_marker = if is_home {
+        None
+    } else {
+        Some(drive_id.as_str())
+    };
+
+    complete_flow(&state, &nextcloud.login_flow, &token, &user, drive_marker).await
+}
+
 /// GET /login/v2/flow/{token}/oidc — Start an OIDC authorization flow that is
 /// tied to a Nextcloud Login Flow v2 session.  After successful IdP
 /// authentication the regular `/api/auth/oidc/callback` endpoint will detect

src/interfaces/nextcloud/mod.rs

@@ -5,6 +5,7 @@ pub mod ocs_handler;
 pub mod preview_handler;
 pub mod report_handler;
 pub mod routes;
+pub mod session;
 pub mod status_handler;
 pub mod trashbin_handler;
 pub mod uploads_handler;

src/interfaces/nextcloud/ocs_handler.rs

@@ -46,9 +46,12 @@ pub async fn handle_capabilities_v2(State(state): State<Arc<AppState>>) -> Respo
     Json(payload).into_response()
 }
 
-pub async fn handle_user_info(State(state): State<Arc<AppState>>, user: AuthUser) -> Response {
+pub async fn handle_user_info(
+    State(state): State<Arc<AppState>>,
+    session: crate::interfaces::nextcloud::session::NcSession,
+) -> Response {
     let quota: (i64, i64) = match state.storage_usage_service.as_ref() {
-        Some(service) => match service.get_user_storage_info(user.id).await {
+        Some(service) => match service.get_user_storage_info(session.user.id).await {
             Ok((used, total)) => (used, total),
             Err(_) => (0, 0),
         },
@@ -62,15 +65,36 @@ pub async fn handle_user_info(State(state): State<Arc<AppState>>, user: AuthUser
         0.0
     };
 
+    // `id` MUST echo the raw wire username the client used at Basic
+    // Auth time — NC desktop reads `data.id` from this endpoint and
+    // splices it into every subsequent WebDAV path it builds
+    // (`/remote.php/dav/files/{id}/…`). Returning the bare canonical
+    // username on a `~{uuid}` session would make the client strip
+    // the marker and revert to the home drive.
+    //
+    // Display fields stay short on the default drive (bare
+    // username); on a marker session we render `username@<drive>`
+    // using the resolved chroot's stored name, which is friendlier
+    // than the raw UUID the wire form carries.
+    let id = session.raw_username.clone();
+    let displayname = if session.is_home() {
+        session.user.username.clone()
+    } else {
+        match session.chroot.as_ref() {
+            Some(chroot) => format!("{}@{}", session.user.username, chroot.name),
+            None => session.user.username.clone(),
+        }
+    };
+
     Json(json!({
         "ocs": {
             "meta": { "status": "ok", "statuscode": 200, "message": "OK" },
             "data": {
                 "enabled": true,
-                "id": user.username,
-                "display-name": user.username,
-                "displayname": user.username,
-                "email": user.email,
+                "id": id,
+                "display-name": displayname,
+                "displayname": displayname,
+                "email": session.user.email,
                 "quota": {
                     "used": quota.0,
                     "total": quota.1,
@@ -399,11 +423,12 @@ pub async fn handle_search(
     let mut entries: Vec<serde_json::Value> = Vec::new();
 
     // Map file results
+    // TODO(D1): drop the hardcoded "Personal/" prefix and read the
+    // caller's default-drive root folder name from `drives.root_folder_id`
+    // instead. Correct for D0-provisioned default drives; secondary
+    // drives keep their original root name.
     for file in &results.files {
-        let display_path = file
-            .path
-            .strip_prefix(&format!("My Folder - {}/", user.username))
-            .unwrap_or(&file.path);
+        let display_path = file.path.strip_prefix("Personal/").unwrap_or(&file.path);
         let display_path = format!("/{}", display_path);
 
         let numeric_id = file_id_map.get(&file.id).copied();
@@ -427,11 +452,11 @@ pub async fn handle_search(
         }));
     }
 
-    // Map folder results
+    // Map folder results — same TODO(D1) as above.
     for folder in &results.folders {
         let display_path = folder
             .path
-            .strip_prefix(&format!("My Folder - {}/", user.username))
+            .strip_prefix("Personal/")
             .unwrap_or(&folder.path);
         let display_path = format!("/{}", display_path);
 

src/interfaces/nextcloud/report_handler.rs

@@ -22,7 +22,6 @@ use crate::application::ports::inbound::SearchUseCase;
 use crate::common::di::AppState;
 use crate::domain::entities::file::File;
 use crate::interfaces::errors::AppError;
-use crate::interfaces::middleware::auth::CurrentUser;
 use crate::interfaces::nextcloud::webdav_handler::{
     batch_resolve_ids, format_oc_id, nc_href, write_file_response, write_folder_response,
 };
@@ -35,7 +34,7 @@ use crate::interfaces::nextcloud::webdav_handler::{
 pub async fn handle_nc_report(
     state: Arc<AppState>,
     req: Request<Body>,
-    user: &CurrentUser,
+    session: &crate::interfaces::nextcloud::session::NcSession,
     _subpath: &str,
 ) -> Result<Response<Body>, AppError> {
     let body_bytes = body::to_bytes(req.into_body(), 64 * 1024)
@@ -45,9 +44,9 @@ pub async fn handle_nc_report(
     let body_str = String::from_utf8_lossy(&body_bytes);
 
     if body_str.contains("filter-files") {
-        handle_filter_files(state, &body_str, user).await
+        handle_filter_files(state, &body_str, session).await
     } else if body_str.contains("searchrequest") {
-        handle_search(state, &body_str, user).await
+        handle_search(state, &body_str, session).await
     } else {
         // Unknown REPORT type -- return empty multistatus.
         Ok(empty_multistatus())
@@ -59,8 +58,10 @@ pub async fn handle_nc_report(
 async fn handle_filter_files(
     state: Arc<AppState>,
     _body: &str,
-    user: &CurrentUser,
+    session: &crate::interfaces::nextcloud::session::NcSession,
 ) -> Result<Response<Body>, AppError> {
+    let user = &session.user;
+    let url_user = &session.raw_username;
     let fav_svc = match state.favorites_service.as_ref() {
         Some(svc) => svc,
         None => return Ok(empty_multistatus()),
@@ -83,7 +84,11 @@ async fn handle_filter_files(
     // All items in this response are favorites.
     let favorite_ids: HashSet<String> = favorites.iter().map(|f| f.item_id.clone()).collect();
 
-    let home_prefix = format!("My Folder - {}/", user.username);
+    // TODO(D1): replace the hardcoded "Personal/" prefix with the
+    // caller's default-drive root folder name read from
+    // `drives.root_folder_id`. Correct for D0-provisioned default
+    // drives; secondary drives keep their original root name.
+    let home_prefix = "Personal/";
 
     // Pass 1: resolve the favorited DTOs in two batch queries (was one
     // get_* per favorite — up to N serial round-trips on a sync client's
@@ -145,9 +150,13 @@ async fn handle_filter_files(
 
         write_multistatus_start(&mut xml)?;
 
+        // Keep main's batched-resolution structure (one batch query
+        // per type, not 2N round-trips). Hrefs use `url_user` so the
+        // multi-drive `~{drive}` form is echoed back to the client;
+        // owner-id stays canonical via `&user.username`.
         for file in &files {
-            let subpath = strip_home_prefix(&file.path, &home_prefix);
-            let href = nc_href(&user.username, subpath);
+            let subpath = strip_home_prefix(&file.path, home_prefix);
+            let href = nc_href(url_user, subpath);
             let fid = file_id_map.get(&file.id).copied();
             let oc_id = fid.map(|id| format_oc_id(id, file_id_svc));
             write_file_response(
@@ -163,8 +172,8 @@ async fn handle_filter_files(
         }
 
         for folder in &folders {
-            let subpath = strip_home_prefix(&folder.path, &home_prefix);
-            let href = format!("{}/", nc_href(&user.username, subpath));
+            let subpath = strip_home_prefix(&folder.path, home_prefix);
+            let href = format!("{}/", nc_href(url_user, subpath));
             let fid = folder_id_map.get(&folder.id).copied();
             let oc_id = fid.map(|id| format_oc_id(id, file_id_svc));
             write_folder_response(
@@ -195,8 +204,13 @@ async fn handle_filter_files(
 async fn handle_search(
     state: Arc<AppState>,
     body: &str,
-    user: &CurrentUser,
+    session: &crate::interfaces::nextcloud::session::NcSession,
 ) -> Result<Response<Body>, AppError> {
+    let user = &session.user;
+    // Validate chroot up-front (path-scoped handler); `resolve_scope_folder`
+    // below re-pulls it from the session for the path-mapping step.
+    session.require_chroot()?;
+    let url_user = &session.raw_username;
     let search_svc = match state.applications.search_service.as_ref() {
         Some(svc) => svc,
         None => return Ok(empty_multistatus()),
@@ -210,7 +224,7 @@ async fn handle_search(
     let nresults = parse_nresults(body).unwrap_or(100);
 
     // Resolve folder scope from <d:href> inside <d:scope>.
-    let folder_id = resolve_scope_folder(&state, body, &user.username).await;
+    let folder_id = resolve_scope_folder(&state, body, session).await;
 
     let criteria = SearchCriteriaDto {
         name_contains: Some(term),
@@ -227,7 +241,10 @@ async fn handle_search(
 
     let nc = state.nextcloud.as_ref();
     let file_id_svc = nc.map(|n| &n.file_ids);
-    let home_prefix = format!("My Folder - {}/", user.username);
+    // TODO(D1): same as the favorites pass above — replace the
+    // hardcoded "Personal/" with the caller's actual default-drive
+    // root folder name from `drives.root_folder_id`.
+    let home_prefix = "Personal/";
 
     // No favorite checking for search results -- pass an empty set.
     let favorite_ids: HashSet<String> = HashSet::new();
@@ -249,8 +266,8 @@ async fn handle_search(
 
         // Files.
         for file in &files {
-            let subpath = strip_home_prefix(&file.path, &home_prefix);
-            let href = nc_href(&user.username, subpath);
+            let subpath = strip_home_prefix(&file.path, home_prefix);
+            let href = nc_href(url_user, subpath);
             let fid = file_id_map.get(&file.id).copied();
             let oc_id = fid.map(|id| format_oc_id(id, file_id_svc));
             write_file_response(
@@ -267,8 +284,8 @@ async fn handle_search(
 
         // Folders.
         for folder in &folders {
-            let subpath = strip_home_prefix(&folder.path, &home_prefix);
-            let href = format!("{}/", nc_href(&user.username, subpath));
+            let subpath = strip_home_prefix(&folder.path, home_prefix);
+            let href = format!("{}/", nc_href(url_user, subpath));
             let fid = folder_id_map.get(&folder.id).copied();
             let oc_id = fid.map(|id| format_oc_id(id, file_id_svc));
             write_folder_response(
@@ -327,6 +344,9 @@ fn file_dto_from_search(fr: &crate::application::dtos::search_dto::SearchFileRes
         sort_date: None,
         content_hash: fr.blob_hash.clone(),
         etag,
+        // §14 provenance not selected by the search result DTO.
+        created_by: None,
+        updated_by: None,
     }
 }
 
@@ -341,12 +361,19 @@ fn folder_dto_from_search(
         path: sr.path.clone(),
         parent_id: sr.parent_id.clone(),
         owner_id: None,
+        // Search result — drive_id is informational. The search row
+        // doesn't currently SELECT it, and path-based lookups never
+        // enter this code path.
+        drive_id: uuid::Uuid::nil(),
         created_at: sr.created_at,
         modified_at: sr.modified_at,
         is_root: sr.is_root,
         icon_class: Arc::from("fas fa-folder"),
         icon_special_class: Arc::from("folder-icon"),
         category: Arc::from("Folder"),
+        // §14 provenance not selected by search results.
+        created_by: None,
+        updated_by: None,
     }
 }
 
@@ -461,23 +488,39 @@ fn xml_extract_text(body: &str, local_name: &[u8]) -> Option<String> {
 }
 
 /// Resolve a scope href (e.g. `/files/username/Documents`) to a folder ID.
-async fn resolve_scope_folder(state: &AppState, body: &str, username: &str) -> Option<String> {
+///
+/// Pulls everything it needs from the `NcSession`: the caller's id (so
+/// `get_folder_by_path` can be user-scoped — post-D0 paths like
+/// `Personal/Docs` are not globally unique), the chroot (provides the
+/// path prefix that `nc_to_internal_path` prepends), and the raw wire
+/// `{user}` segment (bare or `admin~{uuid}`) so we strip the prefix the
+/// NC client actually sent.
+async fn resolve_scope_folder(
+    state: &AppState,
+    body: &str,
+    session: &crate::interfaces::nextcloud::session::NcSession,
+) -> Option<String> {
+    let chroot = session.require_chroot().ok()?;
+    let url_user = &session.raw_username;
     let href = parse_scope_href(body)?;
 
-    // The href is typically `/files/{user}/subpath` or `/remote.php/dav/files/{user}/subpath`.
-    let subpath = extract_subpath_from_scope(&href, username)?;
+    // The href is typically `/files/{url_user}/subpath` or
+    // `/remote.php/dav/files/{url_user}/subpath`. On a multi-drive
+    // session the `{url_user}` segment carries the `~{uuid}` marker,
+    // so we strip with the composite to find the real subpath. Using
+    // `user.username` here would fail to match for non-home drives.
+    let subpath = extract_subpath_from_scope(&href, url_user)?;
     if subpath.is_empty() {
         // Root scope -- no folder_id filter needed.
         return None;
     }
 
     let internal_path =
-        crate::interfaces::nextcloud::webdav_handler::nc_to_internal_path(username, &subpath)
-            .ok()?;
+        crate::interfaces::nextcloud::webdav_handler::nc_to_internal_path(chroot, &subpath).ok()?;
 
     let folder_service = &state.applications.folder_service;
     folder_service
-        .get_folder_by_path(&internal_path)
+        .get_folder_by_path(&internal_path, chroot.drive_id)
         .await
         .ok()
         .map(|f| f.id)
@@ -486,13 +529,16 @@ async fn resolve_scope_folder(state: &AppState, body: &str, username: &str) -> O
 /// Extract the subpath portion from a scope href.
 ///
 /// Handles both short form `/files/{user}/sub` and full
-/// `/remote.php/dav/files/{user}/sub`.
-fn extract_subpath_from_scope(href: &str, username: &str) -> Option<String> {
+/// `/remote.php/dav/files/{user}/sub`. `url_user` is the literal URL
+/// `{user}` segment — bare for legacy single-drive sync, composite
+/// `admin~{uuid}` for multi-drive — so this matches whichever shape
+/// the NC client actually sent.
+fn extract_subpath_from_scope(href: &str, url_user: &str) -> Option<String> {
     let patterns = [
-        format!("/remote.php/dav/files/{}/", username),
-        format!("/files/{}/", username),
-        format!("/remote.php/dav/files/{}", username),
-        format!("/files/{}", username),
+        format!("/remote.php/dav/files/{}/", url_user),
+        format!("/files/{}/", url_user),
+        format!("/remote.php/dav/files/{}", url_user),
+        format!("/files/{}", url_user),
     ];
 
     for pat in &patterns {

src/interfaces/nextcloud/routes.rs

@@ -10,13 +10,14 @@ use axum::{
 use std::sync::Arc;
 
 use crate::common::di::AppState;
-use crate::interfaces::middleware::auth::{AuthUser, CurrentUser};
+use crate::interfaces::middleware::auth::AuthUser;
 use crate::interfaces::middleware::rate_limit::{RateLimiter, rate_limit_login};
 use crate::interfaces::nextcloud::avatar_handler;
 use crate::interfaces::nextcloud::basic_auth_middleware::basic_auth_middleware;
 use crate::interfaces::nextcloud::login_v2_handler;
 use crate::interfaces::nextcloud::ocs_handler;
 use crate::interfaces::nextcloud::preview_handler;
+use crate::interfaces::nextcloud::session::NcSession;
 use crate::interfaces::nextcloud::status_handler;
 use crate::interfaces::nextcloud::trashbin_handler;
 use crate::interfaces::nextcloud::uploads_handler;
@@ -58,6 +59,14 @@ pub fn nextcloud_routes_with_state(state: Arc<AppState>) -> Router<Arc<AppState>
                     rate_limit_login,
                 )),
         )
+        // Drive picker submission — finalises a multi-drive flow that
+        // paused after password verification. Public route by design:
+        // the flow token + single-use `pending_user_id` slot is the
+        // proof of authentication. See `login_v2_handler::handle_drive_pick`.
+        .route(
+            "/login/v2/flow/{token}/drive",
+            post(login_v2_handler::handle_drive_pick),
+        )
         // OIDC initiation from Nextcloud login page
         .route(
             "/login/v2/flow/{token}/oidc",
@@ -204,60 +213,46 @@ pub fn nextcloud_routes_with_state(state: Arc<AppState>) -> Router<Arc<AppState>
 
 // ──────────────── Handler glue ────────────────
 
-/// Reject requests where the URL `{user}` doesn't match the authenticated user.
-#[allow(clippy::result_large_err)]
-fn verify_url_user(url_user: &str, auth_user: &CurrentUser) -> Result<(), Response> {
-    if url_user != auth_user.username {
-        Err(StatusCode::FORBIDDEN.into_response())
-    } else {
-        Ok(())
-    }
-}
-
 async fn handle_dav_files(
     State(state): State<Arc<AppState>>,
-    Path((url_user, subpath)): Path<(String, String)>,
-    user_ext: AuthUser,
+    Path((_url_user, subpath)): Path<(String, String)>,
+    session: NcSession,
     req: Request<Body>,
 ) -> Result<Response, Response> {
-    verify_url_user(&url_user, &user_ext)?;
-    webdav_handler::handle_nc_webdav(state, req, user_ext, subpath)
+    webdav_handler::handle_nc_webdav(state, req, session, subpath)
         .await
         .map_err(|e| e.into_response())
 }
 
 async fn handle_dav_files_root(
     State(state): State<Arc<AppState>>,
-    Path(url_user): Path<String>,
-    user_ext: AuthUser,
+    Path(_url_user): Path<String>,
+    session: NcSession,
     req: Request<Body>,
 ) -> Result<Response, Response> {
-    verify_url_user(&url_user, &user_ext)?;
-    webdav_handler::handle_nc_webdav(state, req, user_ext, String::new())
+    webdav_handler::handle_nc_webdav(state, req, session, String::new())
         .await
         .map_err(|e| e.into_response())
 }
 
 async fn handle_dav_uploads(
     State(state): State<Arc<AppState>>,
-    Path((url_user, upload_id, rest)): Path<(String, String, String)>,
-    user_ext: AuthUser,
+    Path((_url_user, upload_id, rest)): Path<(String, String, String)>,
+    session: NcSession,
     req: Request<Body>,
 ) -> Result<Response, Response> {
-    verify_url_user(&url_user, &user_ext)?;
-    uploads_handler::handle_nc_uploads(state, req, user_ext, upload_id, rest)
+    uploads_handler::handle_nc_uploads(state, req, session, upload_id, rest)
         .await
         .map_err(|e| e.into_response())
 }
 
 async fn handle_dav_uploads_root(
     State(state): State<Arc<AppState>>,
-    Path((url_user, upload_id)): Path<(String, String)>,
-    user_ext: AuthUser,
+    Path((_url_user, upload_id)): Path<(String, String)>,
+    session: NcSession,
     req: Request<Body>,
 ) -> Result<Response, Response> {
-    verify_url_user(&url_user, &user_ext)?;
-    uploads_handler::handle_nc_uploads(state, req, user_ext, upload_id, String::new())
+    uploads_handler::handle_nc_uploads(state, req, session, upload_id, String::new())
         .await
         .map_err(|e| e.into_response())
 }
@@ -283,24 +278,22 @@ async fn handle_legacy_webdav_root(user_ext: AuthUser) -> Response {
 
 async fn handle_dav_trashbin(
     State(state): State<Arc<AppState>>,
-    Path((url_user, subpath)): Path<(String, String)>,
-    user_ext: AuthUser,
+    Path((_url_user, subpath)): Path<(String, String)>,
+    session: NcSession,
     req: Request<Body>,
 ) -> Result<Response, Response> {
-    verify_url_user(&url_user, &user_ext)?;
-    trashbin_handler::handle_nc_trashbin(state, req, user_ext, subpath)
+    trashbin_handler::handle_nc_trashbin(state, req, session, subpath)
         .await
         .map_err(|e| e.into_response())
 }
 
 async fn handle_dav_trashbin_root(
     State(state): State<Arc<AppState>>,
-    Path(url_user): Path<String>,
-    user_ext: AuthUser,
+    Path(_url_user): Path<String>,
+    session: NcSession,
     req: Request<Body>,
 ) -> Result<Response, Response> {
-    verify_url_user(&url_user, &user_ext)?;
-    trashbin_handler::handle_nc_trashbin(state, req, user_ext, String::new())
+    trashbin_handler::handle_nc_trashbin(state, req, session, String::new())
         .await
         .map_err(|e| e.into_response())
 }

src/interfaces/nextcloud/session.rs

@@ -0,0 +1,134 @@
+//! Per-request NextCloud session context.
+//!
+//! Bundles WHO the caller is, the raw wire username they presented,
+//! and (for path-scoped endpoints) WHERE they're confined to. Built
+//! by `basic_auth_middleware` and stashed in request extensions as
+//! `Arc<NcSession>`; handlers extract it via the [`FromRequestParts`]
+//! impl below — just declare `session: NcSession` in the signature.
+//!
+//! ## Source of truth
+//!
+//! - `user`: authenticated identity (id, canonical username, role).
+//! - `raw_username`: the opaque wire identifier from the Basic Auth
+//!   header. Today: plain `user` (single-drive) or `user~{drive_uuid}`
+//!   (multi-drive POC). May look different again when future auth
+//!   schemes land. **Handlers MUST NOT parse it** — it's used verbatim
+//!   only for echoing back into DAV/OCS URLs the client expects to
+//!   see (notably OCS `cloud/user`'s `id` field, which NC desktop
+//!   splices into every subsequent DAV path it builds) and for
+//!   audit logs.
+//! - `chroot`: folder the request is jailed inside. `Some` for every
+//!   authenticated NC request today (the home folder when no drive
+//!   marker is present, or the resolved drive when one is). `None`
+//!   is reserved for future routes that don't operate on a single
+//!   folder (admin / cross-drive queries).
+//!
+//! ## Why this lives in middleware, not routes.rs
+//!
+//! The auth step already has every input needed (raw username from
+//! header + drive marker after `~` + authenticated user). Resolving
+//! the chroot there means every NC handler — DAV, OCS, uploads,
+//! trashbin, sharees, … — gets a uniform `NcSession` regardless of
+//! whether its URL carries a `{user}` segment. The URL `{user}`
+//! segment becomes informational; the auth header is canonical.
+
+use std::sync::Arc;
+
+use axum::{
+    extract::FromRequestParts,
+    http::{StatusCode, request::Parts},
+    response::{IntoResponse, Response},
+};
+
+use crate::application::dtos::folder_dto::FolderDto;
+use crate::interfaces::errors::AppError;
+use crate::interfaces::middleware::auth::CurrentUser;
+
+#[derive(Debug, Clone)]
+pub struct NcSession {
+    pub user: CurrentUser,
+    pub raw_username: String,
+    pub chroot: Option<FolderDto>,
+}
+
+impl NcSession {
+    /// Return the chroot, or 500 if a path-scoped handler is reached
+    /// without one. Documents the invariant that every NC route
+    /// today is path-scoped — if this fires, route wiring is wrong.
+    pub fn require_chroot(&self) -> Result<&FolderDto, AppError> {
+        self.chroot.as_ref().ok_or_else(|| {
+            AppError::internal_error(
+                "NcSession: path-scoped handler reached without a chroot — route wiring bug",
+            )
+        })
+    }
+
+    /// True when the session is scoped to the user's home folder
+    /// (no drive marker in the Basic Auth username). Useful for
+    /// handlers that want to render a friendlier display when the
+    /// user is on their default drive.
+    pub fn is_home(&self) -> bool {
+        !self.raw_username.contains('~')
+    }
+}
+
+/// Pull the `{user}` segment out of a NC DAV URL.
+///
+/// Expected URL shapes:
+/// - `/remote.php/dav/files/{user}` (root)
+/// - `/remote.php/dav/files/{user}/{*subpath}`
+/// - `/remote.php/dav/uploads/{user}/{upload_id}[/{*rest}]`
+/// - `/remote.php/dav/trashbin/{user}[/{*subpath}]`
+///
+/// Returns `None` for anything that doesn't follow this shape (notably
+/// the OCS surfaces, where there is no `{user}` segment to compare).
+fn extract_url_user(path: &str) -> Option<String> {
+    let mut segments = path.split('/');
+    if !segments.next()?.is_empty() {
+        return None;
+    }
+    if segments.next()? != "remote.php" {
+        return None;
+    }
+    if segments.next()? != "dav" {
+        return None;
+    }
+    let _surface = segments.next()?; // files / uploads / trashbin
+    let user_seg = segments.next()?;
+    if user_seg.is_empty() {
+        return None;
+    }
+    urlencoding::decode(user_seg).ok().map(|s| s.into_owned())
+}
+
+/// Axum extractor: pulls the `Arc<NcSession>` that
+/// `basic_auth_middleware` stashed in request extensions and clones
+/// it (cheap — one `Arc` increment, no field copy) into an owned
+/// `NcSession` for handler use.
+///
+/// On path-scoped DAV routes (`/remote.php/dav/{files,uploads,
+/// trashbin}/{user}/…`), the URL `{user}` segment is cross-checked
+/// against `session.raw_username` and 403'd on mismatch. This is a
+/// consistency check, NOT a security boundary — the chroot ACL
+/// (`get_folder_with_perms`) is what actually prevents cross-user
+/// access. It just surfaces malformed requests early (403) instead
+/// of silently letting them through.
+impl<S: Send + Sync> FromRequestParts<S> for NcSession {
+    type Rejection = Response;
+
+    async fn from_request_parts(parts: &mut Parts, _state: &S) -> Result<Self, Self::Rejection> {
+        let session = parts
+            .extensions
+            .get::<Arc<NcSession>>()
+            .map(|arc| (**arc).clone())
+            .ok_or_else(|| StatusCode::UNAUTHORIZED.into_response())?;
+
+        if let Some(url_user) = extract_url_user(parts.uri.path())
+            && url_user != session.raw_username
+        {
+            return Err(StatusCode::FORBIDDEN.into_response());
+        }
+
+        Ok(session)
+    }
+}

src/interfaces/nextcloud/trashbin_handler.rs

@@ -14,7 +14,6 @@ use crate::application::ports::folder_ports::FolderUseCase;
 use crate::application::ports::trash_ports::TrashUseCase;
 use crate::common::di::AppState;
 use crate::interfaces::errors::AppError;
-use crate::interfaces::middleware::auth::{AuthUser, CurrentUser};
 use crate::interfaces::nextcloud::webdav_handler::{
     batch_resolve_ids, extract_nc_subpath_from_dest, format_oc_id, nc_to_internal_path,
     write_text_element,
@@ -28,7 +27,7 @@ const HEADER_DAV: HeaderName = HeaderName::from_static("dav");
 pub async fn handle_nc_trashbin(
     state: Arc<AppState>,
     req: Request<Body>,
-    user: AuthUser,
+    session: crate::interfaces::nextcloud::session::NcSession,
     subpath: String,
 ) -> Result<Response<Body>, AppError> {
     let method = req.method().clone();
@@ -37,21 +36,25 @@ pub async fn handle_nc_trashbin(
     match method.as_str() {
         "OPTIONS" => handle_options(),
         "PROPFIND" if subpath_trimmed == "trash" || subpath_trimmed.is_empty() => {
-            handle_propfind(state, &user).await
+            handle_propfind(state, &session).await
         }
         "MOVE" if subpath_trimmed.starts_with("trash/") => {
+            // Keep the destination-collision-check feature added on HEAD
+            // (RFC 4918 §9.9.4: refuse restore with 412 when the
+            // destination is taken by a live resource). The chroot lookup
+            // moves into `handle_restore` via the session.
             let dest_header = req
                 .headers()
                 .get("destination")
                 .and_then(|v| v.to_str().ok())
                 .map(|s| s.to_string());
-            handle_restore(state, dest_header, &user, subpath_trimmed).await
+            handle_restore(state, dest_header, &session, subpath_trimmed).await
         }
         "DELETE" if subpath_trimmed == "trash" || subpath_trimmed.is_empty() => {
-            handle_empty_trash(state, &user).await
+            handle_empty_trash(state, &session).await
         }
         "DELETE" if subpath_trimmed.starts_with("trash/") => {
-            handle_delete_permanent(state, &user, subpath_trimmed).await
+            handle_delete_permanent(state, &session, subpath_trimmed).await
         }
         _ => Ok(Response::builder()
             .status(StatusCode::METHOD_NOT_ALLOWED)
@@ -75,8 +78,9 @@ fn handle_options() -> Result<Response<Body>, AppError> {
 
 async fn handle_propfind(
     state: Arc<AppState>,
-    user: &CurrentUser,
+    session: &crate::interfaces::nextcloud::session::NcSession,
 ) -> Result<Response<Body>, AppError> {
+    let user = &session.user;
     let trash_svc = state
         .trash_service
         .as_ref()
@@ -107,9 +111,11 @@ async fn handle_propfind(
 async fn handle_restore(
     state: Arc<AppState>,
     dest_header: Option<String>,
-    user: &CurrentUser,
+    session: &crate::interfaces::nextcloud::session::NcSession,
     subpath: &str,
 ) -> Result<Response<Body>, AppError> {
+    let user = &session.user;
+    let chroot = session.require_chroot()?;
     let id = extract_trash_id(subpath)?;
 
     let trash_svc = state
@@ -128,12 +134,15 @@ async fn handle_restore(
     if let Some(dest_header) = dest_header
         && let Some(dest_subpath) = extract_nc_subpath_from_dest(&dest_header, &user.username)
     {
-        let dest_internal = nc_to_internal_path(&user.username, &dest_subpath)?;
+        let dest_internal = nc_to_internal_path(chroot, &dest_subpath)?;
         let folder_service = &state.applications.folder_service;
         let file_service = &state.applications.file_retrieval_service;
-        let dest_taken = file_service.get_file_by_path(&dest_internal).await.is_ok()
+        let dest_taken = file_service
+            .get_file_by_path(&dest_internal, chroot.drive_id)
+            .await
+            .is_ok()
             || folder_service
-                .get_folder_by_path(&dest_internal)
+                .get_folder_by_path(&dest_internal, chroot.drive_id)
                 .await
                 .is_ok();
         if dest_taken {
@@ -184,8 +193,9 @@ async fn handle_restore(
 
 async fn handle_empty_trash(
     state: Arc<AppState>,
-    user: &CurrentUser,
+    session: &crate::interfaces::nextcloud::session::NcSession,
 ) -> Result<Response<Body>, AppError> {
+    let user = &session.user;
     let trash_svc = state
         .trash_service
         .as_ref()
@@ -206,9 +216,10 @@ async fn handle_empty_trash(
 
 async fn handle_delete_permanent(
     state: Arc<AppState>,
-    user: &CurrentUser,
+    session: &crate::interfaces::nextcloud::session::NcSession,
     subpath: &str,
 ) -> Result<Response<Body>, AppError> {
+    let user = &session.user;
     let id = extract_trash_id(subpath)?;
 
     let trash_svc = state
@@ -248,11 +259,18 @@ fn mime_from_name(name: &str) -> String {
         .to_string()
 }
 
-/// Strip the "My Folder - {username}/" prefix from an original path to produce
-/// the Nextcloud-relative original location.
-fn strip_home_prefix<'a>(original_path: &'a str, username: &str) -> &'a str {
-    let prefix = format!("My Folder - {}/", username);
-    original_path.strip_prefix(&prefix).unwrap_or(original_path)
+/// Strip the home-folder prefix from an original path to produce the
+/// Nextcloud-relative original location.
+///
+/// TODO(D1): replace the hardcoded "Personal/" with the caller's actual
+/// default-drive root folder name read from `drives.root_folder_id`.
+/// Correct for D0-provisioned default drives; secondary drives keep
+/// their original root name. The `_username` arg stays for now so the
+/// upcoming dynamic lookup has a way to identify the caller.
+fn strip_home_prefix<'a>(original_path: &'a str, _username: &str) -> &'a str {
+    original_path
+        .strip_prefix("Personal/")
+        .unwrap_or(original_path)
 }
 
 // ────────────── Trashbin PROPFIND XML Generation ──────────────

src/interfaces/nextcloud/uploads_handler.rs

@@ -9,7 +9,6 @@ use crate::application::ports::file_ports::{FileRetrievalUseCase, FileUploadUseC
 use crate::common::di::AppState;
 use crate::common::mime_detect::filename_from_path;
 use crate::interfaces::errors::AppError;
-use crate::interfaces::middleware::auth::{AuthUser, CurrentUser};
 use crate::interfaces::upload_ingest::{
     discard_ingested, ingest_stream_to_cas, stream_body_to_path, stream_from_files,
 };
@@ -25,17 +24,17 @@ use crate::interfaces::upload_ingest::{
 pub async fn handle_nc_uploads(
     state: Arc<AppState>,
     req: Request<Body>,
-    user: AuthUser,
+    session: crate::interfaces::nextcloud::session::NcSession,
     upload_id: String,
     rest: String, // chunk name or ".file" or empty
 ) -> Result<Response<Body>, AppError> {
     let method = req.method().clone();
     match method.as_str() {
-        "MKCOL" => handle_mkcol(state, &user, &upload_id).await,
-        "PUT" => handle_put_chunk(state, req, &user, &upload_id, &rest).await,
-        "MOVE" => handle_assemble(state, req, &user, &upload_id).await,
-        "DELETE" => handle_abort(state, &user, &upload_id).await,
-        "PROPFIND" => handle_propfind_session(state, &user, &upload_id).await,
+        "MKCOL" => handle_mkcol(state, &session, &upload_id).await,
+        "PUT" => handle_put_chunk(state, req, &session, &upload_id, &rest).await,
+        "MOVE" => handle_assemble(state, req, &session, &upload_id).await,
+        "DELETE" => handle_abort(state, &session, &upload_id).await,
+        "PROPFIND" => handle_propfind_session(state, &session, &upload_id).await,
         _ => Ok(Response::builder()
             .status(StatusCode::METHOD_NOT_ALLOWED)
             .body(Body::empty())
@@ -60,9 +59,10 @@ pub async fn handle_nc_uploads(
 /// which matches NC server behaviour.
 async fn handle_propfind_session(
     state: Arc<AppState>,
-    user: &CurrentUser,
+    session: &crate::interfaces::nextcloud::session::NcSession,
     upload_id: &str,
 ) -> Result<Response<Body>, AppError> {
+    let user = &session.user;
     let nc = state
         .nextcloud
         .as_ref()
@@ -147,9 +147,10 @@ fn xml_escape(s: &str) -> String {
 /// MKCOL — create upload session directory.
 async fn handle_mkcol(
     state: Arc<AppState>,
-    user: &CurrentUser,
+    session: &crate::interfaces::nextcloud::session::NcSession,
     upload_id: &str,
 ) -> Result<Response<Body>, AppError> {
+    let user = &session.user;
     let nc = state
         .nextcloud
         .as_ref()
@@ -178,10 +179,11 @@ async fn handle_mkcol(
 async fn handle_put_chunk(
     state: Arc<AppState>,
     req: Request<Body>,
-    user: &CurrentUser,
+    session: &crate::interfaces::nextcloud::session::NcSession,
     upload_id: &str,
     chunk_name: &str,
 ) -> Result<Response<Body>, AppError> {
+    let user = &session.user;
     let nc = state
         .nextcloud
         .as_ref()
@@ -216,9 +218,10 @@ async fn handle_put_chunk(
 async fn handle_assemble(
     state: Arc<AppState>,
     req: Request<Body>,
-    user: &CurrentUser,
+    session: &crate::interfaces::nextcloud::session::NcSession,
     upload_id: &str,
 ) -> Result<Response<Body>, AppError> {
+    let user = &session.user;
     let nc = state
         .nextcloud
         .as_ref()
@@ -256,11 +259,19 @@ async fn handle_assemble(
     let file_service = &state.applications.file_retrieval_service;
     let folder_service = &state.applications.folder_service;
 
-    let internal_path = format!(
-        "My Folder - {}/{}",
-        user.username,
-        dest_subpath.trim_matches('/')
-    );
+    // Path-based lookups below scope by `drive_id`. The NC session's
+    // chroot is always populated for path-scoped handlers (see
+    // `NcSession::require_chroot`); the FolderDto carries `drive_id`
+    // post-D0.
+    let chroot = session.require_chroot()?;
+    let drive_id = chroot.drive_id;
+
+    // TODO(D1): read the caller's default-drive root folder name from
+    // `drives.root_folder_id` instead of hardcoding "Personal". The
+    // constant is correct for every default personal drive provisioned
+    // by the D0 lifecycle hook, but secondary drives (M2 backfill from
+    // SQL-created sibling root folders) keep their original name.
+    let internal_path = format!("Personal/{}", dest_subpath.trim_matches('/'));
 
     let filename = filename_from_path(&dest_subpath).to_string();
     let ingested = ingest_stream_to_cas(
@@ -275,11 +286,20 @@ async fn handle_assemble(
     let content_type = ingested.content_type.clone();
 
     // Check if file exists (update vs create).
-    let existing = file_service.get_file_by_path(&internal_path).await;
+    let existing = file_service
+        .get_file_by_path(&internal_path, drive_id)
+        .await;
 
     let etag: Option<String> = if existing.is_ok() {
         let dto = upload_service
-            .update_file_streaming(&internal_path, ingested.stored(), &content_type, oc_mtime)
+            .update_file_streaming(
+                &internal_path,
+                drive_id,
+                ingested.stored(),
+                &content_type,
+                oc_mtime,
+                user.id,
+            )
             .await
             .map_err(|e| AppError::internal_error(format!("Failed to update file: {}", e)))?;
 
@@ -291,15 +311,14 @@ async fn handle_assemble(
             Some((p, n)) => (p, n),
             None => ("", dest_subpath.as_str()),
         };
-        let parent_internal = format!(
-            "My Folder - {}/{}",
-            user.username,
-            parent_sub.trim_matches('/')
-        );
+        let parent_internal = format!("Personal/{}", parent_sub.trim_matches('/'));
         let parent_internal = parent_internal.trim_end_matches('/');
 
         use crate::application::ports::folder_ports::FolderUseCase;
-        let parent_folder = match folder_service.get_folder_by_path(parent_internal).await {
+        let parent_folder = match folder_service
+            .get_folder_by_path(parent_internal, drive_id)
+            .await
+        {
             Ok(folder) => folder,
             Err(e) => {
                 discard_ingested(&state.core.dedup_service, &ingested).await;
@@ -316,6 +335,7 @@ async fn handle_assemble(
                 Some(parent_folder.id),
                 content_type.to_string(),
                 ingested.stored(),
+                user.id,
             )
             .await
             .map_err(|e| AppError::internal_error(format!("Failed to create file: {}", e)))?;
@@ -344,9 +364,10 @@ async fn handle_assemble(
 /// DELETE — abort an upload session.
 async fn handle_abort(
     state: Arc<AppState>,
-    user: &CurrentUser,
+    session: &crate::interfaces::nextcloud::session::NcSession,
     upload_id: &str,
 ) -> Result<Response<Body>, AppError> {
+    let user = &session.user;
     let nc = state
         .nextcloud
         .as_ref()

src/interfaces/nextcloud/webdav_handler.rs

@@ -25,7 +25,6 @@ use crate::common::di::AppState;
 use crate::common::mime_detect::filename_from_path;
 use crate::interfaces::api::handlers::webdav_handler::PROPFIND_BATCH_SIZE;
 use crate::interfaces::errors::AppError;
-use crate::interfaces::middleware::auth::{AuthUser, CurrentUser};
 use crate::interfaces::range_requests::{not_modified_response, range_response};
 use crate::interfaces::upload_ingest::ingest_body_to_cas;
 
@@ -47,23 +46,35 @@ fn timestamp_to_i64(ts: u64) -> i64 {
 
 const HEADER_DAV: HeaderName = HeaderName::from_static("dav");
 
-/// Resolve the internal OxiCloud path from a Nextcloud DAV subpath.
+/// Resolve the internal OxiCloud path from a NextCloud DAV subpath
+/// and the storage chroot the request is confined to.
 ///
-/// Nextcloud: /remote.php/dav/files/{user}/{subpath}
-/// Internal:  My Folder - {username}/{subpath}
+/// `chroot` is the storage path the request is "jailed" inside —
+/// the route glue (`routes.rs::handle_dav_*`) computes it once per
+/// request:
+/// - Legacy `/files/{user}/…` or explicit `~{home_folder_uuid}` →
+///   `"My Folder - {username}"` (no DB lookup needed).
+/// - `~{some_other_folder_uuid}` → the folder's stored `path` after
+///   a `get_folder_with_perms` check (404 if missing / no access).
 ///
-/// An empty subpath maps to the user's home folder root.
-pub fn nc_to_internal_path(username: &str, subpath: &str) -> Result<String, AppError> {
-    let home = format!("My Folder - {}", username);
+/// By the time we get here `chroot` is known to be a legitimate
+/// target — validation and permission live in the route layer, not
+/// in the path mapper. This function stays sync and free of any
+/// folder-service handle. The chroot's `path` is the canonical root
+/// segment (e.g. `"Personal"` for default personal drives provisioned
+/// by D0, the original sibling-root folder name for secondary drives).
+/// Replaces the pre-D0 hardcoded `"My Folder - {username}/"` prefix.
+pub fn nc_to_internal_path(chroot: &FolderDto, subpath: &str) -> Result<String, AppError> {
     let subpath = subpath.trim_matches('/');
     if subpath.is_empty() {
-        return Ok(home);
+        return Ok(chroot.path.clone());
     }
     // Reject path traversal attempts.
     if subpath.split('/').any(|seg| seg == ".." || seg == ".") {
         return Err(AppError::bad_request("Invalid path: traversal not allowed"));
     }
-    Ok(format!("{}/{}", home, subpath))
+
+    Ok(format!("{}/{}", chroot.path, subpath))
 }
 
 /// Build the Nextcloud DAV href for a **collection** (folder). Always
@@ -113,26 +124,42 @@ pub fn nc_href(username: &str, subpath: &str) -> String {
 /// Dispatch Nextcloud WebDAV request to the appropriate handler.
 ///
 /// `subpath` is everything after `/remote.php/dav/files/{user}/`.
+/// `session.chroot` is the storage path the request is confined to
+/// — see [`nc_to_internal_path`] for what gets resolved upstream.
+/// `session.raw_username` is the literal wire identifier — bare
+/// `admin` for single-drive sync, composite `admin~{drive_uuid}` for
+/// multi-drive. **Hrefs in every response MUST be built from
+/// `session.raw_username`, not from `session.user.username`** — the
+/// NC desktop client validates that PROPFIND/MOVE response hrefs
+/// share the requested URL's prefix and aborts the parse otherwise
+/// (`Invalid href "<…>" expected starting with "<requested-url>"`).
+/// The bare `session.user.username` is still the right value for
+/// the storage-side owner identity (`oc:owner-id`).
 pub async fn handle_nc_webdav(
     state: Arc<AppState>,
     req: Request<Body>,
-    user: AuthUser,
+    session: crate::interfaces::nextcloud::session::NcSession,
     subpath: String,
 ) -> Result<Response<Body>, AppError> {
+    // Validate up-front that we have a chroot — every method below is
+    // path-scoped, so a missing chroot is a route-wiring bug we want to
+    // surface as a 500 immediately rather than re-checking inside each
+    // handler.
+    session.require_chroot()?;
     let method = req.method().clone();
     match method.as_str() {
         "OPTIONS" => handle_options(),
-        "GET" => handle_get(state, &user, &subpath, req.headers()).await,
-        "PROPFIND" => handle_propfind(state, req, &user, &subpath).await,
-        "PUT" => handle_put(state, req, &user, &subpath).await,
-        "MKCOL" => handle_mkcol(state, &user, &subpath).await,
-        "DELETE" => handle_delete(state, &user, &subpath).await,
-        "MOVE" => handle_move(state, req, &user, &subpath).await,
-        "HEAD" => handle_head(state, &user, &subpath).await,
-        "PROPPATCH" => handle_proppatch(state, req, &user, &subpath).await,
+        "PROPFIND" => handle_propfind(state, req, &session, &subpath).await,
+        "GET" => handle_get(state, &session, &subpath, req.headers()).await,
+        "PUT" => handle_put(state, req, &session, &subpath).await,
+        "MKCOL" => handle_mkcol(state, &session, &subpath).await,
+        "DELETE" => handle_delete(state, &session, &subpath).await,
+        "MOVE" => handle_move(state, req, &session, &subpath).await,
+        "HEAD" => handle_head(state, &session, &subpath).await,
+        "PROPPATCH" => handle_proppatch(state, req, &session, &subpath).await,
         "REPORT" | "SEARCH" => {
             crate::interfaces::nextcloud::report_handler::handle_nc_report(
-                state, req, &user, &subpath,
+                state, req, &session, &subpath,
             )
             .await
         }
@@ -171,9 +198,12 @@ fn handle_options() -> Result<Response<Body>, AppError> {
 async fn handle_propfind(
     state: Arc<AppState>,
     req: Request<Body>,
-    user: &CurrentUser,
+    session: &crate::interfaces::nextcloud::session::NcSession,
     subpath: &str,
 ) -> Result<Response<Body>, AppError> {
+    let user = &session.user;
+    let chroot = session.require_chroot()?;
+    let url_user = &session.raw_username;
     let depth = req
         .headers()
         .get("depth")
@@ -198,29 +228,41 @@ async fn handle_propfind(
             .map_err(|e| AppError::bad_request(format!("Invalid PROPFIND XML: {}", e)))?
     };
 
-    let internal_path = nc_to_internal_path(&user.username, subpath)?;
+    let internal_path = nc_to_internal_path(chroot, subpath)?;
+
     let folder_service = &state.applications.folder_service;
     let file_service = &state.applications.file_retrieval_service;
 
     // Try to resolve as folder first.
-    let folder_result = folder_service.get_folder_by_path(&internal_path).await;
+    let folder_result = folder_service
+        .get_folder_by_path(&internal_path, chroot.drive_id)
+        .await;
 
     if let Ok(folder) = folder_result {
         // It's a folder — stream the multistatus: children are fetched in
         // pages and serialized chunk by chunk, so memory stays O(batch)
         // regardless of how many entries the folder holds.
+        //
+        // Multi-drive POC: the hrefs in the response must echo the
+        // wire form (`{user}~{drive}`) the client requested, so we
+        // pass `url_user` (not `user.username`) as the streaming
+        // function's username arg. Refining the owner-id usages
+        // back to the canonical username is deferred to the
+        // NcSession commit.
         return Ok(build_nc_streaming_propfind(
             state.clone(),
             folder,
             depth,
             user.id,
-            user.username.clone(),
+            url_user.to_string(),
             subpath.to_string(),
         ));
     }
 
     // Not a folder — try as a file.
-    let file_result = file_service.get_file_by_path(&internal_path).await;
+    let file_result = file_service
+        .get_file_by_path(&internal_path, chroot.drive_id)
+        .await;
     if let Ok(file) = file_result {
         // Batch-check favorites for this single file.
         let favorite_ids = if let Some(fav_svc) = state.favorites_service.as_ref() {
@@ -240,6 +282,7 @@ async fn handle_propfind(
         write_nc_file_multistatus(
             &mut buf,
             &file,
+            url_user,
             &user.username,
             subpath,
             file_id_svc,
@@ -262,10 +305,11 @@ async fn handle_propfind(
 
 async fn handle_get(
     state: Arc<AppState>,
-    user: &CurrentUser,
+    session: &crate::interfaces::nextcloud::session::NcSession,
     subpath: &str,
     headers: &axum::http::HeaderMap,
 ) -> Result<Response<Body>, AppError> {
+    let chroot = session.require_chroot()?;
     // GET on root folder — NC clients use this as an existence check
     if subpath.is_empty() || subpath == "/" {
         return Ok(Response::builder()
@@ -275,13 +319,13 @@ async fn handle_get(
             .unwrap());
     }
 
-    let internal_path = nc_to_internal_path(&user.username, subpath)?;
+    let internal_path = nc_to_internal_path(chroot, subpath)?;
     let file_service = &state.applications.file_retrieval_service;
     let folder_service = &state.applications.folder_service;
 
     // Check if path is a folder first (NC clients use GET as existence check)
     if folder_service
-        .get_folder_by_path(&internal_path)
+        .get_folder_by_path(&internal_path, chroot.drive_id)
         .await
         .is_ok()
     {
@@ -293,7 +337,7 @@ async fn handle_get(
     }
 
     let file = file_service
-        .get_file_by_path(&internal_path)
+        .get_file_by_path(&internal_path, chroot.drive_id)
         .await
         .map_err(|_| AppError::not_found("File not found"))?;
 
@@ -340,9 +384,10 @@ async fn handle_get(
 
 async fn handle_head(
     state: Arc<AppState>,
-    user: &CurrentUser,
+    session: &crate::interfaces::nextcloud::session::NcSession,
     subpath: &str,
 ) -> Result<Response<Body>, AppError> {
+    let chroot = session.require_chroot()?;
     // HEAD on root folder — NC clients use this as an existence check
     if subpath.is_empty() || subpath == "/" {
         return Ok(Response::builder()
@@ -352,13 +397,13 @@ async fn handle_head(
             .unwrap());
     }
 
-    let internal_path = nc_to_internal_path(&user.username, subpath)?;
+    let internal_path = nc_to_internal_path(chroot, subpath)?;
     let file_service = &state.applications.file_retrieval_service;
     let folder_service = &state.applications.folder_service;
 
     // Check if path is a folder (NC clients use HEAD as existence check)
     if folder_service
-        .get_folder_by_path(&internal_path)
+        .get_folder_by_path(&internal_path, chroot.drive_id)
         .await
         .is_ok()
     {
@@ -370,7 +415,7 @@ async fn handle_head(
     }
 
     let file = file_service
-        .get_file_by_path(&internal_path)
+        .get_file_by_path(&internal_path, chroot.drive_id)
         .await
         .map_err(|_| AppError::not_found("File not found"))?;
 
@@ -404,9 +449,12 @@ async fn handle_head(
 async fn handle_proppatch(
     state: Arc<AppState>,
     req: Request<Body>,
-    user: &CurrentUser,
+    session: &crate::interfaces::nextcloud::session::NcSession,
     subpath: &str,
 ) -> Result<Response<Body>, AppError> {
+    let user = &session.user;
+    let chroot = session.require_chroot()?;
+    let url_user = &session.raw_username;
     let body_bytes = body::to_bytes(req.into_body(), 64 * 1024)
         .await
         .map_err(|e| AppError::bad_request(format!("Failed to read body: {}", e)))?;
@@ -428,12 +476,18 @@ async fn handle_proppatch(
     // PROPPATCH path (no favorite directive in the body) — matches
     // the prior behaviour. A PROPPATCH that *does* try to set
     // favorite on a missing resource still returns NotFound.
-    let internal_path = nc_to_internal_path(&user.username, subpath)?;
+    let internal_path = nc_to_internal_path(chroot, subpath)?;
     let file_service = &state.applications.file_retrieval_service;
     let folder_service = &state.applications.folder_service;
-    let resource = if let Ok(file) = file_service.get_file_by_path(&internal_path).await {
+    let resource = if let Ok(file) = file_service
+        .get_file_by_path(&internal_path, chroot.drive_id)
+        .await
+    {
         Some((file.id, "file"))
-    } else if let Ok(folder) = folder_service.get_folder_by_path(&internal_path).await {
+    } else if let Ok(folder) = folder_service
+        .get_folder_by_path(&internal_path, chroot.drive_id)
+        .await
+    {
         Some((folder.id, "folder"))
     } else {
         None
@@ -472,9 +526,9 @@ async fn handle_proppatch(
     // type to satisfy the RFC 4918 §5.2 trailing-slash invariant —
     // see the comment block at the top of this function.
     let href = if is_collection {
-        nc_collection_href(&user.username, subpath)
+        nc_collection_href(url_user, subpath)
     } else {
-        nc_href(&user.username, subpath)
+        nc_href(url_user, subpath)
     };
     let mut buf = Vec::new();
     {
@@ -610,10 +664,11 @@ fn precondition_failed_response() -> Response<Body> {
 async fn handle_put(
     state: Arc<AppState>,
     req: Request<Body>,
-    user: &CurrentUser,
+    session: &crate::interfaces::nextcloud::session::NcSession,
     subpath: &str,
 ) -> Result<Response<Body>, AppError> {
-    let internal_path = nc_to_internal_path(&user.username, subpath)?;
+    let chroot = session.require_chroot()?;
+    let internal_path = nc_to_internal_path(chroot, subpath)?;
     let file_service = &state.applications.file_retrieval_service;
     let upload_service = &state.applications.file_upload_service;
 
@@ -635,7 +690,10 @@ async fn handle_put(
     // bandwidth or disk I/O on a body the server is going to throw away.
     // The lookup is reused for the create-vs-update distinction below,
     // so this is also free of an extra DB hit.
-    let existing = file_service.get_file_by_path(&internal_path).await.ok();
+    let existing = file_service
+        .get_file_by_path(&internal_path, chroot.drive_id)
+        .await
+        .ok();
     let current_etag = existing.as_ref().map(|f| f.etag.as_str());
 
     if let Some(value) = req
@@ -690,7 +748,14 @@ async fn handle_put(
     // Single streaming path — handles both update and create internally,
     // swapping the file row onto the already-ingested blob.
     let stored = upload_service
-        .update_file_streaming(&internal_path, ingested.stored(), &content_type, oc_mtime)
+        .update_file_streaming(
+            &internal_path,
+            chroot.drive_id,
+            ingested.stored(),
+            &content_type,
+            oc_mtime,
+            session.user.id,
+        )
         .await
         .map_err(|e| AppError::internal_error(format!("Failed to store file: {}", e)))?;
 
@@ -712,13 +777,15 @@ async fn handle_put(
 
 async fn handle_mkcol(
     state: Arc<AppState>,
-    user: &CurrentUser,
+    session: &crate::interfaces::nextcloud::session::NcSession,
     subpath: &str,
 ) -> Result<Response<Body>, AppError> {
+    let user = &session.user;
+    let chroot = session.require_chroot()?;
     use crate::application::dtos::folder_dto::CreateFolderDto;
 
     let folder_service = &state.applications.folder_service;
-    let internal_path = nc_to_internal_path(&user.username, subpath)?;
+    let internal_path = nc_to_internal_path(chroot, subpath)?;
 
     // RFC 4918 §9.3.1:
     //   - target already exists                                → 405 Method Not Allowed
@@ -733,7 +800,7 @@ async fn handle_mkcol(
     // auto-create doesn't break real clients.
 
     if folder_service
-        .get_folder_by_path(&internal_path)
+        .get_folder_by_path(&internal_path, chroot.drive_id)
         .await
         .is_ok()
     {
@@ -751,14 +818,21 @@ async fn handle_mkcol(
     }
     let (target_name, parent_segments) = segments.split_last().expect("checked non-empty above");
 
-    let user_root = nc_to_internal_path(&user.username, "")?;
+    // Take POC's `chroot`-based root resolution (drive-aware mount
+    // point) but keep HEAD's parent_path lookup pattern — the
+    // continuation below uses `get_folder_by_path(&parent_path,
+    // user.id)` (user-scoped lookup added in the D0 rewind).
+    let user_root = nc_to_internal_path(chroot, "")?;
     let parent_path = if parent_segments.is_empty() {
         user_root.clone()
     } else {
         format!("{}/{}", user_root, parent_segments.join("/"))
     };
 
-    let parent_folder = match folder_service.get_folder_by_path(&parent_path).await {
+    let parent_folder = match folder_service
+        .get_folder_by_path(&parent_path, chroot.drive_id)
+        .await
+    {
         Ok(folder) => folder,
         Err(_) => {
             return Ok(Response::builder()
@@ -787,17 +861,22 @@ async fn handle_mkcol(
 
 async fn handle_delete(
     state: Arc<AppState>,
-    user: &CurrentUser,
+    session: &crate::interfaces::nextcloud::session::NcSession,
     subpath: &str,
 ) -> Result<Response<Body>, AppError> {
-    let internal_path = nc_to_internal_path(&user.username, subpath)?;
+    let user = &session.user;
+    let chroot = session.require_chroot()?;
+    let internal_path = nc_to_internal_path(chroot, subpath)?;
     let folder_service = &state.applications.folder_service;
     let file_service = &state.applications.file_retrieval_service;
 
     // Prefer soft-delete (move to trash) when trash service is available.
     // This is what Nextcloud clients expect — items appear in the trashbin.
     if let Some(trash_svc) = state.trash_service.as_ref() {
-        if let Ok(folder) = folder_service.get_folder_by_path(&internal_path).await {
+        if let Ok(folder) = folder_service
+            .get_folder_by_path(&internal_path, chroot.drive_id)
+            .await
+        {
             trash_svc
                 .move_to_trash(&folder.id, "folder", user.id)
                 .await
@@ -807,7 +886,10 @@ async fn handle_delete(
                 .body(Body::empty())
                 .unwrap());
         }
-        if let Ok(file) = file_service.get_file_by_path(&internal_path).await {
+        if let Ok(file) = file_service
+            .get_file_by_path(&internal_path, chroot.drive_id)
+            .await
+        {
             trash_svc
                 .move_to_trash(&file.id, "file", user.id)
                 .await
@@ -823,7 +905,10 @@ async fn handle_delete(
     // Fallback: hard delete when trash service is not available.
     let file_mgmt = &state.applications.file_management_service;
 
-    if let Ok(folder) = folder_service.get_folder_by_path(&internal_path).await {
+    if let Ok(folder) = folder_service
+        .get_folder_by_path(&internal_path, chroot.drive_id)
+        .await
+    {
         folder_service
             .delete_folder_with_perms(&folder.id, user.id)
             .await
@@ -835,7 +920,10 @@ async fn handle_delete(
             .unwrap());
     }
 
-    if let Ok(file) = file_service.get_file_by_path(&internal_path).await {
+    if let Ok(file) = file_service
+        .get_file_by_path(&internal_path, chroot.drive_id)
+        .await
+    {
         file_mgmt
             .delete_file_with_perms(&file.id, user.id)
             .await
@@ -855,9 +943,12 @@ async fn handle_delete(
 async fn handle_move(
     state: Arc<AppState>,
     req: Request<Body>,
-    user: &CurrentUser,
+    session: &crate::interfaces::nextcloud::session::NcSession,
     subpath: &str,
 ) -> Result<Response<Body>, AppError> {
+    let user = &session.user;
+    let chroot = session.require_chroot()?;
+    let url_user = &session.raw_username;
     let destination = req
         .headers()
         .get("destination")
@@ -879,10 +970,14 @@ async fn handle_move(
         .unwrap_or(false);
 
     // Parse destination path: extract subpath after /remote.php/dav/files/{user}/
-    let dest_subpath = extract_nc_subpath_from_dest(&destination, &user.username)
+    // — the URL user-segment carries the drive marker on multi-drive
+    // sessions, so we strip the *composite* prefix to find the real
+    // subpath. Using `user.username` here would fail to match for any
+    // request hitting a non-home drive.
+    let dest_subpath = extract_nc_subpath_from_dest(&destination, url_user)
         .ok_or_else(|| AppError::bad_request("Invalid Destination URL"))?;
 
-    let src_internal = nc_to_internal_path(&user.username, subpath)?;
+    let src_internal = nc_to_internal_path(chroot, subpath)?;
     let folder_service = &state.applications.folder_service;
     let file_service = &state.applications.file_retrieval_service;
     let file_mgmt = &state.applications.file_management_service;
@@ -891,13 +986,13 @@ async fn handle_move(
     // Resolved once up-front so the file/folder branches below don't
     // each have to repeat the check. `dest_existed_before` becomes the
     // 204-vs-201 selector at response time.
-    let dest_internal_precheck = nc_to_internal_path(&user.username, &dest_subpath)?;
+    let dest_internal_precheck = nc_to_internal_path(chroot, &dest_subpath)?;
     let dest_existing_file = file_service
-        .get_file_by_path(&dest_internal_precheck)
+        .get_file_by_path(&dest_internal_precheck, chroot.drive_id)
         .await
         .ok();
     let dest_existing_folder = folder_service
-        .get_folder_by_path(&dest_internal_precheck)
+        .get_folder_by_path(&dest_internal_precheck, chroot.drive_id)
         .await
         .ok();
     let dest_existed_before = dest_existing_file.is_some() || dest_existing_folder.is_some();
@@ -940,12 +1035,15 @@ async fn handle_move(
     };
 
     // Try as file first.
-    if let Ok(file) = file_service.get_file_by_path(&src_internal).await {
+    if let Ok(file) = file_service
+        .get_file_by_path(&src_internal, chroot.drive_id)
+        .await
+    {
         let (dest_parent_sub, dest_name) = match dest_subpath.rsplit_once('/') {
             Some((parent, name)) => (parent, name),
             None => ("", dest_subpath.as_str()),
         };
-        let dest_parent_internal = nc_to_internal_path(&user.username, dest_parent_sub)?;
+        let dest_parent_internal = nc_to_internal_path(chroot, dest_parent_sub)?;
 
         // Rename if only the name changes (same parent).
         let src_parent_sub = match subpath.rsplit_once('/') {
@@ -962,7 +1060,7 @@ async fn handle_move(
         } else {
             // Different parent → move.
             let dest_parent = folder_service
-                .get_folder_by_path(&dest_parent_internal)
+                .get_folder_by_path(&dest_parent_internal, chroot.drive_id)
                 .await
                 .map_err(|_| AppError::not_found("Destination folder not found"))?;
 
@@ -981,9 +1079,15 @@ async fn handle_move(
         }
 
         // Return ETag and OC-ETag so Nextcloud clients can track the moved file.
-        let dest_internal = nc_to_internal_path(&user.username, &dest_subpath)?;
+        // Take POC's chroot-based path resolution; keep HEAD's
+        // final_status (201 vs 204 depending on whether the destination
+        // existed — RFC 4918 §9.9.4 distinguishes create vs overwrite).
+        let dest_internal = nc_to_internal_path(chroot, &dest_subpath)?;
         let mut builder = Response::builder().status(final_status);
-        if let Ok(moved) = file_service.get_file_by_path(&dest_internal).await {
+        if let Ok(moved) = file_service
+            .get_file_by_path(&dest_internal, chroot.drive_id)
+            .await
+        {
             // Route through `FileDto::etag` so the MOVE response
             // matches what a subsequent PROPFIND on the destination
             // will return — `moved.id` (UUID) would differ from the
@@ -997,12 +1101,15 @@ async fn handle_move(
     }
 
     // Try as folder.
-    if let Ok(folder) = folder_service.get_folder_by_path(&src_internal).await {
+    if let Ok(folder) = folder_service
+        .get_folder_by_path(&src_internal, chroot.drive_id)
+        .await
+    {
         let (dest_parent_sub, dest_name) = match dest_subpath.rsplit_once('/') {
             Some((parent, name)) => (parent, name),
             None => ("", dest_subpath.as_str()),
         };
-        let dest_parent_internal = nc_to_internal_path(&user.username, dest_parent_sub)?;
+        let dest_parent_internal = nc_to_internal_path(chroot, dest_parent_sub)?;
 
         let src_parent_sub = match subpath.rsplit_once('/') {
             Some((parent, _)) => parent,
@@ -1025,7 +1132,7 @@ async fn handle_move(
         } else {
             // Different parent → move.
             let dest_parent = folder_service
-                .get_folder_by_path(&dest_parent_internal)
+                .get_folder_by_path(&dest_parent_internal, chroot.drive_id)
                 .await
                 .map_err(|_| AppError::not_found("Destination parent not found"))?;
 
@@ -1112,6 +1219,7 @@ fn write_nc_multistatus_open<W: std::io::Write>(xml: &mut Writer<W>) -> Result<(
 async fn write_nc_file_multistatus<W: std::io::Write>(
     writer: W,
     file: &FileDto,
+    url_user: &str,
     username: &str,
     subpath: &str,
     file_id_svc: Option<&Arc<NextcloudFileIdService>>,
@@ -1124,7 +1232,11 @@ async fn write_nc_file_multistatus<W: std::io::Write>(
     write_nc_multistatus_open(&mut xml)?;
 
     // Single-file PROPFIND — subpath already points to the file.
-    let href = nc_href(username, subpath);
+    // `url_user` is the wire identifier (may carry a `~{drive}`
+    // marker); the NC client validates that the returned `<d:href>`
+    // shares the requested URL's prefix. `username` is the canonical
+    // identity for the `oc:owner-id` field.
+    let href = nc_href(url_user, subpath);
     let file_id = file_id_map.get(&file.id).copied();
     let oc_id = file_id.map(|id| format_oc_id(id, file_id_svc));
     write_file_response(
@@ -1530,39 +1642,83 @@ mod tests {
     use super::*;
 
     // ── nc_to_internal_path ──
+    //
+    // The route glue resolves the `chroot` FolderDto once per request
+    // (legacy/home → user's home folder DTO; explicit `~{folder_uuid}` →
+    // folder's stored DTO after permission check). These tests cover only
+    // the path-mapping function itself; the resolver logic lives in
+    // `routes.rs::verify_url_user_and_resolve_chroot`.
 
-    #[test]
-    fn test_empty_subpath_returns_home() {
-        assert_eq!(
-            nc_to_internal_path("alice", "").unwrap(),
-            "My Folder - alice"
-        );
+    /// Build a stub `FolderDto` carrying only the `path` field (all the
+    /// path mapper looks at). Keeps the tests focused on path mapping
+    /// without dragging in folder-construction machinery.
+    fn stub_folder(path: &str) -> FolderDto {
+        FolderDto {
+            id: "00000000-0000-0000-0000-000000000000".to_string(),
+            name: path.rsplit('/').next().unwrap_or("").to_string(),
+            path: path.to_string(),
+            parent_id: None,
+            owner_id: None,
+            // Test stub — path mapper doesn't read drive_id.
+            drive_id: uuid::Uuid::nil(),
+            created_at: 0,
+            modified_at: 0,
+            is_root: false,
+            icon_class: std::sync::Arc::from("fas fa-folder"),
+            icon_special_class: std::sync::Arc::from("folder-icon"),
+            category: std::sync::Arc::from("Folder"),
+            etag: String::new(),
+            // §14 provenance not relevant to path-mapper tests.
+            created_by: None,
+            updated_by: None,
+        }
     }
 
     #[test]
-    fn test_subpath_appended() {
+    fn test_empty_subpath_returns_chroot() {
+        let home = stub_folder("My Folder - alice");
+        assert_eq!(nc_to_internal_path(&home, "").unwrap(), "My Folder - alice");
+    }
+
+    #[test]
+    fn test_subpath_appended_to_chroot() {
+        let home = stub_folder("My Folder - alice");
         assert_eq!(
-            nc_to_internal_path("alice", "Documents/work").unwrap(),
+            nc_to_internal_path(&home, "Documents/work").unwrap(),
             "My Folder - alice/Documents/work"
         );
     }
 
     #[test]
     fn test_strips_surrounding_slashes() {
+        let home = stub_folder("My Folder - alice");
         assert_eq!(
-            nc_to_internal_path("alice", "/Photos/").unwrap(),
+            nc_to_internal_path(&home, "/Photos/").unwrap(),
             "My Folder - alice/Photos"
         );
     }
 
     #[test]
     fn test_rejects_dot_dot_traversal() {
-        assert!(nc_to_internal_path("alice", "../etc/passwd").is_err());
+        let home = stub_folder("My Folder - alice");
+        assert!(nc_to_internal_path(&home, "../etc/passwd").is_err());
     }
 
     #[test]
     fn test_rejects_single_dot() {
-        assert!(nc_to_internal_path("alice", "foo/./bar").is_err());
+        let home = stub_folder("My Folder - alice");
+        assert!(nc_to_internal_path(&home, "foo/./bar").is_err());
+    }
+
+    /// Confines a subfolder chroot (the multi-drive form once
+    /// resolved). Same path-mapping logic — only the chroot differs.
+    #[test]
+    fn test_subfolder_chroot_with_subpath() {
+        let chroot = stub_folder("My Folder - alice/ext");
+        assert_eq!(
+            nc_to_internal_path(&chroot, "report.pdf").unwrap(),
+            "My Folder - alice/ext/report.pdf"
+        );
     }
 
     // ── nc_href ──