feat(sync): add shared deletion ledger and trashed-from-server counter

Introduces DeletionSyncManager which reads and writes a
`deletions.json` ledger on the WebDAV server. When a note is deleted
locally, its id is appended to the ledger so other devices can
distinguish a true purge from a server-side absence.

detectDeletions now accepts a DeletionTracker: a note absent from the
server is hard-deleted locally if its id appears in the ledger with
deletedAt >= updatedAt (timestamp guard prevents stale purge records
from clobbering a legitimately re-created note).

WebDavSyncService seeds the local DeletionTracker from the remote
ledger before each download pass and appends entries after successful
server deletions. The pending-deletions step is extracted into
processPendingServerDeletions for clarity.

Adds trashedDownloadedCount/trashedFromServerCount to DownloadResult
and SyncResult so notes arriving pre-trashed are counted separately
and shown in the sync banner.

Author: inventory69

android/app/src/main/java/dev/dettmer/simplenotes/sync/DeletionSyncManager.kt

@@ -0,0 +1,65 @@
+package dev.dettmer.simplenotes.sync
+
+import com.thegrizzlylabs.sardineandroid.Sardine
+import dev.dettmer.simplenotes.models.DeletionRecord
+import dev.dettmer.simplenotes.models.DeletionTracker
+import dev.dettmer.simplenotes.utils.Constants
+import dev.dettmer.simplenotes.utils.Logger
+
+/**
+ * Synchronises the shared `<syncFolder>/deletions.json` ledger with the server.
+ * Mirrors the FolderSyncManager pattern: all failures are non-fatal.
+ */
+internal class DeletionSyncManager(private val urlBuilder: SyncUrlBuilder) {
+    fun deletionsFileUrl(serverUrl: String): String =
+        urlBuilder.getNotesUrl(serverUrl).trimEnd('/') + "/" + DELETIONS_FILE_NAME
+
+    /** GET deletions.json; 404 or parse error → empty tracker. */
+    fun downloadRemote(sardine: Sardine, url: String): DeletionTracker = try {
+        val exists = when (sardine) {
+            is SafeSardineWrapper -> sardine.exists(url)
+            else -> try {
+                sardine.exists(url)
+            } catch (_: Exception) {
+                false
+            }
+        }
+        if (!exists) {
+            DeletionTracker()
+        } else {
+            sardine.get(url).use { input ->
+                DeletionTracker.fromJson(input.reader().readText()) ?: DeletionTracker()
+            }
+        }
+    } catch (e: Exception) {
+        Logger.w(TAG, "download deletions.json failed (non-fatal): ${e.message}")
+        DeletionTracker()
+    }
+
+    /**
+     * Read-modify-write: adds the deletion record for [noteId], dedupes by id
+     * (keeps newest deletedAt), prunes entries older than [Constants.TRASH_RETENTION_MS],
+     * then PUTs the result back. Best-effort — logs on failure, never throws.
+     */
+    fun appendAndUpload(sardine: Sardine, url: String, noteId: String, deviceId: String) {
+        try {
+            val tracker = downloadRemote(sardine, url)
+            val now = System.currentTimeMillis()
+            val existing = tracker.deletedNotes.find { it.id == noteId }
+            if (existing == null || now > existing.deletedAt) {
+                tracker.deletedNotes.removeIf { it.id == noteId }
+                tracker.deletedNotes.add(DeletionRecord(noteId, now, deviceId))
+            }
+            tracker.deletedNotes.removeIf { now - it.deletedAt > Constants.TRASH_RETENTION_MS }
+            sardine.put(url, tracker.toJson().toByteArray(Charsets.UTF_8), "application/json")
+            Logger.d(TAG, "📝 deletions.json updated: added $noteId, ${tracker.deletedNotes.size} entries")
+        } catch (e: Exception) {
+            Logger.w(TAG, "appendAndUpload deletions.json for $noteId failed (non-fatal): ${e.message}")
+        }
+    }
+
+    companion object {
+        private const val TAG = "DeletionSyncManager"
+        const val DELETIONS_FILE_NAME = "deletions.json"
+    }
+}

android/app/src/main/java/dev/dettmer/simplenotes/sync/NoteDownloader.kt

@@ -29,6 +29,7 @@ internal data class DownloadResult(
     val conflictCount: Int,
     val deletedOnServerCount: Int = 0,
     val folderReconciledCount: Int = 0,
+    val trashedDownloadedCount: Int = 0,
     val downloadFailed: Boolean = false,
     val downloadError: String? = null
 )
@@ -90,6 +91,7 @@ internal class NoteDownloader(
         var conflictCount = 0
         var skippedDeleted = 0 // Track skipped deleted notes
         var folderReconciledCount = 0
+        var trashedDownloadedCount = 0
         val processedIds = mutableSetOf<String>() // 🆕 v1.2.2: Track already loaded notes
 
         Logger.d(TAG, "📥 downloadAll() called:")
@@ -378,7 +380,7 @@ internal class NoteDownloader(
                                     localNote == null -> {
                                         // New note from server
                                         storage.saveNote(remoteNoteFoldered.copy(syncStatus = SyncStatus.SYNCED))
-                                        downloadedCount++
+                                        if (remoteNote.trashedAt == null) downloadedCount++ else trashedDownloadedCount++
                                         Logger.d(TAG, "   ✅ Downloaded from /$activeSyncFolderName/: ${remoteNote.id}")
 
                                         // ⚡ Batch E-Tag for later
@@ -389,7 +391,7 @@ internal class NoteDownloader(
                                     forceOverwrite -> {
                                         // OVERWRITE mode: Always replace regardless of timestamps
                                         storage.saveNote(remoteNoteFoldered.copy(syncStatus = SyncStatus.SYNCED))
-                                        downloadedCount++
+                                        if (remoteNote.trashedAt == null) downloadedCount++ else trashedDownloadedCount++
                                         Logger.d(
                                             TAG,
                                             "   ♻️ Overwritten from /$activeSyncFolderName/: ${remoteNote.id}"
@@ -409,7 +411,7 @@ internal class NoteDownloader(
                                         } else {
                                             // Safe to overwrite
                                             storage.saveNote(remoteNoteFoldered.copy(syncStatus = SyncStatus.SYNCED))
-                                            downloadedCount++
+                                            if (remoteNote.trashedAt == null) downloadedCount++ else trashedDownloadedCount++
                                             Logger.d(TAG, "   ✅ Updated from /$activeSyncFolderName/: ${remoteNote.id}")
 
                                             if (result.etag != null) {
@@ -566,13 +568,13 @@ internal class NoteDownloader(
                             when {
                                 localNote == null -> {
                                     storage.saveNote(remoteNote.copy(syncStatus = SyncStatus.SYNCED))
-                                    downloadedCount++
+                                    if (remoteNote.trashedAt == null) downloadedCount++ else trashedDownloadedCount++
                                     Logger.d(TAG, "   ✅ Downloaded from ROOT: ${remoteNote.id}")
                                 }
                                 forceOverwrite -> {
                                     // OVERWRITE mode: Always replace regardless of timestamps
                                     storage.saveNote(remoteNote.copy(syncStatus = SyncStatus.SYNCED))
-                                    downloadedCount++
+                                    if (remoteNote.trashedAt == null) downloadedCount++ else trashedDownloadedCount++
                                     Logger.d(TAG, "   ♻️ Overwritten from ROOT: ${remoteNote.id}")
                                 }
                                 localNote.updatedAt < remoteNote.updatedAt -> {
@@ -581,7 +583,7 @@ internal class NoteDownloader(
                                         conflictCount++
                                     } else {
                                         storage.saveNote(remoteNote.copy(syncStatus = SyncStatus.SYNCED))
-                                        downloadedCount++
+                                        if (remoteNote.trashedAt == null) downloadedCount++ else trashedDownloadedCount++
                                         Logger.d(TAG, "   ✅ Updated from ROOT: ${remoteNote.id}")
                                     }
                                 }
@@ -623,7 +625,7 @@ internal class NoteDownloader(
 
         // 🆕 v1.8.0: Server-Deletions erkennen (nach Downloads)
         val allLocalNotes = storage.loadAllNotes()
-        val deletedOnServerCount = detectDeletions(serverNoteIds, allLocalNotes)
+        val deletedOnServerCount = detectDeletions(serverNoteIds, allLocalNotes, deletionTracker)
 
         if (deletedOnServerCount > 0) {
             Logger.d(TAG, "$deletedOnServerCount note(s) detected as deleted on server")
@@ -635,6 +637,7 @@ internal class NoteDownloader(
             conflictCount = conflictCount,
             deletedOnServerCount = deletedOnServerCount,
             folderReconciledCount = folderReconciledCount,
+            trashedDownloadedCount = trashedDownloadedCount,
             downloadFailed = downloadException != null,
             downloadError = downloadException?.message
         )
@@ -651,7 +654,11 @@ internal class NoteDownloader(
      * @param localNotes Alle lokalen Notizen
      * @return Anzahl der als DELETED_ON_SERVER markierten Notizen
      */
-    suspend fun detectDeletions(serverNoteIds: Set<String>, localNotes: List<Note>): Int {
+    suspend fun detectDeletions(
+        serverNoteIds: Set<String>,
+        localNotes: List<Note>,
+        deletionTracker: dev.dettmer.simplenotes.models.DeletionTracker = dev.dettmer.simplenotes.models.DeletionTracker()
+    ): Int {
         // 🆕 v2.8.0 (Local-Only Folders): Notizen in lokalen Ordnern nie als server-gelöscht markieren.
         val localOnlyFolders = folderStore.getLocalOnlyFolderNames().map { it.lowercase() }.toSet()
         val syncedNotes = localNotes.filter {
@@ -706,15 +713,17 @@ internal class NoteDownloader(
             // - CONFLICT: Wird separat behandelt
             // - DELETED_ON_SERVER: Bereits markiert
             if (note.id !in serverNoteIds) {
-                if (note.trashedAt != null) {
-                    // 🆕 v2.9.0 (Trash): Die Notiz lag bereits im Papierkorb und ist jetzt auch vom
-                    // Server verschwunden → ein anderes Gerät hat sie endgültig gelöscht (purge).
-                    // Lokal hart löschen; der DeletionTracker-Eintrag verhindert Zombie-Wiederkehr.
+                val purgedRemotely = deletionTracker.isDeleted(note.id) &&
+                    (deletionTracker.getDeletionTimestamp(note.id) ?: 0L) >= note.updatedAt
+                if (note.trashedAt != null || purgedRemotely) {
+                    // 🆕 v2.9.0 (Trash): already trashed + gone from server → purged on another device.
+                    // 🆕 shared ledger: id in deletions.json with deletedAt ≥ updatedAt → hard-delete.
+                    // Timestamp guard preserves a note legitimately re-created after the recorded purge.
                     storage.deleteNote(note.id)
                     Logger.d(
                         TAG,
-                        "🔥 Trashed note '${note.title}' (${note.id}) purged on another device → " +
-                            "hard-deleted locally"
+                        "🔥 Note '${note.title}' (${note.id}) purged remotely → hard-deleted locally" +
+                            if (purgedRemotely && note.trashedAt == null) " (shared ledger)" else ""
                     )
                 } else {
                     // 🆕 v2.9.0 (Trash): Echte Server-Löschung → in den Papierkorb verschieben.

android/app/src/main/java/dev/dettmer/simplenotes/sync/SyncBannerHelper.kt

@@ -18,6 +18,9 @@ fun buildSyncResultBanner(context: Context, result: SyncResult): String? {
         if (result.purgedFromServerCount > 0) {
             add(context.getString(R.string.sync_deleted_from_server_count, result.purgedFromServerCount))
         }
+        if (result.trashedFromServerCount > 0) {
+            add(context.getString(R.string.sync_trashed_from_server_count, result.trashedFromServerCount))
+        }
     }
     return if (parts.isEmpty()) null else parts.joinToString(" · ")
 }

android/app/src/main/java/dev/dettmer/simplenotes/sync/SyncResult.kt

@@ -13,6 +13,7 @@ data class SyncResult(
     val conflictCount: Int = 0,
     val deletedOnServerCount: Int = 0, // 🆕 v1.8.0
     val purgedFromServerCount: Int = 0, // 🆕 v2.9.x (Trash): via „Papierkorb leeren" ausgelöste Server-Löschungen
+    val trashedFromServerCount: Int = 0, // Notizen, die vom Server bereits mit trashedAt ankamen
     val foldersChanged: Boolean = false, // 🆕 v2.7.0 (Folders): Ordner-Metadaten haben sich geändert
     val foldersReconciled: Boolean = false, // 🆕 v2.7.2: folderName einer Notiz an Server-Pfad geheilt
     val errorMessage: String? = null,