TrustedCopy is good enough to allow dropping

By definition, a trusted repository is trusted to always have its location
tracking log accurate. Thus, it should never be in a position where content
is being dropped from it concurrently, as that would result in the location
tracking log not being accurate.

Annex/NumCopies.hs

@@ -104,7 +104,7 @@ verifyEnoughCopies
 	-> [Remote] -- remotes to check to see if they have it
 	-> Annex Bool
 verifyEnoughCopies nolocmsg key need skip preverified tocheck = 
-	helper [] [] (deDupVerifiedCopies preverified) (nub tocheck)
+	helper [] [] preverified (nub tocheck)
   where
 	helper bad missing have []
 		| NumCopies (length have) >= need = return True
@@ -117,7 +117,7 @@ verifyEnoughCopies nolocmsg key need skip preverified tocheck =
 			if verifiedEnoughCopies need stillhave
 				then return True
 				else helper bad missing stillhave (r:rs)
-		| any isFullVerification have = helper bad missing have rs
+		| any safeVerification have = helper bad missing have rs
 		| otherwise = do
 			haskey <- Remote.hasKey r key
 			case haskey of
@@ -128,23 +128,25 @@ verifyEnoughCopies nolocmsg key need skip preverified tocheck =
 {- Check whether enough verification has been done of copies to allow
  - dropping content safely.
  -
- - Unless numcopies is 0, at least one VerifiedCopyLock is required.
- - This prevents races between concurrent drops from dropping the last
- - copy, no matter what.
+ - Unless numcopies is 0, at least one VerifiedCopyLock or TrustedCopy
+ - is required. A VerifiedCopyLock prevents races between concurrent
+ - drops from dropping the last copy, no matter what.
  -
- - The other N-1 copies can be less strong verifications. While those
- - are subject to concurrent drop races, and so could be dropped
- - all at once, causing numcopies to be violated, this is the best that can
- - be done without requiring all special remotes to support locking.
+ - The other N-1 copies can be less strong verifications, like
+ - RecentlyVerifiedCopy. While those are subject to concurrent drop races,
+ - and so could be dropped all at once, causing numcopies to be violated,
+ - this is the best that can be done without requiring all special remotes
+ - to support locking.
  -}
 verifiedEnoughCopies :: NumCopies -> [VerifiedCopy] -> Bool
 verifiedEnoughCopies (NumCopies n) l
 	| n == 0 = True
-	| otherwise = length (deDupVerifiedCopies l) >= n && any isFullVerification l
+	| otherwise = length (deDupVerifiedCopies l) >= n && any safeVerification l
 
-isFullVerification :: VerifiedCopy -> Bool
-isFullVerification (VerifiedCopyLock _) = True
-isFullVerification _ = False
+safeVerification :: VerifiedCopy -> Bool
+safeVerification (VerifiedCopyLock _) = True
+safeVerification (TrustedCopy _) = True
+safeVerification (RecentlyVerifiedCopy _) = False
 
 notEnoughCopies :: Key -> NumCopies -> [VerifiedCopy] -> [UUID] -> [Remote] -> String -> Annex ()
 notEnoughCopies key need have skip bad nolocmsg = do