pub fn share_cards_at_exchange() -> Result<(), String>Expand description
Before each exchange: each security key read here and not shared yet
from this device is shared once (an existing setup’s first sharing), and
marked so on this device (state/security-keys.toml, never shared);
once marked, a file another device took out (it stopped using the key)
is never made again here by this pass (review of 19 October 2026, F4),
and a file there is written again only when this device’s certificate
adds to it (a renewal the other computer’s older write missed: F5).