sioul_sync/

remote.rs

// SPDX-License-Identifier: GPL-3.0-or-later
// Copyright © 2026 Aurélien Pierre

//! The other devices' files fetched from the server too (docs/database.md,
//! "Fetched from the server too"). The sharing folder stays the one a sync app
//! carries, whichever it is; when that folder lives on a WebDAV server Sioul
//! has an account for (Nextcloud, Murena, ownCloud), Sioul also reads it there,
//! in case the sync app is late bringing the others' files, or stops: Murena's
//! eDrive was seen bringing a computer's records an hour and a half late, and
//! its entry among the devices never.
//!
//! - **Found** on the servers of the contacts-and-calendars accounts that keep
//!   files Nextcloud's way (`…/remote.php/dav/files/<user>/`, the user as the
//!   server names it): the place given by hand, else the folder's path from a
//!   phone's storage (eDrive carries it as the cloud's root), from a folder the
//!   Nextcloud client carries (`localPath` → `targetPath`), or its last names.
//! - **Confirmed** only where the server's `seal.toml` is this folder's, byte
//!   for byte: a folder sealed otherwise is never read. Read again when it
//!   changes there, and every six hours.
//! - **Fetched** when the window or the phone's background step asks
//!   (`pull`): `PROPFIND` (`Depth: 1`) on the folder, `devices/`, `leases/` and
//!   each part's claims, a folder whose ETag did not change skipped for ten
//!   minutes; of the other devices' files, only those newer than both the
//!   synced folder's copy and what was fetched before come down, into this
//!   device's own state (`$XDG_STATE_HOME/sioul/share/remote/`, their paths as
//!   in the folder): records from where the copy here ends (its last line
//!   asked again and checked: a copy that does not join comes whole), only
//!   whole lines kept; the rest whole, a few hundred bytes each, kept only when
//!   it came whole. Ten seconds for each wait of the network, thirty for a pull.
//! - **Read** (`overlay`): the sharing reads, for each other device's file, the
//!   newer of the two copies: records the longer (they only grow), notes to
//!   each other, entries and claims by the times they hold. The folder's copy
//!   wins a tie. What was fetched goes once the folder's copy caught up.
//! - **Sent too** (`send`, docs/database.md, "Sent to the server too"): this
//!   device's own files, beside the sync app, each over what is there as it
//!   was seen; found there the same (the sync app sent it), not sent twice;
//!   records never shorter; never another device's file.
//! - **Never**: another device's file written, moved or deleted on the
//!   server; anything written into the synced folder; this device's own files
//!   fetched or read from there; plain HTTP (a test's own stand-in apart); the
//!   password kept or said (it comes from the keyring, as the calendars' sync
//!   has it, for the requests only).

use crate::SyncError;
use crate::dav::{self, DAV};
use serde::{Deserialize, Serialize};
use std::collections::{BTreeMap, BTreeSet};
use std::io::{Read, Seek, SeekFrom, Write};
use std::path::{Path, PathBuf};
use std::sync::Mutex;
use std::time::{Duration, Instant, SystemTime};

/// How long the network may take: each wait (to connect, for the next
/// bytes); a listing or a small file in all; a records' file in all, as long
/// as it moves; a whole pull.
#[derive(Debug, Clone, Copy)]
pub(crate) struct Limits {
    pub(crate) wait: Duration,
    pub(crate) small: Duration,
    pub(crate) large: Duration,
    pub(crate) pull: Duration,
    /// A sealed note or paper, as long as it moves.
    pub(crate) blob: Duration,
    /// A file sent (`Server::put_file`): given `large`, and as long more as
    /// it takes at `floor` bytes a second; cut when nothing moved for `stall`.
    pub(crate) floor: u64,
    pub(crate) stall: Duration,
}

pub(crate) const LIMITS: Limits = Limits { wait: Duration::from_secs(10), small: Duration::from_secs(10), large: Duration::from_secs(60), pull: Duration::from_secs(30), blob: Duration::from_secs(15 * 60), floor: FLOOR, stall: Duration::from_secs(30) };

/// The slowest upload Sioul waits for (bytes a second): a phone's mobile
/// data on 3G sends faster. A 2.5 MB file is given 60 s and 156 s more.
pub const FLOOR: u64 = 16 << 10;

/// Sending this device's files (`send`): a step that sends a large file on a
/// slow line is not cut after thirty seconds, as a pull is; each file is
/// given the time its size asks (`FLOOR`).
pub(crate) const SEND_LIMITS: Limits = Limits { wait: Duration::from_secs(20), small: Duration::from_secs(30), large: Duration::from_secs(60), pull: Duration::from_secs(20 * 60), blob: Duration::from_secs(15 * 60), floor: FLOOR, stall: Duration::from_secs(30) };

/// Looked for again this long after the last look, when not found (seconds).
pub const LOOK_AGAIN: i64 = 6 * 3600;
/// The server's seal read again this long after the last time, even unchanged (seconds).
const SEAL_AGAIN: i64 = 6 * 3600;
/// A folder whose ETag did not change is looked through again after this long all the same (seconds).
const LIST_AGAIN: i64 = 10 * 60;
/// Sioul keeping the folder itself: `blobs/` is listed again at most this
/// long after its last listing, once its ETag changed (seconds): it is for
/// letting go of what the server no longer has, and sending again what it
/// lost of this device's; what is waited for comes by name.
const BLOBS_AGAIN: i64 = 3600;
/// Sioul keeping the folder itself: the sealed files waited for that come
/// down in one step, at most (the first whatever its size).
const MIRROR_WANTED_BYTES: u64 = 64 << 20;
/// A records' file is never fetched past this.
const LARGEST: u64 = 64 << 20;
/// A device's urgent small files (its texts to send, `texts/send/<id>.jsonl`;
/// its replies to send, `phone-messages/ask/<id>.jsonl`) are never fetched past this.
const TEXTS_LARGEST: u64 = 4 << 20;
/// The folders of the urgent small files, each device's own file there
/// (`<top>/<sub>/<id>.jsonl`): its texts to send, its replies to send.
const URGENT: [(&str, &str); 2] = [("texts", "send"), ("phone-messages", "ask")];
/// A listing is never read past this: some 130,000 names, read a response
/// at a time (`read_listing`), never held whole. Until 17 October 2026 a
/// listing was read whole up to 4 MiB, and `blobs/` past some 8,700 sealed
/// files failed every step (review of 17 October 2026, M4).
const LISTING: u64 = 64 << 20;
/// The last line asked again, to check the copy here joins what is there, when shorter than this.
const OVERLAP: u64 = 1 << 20;

const XML: &str = "application/xml; charset=utf-8";
const LIST: &str = r#"<?xml version="1.0" encoding="utf-8"?><d:propfind xmlns:d="DAV:" xmlns:oc="http://owncloud.org/ns"><d:prop><d:resourcetype/><d:getetag/><d:getcontentlength/><oc:checksums/></d:prop></d:propfind>"#;
/// One file's properties (`Server::stat`): a listing's, and its time there.
const STAT: &str = r#"<?xml version="1.0" encoding="utf-8"?><d:propfind xmlns:d="DAV:" xmlns:oc="http://owncloud.org/ns"><d:prop><d:resourcetype/><d:getetag/><d:getcontentlength/><d:getlastmodified/><oc:checksums/></d:prop></d:propfind>"#;
/// Nextcloud's own properties: the checksums a file was sent with (`oc:checksums`).
const OC: &str = "http://owncloud.org/ns";
const PRINCIPAL: &str = r#"<?xml version="1.0" encoding="utf-8"?><d:propfind xmlns:d="DAV:"><d:prop><d:current-user-principal/></d:prop></d:propfind>"#;

// ---------------------------------------------------------------- where

/// Where the backup keeps what it fetched, beside the sharing's memory: `<state>/share/remote/`.
pub fn cache_of(memory: &Path) -> PathBuf {
    memory.with_file_name("remote")
}

/// What the backup knows, beside it: `<state>/share/remote.toml`.
fn state_path(memory: &Path) -> PathBuf {
    memory.with_file_name("remote.toml")
}

fn shown(folder: &Path) -> String {
    folder.display().to_string()
}

/// A server's name, to say where: "murena.io".
pub fn host_of(url: &str) -> String {
    let rest = url.split_once("://").map_or(url, |(_, rest)| rest);
    let authority = rest.split(['/', '?', '#']).next().unwrap_or("");
    authority.rsplit('@').next().unwrap_or("").to_string()
}

// ---------------------------------------------------------------- the state

/// What the backup knows, kept privately beside the sharing's memory
/// (`remote.toml`), never shared. `on`, `given` and `asked` are yours,
/// written only through `State::choose`; the rest is the backup's.
#[derive(Debug, Default, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct State {
    /// Switched on or off here; unsaid, on.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub on: Option<bool>,
    /// The folder's place on the server, given by hand: a path in an
    /// account's files ("Documents/Sioul"), or an address; "" to look by itself.
    #[serde(default, skip_serializing_if = "String::is_empty")]
    pub given: String,
    /// When you asked to look again (Unix seconds).
    #[serde(default)]
    pub asked: i64,
    /// This device's own files sent there too, beside the sync app (`send`):
    /// as switched here, else on wherever the backup is.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub send: Option<bool>,
    /// The sharing folder here it backs.
    #[serde(default, skip_serializing_if = "String::is_empty")]
    pub folder: String,
    /// The account whose server holds it, by its id, and the folder there (an address ending with "/").
    #[serde(default, skip_serializing_if = "String::is_empty")]
    pub account: String,
    #[serde(default, skip_serializing_if = "String::is_empty")]
    pub url: String,
    /// Since when the server's seal is found to be this folder's (Unix seconds); 0: not confirmed.
    #[serde(default)]
    pub confirmed: i64,
    /// When the server's seal was last read and found the same (Unix seconds).
    #[serde(default)]
    pub sealed: i64,
    /// When the folder was last looked for (Unix seconds).
    #[serde(default)]
    pub looked: i64,
    /// When a pull last went through, and was last tried (Unix seconds).
    #[serde(default)]
    pub last: i64,
    #[serde(default)]
    pub tried: i64,
    /// Why nothing is fetched, or the last pull failed, in a code
    /// ("not-found:murena.io", "network:murena.io"); "" when all is well.
    #[serde(default, skip_serializing_if = "String::is_empty")]
    pub said: String,
    /// The other devices' records on the server past what a pull brings
    /// (`LARGEST`), longer there than here, by name, as the last look through
    /// the folder found them: only the sync app brings them, and the pull
    /// alone is not trusted meanwhile (`pulls_well`).
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    pub left: BTreeMap<String, u64>,
    /// This device's entry on the server (`devices/<id>.device`) as a pull
    /// last listed it: its size, and when (Unix seconds). Of another size than
    /// this device last sent, listed after that send, it is an older copy put
    /// back there: looked at again by the next send, and sent over it (`send`).
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub own_entry: Option<(u64, i64)>,
    /// `MIRROR` when Sioul keeps the folder in step itself, no sync app: the
    /// folder here is its own copy (`mirror_of`), the server's is the one the
    /// devices share; "" beside a sync app's folder.
    #[serde(default, skip_serializing_if = "String::is_empty")]
    pub mode: String,
    /// The folder's place in the account's files, as given ("Documents/Sioul"): to say where.
    #[serde(default, skip_serializing_if = "String::is_empty")]
    pub place: String,
    /// Joined through the server's own sign-in (`loginflow`, `MIRROR`): the
    /// login name it gave, whose app password the keyring keeps under that
    /// name on the server (`<user> on <host>`, as an account's). The folder
    /// is then kept with that login, whatever account the contacts and
    /// calendars use; "" when kept with the account's own (`account`). Never
    /// the password.
    #[serde(default, skip_serializing_if = "String::is_empty")]
    pub user: String,
    /// When this device's own files last went up (`MIRROR`, Unix seconds).
    #[serde(default)]
    pub pushed: i64,
    /// The server's files as last fetched, or found here already, by their path in the folder.
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    pub files: BTreeMap<String, Fetched>,
    /// The server's folders as last looked through, by their path ("" the folder itself, "devices/").
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    pub folders: BTreeMap<String, Looked>,
    /// This device's own files as they last went up (`MIRROR`), by their path in the folder.
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    pub sent: BTreeMap<String, Sent>,
    /// When the sealed files swept here as written by a device that no
    /// longer counts were last looked for there (`MIRROR`, `Departed`, Unix
    /// seconds): every six hours at most.
    #[serde(default, skip_serializing_if = "is_zero_i64")]
    pub swept_at: i64,
    /// Sioul keeping the folder itself: a listing of `blobs/` that failed
    /// (too slow, cut), how many in a row, and none tried again before
    /// `blobs_again` (Unix seconds): never at every step.
    #[serde(default, skip_serializing_if = "is_zero_u32")]
    pub blobs_tries: u32,
    #[serde(default, skip_serializing_if = "is_zero_i64")]
    pub blobs_again: i64,
    /// Sioul keeping the folder itself: `blobs/`'s ETag as the last look
    /// through the folder saw it ("-" there without one; "" not there), for
    /// `sealed_step`, which lists it once it changed (`listing_due`).
    #[serde(default, skip_serializing_if = "String::is_empty")]
    pub blobs_seen: String,
}

fn is_zero_u32(n: &u32) -> bool {
    *n == 0
}

fn is_zero_i64(n: &i64) -> bool {
    *n == 0
}

/// A file of the server, as last fetched: its ETag and size there.
#[derive(Debug, Default, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct Fetched {
    #[serde(default)]
    pub etag: String,
    #[serde(default)]
    pub size: u64,
}

/// A folder of the server, as last looked through: its ETag, and when (Unix seconds).
#[derive(Debug, Default, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct Looked {
    #[serde(default)]
    pub etag: String,
    #[serde(default)]
    pub at: i64,
}

/// One of this device's own files as it last went up (`MIRROR`): its size and
/// time here (nanoseconds), its ETag there ("" when the server did not say).
#[derive(Debug, Default, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct Sent {
    #[serde(default)]
    pub size: u64,
    #[serde(default)]
    pub modified: u64,
    #[serde(default)]
    pub etag: String,
}

impl State {
    pub fn load(memory: &Path) -> State {
        std::fs::read_to_string(state_path(memory)).ok().and_then(|text| toml::from_str(&text).ok()).unwrap_or_default()
    }

    fn write(&self, memory: &Path) -> Result<(), String> {
        let text = toml::to_string(self).map_err(|e| e.to_string())?;
        crate::share::write_atomically(&state_path(memory), format!("# Sioul: the sharing folder fetched from its server too (docs/database.md). Never shared.\n{text}").as_bytes())
    }

    /// Written as the backup's work left it, under its lock: what you chose
    /// meanwhile (`on`, `given`, `asked`) kept as the file has it.
    fn save(&self, memory: &Path) -> Result<(), String> {
        let path = state_path(memory);
        sioul_core::filelock::with_lock(&path, || {
            let there = State::load(memory);
            State { on: there.on, given: there.given, asked: there.asked, send: there.send, ..self.clone() }.write(memory)
        })
    }

    /// What a pull found, written over the state as it is now, under its lock:
    /// two processes pull (the window's or an alarm's, and the background
    /// step's), and neither undoes the other. The pull begun later says when
    /// a pull was tried and how it went; the latest that went through is kept;
    /// what was fetched and looked through, each file's and folder's latest;
    /// what is left to the sync app (`left`): as it is now, with what this
    /// pull found left added (new, or at another size) and what it found
    /// brought taken out, from what it knew when it began (`loaded_left`):
    /// another pull's finding meanwhile is
    /// never erased, only a look that finds it brought clears it; the rest
    /// (your choices, the place) as it is now. A place changed meanwhile
    /// (found elsewhere): what this pull found is not that place's, left out.
    /// `ended`: this pull's last moment by the clock it began by (Unix
    /// seconds); one said begun after that began after this pull ended,
    /// which no pull of the other process can: the clock was set back since,
    /// and this pull is the later.
    fn save_pulled(&self, memory: &Path, ended: i64, loaded_left: &BTreeMap<String, u64>) -> Result<(), String> {
        let path = state_path(memory);
        sioul_core::filelock::with_lock(&path, || {
            let mut merged = State::load(memory);
            if (merged.url.as_str(), merged.folder.as_str(), merged.account.as_str()) != (self.url.as_str(), self.folder.as_str(), self.account.as_str()) && !merged.url.is_empty() {
                return Ok(());
            }
            let ours_later = self.tried >= merged.tried || merged.tried > ended;
            let (later, earlier) = if ours_later { (self.clone(), merged.clone()) } else { (merged.clone(), self.clone()) };
            merged.url = later.url.clone();
            merged.folder = later.folder.clone();
            merged.account = later.account.clone();
            merged.tried = later.tried;
            // A time later than this pull's end dates from before the clock was set back: not a later pull.
            merged.last = [later.last, earlier.last].into_iter().filter(|last| *last <= ended).max().unwrap_or(self.last);
            merged.said = later.said.clone();
            merged.confirmed = later.confirmed;
            merged.sealed = later.sealed.max(earlier.sealed);
            merged.files = earlier.files.into_iter().chain(later.files).collect();
            merged.folders = earlier.folders.into_iter().chain(later.folders).collect();
            let brought: Vec<&String> = loaded_left.keys().filter(|name| !self.left.contains_key(*name)).collect();
            merged.left.retain(|name, _| !brought.contains(&name));
            // Found by this pull: new, or found again at another size (grown there since).
            merged.left.extend(self.left.iter().filter(|(name, size)| loaded_left.get(*name) != Some(*size)).map(|(name, size)| (name.clone(), *size)));
            merged.own_entry = [earlier.own_entry, later.own_entry].into_iter().flatten().max_by_key(|(_, at)| *at);
            merged.write(memory)
        })
    }

    /// What you choose (the switch, the place given by hand), changed under its lock.
    pub fn choose(memory: &Path, change: impl FnOnce(&mut State)) -> Result<State, String> {
        let path = state_path(memory);
        sioul_core::filelock::with_lock(&path, || {
            let mut state = State::load(memory);
            change(&mut state);
            state.write(memory)?;
            Ok(state)
        })
    }

    /// Its server's seal was found to be this folder's.
    pub fn confirmed_for(&self, folder: &Path) -> bool {
        self.confirmed > 0 && !self.url.is_empty() && self.folder == shown(folder)
    }

    /// Fetching: as switched here, else on.
    pub fn fetching(&self) -> bool {
        self.on != Some(false)
    }

    /// Pulling from the server works for `folder` beside a sync app: switched
    /// on, the folder confirmed there, a pull gone through and the last one
    /// too (`said` empty). A phone's background step then reads the other
    /// devices' news from its pull alone, the sync app neither asked to look
    /// nor waited for (docs/android.md, "In the background"); otherwise, as
    /// before: the sync app asked, and given twenty seconds.
    pub fn pulls_well(&self, folder: &Path) -> bool {
        self.mode != MIRROR && self.fetching() && self.confirmed_for(folder) && self.last > 0 && self.said.is_empty() && self.left.is_empty()
    }

    /// A pull begun at or after `since` and not after `now` (Unix seconds)
    /// went through, with nothing left on the server that only the sync app
    /// brings: what a dose's or a waking's alarm trusts alone (`alarm_news`).
    /// A pull said begun after now is one from before the clock was set back:
    /// not since, pulled again.
    pub fn went_through_since(&self, folder: &Path, since: i64, now: i64) -> bool {
        self.pulls_well(folder) && (since..=now).contains(&self.last)
    }

    /// Sending this device's own files there too (`send`): with the backup
    /// on, as switched here, else on.
    pub fn sending(&self) -> bool {
        self.fetching() && self.send != Some(false)
    }

    /// The server, by its name: "murena.io".
    pub fn host(&self) -> String {
        host_of(&self.url)
    }

    /// Whether to look for the folder now: asked to (a place given by hand,
    /// the switch turned on), another folder shared here, or not confirmed
    /// and never looked for, or looked for `LOOK_AGAIN` ago.
    pub fn look_due(&self, folder: &Path, now: i64) -> bool {
        self.folder != shown(folder) || self.asked > self.looked || (!self.confirmed_for(folder) && (self.looked == 0 || now - self.looked >= LOOK_AGAIN))
    }
}

// ---------------------------------------------------------------- read here

/// The cache attached to each sharing folder in this process (`attach`), and
/// what that was decided on: the backup's state, this folder's seal, the
/// cache's (their sizes and times).
type Stamp = [Option<(u64, SystemTime)>; 3];
static ATTACHED: Mutex<BTreeMap<PathBuf, (Stamp, Option<PathBuf>)>> = Mutex::new(BTreeMap::new());

fn stamp_of(path: &Path) -> Option<(u64, SystemTime)> {
    std::fs::metadata(path).ok().map(|m| (m.len(), m.modified().unwrap_or(SystemTime::UNIX_EPOCH)))
}

/// The copy fetched for the sharing folder `folder`, read beside it from now
/// on in this process (`overlay`), when there is one for it: its state names
/// this folder, and what was fetched was fetched under this folder's seal
/// (the cache's `seal.toml`, written when the server's was found the same).
/// Cheap when nothing changed; nothing of it needs the network. Returns it.
pub fn attach(folder: &Path, memory: &Path) -> Option<PathBuf> {
    let cache = cache_of(memory);
    let stamp = [stamp_of(&state_path(memory)), stamp_of(&folder.join("seal.toml")), stamp_of(&cache.join("seal.toml"))];
    let mut attached = ATTACHED.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
    if let Some((was, chosen)) = attached.get(folder)
        && *was == stamp
    {
        return chosen.clone();
    }
    let chosen = usable(folder, memory).then_some(cache);
    attached.insert(folder.to_path_buf(), (stamp, chosen.clone()));
    chosen
}

/// The copy fetched for `folder`, when one is attached in this process: the
/// sharing reads, for each other device's file, the newer of the two.
pub fn overlay(folder: &Path) -> Option<PathBuf> {
    ATTACHED.lock().ok()?.get(folder).and_then(|(_, chosen)| chosen.clone())
}

/// The seal of a folder, its bytes: at most a small file's.
fn seal_of(folder: &Path) -> Option<Vec<u8>> {
    let path = folder.join("seal.toml");
    let size = std::fs::metadata(&path).ok()?.len();
    (size <= crate::share::SMALL_FILE).then(|| std::fs::read(&path).ok()).flatten()
}

/// What was fetched for this folder may be read: fetched for it, under its seal.
fn usable(folder: &Path, memory: &Path) -> bool {
    let state = State::load(memory);
    state.mode != MIRROR && state.folder == shown(folder) && seal_of(folder).is_some_and(|here| seal_of(&cache_of(memory)).is_some_and(|fetched| fetched == here))
}

/// Sharing stopped here: what was fetched and known goes, and nothing is read beside the folder.
pub fn forget(memory: &Path, folder: &Path) {
    let _ = std::fs::remove_dir_all(cache_of(memory));
    let _ = std::fs::remove_file(state_path(memory));
    let _ = std::fs::remove_file(crate::blobs::Wanted::path(memory));
    let _ = std::fs::remove_file(Lane::Main.memory(memory));
    let _ = std::fs::remove_file(Lane::Urgent.memory(memory));
    if let Ok(mut attached) = ATTACHED.lock() {
        attached.remove(folder);
    }
}

// ---------------------------------------------------------------- the server

/// An account to fetch with: its id in the configuration, where its server
/// was found (`Account::url`), its login, and its password from the keyring
/// (none kept there): used for the requests only, never kept nor said.
pub struct Login {
    pub account: String,
    pub url: String,
    pub user: String,
    pub password: Option<String>,
}

/// One server, signed in: requests with the account's login, over TLS (plain
/// HTTP only to a test's own stand-in, `dav::allowed`), never redirected. Its
/// requests go through the process's one agent (`dav::shared_agent`): a pull,
/// the sends after it and the next pull reuse one connection while it is
/// open, each request with its own budget (`limits`).
pub(crate) struct Server {
    agent: ureq::Agent,
    authorization: String,
    started: Instant,
    limits: Limits,
    /// Bytes the listings of this step read, for the log (`Pulled::listed_bytes`).
    listed_bytes: std::sync::atomic::AtomicU64,
}

/// A folder of the server, as listed: its own ETag, and what it holds by name.
#[derive(Debug, Default)]
pub(crate) struct Listing {
    pub(crate) etag: String,
    pub(crate) items: BTreeMap<String, Item>,
}

#[derive(Debug, Default, Clone)]
pub(crate) struct Item {
    pub(crate) dir: bool,
    pub(crate) etag: String,
    pub(crate) size: u64,
    /// The checksums the server keeps of it, as it says them ("SHA1:… MD5:…"); "" when none.
    pub(crate) checksum: String,
    /// Its time there (Unix seconds), as the `PUT` that wrote it said it
    /// (`X-OC-Mtime`): asked of one file (`Server::stat`), never in a listing.
    pub(crate) modified: Option<i64>,
}

/// What came of a file asked from a place in it: where it starts, its bytes,
/// whether all came, and why not.
pub(crate) struct Got {
    start: u64,
    bytes: Vec<u8>,
    error: Option<SyncError>,
}

/// A file that did not go (`Server::put_file`): the error, what kind of
/// failure ("timeout", "stalled", "unreachable", "tls", "login", "network"),
/// how long the try lasted (seconds), how many of its bytes went, of how many.
#[derive(Debug)]
pub(crate) struct PutFailed {
    pub(crate) error: SyncError,
    pub(crate) kind: &'static str,
    pub(crate) words: String,
    pub(crate) seconds: u64,
    pub(crate) sent: u64,
    pub(crate) total: u64,
}

/// A body read from memory, counting what went: what a failure says it sent.
struct Counted {
    inner: std::io::Cursor<Vec<u8>>,
    moved: std::sync::Arc<std::sync::atomic::AtomicU64>,
}

impl Read for Counted {
    fn read(&mut self, buf: &mut [u8]) -> std::io::Result<usize> {
        let n = self.inner.read(buf)?;
        self.moved.fetch_add(n as u64, std::sync::atomic::Ordering::Relaxed);
        Ok(n)
    }
}

fn failed(e: &ureq::Error) -> SyncError {
    match e {
        ureq::Error::Tls(_) => SyncError::Tls(e.to_string()),
        _ if format!("{e:?}").starts_with("Rustls") => SyncError::Tls(e.to_string()),
        _ => SyncError::Network(e.to_string()),
    }
}

fn header(response: &ureq::http::Response<ureq::Body>, name: &str) -> Option<String> {
    response.headers().get(name).and_then(|v| v.to_str().ok()).map(str::to_string)
}

impl Server {
    pub(crate) fn new(login: &Login, limits: Limits) -> Result<Server, SyncError> {
        let password = login.password.as_deref().ok_or(SyncError::NoPassword)?;
        Ok(Server {
            agent: dav::shared_agent(),
            authorization: format!("Basic {}", sioul_core::lines::base64_encode(format!("{}:{password}", login.user).as_bytes())),
            started: Instant::now(),
            limits,
            listed_bytes: std::sync::atomic::AtomicU64::new(0),
        })
    }

    pub(crate) fn request(&self, large: bool, method: &str, url: &str, headers: &[(&str, &str)], body: Vec<u8>) -> Result<ureq::http::Response<ureq::Body>, SyncError> {
        self.request_with(if large { self.limits.large } else { self.limits.small }, method, url, headers, body)
    }

    /// A request run with `whole` for all of it, `limits.wait` to connect and
    /// for each read or write (`stalls::ask`, its answer's body read after
    /// included).
    fn request_with(&self, whole: Duration, method: &str, url: &str, headers: &[(&str, &str)], body: Vec<u8>) -> Result<ureq::http::Response<ureq::Body>, SyncError> {
        dav::allowed(url)?;
        if self.started.elapsed() > self.limits.pull {
            return Err(SyncError::Network("out of time".into()));
        }
        let mut request = ureq::http::Request::builder().method(method).uri(url).header("Authorization", &self.authorization).header("User-Agent", "Sioul");
        for (name, value) in headers {
            request = request.header(*name, *value);
        }
        let request = request.body(body).map_err(|e| SyncError::Server(e.to_string()))?;
        let request = self.agent.configure_request(request).timeout_connect(Some(self.limits.wait)).timeout_global(Some(whole)).build();
        crate::stalls::ask(self.limits.wait, false);
        let response = self.agent.run(request).map_err(|e| failed(&e))?;
        if response.status().as_u16() == 401 {
            return Err(SyncError::Login(format!("{method}: 401")));
        }
        Ok(response)
    }

    /// A folder's own ETag and what it holds (`Depth: 1`), by name.
    pub(crate) fn list(&self, url: &str) -> Result<Listing, SyncError> {
        self.list_within(self.limits.small, url)
    }

    /// The same, given `whole` for all of it (a folder of thousands of
    /// sealed files, on a slow line: `limits.large`).
    pub(crate) fn list_within(&self, whole: Duration, url: &str) -> Result<Listing, SyncError> {
        let mut response = self.request_with(whole, "PROPFIND", url, &[("Depth", "1"), ("Content-Type", XML)], LIST.as_bytes().to_vec())?;
        match response.status().as_u16() {
            207 => {}
            404 => return Err(SyncError::NotFound(String::new())),
            status => return Err(SyncError::Server(format!("PROPFIND: {status}"))),
        }
        let reader = response.body_mut().with_config().limit(LISTING).reader();
        let (listing, bytes) = read_listing(reader, url)?;
        self.listed_bytes.fetch_add(bytes, std::sync::atomic::Ordering::Relaxed);
        Ok(listing)
    }

    /// Bytes the listings read so far.
    pub(crate) fn listed_bytes(&self) -> u64 {
        self.listed_bytes.load(std::sync::atomic::Ordering::Relaxed)
    }

    /// One file as the server has it now (`Depth: 0`): its ETag, size,
    /// checksums and time; none when it is not there.
    pub(crate) fn stat(&self, url: &str) -> Result<Option<Item>, SyncError> {
        let mut response = self.request(false, "PROPFIND", url, &[("Depth", "0"), ("Content-Type", XML)], STAT.as_bytes().to_vec())?;
        match response.status().as_u16() {
            207 => {}
            404 => return Ok(None),
            status => return Err(SyncError::Server(format!("PROPFIND: {status}"))),
        }
        let body = response.body_mut().with_config().limit(LISTING).read_to_string().map_err(|e| failed(&e))?;
        let (responses, _) = dav::multistatus(&body)?;
        let sums = checksums(&body, url);
        Ok(responses.first().map(|r| Item {
            dir: r.is(DAV, "collection"),
            etag: r.text(DAV, "getetag").unwrap_or_default(),
            size: r.text(DAV, "getcontentlength").and_then(|t| t.parse().ok()).unwrap_or(0),
            checksum: sums.get(&dav::path_key(&dav::absolute(url, &r.href))).cloned().unwrap_or_default(),
            modified: r.text(DAV, "getlastmodified").and_then(|t| jiff::fmt::rfc2822::DateTimeParser::new().parse_timestamp(t.trim()).ok()).map(|t| t.as_second()),
        }))
    }

    /// One of this device's files sent whole beside a sync app (`send`): over
    /// what is there as it was seen (`If-Match` its ETag, `If-None-Match: *`
    /// when none was there), dated as the file here (`X-OC-Mtime`), with its
    /// SHA-1 (`OC-Checksum`): a Nextcloud client finding the same file there
    /// as here, same size, date and checksum, takes it as its own, without a
    /// download and without a conflicted copy. Its status, and its ETag there.
    ///
    /// Given the time its size asks: `limits.large`, and as long more as it
    /// takes at `limits.floor` bytes a second (a file still moving is not cut
    /// at a flat minute); cut when nothing moved for `limits.stall`. Failed:
    /// why, how long it lasted and how many of its bytes went (`PutFailed`).
    pub(crate) fn put_file(&self, url: &str, body: Vec<u8>, seen: Option<&str>, modified_s: u64, sha1: &str) -> Result<(u16, Option<String>), PutFailed> {
        let total = body.len() as u64;
        let started = Instant::now();
        let gave_up = |error: SyncError, kind: &'static str, sent: u64| PutFailed { words: error.to_string(), error, kind, seconds: started.elapsed().as_millis().div_ceil(1000) as u64, sent, total };
        dav::allowed(url).map_err(|e| gave_up(e, "refused", 0))?;
        if self.started.elapsed() > self.limits.pull {
            return Err(gave_up(SyncError::Network("out of time".into()), "out-of-time", 0));
        }
        let precondition = match seen.filter(|etag| !etag.is_empty()) {
            Some(etag) => ("If-Match", etag),
            None => ("If-None-Match", "*"),
        };
        let whole = self.limits.large + Duration::from_secs(total / self.limits.floor.max(1));
        let moved = std::sync::Arc::new(std::sync::atomic::AtomicU64::new(0));
        let reader = Counted { inner: std::io::Cursor::new(body), moved: std::sync::Arc::clone(&moved) };
        let request = ureq::http::Request::builder()
            .method("PUT")
            .uri(url)
            .header("Authorization", &self.authorization)
            .header("User-Agent", "Sioul")
            .header(precondition.0, precondition.1)
            .header("Content-Type", "application/octet-stream")
            .header("Content-Length", total.to_string())
            .header("X-OC-Mtime", modified_s.to_string())
            .header("OC-Checksum", format!("SHA1:{sha1}"))
            .body(ureq::SendBody::from_owned_reader(reader))
            .map_err(|e| gave_up(SyncError::Server(e.to_string()), "server", 0))?;
        // Given `whole`, each write `limits.stall` at most; the answer awaited
        // within `whole` alone while the last bytes drain from the system's
        // buffers on a slow uplink.
        let request = self.agent.configure_request(request).timeout_connect(Some(self.limits.wait)).timeout_global(Some(whole)).build();
        crate::stalls::ask(self.limits.stall, true);
        match self.agent.run(request) {
            Ok(response) if response.status().as_u16() == 401 => Err(gave_up(SyncError::Login("PUT: 401".into()), "login", moved.load(std::sync::atomic::Ordering::Relaxed))),
            Ok(response) => Ok((response.status().as_u16(), header(&response, "ETag").or_else(|| header(&response, "OC-ETag")))),
            Err(e) => {
                let sent = moved.load(std::sync::atomic::Ordering::Relaxed);
                let kind = match &e {
                    ureq::Error::Timeout(ureq::Timeout::Connect | ureq::Timeout::Resolve) | ureq::Error::ConnectionFailed | ureq::Error::HostNotFound => "unreachable",
                    // Nothing moved for `stall`, well before the time given.
                    ureq::Error::Timeout(_) | ureq::Error::Io(_) if started.elapsed() + Duration::from_secs(2) < whole && sent > 0 => "stalled",
                    ureq::Error::Timeout(_) => "timeout",
                    ureq::Error::Tls(_) => "tls",
                    _ if format!("{e:?}").starts_with("Rustls") => "tls",
                    _ => "network",
                };
                Err(gave_up(failed(&e), kind, sent))
            }
        }
    }

    /// A small file whole (`share::SMALL_FILE` at most) and its ETag; none
    /// when it is not there, or larger than any such file. A body that came
    /// cut, or whose end cannot be told, is an error: never taken as whole.
    pub(crate) fn small(&self, url: &str) -> Result<Option<(Vec<u8>, Option<String>)>, SyncError> {
        self.small_up_to(url, crate::share::SMALL_FILE)
    }

    /// The same, at most `cap` bytes (a texts' file may grow past a small file's).
    pub(crate) fn small_up_to(&self, url: &str, cap: u64) -> Result<Option<(Vec<u8>, Option<String>)>, SyncError> {
        let mut response = self.request(false, "GET", url, &[("Accept-Encoding", "identity")], Vec::new())?;
        match response.status().as_u16() {
            200 => {}
            404 | 410 => return Ok(None),
            status => return Err(SyncError::Server(format!("GET: {status}"))),
        }
        let etag = header(&response, "ETag");
        let length = response.body().content_length();
        let chunked = header(&response, "Transfer-Encoding").is_some_and(|t| t.to_ascii_lowercase().contains("chunked"));
        if length.is_some_and(|l| l > cap) {
            return Ok(None);
        }
        let bytes = match response.body_mut().with_config().limit(cap).read_to_vec() {
            Ok(bytes) => bytes,
            Err(ureq::Error::BodyExceedsLimit(_)) => return Ok(None),
            Err(e) => return Err(failed(&e)),
        };
        if !(length == Some(bytes.len() as u64) || (length.is_none() && chunked)) {
            return Err(SyncError::Network("GET: cut".into()));
        }
        Ok(Some((bytes, etag)))
    }

    /// A file from `from` on (all of it from 0): where what came starts (0
    /// when the server sent it all), what came as it came, and why the rest
    /// did not; none when it is not there, or shorter than `from` now.
    fn tail(&self, url: &str, from: u64) -> Result<Option<Got>, SyncError> {
        let range = format!("bytes={from}-");
        let mut headers = vec![("Accept-Encoding", "identity")];
        if from > 0 {
            headers.push(("Range", range.as_str()));
        }
        let mut response = self.request(true, "GET", url, &headers, Vec::new())?;
        let start = match response.status().as_u16() {
            200 => 0,
            206 => {
                // "bytes 100-199/200".
                let said = header(&response, "Content-Range").unwrap_or_default();
                said.trim().strip_prefix("bytes").and_then(|r| r.trim().split('-').next()).and_then(|s| s.trim().parse().ok()).ok_or_else(|| SyncError::Server(format!("GET: Content-Range {said}")))?
            }
            404 | 410 | 416 => return Ok(None),
            status => return Err(SyncError::Server(format!("GET: {status}"))),
        };
        let length = response.body().content_length();
        let mut reader = response.body_mut().with_config().limit(LARGEST).reader();
        let mut bytes = Vec::new();
        let mut piece = vec![0u8; 64 << 10];
        let mut error = loop {
            match reader.read(&mut piece) {
                Ok(0) => break None,
                Ok(n) => bytes.extend_from_slice(&piece[..n]),
                Err(e) => break Some(SyncError::Network(e.to_string())),
            }
        };
        if error.is_none() && length.is_some_and(|l| l != bytes.len() as u64) {
            error = Some(SyncError::Network("GET: cut".into()));
        }
        Ok(Some(Got { start, bytes, error }))
    }

    /// A file sent whole (`PUT`), over what is there as it was seen: `If-Match`
    /// its ETag, or `If-None-Match: *` when none was there. Its status, and its
    /// ETag there when the server says it.
    pub(crate) fn put(&self, url: &str, body: Vec<u8>, seen: Option<&str>) -> Result<(u16, Option<String>), SyncError> {
        let precondition = match seen {
            Some(etag) => ("If-Match", etag),
            None => ("If-None-Match", "*"),
        };
        let response = self.request(true, "PUT", url, &[precondition, ("Content-Type", "application/octet-stream")], body)?;
        Ok((response.status().as_u16(), header(&response, "ETag").or_else(|| header(&response, "OC-ETag"))))
    }

    /// A folder made (`MKCOL`): 201 made, 405 there already.
    pub(crate) fn mkcol(&self, url: &str) -> Result<u16, SyncError> {
        Ok(self.request(false, "MKCOL", url, &[], Vec::new())?.status().as_u16())
    }

    /// One of this device's files taken out (`DELETE`), only as it was seen (`If-Match`) when its ETag is known.
    pub(crate) fn delete(&self, url: &str, seen: Option<&str>) -> Result<u16, SyncError> {
        let headers: Vec<(&str, &str)> = seen.map(|etag| vec![("If-Match", etag)]).unwrap_or_default();
        Ok(self.request(false, "DELETE", url, &headers, Vec::new())?.status().as_u16())
    }

    /// A file's ETag there now (`Depth: 0`); none when it is not there.
    pub(crate) fn etag(&self, url: &str) -> Result<Option<String>, SyncError> {
        let mut response = self.request(false, "PROPFIND", url, &[("Depth", "0"), ("Content-Type", XML)], LIST.as_bytes().to_vec())?;
        match response.status().as_u16() {
            207 => {}
            404 => return Ok(None),
            status => return Err(SyncError::Server(format!("PROPFIND: {status}"))),
        }
        let body = response.body_mut().with_config().limit(LISTING).read_to_string().map_err(|e| failed(&e))?;
        let (responses, _) = dav::multistatus(&body)?;
        Ok(responses.first().map(|r| r.text(DAV, "getetag").unwrap_or_default()))
    }

    /// A file fetched whole into `path`, under a hidden name beside it, then
    /// renamed once all of it came (its length said, or chunked to its end),
    /// at most `limit` bytes, as long as it moves (`Limits::blob`). Its size;
    /// none when it is not there, or larger.
    pub(crate) fn download(&self, url: &str, path: &Path, limit: u64) -> Result<Option<u64>, SyncError> {
        let Some((size, temporary)) = self.download_aside(url, path, limit)? else { return Ok(None) };
        if let Err(e) = std::fs::rename(&temporary, path) {
            let _ = std::fs::remove_file(&temporary);
            return Err(SyncError::Disk(format!("{}: {e}", path.display())));
        }
        Ok(Some(size))
    }

    /// The same, left under its hidden name beside `path` once all of it
    /// came (`share::temporary`: a crash's leftover is cleaned as any): its
    /// size and that name, for the caller to put in its place.
    pub(crate) fn download_aside(&self, url: &str, path: &Path, limit: u64) -> Result<Option<(u64, PathBuf)>, SyncError> {
        let mut response = self.request_with(self.limits.blob, "GET", url, &[("Accept-Encoding", "identity")], Vec::new())?;
        match response.status().as_u16() {
            200 => {}
            404 | 410 => return Ok(None),
            status => return Err(SyncError::Server(format!("GET: {status}"))),
        }
        let length = response.body().content_length();
        let chunked = header(&response, "Transfer-Encoding").is_some_and(|t| t.to_ascii_lowercase().contains("chunked"));
        if length.is_some_and(|l| l > limit) {
            return Ok(None);
        }
        if length.is_none() && !chunked {
            return Err(SyncError::Network("GET: its end cannot be told".into()));
        }
        let temporary = crate::share::temporary(path);
        let disk = |e: std::io::Error| SyncError::Disk(format!("{}: {e}", path.display()));
        let written = (|| -> Result<u64, SyncError> {
            if let Some(parent) = path.parent() {
                crate::share::private_dirs(parent).map_err(disk)?;
            }
            let mut out = crate::share::new_private(&temporary).map_err(disk)?;
            let mut reader = response.body_mut().with_config().limit(limit).reader();
            let copied = std::io::copy(&mut reader, &mut out).map_err(|e| SyncError::Network(e.to_string()))?;
            if length.is_some_and(|l| l != copied) {
                return Err(SyncError::Network("GET: cut".into()));
            }
            out.sync_all().map_err(disk)?;
            Ok(copied)
        })();
        if written.is_err() {
            let _ = std::fs::remove_file(&temporary);
        }
        written.map(|size| Some((size, temporary)))
    }
}

/// A path in a folder of the server as an address's: each name percent-encoded ("Mes documents/Sioul" → "Mes%20documents/Sioul").
pub(crate) fn encode_path(path: &str) -> String {
    path.split('/')
        .map(|name| name.bytes().map(|b| if b.is_ascii_alphanumeric() || b"-._~".contains(&b) { (b as char).to_string() } else { format!("%{b:02X}") }).collect::<String>())
        .collect::<Vec<_>>()
        .join("/")
}

/// A folder's listing read as it comes, a response at a time: each
/// `<response>` taken out of what came, read on its own (wrapped in the
/// namespaces the answer's first element declares), then dropped; what is
/// kept per name is its ETag, size and checksums. Its bytes too. Never more
/// than one response and a read's piece held at once, whatever the size of
/// the folder (review of 17 October 2026, M4). Whole only with the folder's
/// own response and the answer's last element closed: a listing that leaves
/// the folder out, or ends early, is no listing (review of 18 October 2026,
/// L-1 and L-6).
fn read_listing(mut reader: impl std::io::Read, url: &str) -> Result<(Listing, u64), SyncError> {
    let me = dav::path_key(url);
    let mut listing = Listing::default();
    let mut itself = false;
    let (mut buf, mut total, mut piece) = (Vec::new(), 0u64, vec![0u8; 64 << 10]);
    let mut namespaces: Option<String> = None;
    loop {
        let n = reader.read(&mut piece).map_err(|e| SyncError::Network(format!("PROPFIND: {e}")))?;
        total += n as u64;
        buf.extend_from_slice(&piece[..n]);
        if namespaces.is_none() {
            match first_element(&buf) {
                Some((declared, end)) => {
                    namespaces = Some(declared);
                    buf.drain(..end);
                }
                None if n == 0 => return Err(SyncError::Server("XML: no element".into())),
                None => continue,
            }
        }
        let declared = namespaces.as_deref().unwrap_or_default();
        let mut from = 0;
        while let Some(end) = response_end(&buf[from..]) {
            let chunk = std::str::from_utf8(&buf[from..from + end]).map_err(|e| SyncError::Server(format!("XML: {e}")))?;
            // What stands before the response's opening (spaces, the end of the one before) is passed over.
            let start = chunk.find('<').unwrap_or(0);
            let xml = format!("<listing{declared}>{}</listing>", &chunk[start..]);
            let (responses, _) = dav::multistatus(&xml)?;
            let sums = checksums(&xml, url);
            for response in responses {
                let path = dav::path_key(&dav::absolute(url, &response.href));
                let etag = response.text(DAV, "getetag").unwrap_or_default();
                if path == me {
                    listing.etag = etag;
                    itself = true;
                    continue;
                }
                let Some(name) = path.strip_prefix(&me).and_then(|rest| rest.strip_prefix('/')).filter(|n| !n.is_empty() && !n.contains('/')) else { continue };
                let size = response.text(DAV, "getcontentlength").and_then(|t| t.parse().ok()).unwrap_or(0);
                listing.items.insert(name.to_string(), Item { dir: response.is(DAV, "collection"), etag, size, checksum: sums.get(&path).cloned().unwrap_or_default(), modified: None });
            }
            from += end;
        }
        buf.drain(..from);
        if n == 0 {
            // Its last element closed, or the answer ended early: never a part taken for the whole.
            if end_tag(&buf, b"multistatus").is_none() {
                return Err(SyncError::Server("XML: the answer ends before its end".into()));
            }
            // The folder's own response missing: what it holds cannot be told whole.
            if !itself {
                return Err(SyncError::Server("XML: the folder's own answer is missing".into()));
            }
            return Ok((listing, total));
        }
    }
}

/// The namespaces an answer's first element declares (` xmlns:d="DAV:"…`,
/// as written), and where that element's opening ends; none until it all came.
fn first_element(buf: &[u8]) -> Option<(String, usize)> {
    let mut at = 0;
    loop {
        let open = at + buf[at..].iter().position(|b| *b == b'<')?;
        let close = open + buf[open..].iter().position(|b| *b == b'>')?;
        let tag = std::str::from_utf8(&buf[open..=close]).ok()?;
        if tag.starts_with("<?") || tag.starts_with("<!") {
            at = close + 1;
            continue;
        }
        let mut declared = String::new();
        let mut rest = tag;
        while let Some(found) = rest.find(" xmlns").or_else(|| rest.find("\nxmlns")).or_else(|| rest.find("\txmlns")) {
            let attribute = &rest[found..];
            let quote_at = attribute.find(['"', '\''])?;
            let quote = attribute.as_bytes()[quote_at] as char;
            let value_end = quote_at + 1 + attribute[quote_at + 1..].find(quote)?;
            declared.push(' ');
            declared.push_str(attribute[..=value_end].trim_start());
            rest = &attribute[value_end + 1..];
        }
        return Some((declared, close + 1));
    }
}

/// Where the first whole `<response>` of what came ends (after its closing
/// tag, whatever its prefix: `</d:response>`, `</D:response>`, `</response>`).
fn response_end(buf: &[u8]) -> Option<usize> {
    end_tag(buf, b"response")
}

/// Where the first end tag of `name` in `buf` ends (`</name>`, `</d:name>`,
/// spaces allowed before its `>`, as XML allows: `</d:response >`); none
/// until all of one came.
fn end_tag(buf: &[u8], name: &[u8]) -> Option<usize> {
    let mut from = 0;
    while let Some(found) = buf[from..].windows(name.len()).position(|w| w == name) {
        let at = from + found;
        // Its end: spaces maybe, then `>`; not all of it come yet: none so far.
        let close = at + name.len() + buf[at + name.len()..].iter().position(|b| !b.is_ascii_whitespace())?;
        // Back to the `<` of that tag: `</`, maybe a prefix and its colon.
        if buf[close] == b'>'
            && let Some(open) = buf[..at].iter().rposition(|b| *b == b'<')
        {
            let between = &buf[open + 1..at];
            if between.first() == Some(&b'/') && between[1..].iter().all(|b| b.is_ascii_alphanumeric() || matches!(b, b'_' | b'-' | b'.' | b':')) && (between.len() == 1 || between.last() == Some(&b':')) {
                return Some(close + 1);
            }
        }
        from = at + name.len();
    }
    None
}

/// The checksums a multistatus says (`oc:checksums`, Nextcloud's), by the
/// path of each response: "SHA1:… MD5:… ADLER32:…".
fn checksums(body: &str, url: &str) -> BTreeMap<String, String> {
    let Ok(doc) = roxmltree::Document::parse(body) else { return BTreeMap::new() };
    doc.descendants()
        .filter(|n| n.has_tag_name((DAV, "response")))
        .filter_map(|response| {
            let href = response.children().find(|c| c.has_tag_name((DAV, "href")))?.text()?.trim().to_string();
            let sums = response.descendants().filter(|n| n.has_tag_name((OC, "checksum"))).filter_map(|n| n.text()).map(str::trim).filter(|t| !t.is_empty()).collect::<Vec<_>>().join(" ");
            (!sums.is_empty()).then(|| (dav::path_key(&dav::absolute(url, &href)), sums))
        })
        .collect()
}

/// A content's SHA-1, in lower case hexadecimal, as `OC-Checksum` says it.
fn sha1_hex(bytes: &[u8]) -> String {
    use sha1::Digest;
    sha1::Sha1::digest(bytes).iter().map(|b| format!("{b:02x}")).collect()
}

/// The SHA-1 among checksums as a server says them ("SHA1:ab12… MD5:…"), in lower case.
fn sha1_of(checksums: &str) -> Option<String> {
    checksums.split_whitespace().find_map(|sum| sum.split_once(':').filter(|(kind, _)| kind.eq_ignore_ascii_case("sha1")).map(|(_, hex)| hex.to_ascii_lowercase()))
}

/// Why, in a code the window says in words: "login:murena.io".
fn code(error: &SyncError, host: &str) -> String {
    let kind = match error {
        SyncError::Login(_) | SyncError::AppPassword(_) => "login",
        SyncError::Tls(_) => "tls",
        SyncError::Network(_) => "network",
        SyncError::NoPassword => "no-password",
        SyncError::Disk(_) => "disk",
        SyncError::Server(d) if d == "quota" => "quota",
        _ => "server",
    };
    format!("{kind}:{host}")
}

/// Where an account's files are on its server, Nextcloud's way
/// (`…/remote.php/dav/files/<user>/`, the user as the server names it in its
/// principal), from the address its calendars were found at; none for a
/// server of another kind. On that server only: a principal named on another
/// is refused (`SyncError::Elsewhere`), since every request there would carry
/// the account's login.
pub(crate) fn files_root(server: &Server, login: &Login) -> Result<Option<String>, SyncError> {
    let Some(at) = login.url.find("/remote.php/") else { return Ok(None) };
    let base = format!("{}/remote.php/dav/", &login.url[..at]);
    let mut response = server.request(false, "PROPFIND", &base, &[("Depth", "0"), ("Content-Type", XML)], PRINCIPAL.as_bytes().to_vec())?;
    if response.status().as_u16() != 207 {
        return Ok(None);
    }
    let body = response.body_mut().with_config().limit(LISTING).read_to_string().map_err(|e| failed(&e))?;
    let (responses, _) = dav::multistatus(&body)?;
    let principal = responses.iter().find_map(|r| r.prop(DAV, "current-user-principal").and_then(|p| p.hrefs.first().cloned()));
    let root = principal.and_then(|href| {
        let at = href.find("/principals/users/")?;
        let user = href[at + "/principals/users/".len()..].trim_end_matches('/');
        (!user.is_empty() && !user.contains('/')).then(|| dav::absolute(&base, &format!("{}/files/{user}/", &href[..at])))
    });
    match root {
        Some(root) if dav::origin(&root).is_none() || dav::origin(&root) != dav::origin(&base) => Err(SyncError::Elsewhere(root)),
        root => Ok(root),
    }
}

// ---------------------------------------------------------------- finding it

/// Where a folder may be on a server, as paths in an account's files, the
/// likeliest first: on a phone, its path from the storage, which eDrive
/// carries as the cloud's root (`/storage/emulated/0/Documents/Sioul` →
/// `Documents/Sioul`), or from the Nextcloud app's own folder; under a folder
/// the Nextcloud client carries (`nextcloud`: its `nextcloud.cfg`, as text),
/// the same under its `targetPath`; then its last one, two and three names.
pub fn places(folder: &Path, nextcloud: &[String]) -> Vec<String> {
    let text = folder.to_string_lossy().replace('\\', "/");
    let text = text.trim_end_matches('/');
    let mut out: Vec<String> = Vec::new();
    for storage in ["/storage/emulated/0", "/sdcard", "/storage/self/primary", "/mnt/sdcard", "/mnt/user/0/primary"] {
        let Some(rest) = text.strip_prefix(storage).and_then(|r| r.strip_prefix('/')) else { continue };
        // The Nextcloud app's own: Android/media/com.nextcloud.client/nextcloud/<account>/<path>.
        match rest.strip_prefix("Android/media/com.nextcloud.client/nextcloud/").and_then(|r| r.split_once('/')) {
            Some((_, inside)) => out.push(inside.to_string()),
            None if !rest.starts_with("Android/") => out.push(rest.to_string()),
            None => {}
        }
    }
    for config in nextcloud {
        out.extend(nextcloud_places(text, config));
    }
    let names: Vec<&str> = text.rsplit('/').filter(|n| !n.is_empty()).take(3).collect();
    for n in 1..=names.len() {
        out.push(names[..n].iter().rev().copied().collect::<Vec<_>>().join("/"));
    }
    let mut seen = BTreeSet::new();
    out.into_iter().map(|p| p.trim_matches('/').to_string()).filter(|p| !p.is_empty() && seen.insert(p.clone())).collect()
}

/// The places a Nextcloud client's configuration gives a folder: under one of
/// its `localPath`, the same under that folder's `targetPath`
/// ("0\Folders\1\localPath=/home/me/Nextcloud/", "0\Folders\1\targetPath=/").
fn nextcloud_places(folder: &str, config: &str) -> Vec<String> {
    let mut local: BTreeMap<&str, &str> = BTreeMap::new();
    let mut target: BTreeMap<&str, &str> = BTreeMap::new();
    for line in config.lines() {
        let Some((key, value)) = line.split_once('=') else { continue };
        if let Some(prefix) = key.trim().strip_suffix("localPath") {
            local.insert(prefix, value.trim());
        } else if let Some(prefix) = key.trim().strip_suffix("targetPath") {
            target.insert(prefix, value.trim());
        }
    }
    local
        .into_iter()
        .filter_map(|(prefix, root)| {
            let root = root.trim_end_matches('/');
            let rest = folder.strip_prefix(root).filter(|r| !root.is_empty() && (r.is_empty() || r.starts_with('/')))?;
            Some(format!("{}/{}", target.get(prefix)?.trim_matches('/'), rest.trim_matches('/')))
        })
        .collect()
}

/// Looks for the sharing folder on the accounts' servers: the place given by
/// hand alone when there is one (`State::given`), else `places` under each
/// account's files. Confirmed only where the server's `seal.toml` is this
/// folder's, byte for byte; a folder sealed otherwise is never used. The
/// state, saved, says what was found, or why nothing was.
pub fn find(memory: &Path, folder: &Path, logins: &[Login], places: &[String], now: i64) -> State {
    find_with(memory, folder, logins, places, now, LIMITS)
}

pub(crate) fn find_with(memory: &Path, folder: &Path, logins: &[Login], places: &[String], now: i64, limits: Limits) -> State {
    let mut state = State::load(memory);
    // Sioul keeping the folder itself: nothing to look for.
    if state.mode == MIRROR {
        return state;
    }
    if state.folder != shown(folder) {
        // Another folder: what was fetched for the last one goes.
        let _ = std::fs::remove_dir_all(cache_of(memory));
        state = State { on: state.on, given: state.given.clone(), asked: state.asked, send: state.send, folder: shown(folder), ..State::default() };
    }
    state.looked = now;
    state.confirmed = 0;
    let Some(seal) = seal_of(folder) else {
        state.said = "no-seal".into();
        let _ = state.save(memory);
        return state;
    };
    let given = state.given.trim().to_string();
    let mut said: Vec<String> = Vec::new();
    let mut looked_on: Vec<String> = Vec::new();
    for login in logins {
        let host = host_of(&login.url);
        // Given as an address: on its own server only.
        if given.contains("://") && host_of(&given) != host {
            continue;
        }
        let server = match Server::new(login, limits) {
            Ok(server) => server,
            Err(e) => {
                said.push(code(&e, &login.account));
                continue;
            }
        };
        let urls: Vec<String> = if given.contains("://") {
            vec![format!("{}/", given.trim_end_matches('/'))]
        } else {
            let root = match files_root(&server, login) {
                Ok(Some(root)) => root,
                Ok(None) => continue,
                Err(e) => {
                    said.push(code(&e, &host));
                    continue;
                }
            };
            let wanted: Vec<String> = if given.is_empty() { places.to_vec() } else { vec![given.trim_matches('/').to_string()] };
            wanted.iter().filter(|p| !p.is_empty()).map(|p| format!("{root}{}/", encode_path(p))).collect()
        };
        if !looked_on.contains(&host) {
            looked_on.push(host.clone());
        }
        for url in urls {
            match server.small(&format!("{url}seal.toml")) {
                Ok(Some((bytes, etag))) if bytes == seal => {
                    confirm(&mut state, memory, login, &url, &seal, etag, now);
                    let _ = state.save(memory);
                    return state;
                }
                Ok(Some(_)) => said.push(format!("seal-differs:{host}")),
                Ok(None) => {}
                Err(e) => {
                    said.push(code(&e, &host));
                    // A refused password is not tried again and again (it could lock the account); a network down neither.
                    if e.is_lasting() || matches!(e, SyncError::Network(_)) {
                        break;
                    }
                }
            }
        }
    }
    // The likeliest reason first: a folder sealed otherwise, then what you can mend.
    let rank = |code: &String| ["seal-differs:", "login:", "no-password:", "tls:", "network:", "server:", "disk:"].iter().position(|p| code.starts_with(p)).unwrap_or(9);
    said.sort_by_key(rank);
    state.said = match said.into_iter().next() {
        Some(why) => why,
        None if looked_on.is_empty() && given.contains("://") => format!("no-account-for:{}", host_of(&given)),
        None if looked_on.is_empty() => "no-account".into(),
        None => format!("not-found:{}", looked_on.join(", ")),
    };
    let _ = state.save(memory);
    state
}

/// The folder found at `url`: confirmed, its seal kept in the cache, which
/// holds what was fetched under that seal only.
fn confirm(state: &mut State, memory: &Path, login: &Login, url: &str, seal: &[u8], etag: Option<String>, now: i64) {
    let cache = cache_of(memory);
    if seal_of(&cache).as_deref() != Some(seal) {
        let _ = std::fs::remove_dir_all(&cache);
        state.files.clear();
        state.folders.clear();
    }
    if state.url != url {
        state.files.clear();
        state.folders.clear();
    }
    let _ = crate::share::write_atomically(&cache.join("seal.toml"), seal);
    state.account = login.account.clone();
    state.url = url.to_string();
    state.confirmed = now;
    state.sealed = now;
    state.said.clear();
    // Known by its ETag there: read again only when it changes, or six hours on.
    if let Some(etag) = etag {
        state.files.insert("seal.toml".into(), Fetched { etag, size: seal.len() as u64 });
    }
}

// ---------------------------------------------------------------- fetching

/// How a device stands, for the pace of its pulls (`due`).
#[derive(Debug, Clone, Copy, Default)]
pub struct Pace {
    /// A phone; else a computer, which pulls once a minute.
    pub phone: bool,
    /// Sioul on its screen: you are there.
    pub shown: bool,
    /// Another device says it is in use, as read here (what was fetched too).
    pub in_use: bool,
    /// A dose's alarm, a waking, the background step asking for news now.
    pub urgent: bool,
    /// The phone's background step's pace now (seconds): five minutes, fifteen while you sleep.
    pub step: i64,
}

/// Whether a pull is due now. The first after the folder is found, at once,
/// whatever the hour: until it comes, this device knows the others only from
/// the folder the sync app left stale, so whether another one is in use
/// cannot be told (6 October 2026, 23:30: found on the phone at night, never
/// pulled, the desk in use taken for closed hours before). Then a computer, a
/// phone with Sioul on its screen or another device in use, once a minute; a
/// phone in the background otherwise at its step's pace, the night's
/// included: a device opened at night is noticed within its fifteen minutes.
/// Asked for news, twenty seconds after the last.
pub fn due(state: &State, now: i64, pace: Pace) -> bool {
    let since = now - state.tried;
    // Tried "later" than now: the clock was set back since; never a reason to wait.
    if state.tried < state.confirmed || since < 0 {
        return true;
    }
    if pace.urgent {
        return since >= 20;
    }
    if !pace.phone || pace.shown || pace.in_use {
        return since >= 60;
    }
    since >= pace.step - 30
}

/// The longest of another device's records a pull brings (`LARGEST`); a test's own, in its thread.
fn round_cap() -> u64 {
    #[cfg(test)]
    if let Some(cap) = tests::ROUND_CAP.with(std::cell::Cell::get) {
        return cap;
    }
    LARGEST
}

/// How long a dose's or a waking's alarm waits for the others' news (`alarm_news`).
#[derive(Debug, Clone, Copy)]
pub struct AlarmTimes {
    /// Sioul's own pull alone, before the sync app is asked too.
    pub alone: Duration,
    /// In all, at most: the twenty seconds the sync app had, and the five the pull had after them.
    pub most: Duration,
}

/// An alarm's waits, as they are on a phone.
pub const ALARM_TIMES: AlarmTimes = AlarmTimes { alone: Duration::from_secs(5), most: Duration::from_secs(25) };

/// Where an alarm's news came from (`alarm_news`).
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum AlarmNews {
    /// A pull begun since the alarm went through: what it read is trusted alone.
    Pulled,
    /// No pull since went through; the sync app asked and waited for, as
    /// before Sioul's own pull. `heard`: the devices whose entry or claim on
    /// the health part says more since the alarm began, by its own times (in
    /// the folder, or in what was fetched beside it). Of the others no news
    /// came: what this device knows
    /// of them is from before the alarm, and one known closed then may have
    /// opened since and answered (`sioul_core::health::doubts_unread`).
    SyncApp { heard: BTreeSet<String> },
}

/// What a dose's or a waking's alarm reads before it decides, `since` its
/// start (Unix seconds), on a phone whose folder is found on the server
/// (`State::fetching`; docs/android.md, "Doses while Sioul is away"). Sioul's
/// own pull alone is trusted only once a pull begun since the alarm went
/// through (`State::went_through_since`; in this process, by its steady clock:
/// `PULLED`): this one, or another's that ran meanwhile in this process
/// (`lock`, one pull at a time: another alarm's, the window's), waited for,
/// never passed over. A pull that fails, or has not gone through within
/// `times.alone`: the sync app asked as before (`ask`, which asks it and says
/// how long its wait still runs: twenty seconds, less when another alarm
/// asked it a moment ago), and waited for, that wait ended as soon as a pull
/// since the alarm goes through; `times.most` in all at most. `clock` gives
/// the time now (Unix seconds); `key` opens the others' entries and claims.
#[allow(clippy::too_many_arguments)]
pub fn alarm_news(memory: &Path, folder: &Path, own: &str, key: [u8; 32], login: Option<Login>, lock: &'static Mutex<()>, since: i64, clock: std::sync::Arc<dyn Fn() -> i64 + Send + Sync>, ask: &mut dyn FnMut() -> Duration) -> AlarmNews {
    alarm_news_with(memory, folder, own, key, login, lock, since, ALARM_TIMES, clock, ask, LIMITS)
}

#[allow(clippy::too_many_arguments)]
pub(crate) fn alarm_news_with(memory: &Path, folder: &Path, own: &str, key: [u8; 32], login: Option<Login>, lock: &'static Mutex<()>, since: i64, times: AlarmTimes, clock: std::sync::Arc<dyn Fn() -> i64 + Send + Sync>, ask: &mut dyn FnMut() -> Duration, limits: Limits) -> AlarmNews {
    let begun = Instant::now();
    let until = begun + times.most;
    // What each other device says of itself now, for the doses: what the sync app brings may say more.
    let before = said_by_each(folder, &key, own);
    let mut pulling = {
        let (memory, folder, own, clock) = (memory.to_path_buf(), folder.to_path_buf(), own.to_string(), std::sync::Arc::clone(&clock));
        Some(std::thread::spawn(move || pull_since_with(&memory, &folder, &own, login.as_ref(), lock, since, begun, until, &*clock, limits)))
    };
    let mut went = None;
    let mut asked: Option<Instant> = None;
    loop {
        if went.is_none() && pulling.as_ref().is_some_and(std::thread::JoinHandle::is_finished) {
            went = pulling.take().map(|pull| pull.join().unwrap_or(false));
        }
        if went == Some(true) {
            return AlarmNews::Pulled;
        }
        let now = Instant::now();
        // Failed, or not through yet: the sync app asked, as before.
        if asked.is_none() && (went == Some(false) || now >= begun + times.alone) {
            asked = Some(now + ask());
        }
        if asked.is_some_and(|end| now >= end) || now >= until {
            // A pull since, through at the last moment, counts all the same.
            if through_since(memory, folder, since, begun, clock()) {
                return AlarmNews::Pulled;
            }
            return AlarmNews::SyncApp { heard: heard_since(&before, &said_by_each(folder, &key, own)) };
        }
        std::thread::sleep(Duration::from_millis(50));
    }
}

/// Whether a pull begun since the alarm (`since`, Unix seconds; `begun`, on
/// this process's steady clock) went through. The last one gone through in
/// this process, when it is the one the state says, is judged by the steady
/// clock (`PULLED`), which no setting of the clock moves; another process's
/// by its saved time, within `since` and `now`.
fn through_since(memory: &Path, folder: &Path, since: i64, begun: Instant, now: i64) -> bool {
    let state = State::load(memory);
    if !state.pulls_well(folder) {
        return false;
    }
    match PULLED.lock().ok().and_then(|all| all.get(memory).copied()) {
        Some((at, last)) if last == state.last => at >= begun,
        _ => state.went_through_since(folder, since, now),
    }
}

/// A pull begun since the alarm (`since`, Unix seconds; `begun`, this
/// process's steady clock) gone through: one that ran meanwhile, waited for
/// (`lock`: one pull at a time in this process), else this one, begun before
/// `until`. False when a pull begun since failed, or none could begin in time.
#[allow(clippy::too_many_arguments)]
pub(crate) fn pull_since_with(memory: &Path, folder: &Path, own: &str, login: Option<&Login>, lock: &Mutex<()>, since: i64, begun: Instant, until: Instant, clock: &dyn Fn() -> i64, limits: Limits) -> bool {
    let through = || through_since(memory, folder, since, begun, clock());
    let _one = loop {
        match lock.try_lock() {
            Ok(held) => break held,
            Err(std::sync::TryLockError::Poisoned(held)) => break held.into_inner(),
            Err(std::sync::TryLockError::WouldBlock) if Instant::now() < until => std::thread::sleep(Duration::from_millis(50)),
            Err(std::sync::TryLockError::WouldBlock) => return through(),
        }
    };
    if through() {
        return true;
    }
    // One begun since that failed (another alarm's): the sync app, not another
    // try within this alarm. Tried "later" than now: the clock was set back,
    // tried again; one gone through before this alarm began: pulled again.
    let state = State::load(memory);
    if (!state.said.is_empty() && (since..=clock()).contains(&state.tried)) || Instant::now() >= until {
        return false;
    }
    let Some(login) = login else { return false };
    let _ = pull_with(memory, folder, own, login, clock(), limits);
    through()
}

/// What each other device says of itself as the doses read it (`health::know`):
/// its entry (`devices`) and its claim on the health part (`lease`), the later
/// of the folder's copy and the one fetched beside it, each by its own times
/// (`devices::written`; the claim's renewal and its end).
type Said = BTreeMap<String, (Option<(i64, i64, i64, i64, i64)>, Option<(i64, i64)>)>;

pub(crate) fn said_by_each(folder: &Path, key: &[u8; 32], own: &str) -> Said {
    let mut out: Said = BTreeMap::new();
    for entry in crate::devices::all(folder, key).0.into_iter().filter(|e| e.id != own) {
        out.entry(entry.id.clone()).or_default().0 = Some(crate::devices::written(&entry));
    }
    for claim in crate::lease::claims(folder, key, "health").into_iter().filter(|c| c.computer != own) {
        out.entry(claim.computer.clone()).or_default().1 = Some((claim.renewed, claim.until));
    }
    out
}

/// The devices whose entry or health claim says more than before: later by
/// its own times. Another part's claim (notices, invoices) is no news of a
/// session for the doses; a file touched with the same bytes, or an older
/// copy put back, is none either.
fn heard_since(before: &Said, now: &Said) -> BTreeSet<String> {
    now.iter()
        .filter(|(id, (entry, claim))| {
            let (was_entry, was_claim) = before.get(*id).copied().unwrap_or_default();
            entry.is_some_and(|e| was_entry.is_none_or(|w| e > w)) || claim.is_some_and(|c| was_claim.is_none_or(|w| c > w))
        })
        .map(|(id, _)| id.clone())
        .collect()
}

/// What a pull did.
#[derive(Debug, Default, Clone, PartialEq, Eq)]
pub struct Pulled {
    /// Files and folders the server's listings showed.
    pub listed: usize,
    /// Files that came down and are kept.
    pub fetched: usize,
    /// This device's own files that went up (`MIRROR`, or beside a sync app: `send`).
    pub sent: usize,
    /// This device's own files found there already as they are here: nothing sent (`send`).
    pub same: usize,
    /// This device's records found longer there than here (a sync app put an
    /// older copy back here): left as they are there (`send`).
    pub longer: usize,
    /// This device's files taken out there: its records past their time and
    /// the sealed files it swept (`send`).
    pub taken_out: usize,
    /// This device's files found otherwise there, by kind and size, for the
    /// log ("records 70708 here, 71234 there"; eight at most): never a name nor a content.
    pub differ: Vec<String>,
    /// Large files left for later on a metered or slow connection (`send`, `fetch_wanted`).
    pub paced: usize,
    /// Files that did not go (too slow, cut), held back until their backoff
    /// (`send`); sealed files fetched that did not open whole (`fetch_wanted`).
    pub held: usize,
    /// The last failure, in detail (`send`).
    pub failure: Option<Failure>,
    /// Bytes that came down.
    pub bytes: u64,
    /// The other devices' records found past what a pull brings, left to the sync app (`State::left`).
    pub left: usize,
    /// Bytes the listings read (`Server::listed_bytes`), for the log.
    pub listed_bytes: u64,
    /// Sioul keeping the folder itself: the others' sealed files its copy let
    /// go, the server no longer having them, and their bytes.
    pub let_go: usize,
    pub freed: u64,
    /// The listing of `blobs/` failed this step (the step went on).
    pub listing_failed: bool,
    /// What went wrong, as `State::said` says it; none when it went through.
    pub problem: Option<String>,
}

/// Why a pull stopped: the network or the server, or the folder no longer confirmed.
enum Stop {
    Failed(SyncError),
    Unconfirmed(String),
}

impl From<SyncError> for Stop {
    fn from(e: SyncError) -> Stop {
        Stop::Failed(e)
    }
}

/// The other devices' files newer on the server than here, fetched beside the
/// synced folder (see the module's words); `own` is this device's id, whose
/// files are never fetched. Nothing when the folder is not confirmed, or its
/// seal here is no longer the one fetched under. Never on the window's thread.
pub fn pull(memory: &Path, folder: &Path, own: &str, login: &Login, now: i64) -> Pulled {
    pull_with(memory, folder, own, login, now, LIMITS)
}

pub(crate) fn pull_with(memory: &Path, folder: &Path, own: &str, login: &Login, now: i64, limits: Limits) -> Pulled {
    let mut state = State::load(memory);
    let mut pulled = Pulled::default();
    // Sioul keeping the folder itself: no backup beside it (`step`).
    if state.mode == MIRROR {
        pulled.problem = Some("mirror".into());
        return pulled;
    }
    if !state.confirmed_for(folder) || state.account != login.account {
        pulled.problem = Some("not-confirmed".into());
        return pulled;
    }
    let cache = cache_of(memory);
    // Switched off here: not a request; what the folder caught up with goes.
    if !state.fetching() {
        tidy_cache(&state, folder, memory, own);
        pulled.problem = Some("off".into());
        return pulled;
    }
    // This folder's seal changed here (sharing started again): what was
    // fetched belongs to another sharing, and the server's folder is looked at again.
    if !usable(folder, memory) {
        let _ = std::fs::remove_dir_all(&cache);
        state = State { on: state.on, given: state.given.clone(), asked: state.asked, send: state.send, folder: state.folder.clone(), said: "no-seal".into(), ..State::default() };
        let _ = state.save(memory);
        pulled.problem = Some(state.said);
        return pulled;
    }
    let loaded_left = state.left.clone();
    state.tried = now;
    let begun = Instant::now();
    let host = state.host();
    let outcome = Server::new(login, limits).map_err(Stop::Failed).and_then(|server| {
        let ran = Puller { server: &server, folder, into: &cache, own, state: &mut state, pulled: &mut pulled, now, own_there: BTreeMap::new(), covered: BTreeSet::new(), lost: false, departed: Departed::load(memory, own), departed_there: Vec::new(), past: None, mine: BTreeSet::new() }.run();
        pulled.listed_bytes += server.listed_bytes();
        ran
    });
    match outcome {
        Ok(()) => {
            state.last = now;
            state.said.clear();
        }
        Err(Stop::Unconfirmed(why)) => {
            state.confirmed = 0;
            state.said = why;
        }
        Err(Stop::Failed(e)) => state.said = code(&e, &host),
    }
    tidy_cache(&state, folder, memory, own);
    if state.said.is_empty() {
        // Gone through, begun at this moment of this process (`went_through_since`).
        if let Ok(mut all) = PULLED.lock()
            && all.get(memory).is_none_or(|(at, _)| *at < begun)
        {
            all.insert(memory.to_path_buf(), (begun, state.last));
        }
    }
    let _ = state.save_pulled(memory, now + begun.elapsed().as_secs() as i64 + 1, &loaded_left);
    pulled.problem = (!state.said.is_empty()).then(|| state.said.clone());
    pulled
}

/// The last pull of each memory gone through in this process: when it began
/// on the process's own steady clock, and its time as saved (`State::last`).
/// A clock set back makes a pull's saved time later than the moment; an
/// alarm in this process tells by this one whether that pull began before it.
static PULLED: Mutex<BTreeMap<PathBuf, (Instant, i64)>> = Mutex::new(BTreeMap::new());

/// What is no longer needed in the cache, gone, without the network: this
/// device's own files (never fetched, never read from there), records the
/// synced folder caught up with, entries and notes the same as the folder's
/// and, the backup switched off, all of them; records longer than the
/// folder's stay until it catches up (read past its end here, a records'
/// file gone would read as cut, and the doses would doubt for hours). Sealed
/// files fetched for a note waiting (`fetch_wanted`) go once it is written,
/// once the synced folder holds them, or after a few days.
pub fn tidy(memory: &Path, folder: &Path, own: &str) {
    let state = State::load(memory);
    if state.folder == shown(folder) && state.mode != MIRROR {
        tidy_cache(&state, folder, memory, own);
    }
}

fn tidy_cache(state: &State, folder: &Path, memory: &Path, own: &str) {
    let cache = &cache_of(memory);
    // What a crash left half written, an hour later.
    for dir in [cache.to_path_buf(), cache.join("devices"), cache.join("blobs")].into_iter().chain(std::fs::read_dir(cache.join("leases")).into_iter().flatten().filter_map(Result::ok).map(|e| e.path())) {
        crate::share::clean_leftovers(&dir);
    }
    for relative in cached_files(cache) {
        let (here, fetched) = (folder.join(&relative), cache.join(&relative));
        let name = relative.rsplit('/').next().unwrap_or_default();
        let gone = match kind_of(&relative) {
            None => continue,
            Some((_, id)) if id == own => true,
            Some((Kind::Round, _)) => std::fs::metadata(&here).is_ok_and(|h| std::fs::metadata(&fetched).is_ok_and(|f| h.len() >= f.len())),
            Some(_) => !state.fetching() || std::fs::read(&here).ok().is_some_and(|h| std::fs::read(&fetched).ok().is_some_and(|f| f == h)),
        };
        if gone && !name.starts_with('.') {
            let _ = std::fs::remove_file(&fetched);
        }
    }
    // Sealed files fetched because a note or a paper waited for them
    // (`fetch_wanted`): gone once the synced folder holds the same, once
    // nothing waits for them (written), after `WANTED_KEPT_DAYS` whatever,
    // and all of them with the backup switched off.
    // One aged out is no longer waited for either, until an exchange that
    // reads notes finds it missing again: never fetched every few days for a
    // note nothing here writes (Android's leave to read them taken back).
    let wanted = crate::blobs::Wanted::load(memory);
    let mut aged: Vec<String> = Vec::new();
    for entry in std::fs::read_dir(cache.join("blobs")).into_iter().flatten().filter_map(Result::ok) {
        let name = entry.file_name().to_string_lossy().to_string();
        let Ok(meta) = entry.metadata() else { continue };
        if name.starts_with('.') || !meta.is_file() {
            continue;
        }
        let brought = std::fs::metadata(folder.join("blobs").join(&name)).is_ok_and(|here| here.len() == meta.len());
        let old = meta.modified().ok().and_then(|t| t.elapsed().ok()).is_some_and(|age| age.as_secs() >= WANTED_KEPT_DAYS * 86_400);
        if !state.fetching() || brought || old || !wanted.blobs.contains_key(&name) {
            let _ = std::fs::remove_file(entry.path());
            if old {
                aged.push(name);
            }
        }
    }
    if !aged.is_empty() {
        let _ = crate::blobs::Wanted::change(memory, |wanted| wanted.blobs.retain(|name, _| !aged.contains(name)));
    }
}

/// What a file of the folder is, by its path, and whose: a device's records
/// (`<id>-<n>.jsonl`), its notes to the others (`<id>.toml`), its entry
/// (`devices/<id>.device`), a claim (`leases/<part>/<id>.lease`).
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub(crate) enum Kind {
    Round,
    Seen,
    Device,
    Claim,
    /// What must reach the others within minutes: its texts to send
    /// (`texts/send/<id>.jsonl`, `place_texts`), its replies to send
    /// (`phone-messages/ask/<id>.jsonl`, `place_asks`); a small file of their own.
    Urgent,
}

pub(crate) fn is_id(id: &str) -> bool {
    id.len() == 36 && uuid::Uuid::parse_str(id).is_ok()
}

pub(crate) fn kind_of(relative: &str) -> Option<(Kind, &str)> {
    let parts: Vec<&str> = relative.split('/').collect();
    match parts.as_slice() {
        [name] => {
            if let Some((id, round)) = name.strip_suffix(".jsonl").and_then(|stem| stem.rsplit_once('-')) {
                return (is_id(id) && round.parse::<u32>().is_ok()).then_some((Kind::Round, id));
            }
            name.strip_suffix(".toml").filter(|id| is_id(id)).map(|id| (Kind::Seen, id))
        }
        ["devices", name] => name.strip_suffix(".device").filter(|id| is_id(id)).map(|id| (Kind::Device, id)),
        ["leases", _, name] => name.strip_suffix(".lease").filter(|id| !id.is_empty() && !id.starts_with('.')).map(|id| (Kind::Claim, id)),
        ["texts", "send", name] | ["phone-messages", "ask", name] => name.strip_suffix(".jsonl").filter(|id| is_id(id)).map(|id| (Kind::Urgent, id)),
        _ => None,
    }
}

/// The files of the cache, by their path in the folder: the folder's own, `devices/`, `leases/<part>/`.
fn cached_files(cache: &Path) -> Vec<String> {
    let names = |dir: &Path| -> Vec<String> { std::fs::read_dir(dir).into_iter().flatten().filter_map(Result::ok).filter(|e| e.file_type().is_ok_and(|t| t.is_file())).map(|e| e.file_name().to_string_lossy().to_string()).collect() };
    let mut out: Vec<String> = names(cache);
    out.extend(names(&cache.join("devices")).into_iter().map(|n| format!("devices/{n}")));
    for part in std::fs::read_dir(cache.join("leases")).into_iter().flatten().filter_map(Result::ok).filter(|e| e.file_type().is_ok_and(|t| t.is_dir())) {
        let part = part.file_name().to_string_lossy().to_string();
        out.extend(names(&cache.join("leases").join(&part)).into_iter().map(|n| format!("leases/{part}/{n}")));
    }
    for (top, sub) in URGENT {
        out.extend(names(&cache.join(top).join(sub)).into_iter().map(|n| format!("{top}/{sub}/{n}")));
    }
    out
}

// ---------------------------------------------------------------- sealed files waited for

/// A step fetches at most this many sealed files waited for (`fetch_wanted`),
const WANTED_FILES: usize = 16;
/// and this many bytes of them, the first whatever its size.
const WANTED_BYTES: u64 = 16 << 20;
/// A file waited for under this size (a note, bytes) comes at once, the
/// connection metered or slow too; a larger one (a paper) at most every ten minutes then.
pub const SMALL_WANTED: u64 = 1 << 20;
/// A sealed file fetched for a note waiting is kept this long at most (days),
/// in case it was not written meanwhile (`tidy_cache`).
const WANTED_KEPT_DAYS: u64 = 3;
/// A sealed file waited for and not on the server yet (or cut on the way) is
/// asked again within this long (seconds): it comes as soon as it is there.
const WANTED_AGAIN: i64 = 5 * 60;

/// The sealed files of the others' notes and papers this device waits for
/// (`blobs::Wanted`: their records came, the files they name did not),
/// fetched from the folder's server by their names, beside the synced folder
/// (`overlay`'s `blobs/`, read by `blobs::get`), when the backup is found
/// there under the same seal (docs/database.md, "Sealed files fetched when
/// waited for"). Only those neither in the folder nor fetched yet, the
/// smallest first, at most `WANTED_FILES` and `WANTED_BYTES` a step (the
/// first whatever its size). On a metered or slow connection (`frugal`),
/// the pace of what is sent (`send`): one of `SMALL_WANTED` or more at most
/// every ten minutes, a note's at once. Each kept only once it opens whole to
/// its content (`blobs::check`): one that does not is asked again after a
/// while (`backoff`, up to an hour); one not on the server yet, within five
/// minutes. No listing of the server's `blobs/`: the records name them. Never
/// on the window's thread; one fetch at a time on this device.
pub fn fetch_wanted(memory: &Path, folder: &Path, login: &Login, key: &[u8; 32], now: i64, frugal: bool) -> Pulled {
    fetch_wanted_with(memory, folder, login, key, now, frugal, LIMITS)
}

/// Whether a sealed file waited for is due to be fetched (`fetch_wanted`):
/// cheap, nothing of the network; none while nothing waits.
pub fn wanted_due(memory: &Path, folder: &Path, now: i64) -> bool {
    crate::blobs::Wanted::path(memory).exists() && !wanted_now(&crate::blobs::Wanted::load(memory), folder, &cache_of(memory).join("blobs"), now).is_empty()
}

/// The sealed files waited for that are neither in the folder nor fetched
/// (`into`), and not asked lately in vain: those the records wait for, and
/// the texts' media asked by name (`blobs::Wanted::media`: a computer's
/// lacking, a multimedia message's that its phone waits for), each asked
/// `WANTED_KEPT_DAYS` at most.
fn wanted_now<'a>(wanted: &'a crate::blobs::Wanted, folder: &Path, into: &Path, now: i64) -> Vec<(&'a String, &'a crate::blobs::Want)> {
    let here = |dir: &Path, name: &str| std::fs::metadata(dir.join(name)).is_ok_and(|m| m.len() > 0);
    let fresh = |want: &&crate::blobs::Want| now - want.since < WANTED_KEPT_DAYS as i64 * 86_400;
    wanted.blobs.iter().chain(wanted.media.iter().filter(|(_, want)| fresh(want))).filter(|(name, want)| want.again <= now && !here(&folder.join("blobs"), name) && !here(into, name)).collect()
}

#[allow(clippy::too_many_arguments)]
pub(crate) fn fetch_wanted_with(memory: &Path, folder: &Path, login: &Login, key: &[u8; 32], now: i64, frugal: bool, limits: Limits) -> Pulled {
    let mut pulled = Pulled::default();
    let state = State::load(memory);
    if state.mode == MIRROR || !state.fetching() || !state.confirmed_for(folder) || state.account != login.account || !usable(folder, memory) {
        pulled.problem = Some("not-confirmed".into());
        return pulled;
    }
    let into = cache_of(memory).join("blobs");
    sioul_core::filelock::with_lock(&memory.with_file_name("wanted.step"), || {
        let wanted = crate::blobs::Wanted::load(memory);
        let mut due = wanted_now(&wanted, folder, &into, now);
        if due.is_empty() {
            return pulled;
        }
        due.sort_by_key(|(name, want)| (want.size, want.since, *name));
        let mut tried: BTreeMap<String, (u32, i64)> = BTreeMap::new();
        let mut large_at = wanted.large_at;
        let (mut count, mut budget) = (0, WANTED_BYTES);
        let outcome = Server::new(login, limits).and_then(|server| {
            for (name, want) in due {
                if count >= WANTED_FILES || (count > 0 && want.size > budget) {
                    break;
                }
                let large = want.size >= SMALL_WANTED;
                if frugal && large && now - large_at < PACE {
                    pulled.paced += 1;
                    continue;
                }
                if frugal && large {
                    large_at = now;
                }
                count += 1;
                budget = budget.saturating_sub(want.size);
                let path = into.join(name);
                let failed = |soon: bool| {
                    let tries = want.tries + 1;
                    (tries, now + if soon { backoff(tries).min(WANTED_AGAIN) } else { backoff(tries) })
                };
                match server.download(&format!("{}{}", state.url, encode_path(&format!("blobs/{name}"))), &path, BLOB_LIMIT) {
                    Ok(Some(size)) => match crate::blobs::check(&path, key, &want.hash) {
                        Ok(()) => {
                            pulled.fetched += 1;
                            pulled.bytes += size;
                            tried.insert(name.clone(), (0, 0));
                        }
                        // Not whole, or another content: never kept, asked again after a while.
                        Err(fault) => {
                            let _ = std::fs::remove_file(&path);
                            pulled.held += 1;
                            tried.insert(name.clone(), failed(!matches!(fault, crate::blobs::Fault::Broken)));
                        }
                    },
                    // Not on the server yet (its writer's sync app has not sent it), or too large.
                    Ok(None) => {
                        tried.insert(name.clone(), failed(true));
                    }
                    Err(e) => {
                        tried.insert(name.clone(), failed(true));
                        return Err(e);
                    }
                }
            }
            Ok(())
        });
        if let Err(e) = outcome {
            pulled.problem = Some(code(&e, &state.host()));
        }
        let _ = crate::blobs::Wanted::change(memory, |wanted| {
            for (name, (tries, again)) in tried {
                for want in [wanted.blobs.get_mut(&name), wanted.media.get_mut(&name)].into_iter().flatten() {
                    (want.tries, want.again) = (tries, again);
                }
            }
            wanted.large_at = wanted.large_at.max(large_at);
        });
        pulled
    })
}

/// One pull: the server's folder looked through, what is newer there fetched.
struct Puller<'a> {
    server: &'a Server,
    /// The sharing folder as the sync app keeps it, and where what comes goes.
    folder: &'a Path,
    into: &'a Path,
    own: &'a str,
    state: &'a mut State,
    pulled: &'a mut Pulled,
    now: i64,
    /// This device's own files seen in the folders looked through, their ETags there (`MIRROR`).
    own_there: BTreeMap<String, String>,
    /// The folders of the server looked through in this step ("" the folder itself, "devices/").
    covered: BTreeSet<String>,
    /// Sioul keeping the folder itself, its copy lost: none of its records here.
    lost: bool,
    /// What this device took out here of the devices that no longer count
    /// (`Departed`): never fetched again; Sioul keeping the folder itself, taken
    /// out there too (`push`).
    departed: Departed,
    /// Those of their past rounds still there and gone here, with their ETag
    /// as listed (`MIRROR`): taken out there by `push`; and every file there
    /// of a device whose files you removed (`Departed::devices`).
    departed_there: Vec<(String, String)>,
    /// Sioul keeping the folder itself: this device's rounds below this one
    /// are past their time (`share::rounds_past`): taken out there whatever
    /// it remembers sending (`take_out_own`), never brought back (`restore`).
    past: Option<u32>,
    /// Sioul keeping the folder itself: the sealed files this device made or
    /// counts as its own (`share::own_sealed`): one its copy fetched once
    /// and its own change names now goes up as its own (`own_files`).
    mine: BTreeSet<String>,
}

impl Puller<'_> {
    fn url(&self, relative: &str) -> String {
        format!("{}{}", self.state.url, encode_path(relative))
    }

    /// A folder of the server not changed since it was last looked through, lately.
    fn unchanged(&self, relative: &str, etag: &str) -> bool {
        !self.lost && !etag.is_empty() && self.state.folders.get(relative).is_some_and(|l| l.etag == etag && self.now - l.at < LIST_AGAIN)
    }

    /// A folder looked through to its end: until it changes, not again for a while.
    fn looked(&mut self, relative: &str, etag: &str) {
        self.state.folders.insert(relative.to_string(), Looked { etag: etag.to_string(), at: self.now });
    }

    fn run(&mut self) -> Result<(), Stop> {
        let root = self.server.list(&self.state.url).map_err(|e| match e {
            SyncError::NotFound(_) => Stop::Unconfirmed(format!("seal-gone:{}", self.state.host())),
            e => Stop::Failed(e),
        })?;
        self.pulled.listed += root.items.len();
        // Never fetched from a folder sealed otherwise.
        self.seal(&root)?;
        // Sioul keeping the folder itself, its copy lost (none of its records
        // here): everything looked through again, what it wrote brought back first.
        self.lost = self.mirror() && own_latest(self.folder, self.own).is_none();
        if self.unchanged("", &root.etag) {
            // What was left to the sync app and has come here since: no longer left.
            let (folder, into) = (self.folder, self.into);
            let here = |name: &str| [folder.join(name), into.join(name)].iter().filter_map(|path| std::fs::metadata(path).ok()).map(|m| m.len()).max().unwrap_or(0);
            self.state.left.retain(|name, size| here(name) < *size);
            return Ok(());
        }
        // Looked through anew: what is left to the sync app, found again.
        self.state.left.clear();
        self.own_listed("", &root);
        for (name, item) in root.items.iter().filter(|(_, item)| !item.dir) {
            match kind_of(name) {
                // A round past its time of a device that no longer counts,
                // taken out here (`Departed`): never fetched again. Sioul
                // keeping the folder itself takes it out there (`push`).
                Some((Kind::Round, id)) if id != self.own && (self.departed.past_round(name) || self.departed.removed_as_known(name, item, &self.state.files)) => self.away(name, item),
                Some((Kind::Seen, id)) if id != self.own && self.departed.removed_as_known(name, item, &self.state.files) => self.away(name, item),
                Some((Kind::Round, id)) if id != self.own => self.round(name, item)?,
                Some((Kind::Seen, id)) if id != self.own => self.small(name, item)?,
                Some(_) if self.mirror() => self.restore(name, item)?,
                _ => {}
            }
        }
        if let Some(devices) = root.items.get("devices").filter(|item| item.dir)
            && !self.unchanged("devices/", &devices.etag)
        {
            let listing = self.server.list(&self.url("devices/"))?;
            self.pulled.listed += listing.items.len();
            self.own_listed("devices/", &listing);
            // This device's own entry there, as listed: an older copy put back there is sent over (`send`).
            if let Some(item) = listing.items.get(&format!("{}.device", self.own)).filter(|item| !item.dir) {
                self.state.own_entry = Some((item.size, self.now));
            }
            for (name, item) in listing.items.iter().filter(|(_, item)| !item.dir) {
                let relative = format!("devices/{name}");
                match kind_of(&relative) {
                    Some((_, id)) if id != self.own && self.departed.removed_as_known(&relative, item, &self.state.files) => self.away(&relative, item),
                    Some((_, id)) if id != self.own => self.small(&relative, item)?,
                    Some(_) if self.mirror() => self.restore(&relative, item)?,
                    _ => {}
                }
            }
            self.forget_gone("devices/", &listing);
            self.looked("devices/", &listing.etag);
        }
        if let Some(leases) = root.items.get("leases").filter(|item| item.dir)
            && !self.unchanged("leases/", &leases.etag)
        {
            let parts = self.server.list(&self.url("leases/"))?;
            self.pulled.listed += parts.items.len();
            for (part, item) in parts.items.iter().filter(|(_, item)| item.dir) {
                let dir = format!("leases/{part}/");
                if self.unchanged(&dir, &item.etag) {
                    continue;
                }
                let listing = self.server.list(&self.url(&dir))?;
                self.pulled.listed += listing.items.len();
                self.own_listed(&dir, &listing);
                for (name, item) in listing.items.iter().filter(|(_, item)| !item.dir) {
                    let relative = format!("{dir}{name}");
                    match kind_of(&relative) {
                        Some((_, id)) if id != self.own && self.departed.removed_as_known(&relative, item, &self.state.files) => self.away(&relative, item),
                        Some((_, id)) if id != self.own => self.small(&relative, item)?,
                        Some(_) if self.mirror() => self.restore(&relative, item)?,
                        _ => {}
                    }
                }
                self.forget_gone(&dir, &listing);
                self.looked(&dir, &listing.etag);
            }
            self.looked("leases/", &parts.etag);
        }
        // Each device's texts and replies to send, a small file of its own: a
        // phone has them within their quarter of an hour, whatever the records' size.
        for (top, sub) in URGENT {
            let (dir, files) = (format!("{top}/"), format!("{top}/{sub}/"));
            let Some(urgent) = root.items.get(top).filter(|item| item.dir) else { continue };
            if self.unchanged(&dir, &urgent.etag) {
                continue;
            }
            match self.server.list(&self.url(&files)) {
                Ok(listing) => {
                    self.pulled.listed += listing.items.len();
                    self.own_listed(&files, &listing);
                    for (name, item) in listing.items.iter().filter(|(_, item)| !item.dir) {
                        let relative = format!("{files}{name}");
                        if let Some((Kind::Urgent, id)) = kind_of(&relative)
                            && id != self.own
                        {
                            if self.departed.removed_as_known(&relative, item, &self.state.files) {
                                self.away(&relative, item);
                            } else {
                                self.small(&relative, item)?;
                            }
                        }
                    }
                    self.forget_gone(&files, &listing);
                    self.looked(&dir, &urgent.etag);
                }
                Err(SyncError::NotFound(_)) => self.looked(&dir, &urgent.etag),
                Err(e) => return Err(Stop::Failed(e)),
            }
        }
        // Sioul keeping the folder itself: `blobs/`'s ETag as seen now, for
        // `sealed_step`, which lists it once it changed and fetches the
        // others' sealed files by their names, after the steps and never in
        // one. Until 17 October 2026 the steps listed it whole every ten
        // minutes, megabytes of names each time on a phone, and
        // fetched every sealed file it held (review of 17 October 2026, M4).
        if self.mirror() {
            self.state.blobs_seen = root.items.get("blobs").filter(|item| item.dir).map(|item| if item.etag.is_empty() { "-".to_string() } else { item.etag.clone() }).unwrap_or_default();
        }
        self.forget_gone("", &root);
        self.looked("", &root.etag);
        Ok(())
    }

    /// A file there that this device took out here and never fetches again
    /// (`Departed`): a device's round past its time, any file of a device
    /// whose files you removed. Sioul keeping the folder itself, one gone
    /// here is taken out there at the end of the step (`push`).
    fn away(&mut self, relative: &str, item: &Item) {
        if self.mirror() && !item.etag.is_empty() && !self.folder.join(relative).exists() {
            self.departed_there.push((relative.to_string(), item.etag.clone()));
        }
    }

    /// Sioul keeps the folder itself (`MIRROR`): what comes goes into it, no sync app beside.
    fn mirror(&self) -> bool {
        self.into == self.folder
    }

    /// A folder of the server just looked through: this device's own files
    /// in it (`MIRROR`), their ETags there, for what goes up next.
    fn own_listed(&mut self, dir: &str, listing: &Listing) {
        self.covered.insert(dir.to_string());
        for (name, item) in listing.items.iter().filter(|(_, item)| !item.dir) {
            let relative = format!("{dir}{name}");
            let own = match kind_of(&relative) {
                Some((_, id)) => id == self.own,
                None => dir == "blobs/" && self.state.sent.contains_key(&relative),
            };
            if own {
                self.own_there.insert(relative, item.etag.clone());
            }
        }
    }

    /// The server's seal, read again when it changed there or every six
    /// hours: another, or none, and nothing more is fetched from there.
    fn seal(&mut self, root: &Listing) -> Result<(), Stop> {
        let host = self.state.host();
        let Some(item) = root.items.get("seal.toml").filter(|item| !item.dir) else { return Err(Stop::Unconfirmed(format!("seal-gone:{host}"))) };
        let known = Fetched { etag: item.etag.clone(), size: item.size };
        if !item.etag.is_empty() && self.state.files.get("seal.toml") == Some(&known) && self.now - self.state.sealed < SEAL_AGAIN {
            return Ok(());
        }
        let here = seal_of(self.folder).ok_or_else(|| Stop::Unconfirmed("no-seal".into()))?;
        match self.server.small(&self.url("seal.toml"))? {
            Some((bytes, _)) if bytes == here => {
                self.state.sealed = self.now;
                self.state.files.insert("seal.toml".into(), known);
                Ok(())
            }
            Some(_) => Err(Stop::Unconfirmed(format!("seal-differs:{host}"))),
            None => Err(Stop::Unconfirmed(format!("seal-gone:{host}"))),
        }
    }

    /// Files of a folder of the server no longer there: forgotten, and their
    /// copies fetched gone (a records' file only once its writer removed it:
    /// every device had read past it).
    fn forget_gone(&mut self, dir: &str, listing: &Listing) {
        let gone: Vec<String> = self.state.files.keys().filter(|path| path.strip_prefix(dir).is_some_and(|name| !name.contains('/') && !listing.items.contains_key(name))).cloned().collect();
        for path in gone {
            self.state.files.remove(&path);
            // Beside a sync app, the copy fetched goes; Sioul keeping the folder
            // itself, another device's records its writer let go (every device read past them).
            let round = matches!(kind_of(&path), Some((Kind::Round, _)));
            if path != "seal.toml" && (self.into != self.folder || round) {
                let _ = std::fs::remove_file(self.into.join(&path));
            }
        }
    }

    /// A small file (notes, an entry, a claim) fetched whole when it changed
    /// there since it was last fetched; kept only when it differs from the
    /// synced folder's copy, and only when all of it came.
    fn small(&mut self, relative: &str, item: &Item) -> Result<(), Stop> {
        let known = Fetched { etag: item.etag.clone(), size: item.size };
        // Sioul keeping the folder itself, one gone from its copy comes again.
        if !item.etag.is_empty() && self.state.files.get(relative) == Some(&known) && (!self.mirror() || self.folder.join(relative).exists()) {
            return Ok(());
        }
        let cap = if matches!(kind_of(relative), Some((Kind::Urgent, _))) { TEXTS_LARGEST } else { crate::share::SMALL_FILE };
        if item.size > cap {
            return Ok(());
        }
        let Some((bytes, _)) = self.server.small_up_to(&self.url(relative), cap)? else {
            self.state.files.remove(relative);
            return Ok(());
        };
        self.pulled.bytes += bytes.len() as u64;
        let (here, into) = (self.folder.join(relative), self.into.join(relative));
        if std::fs::read(&here).ok().as_deref() == Some(&bytes[..]) {
            // The sync app brought it already: nothing kept twice.
            if into != here {
                let _ = std::fs::remove_file(&into);
            }
        } else {
            crate::share::write_atomically(&into, &bytes).map_err(|e| Stop::Failed(SyncError::Disk(e)))?;
            self.pulled.fetched += 1;
        }
        self.state.files.insert(relative.to_string(), known);
        Ok(())
    }

    /// One of this device's own files there and not here (`MIRROR`), never
    /// sent from here, or its copy lost (`lost`: none of its records here):
    /// brought back, so that it goes on after its last record rather than
    /// numbering them again over the others' reading.
    fn restore(&mut self, relative: &str, item: &Item) -> Result<(), Stop> {
        let here = self.folder.join(relative);
        if here.exists() || (self.state.sent.contains_key(relative) && !self.lost) || item.size > LARGEST {
            return Ok(());
        }
        // A round of its own below the readers' floor is past its time: never brought back (`take_out_own`).
        if matches!(kind_of(relative), Some((Kind::Round, _))) && round_of(relative).zip(self.past).is_some_and(|(round, past)| round < past) {
            return Ok(());
        }
        let Some(got) = self.server.tail(&self.url(relative), 0)? else { return Ok(()) };
        if let Some(e) = got.error {
            return Err(Stop::Failed(e));
        }
        // Records keep their whole lines only.
        let keep = if matches!(kind_of(relative), Some((Kind::Round, _))) { got.bytes.iter().rposition(|b| *b == b'\n').map_or(0, |at| at + 1) } else { got.bytes.len() };
        crate::share::write_atomically(&here, &got.bytes[..keep]).map_err(|e| Stop::Failed(SyncError::Disk(e)))?;
        let modified = std::fs::metadata(&here).map(|m| crate::share::modified_ns(&m)).unwrap_or(0);
        let etag = if keep == got.bytes.len() { item.etag.clone() } else { String::new() };
        self.state.sent.insert(relative.to_string(), Sent { size: keep as u64, modified, etag });
        self.pulled.fetched += 1;
        self.pulled.bytes += keep as u64;
        Ok(())
    }

    /// This device's own files (`MIRROR`) changed here since they went up, or
    /// changed or gone there since (seen in the folders just looked through),
    /// sent, in `own_files`' order, each over what is there as it was seen
    /// (`send`). Then what it let go here goes there too: its records past
    /// their time (`remove_old_rounds`: every device read past them), never
    /// its last round, and nothing while none of its records is here; the
    /// sealed files it swept.
    fn push(&mut self) -> Result<(), Stop> {
        let mut stopped: Option<Stop> = None;
        for relative in own_files(self.folder, self.own, self.state, &self.mine) {
            let Ok(meta) = std::fs::metadata(self.folder.join(&relative)) else { continue };
            let (size, modified) = (meta.len(), crate::share::modified_ns(&meta));
            let sent = self.state.sent.get(&relative).cloned();
            let covered = self.covered.contains(dir_of(&relative));
            let there = self.own_there.get(&relative).cloned();
            let same_here = sent.as_ref().is_some_and(|s| s.size == size && s.modified == modified);
            // Its ETag there, unsaid when it went up, known now.
            if same_here
                && let (Some(sent), Some(etag)) = (&sent, &there)
                && sent.etag.is_empty()
            {
                self.state.sent.insert(relative.clone(), Sent { etag: etag.clone(), ..sent.clone() });
                continue;
            }
            let same_there = !covered || there.as_deref() == sent.as_ref().map(|s| s.etag.as_str());
            if same_here && same_there {
                continue;
            }
            // A sealed file fetched once that this device's own change names
            // now (`share::seal_apart`): sent only where the server no longer
            // has it, one look first (review of 17 October 2026, H1).
            if sent.is_none() && relative.starts_with("blobs/") && self.state.files.contains_key(&relative) {
                match self.server.etag(&self.url(&relative)) {
                    Ok(Some(etag)) => {
                        self.state.sent.insert(relative.clone(), Sent { size, modified, etag });
                        continue;
                    }
                    Ok(None) => {}
                    Err(e) => {
                        stopped = Some(Stop::Failed(e));
                        break;
                    }
                }
            }
            let seen = if covered { there } else { sent.map(|s| s.etag).filter(|e| !e.is_empty()) };
            // One that fails (a large sealed file on a slow line, the space
            // there full) stops the uploads, never what is taken out after.
            if let Err(stop) = self.send(&relative, size, modified, seen) {
                stopped = Some(stop);
                break;
            }
        }
        let taken = self.take_out_own();
        self.take_out_departed();
        match stopped {
            Some(stop) => Err(stop),
            None => taken,
        }
    }

    /// What this device let go here, taken out there too: its records past
    /// their time (`remove_old_rounds`: every device read past them) listed in
    /// this step and gone here, never its last round, and nothing while none
    /// of its records is here: those it remembers sending, and those below the
    /// readers' floor (`past`, `share::rounds_past`) whatever it remembers (one
    /// forgotten after a refused delete, "Send everything again", its state
    /// lost); then the sealed files it swept. Until 17 October 2026 a past
    /// round it no longer remembered stayed there, and `restore` brought it
    /// back here at the next step, megabytes each.
    fn take_out_own(&mut self) -> Result<(), Stop> {
        if let Some(latest) = own_latest(self.folder, self.own)
            && self.covered.contains("")
        {
            let past = self.past;
            let gone: Vec<(String, String)> = self
                .own_there
                .iter()
                .filter(|(relative, _)| matches!(kind_of(relative), Some((Kind::Round, _))) && !self.folder.join(relative).exists())
                .filter(|(relative, _)| round_of(relative).is_some_and(|round| round < latest && (self.state.sent.contains_key(*relative) || past.is_some_and(|past| round < past))))
                .map(|(relative, etag)| (relative.clone(), etag.clone()))
                .collect();
            for (relative, etag) in gone {
                self.take_out(&relative, Some(etag))?;
            }
        }
        let swept: Vec<(String, String)> = self.state.sent.iter().filter(|(relative, _)| relative.starts_with("blobs/") && !self.folder.join(relative).exists()).map(|(relative, sent)| (relative.clone(), sent.etag.clone())).collect();
        for (relative, etag) in swept {
            self.take_out(&relative, Some(etag).filter(|e| !e.is_empty()))?;
        }
        Ok(())
    }

    /// What this device took out here of the devices that no longer count
    /// (`Departed`), taken out there too: their past rounds still listed in
    /// this step and gone here, over the ETag listed; the sealed files swept,
    /// every six hours at most, when still as old there (`take_out_swept`).
    /// Another device doing the same first makes it gone (`404`), a sync
    /// app's copy sent again since makes it changed (`412`): left, as any
    /// other answer or failure, for a later step.
    fn take_out_departed(&mut self) {
        for (relative, etag) in std::mem::take(&mut self.departed_there) {
            if matches!(self.server.delete(&self.url(&relative), Some(&etag)), Ok(200 | 204)) {
                self.pulled.taken_out += 1;
            }
        }
        if self.departed.blobs.is_empty() || !self.covered.contains("") || self.now - self.state.swept_at < CHECK_AGAIN {
            return;
        }
        self.state.swept_at = self.now;
        for (name, at) in self.departed.blobs.clone() {
            let relative = format!("blobs/{name}");
            if !self.folder.join(&relative).exists() && take_out_swept(self.server, &self.url(&relative), at) {
                self.pulled.taken_out += 1;
            }
        }
    }

    /// One of this device's files sent whole over what is there as it was
    /// seen (`seen`: its ETag; none there). Refused because it changed there
    /// meanwhile (`412`), sent again over what is there now: it is this
    /// device's own. A folder missing there (`409`), made first. A sealed file
    /// goes only where none is: one there already is the same. Refused again
    /// and again: left for the next step; nothing here is lost.
    fn send(&mut self, relative: &str, size: u64, modified: u64, seen: Option<String>) -> Result<(), Stop> {
        let blob = relative.starts_with("blobs/");
        let bytes = std::fs::read(self.folder.join(relative)).map_err(|e| Stop::Failed(SyncError::Disk(format!("{relative}: {e}"))))?;
        let url = self.url(relative);
        let mut seen = if blob { None } else { seen };
        let sha1 = sha1_hex(&bytes);
        for attempt in 0..3 {
            // Given the time its size asks on a slow line (`put_file`).
            let (status, etag) = self.server.put_file(&url, bytes.clone(), seen.as_deref(), modified / 1_000_000_000, &sha1).map_err(|failed| Stop::Failed(failed.error))?;
            match status {
                200 | 201 | 204 => {
                    self.state.sent.insert(relative.to_string(), Sent { size, modified, etag: etag.unwrap_or_default() });
                    self.pulled.sent += 1;
                    self.pulled.bytes += bytes.len() as u64;
                    return Ok(());
                }
                412 if blob => {
                    self.state.sent.insert(relative.to_string(), Sent { size, modified, etag: String::new() });
                    return Ok(());
                }
                412 => seen = self.server.etag(&url)?,
                409 if attempt == 0 => self.make_folders(relative)?,
                507 => return Err(Stop::Failed(SyncError::Server("quota".into()))),
                status => return Err(Stop::Failed(SyncError::Server(format!("PUT: {status}")))),
            }
        }
        Err(Stop::Failed(SyncError::Server("PUT: 412".into())))
    }

    /// The folders a file's path goes through, made there (`MKCOL`) when missing.
    fn make_folders(&mut self, relative: &str) -> Result<(), Stop> {
        let mut at = String::new();
        let names: Vec<&str> = relative.split('/').collect();
        for name in &names[..names.len().saturating_sub(1)] {
            at = format!("{at}{name}/");
            match self.server.mkcol(&self.url(&at))? {
                201 | 405 => {}
                status => return Err(Stop::Failed(SyncError::Server(format!("MKCOL: {status}")))),
            }
        }
        Ok(())
    }

    /// One of this device's files taken out there, only as it was seen when
    /// its ETag is known; gone already, or changed there since (another device
    /// sealed the same content again), forgotten here all the same.
    fn take_out(&mut self, relative: &str, seen: Option<String>) -> Result<(), Stop> {
        match self.server.delete(&self.url(relative), seen.as_deref())? {
            200 | 204 | 404 | 412 => {
                self.state.sent.remove(relative);
                Ok(())
            }
            status => Err(Stop::Failed(SyncError::Server(format!("DELETE: {status}")))),
        }
    }

    /// A device's records, when the server's copy is longer than both the
    /// synced folder's and what was fetched: what is new there, from the end
    /// of the longer copy here, its last whole line asked again and checked
    /// to be the same there (a copy that does not join comes whole). Only
    /// whole lines are kept: a line half arrived comes again next time.
    fn round(&mut self, name: &str, item: &Item) -> Result<(), Stop> {
        let (here, into) = (self.folder.join(name), self.into.join(name));
        let size = |path: &Path| std::fs::metadata(path).map_or(0, |m| m.len());
        let longest = size(&here).max(size(&into));
        let known = Fetched { etag: item.etag.clone(), size: item.size };
        if item.size <= longest {
            // Nothing more there than here.
            self.state.files.insert(name.to_string(), known);
            return Ok(());
        }
        if item.size > round_cap() {
            // Past what a pull brings: left to the sync app, and said (`State::left`).
            self.state.left.insert(name.to_string(), item.size);
            self.pulled.left += 1;
            return Ok(());
        }
        let base = if size(&into) >= size(&here) { into.clone() } else { here.clone() };
        let (end, last) = whole_end(&base);
        let from = if end - last > OVERLAP { end.saturating_sub(1) } else { last };
        let overlap = read_range(&base, from, end).unwrap_or_default();
        let url = self.url(name);
        let Some(mut got) = self.server.tail(&url, from)? else { return Ok(()) };
        let joins = got.start == from && from > 0;
        if joins && !got.bytes.starts_with(&overlap) {
            if got.error.is_some() && overlap.starts_with(&got.bytes) {
                // Cut within the line asked again: nothing new came.
                return Err(Stop::Failed(got.error.take().unwrap_or(SyncError::Network(String::new()))));
            }
            // Not the same there: the whole file.
            match self.server.tail(&url, 0)? {
                Some(whole) => got = whole,
                None => return Ok(()),
            }
        } else if !joins && got.start != 0 {
            return Err(Stop::Failed(SyncError::Server(format!("GET: from {}", got.start))));
        }
        let prefix = if got.start == from && from > 0 { from } else { 0 };
        self.pulled.bytes += got.bytes.len() as u64;
        // Whole lines only.
        let whole = got.bytes.iter().rposition(|b| *b == b'\n').map_or(0, |at| at + 1);
        if prefix + whole as u64 > longest {
            let temporary = crate::share::temporary(&into);
            let written = (|| -> std::io::Result<()> {
                if let Some(parent) = into.parent() {
                    crate::share::private_dirs(parent)?;
                }
                let mut out = crate::share::new_private(&temporary)?;
                if prefix > 0 {
                    std::io::copy(&mut std::fs::File::open(&base)?.take(prefix), &mut out)?;
                }
                out.write_all(&got.bytes[..whole])?;
                out.sync_all()?;
                std::fs::rename(&temporary, &into)
            })();
            if let Err(e) = written {
                let _ = std::fs::remove_file(&temporary);
                return Err(Stop::Failed(SyncError::Disk(format!("{name}: {e}"))));
            }
            self.pulled.fetched += 1;
        }
        match got.error {
            Some(e) => Err(Stop::Failed(e)),
            None => {
                self.state.files.insert(name.to_string(), known);
                Ok(())
            }
        }
    }
}

/// Where a file's last whole line ends, and where it starts: (0, 0) when it holds none.
fn whole_end(path: &Path) -> (u64, u64) {
    let Ok(mut file) = std::fs::File::open(path) else { return (0, 0) };
    let size = file.metadata().map_or(0, |m| m.len());
    let Some(end) = newline_before(&mut file, size).map(|at| at + 1) else { return (0, 0) };
    let last = newline_before(&mut file, end - 1).map_or(0, |at| at + 1);
    (end, last)
}

/// Where the last line break before `before` is, read back a piece at a time.
fn newline_before(file: &mut std::fs::File, before: u64) -> Option<u64> {
    let mut end = before;
    while end > 0 {
        let from = end.saturating_sub(64 << 10);
        let mut piece = vec![0u8; usize::try_from(end - from).ok()?];
        file.seek(SeekFrom::Start(from)).ok()?;
        file.read_exact(&mut piece).ok()?;
        if let Some(at) = piece.iter().rposition(|b| *b == b'\n') {
            return Some(from + at as u64);
        }
        end = from;
    }
    None
}

fn read_range(path: &Path, from: u64, to: u64) -> Option<Vec<u8>> {
    let mut file = std::fs::File::open(path).ok()?;
    file.seek(SeekFrom::Start(from)).ok()?;
    let mut bytes = vec![0u8; usize::try_from(to.saturating_sub(from)).ok()?];
    file.read_exact(&mut bytes).ok()?;
    Some(bytes)
}

// ---------------------------------------------------------------- kept in step by Sioul itself

/// The mode where Sioul keeps the folder in step with the server itself, no
/// sync app at all (docs/database.md, "Kept in step by Sioul itself"): the
/// folder here is its own copy (`mirror_of`), the server's the one the
/// devices share, a device beside a sync app reading the same.
pub const MIRROR: &str = "mirror";

/// Sioul's own copy of the folder in that mode: `<state>/share/mirror/`.
pub fn mirror_of(memory: &Path) -> PathBuf {
    memory.with_file_name("mirror")
}

/// A sealed file is never fetched past this: the largest note's, sealed.
const BLOB_LIMIT: u64 = crate::blobs::LARGEST + (1 << 20);

/// A folder of an account's files as Sioul keeping it itself finds it: its
/// address, where it is among the files, and its seal when it has one
/// (another device shares through it: joining), else none (a new sharing).
pub struct Opened {
    pub url: String,
    root: String,
    pub place: String,
    pub seal: Option<Vec<u8>>,
}

/// Where `place` ("Documents/Sioul") is among `login`'s files, and what it
/// holds; why not, in a code as `State::said` has them.
pub fn open(login: &Login, place: &str) -> Result<Opened, String> {
    open_with(login, place, LIMITS)
}

pub(crate) fn open_with(login: &Login, place: &str, limits: Limits) -> Result<Opened, String> {
    let host = host_of(&login.url);
    let place = place.trim().trim_matches('/').to_string();
    if place.is_empty() {
        return Err("no-place".into());
    }
    let server = Server::new(login, limits).map_err(|e| code(&e, &login.account))?;
    let root = files_root(&server, login).map_err(|e| code(&e, &host))?.ok_or_else(|| format!("no-files:{host}"))?;
    let url = format!("{root}{}/", encode_path(&place));
    let seal = server.small(&format!("{url}seal.toml")).map_err(|e| code(&e, &host))?.map(|(bytes, _)| bytes);
    Ok(Opened { url, root, place, seal })
}

/// A new sharing there: each missing folder of its place made (`MKCOL`),
/// then `folder`'s seal sent only if none is there yet (`If-None-Match: *`):
/// two devices starting at once never seal it twice ("sealed-meanwhile").
pub fn create(login: &Login, opened: &Opened, folder: &Path) -> Result<(), String> {
    create_with(login, opened, folder, LIMITS)
}

pub(crate) fn create_with(login: &Login, opened: &Opened, folder: &Path, limits: Limits) -> Result<(), String> {
    let host = host_of(&login.url);
    let failed = |e: SyncError| code(&e, &host);
    let server = Server::new(login, limits).map_err(failed)?;
    let mut at = opened.root.clone();
    for name in opened.place.split('/').filter(|n| !n.is_empty()) {
        at = format!("{at}{}/", encode_path(name));
        if !matches!(server.mkcol(&at).map_err(failed)?, 201 | 405) {
            return Err(format!("server:{host}"));
        }
    }
    let seal = seal_of(folder).ok_or_else(|| "no-seal".to_string())?;
    match server.put(&format!("{}seal.toml", opened.url), seal, None).map_err(failed)?.0 {
        200 | 201 | 204 => Ok(()),
        412 => Err("sealed-meanwhile".into()),
        _ => Err(format!("server:{host}")),
    }
}

/// From now on Sioul keeps `folder` in step with `opened` itself (`MIRROR`),
/// with `login`'s account: what the backup knew goes.
pub fn begin(memory: &Path, folder: &Path, login: &Login, opened: &Opened, now: i64) -> Result<(), String> {
    begin_as(memory, folder, login, opened, now, String::new())
}

/// The same, joined through the server's own sign-in (`loginflow`): the
/// folder kept with that login (`State::user`), its app password from the
/// keyring under that login, whatever account the contacts and calendars
/// use; `login.account` names the account of this server and login, made or
/// found here.
pub fn begin_signed_in(memory: &Path, folder: &Path, login: &Login, opened: &Opened, now: i64) -> Result<(), String> {
    begin_as(memory, folder, login, opened, now, login.user.clone())
}

fn begin_as(memory: &Path, folder: &Path, login: &Login, opened: &Opened, now: i64, user: String) -> Result<(), String> {
    let _ = std::fs::remove_dir_all(cache_of(memory));
    let state = State { mode: MIRROR.into(), place: opened.place.clone(), folder: shown(folder), account: login.account.clone(), url: opened.url.clone(), confirmed: now, sealed: now, user, ..State::default() };
    let path = state_path(memory);
    sioul_core::filelock::with_lock(&path, || state.write(memory))
}

/// Where a device joining through its Nextcloud's sign-in looks for the
/// sharing folder first (`seek`): Sioul's own place, then the top of the files.
pub const SOUGHT: [&str; 2] = ["Documents/Sioul", "Sioul"];

/// The folders one level under `Documents` looked at, at most (by name).
const SOUGHT_UNDER: usize = 40;

/// What the look for the sharing folder found (`seek`): the places holding a
/// seal of Sioul's, in the order looked at, and whether every place it looks
/// at was looked at (`complete`): a listing or a seal that could not be read,
/// or the time running out, leaves it incomplete, and then "none found" is
/// never said, nor a new sharing offered (the review of the join, M3).
#[derive(Debug, Default, Clone, PartialEq, Eq)]
pub struct Sought {
    pub found: Vec<String>,
    pub complete: bool,
}

/// Whether `place` is one the look goes through by itself (`seek`): one of
/// `SOUGHT`, or a folder one level under `Documents`.
pub fn sought(place: &str) -> bool {
    let place = place.trim().trim_matches('/');
    SOUGHT.contains(&place) || place.strip_prefix("Documents/").is_some_and(|name| !name.is_empty() && !name.contains('/') && !name.starts_with('.'))
}

/// Where the sharing folder is among `login`'s files, for a device joining
/// with nothing set up (docs/database.md, "Joining through your Nextcloud's
/// sign-in"): each of `SOUGHT` first, then each folder one level under
/// `Documents` (the first 40 by name, hidden ones left out), that holds a
/// seal of Sioul's (`share::is_seal`), in that order. Only `PROPFIND` and
/// `GET` of `seal.toml` files, on the account's own server. A listing of
/// `Documents` that fails only ends the extra places; one place that cannot
/// be read leaves the others looked at; the time running out ends the look
/// with what was found: each makes the look incomplete (`Sought`). Why it
/// could not look at all, in a code as `open` has them ("login:murena.io",
/// "no-files:murena.io"): a refused login, a certificate, the files not found.
pub fn seek(login: &Login) -> Result<Sought, String> {
    seek_with(login, LIMITS)
}

pub(crate) fn seek_with(login: &Login, limits: Limits) -> Result<Sought, String> {
    let host = host_of(&login.url);
    let server = Server::new(login, limits).map_err(|e| code(&e, &host))?;
    let root = files_root(&server, login).map_err(|e| code(&e, &host))?.ok_or_else(|| format!("no-files:{host}"))?;
    let mut sought = Sought { found: Vec::new(), complete: true };
    let out_of_time = |e: &SyncError| matches!(e, SyncError::Network(d) if d == "out of time");
    // Each place's seal: found, none, or not read (the look incomplete). Err ends the look.
    let look = |place: &str, sought: &mut Sought| -> Result<(), SyncError> {
        match server.small(&format!("{root}{}/seal.toml", encode_path(place))) {
            Ok(Some((bytes, _))) if crate::share::is_seal(&bytes) => sought.found.push(place.to_string()),
            Ok(_) => {}
            Err(e) if e.is_lasting() || out_of_time(&e) => return Err(e),
            Err(_) => sought.complete = false,
        }
        Ok(())
    };
    // A refused login, a certificate, before anything was found: said; after, or the time out: what was found.
    let ended = |e: SyncError, mut sought: Sought| -> Result<Sought, String> {
        if sought.found.is_empty() && e.is_lasting() {
            return Err(code(&e, &host));
        }
        sought.complete = false;
        Ok(sought)
    };
    for place in SOUGHT {
        if let Err(e) = look(place, &mut sought) {
            return ended(e, sought);
        }
    }
    let extra: Vec<String> = match server.list(&format!("{root}Documents/")) {
        Ok(listing) => listing.items.iter().filter(|(name, item)| item.dir && !name.starts_with('.') && name.as_str() != "Sioul").take(SOUGHT_UNDER).map(|(name, _)| format!("Documents/{name}")).collect(),
        Err(SyncError::NotFound(_)) => Vec::new(),
        Err(e) if e.is_lasting() || out_of_time(&e) => return ended(e, sought),
        Err(_) => {
            sought.complete = false;
            return Ok(sought);
        }
    };
    for place in extra {
        if let Err(e) = look(&place, &mut sought) {
            return ended(e, sought);
        }
    }
    Ok(sought)
}

/// One step of Sioul keeping the folder itself (`MIRROR`): with `whole`, the
/// server's folder looked through first and the other devices' newer files
/// brought into the copy here, as `pull` brings them beside a synced folder;
/// then this device's own files changed since they went up, or changed there
/// since, sent (`Puller::push`), its records first, its sealed files last;
/// the others' sealed notes, papers and spam filter's tables come after the
/// steps, by their names (`sealed_step`). A large sealed file on a slow
/// line, going up, never holds back the records: the doses' answers go first.
/// Never another device's file written; nothing here lost when the server
/// refuses. One step at a time on this device, whichever process runs it.
pub fn step(memory: &Path, folder: &Path, own: &str, login: &Login, now: i64, whole: bool) -> Pulled {
    step_with(memory, folder, own, login, now, whole, LIMITS)
}

pub(crate) fn step_with(memory: &Path, folder: &Path, own: &str, login: &Login, now: i64, whole: bool, limits: Limits) -> Pulled {
    sioul_core::filelock::with_lock(&memory.with_file_name("mirror.step"), || {
        let mut state = State::load(memory);
        let mut pulled = Pulled::default();
        if state.mode != MIRROR || !state.confirmed_for(folder) || state.account != login.account {
            pulled.problem = Some("not-confirmed".into());
            return pulled;
        }
        let host = state.host();
        if whole {
            state.tried = now;
        }
        let mine: BTreeSet<String> = crate::share::own_sealed(memory, own).into_keys().collect();
        let outcome = Server::new(login, limits).map_err(Stop::Failed).and_then(|server| {
            let mut puller = Puller { server: &server, folder, into: folder, own, state: &mut state, pulled: &mut pulled, now, own_there: BTreeMap::new(), covered: BTreeSet::new(), lost: false, departed: Departed::load(memory, own), departed_there: Vec::new(), past: crate::share::rounds_past(folder, memory, own, now * 1000), mine };
            let ran = (|| {
                if whole {
                    puller.run()?;
                }
                // This device's own files (its records before its sealed files):
                // nothing large holds back what the others wait for. The
                // others' sealed files come after the step (`sealed_step`).
                puller.push()
            })();
            puller.pulled.listed_bytes += server.listed_bytes();
            ran
        });
        match outcome {
            Ok(()) => {
                if whole {
                    state.last = now;
                }
                state.pushed = now;
                state.said.clear();
            }
            Err(Stop::Unconfirmed(why)) => {
                state.confirmed = 0;
                state.said = why;
            }
            Err(Stop::Failed(e)) => state.said = code(&e, &host),
        }
        let _ = state.save(memory);
        pulled.problem = (!state.said.is_empty()).then(|| state.said.clone());
        pulled
    })
}

// ---------------------------------------------------------------- the others' sealed files, Sioul keeping the folder itself

/// Whether `sealed_step` has something to do now: `blobs/` due to be
/// listed, or a sealed file waited for and due. Cheap: nothing of the
/// network, nor of the key.
pub fn sealed_due(memory: &Path, folder: &Path, own: &str, now: i64) -> bool {
    let state = State::load(memory);
    if state.mode != MIRROR || !state.confirmed_for(folder) {
        return false;
    }
    if listing_due(&state, now) {
        return true;
    }
    let wanted = crate::blobs::Wanted::load(memory);
    (!wanted.blobs.is_empty() || !wanted.media.is_empty()) && !wanted_in_copy(&wanted, folder, &Departed::load(memory, own), now).is_empty()
}

/// `blobs/` listed again (`sealed_step`): once its ETag changed since its
/// last listing, an hour at least after it; every six hours whatever (a
/// server whose folders' ETags lag); never while a failed one waits its
/// backoff, nor while no look through the folder saw it there.
fn listing_due(state: &State, now: i64) -> bool {
    if state.blobs_seen.is_empty() || now < state.blobs_again {
        return false;
    }
    let last = state.folders.get("blobs/");
    let changed = last.is_none_or(|looked| looked.etag != state.blobs_seen);
    // The clock set back since: due.
    let since = last.map_or(i64::MAX, |looked| if now < looked.at { i64::MAX } else { now - looked.at });
    (changed && since >= BLOBS_AGAIN) || since >= CHECK_AGAIN
}

/// The sealed files waited for (`blobs::Wanted`: the others' records name
/// them; a computer lacks a text's medium) not in the copy and due, never
/// one swept here as a departed device's (`Departed`).
fn wanted_in_copy(wanted: &crate::blobs::Wanted, folder: &Path, departed: &Departed, now: i64) -> Vec<(String, crate::blobs::Want)> {
    let blobs = folder.join("blobs");
    let here = |name: &str| std::fs::metadata(blobs.join(name)).is_ok_and(|m| m.len() > 0);
    // A text's medium asked for three days in vain is asked no more, until the
    // texts' page asks for it again (`blobs::Want::since` renewed there):
    // never every few minutes for good (review of 18 October 2026, L-8).
    let fresh = |want: &&crate::blobs::Want| now - want.since < WANTED_KEPT_DAYS as i64 * 86_400;
    let due: BTreeMap<&String, &crate::blobs::Want> = wanted.blobs.iter().chain(wanted.media.iter().filter(|(_, want)| fresh(want))).filter(|(name, want)| want.again <= now && !here(name) && !departed.swept(name)).collect();
    due.into_iter().map(|(name, want)| (name.clone(), want.clone())).collect()
}

/// Sioul keeping the folder itself (`MIRROR`): the others' sealed files,
/// after the steps, on a thread of their own (the window's worker after its
/// exchange, the phone's background step beside its mail), never in a
/// step: a dose's alarm never waits for them, and a step waits a moment at
/// most (the step's lock is taken only to note a listing and to put in
/// place what came, `place_fetched`). First `blobs/`, listed when due
/// (`listing_due`): this device's own sealed files gone there go up again
/// at the next push; the others' its copy fetched that the server no longer
/// lists are let go, but those this device still needs (`blobs_looked`).
/// Then those waited for (`blobs::Wanted`), by their names, the smallest
/// first, 64 MiB at most a step (the first whatever its size), as long as
/// the step's time lasts, each kept only once it opens whole to its
/// content (`blobs::check`); one not there, cut, or that does not open is
/// asked again after its backoff. On a metered or slow connection
/// (`frugal`), one of a megabyte or more at most every ten minutes, as the
/// sending paces them. One at a time on this device.
pub fn sealed_step(memory: &Path, folder: &Path, own: &str, login: &Login, key: &[u8; 32], now: i64, frugal: bool) -> Pulled {
    sealed_step_with(memory, folder, own, login, key, now, frugal, LIMITS)
}

#[allow(clippy::too_many_arguments)]
pub(crate) fn sealed_step_with(memory: &Path, folder: &Path, own: &str, login: &Login, key: &[u8; 32], now: i64, frugal: bool, limits: Limits) -> Pulled {
    sioul_core::filelock::with_lock(&memory.with_file_name("mirror.sealed"), || {
        let mut pulled = Pulled::default();
        let state = State::load(memory);
        if state.mode != MIRROR || !state.confirmed_for(folder) || state.account != login.account {
            pulled.problem = Some("not-confirmed".into());
            return pulled;
        }
        let server = match Server::new(login, limits) {
            Ok(server) => server,
            Err(e) => {
                pulled.problem = Some(code(&e, &state.host()));
                return pulled;
            }
        };
        let url = |relative: &str| format!("{}{}", state.url, encode_path(relative));
        if listing_due(&state, now) {
            // Given a minute whatever the step's own time: thousands of names on a slow line.
            let listed = server.list_within(limits.large, &url("blobs/"));
            let before = |map: Vec<&String>| -> BTreeSet<String> { map.into_iter().filter(|relative| relative.starts_with("blobs/")).cloned().collect() };
            let (sent_before, fetched_before) = (before(state.sent.keys().collect()), before(state.files.keys().collect()));
            let etag = state.blobs_seen.clone();
            in_step(memory, folder, &login.account, |state| match &listed {
                Ok(listing) => {
                    let keep: Option<BTreeSet<String>> = crate::share::needed_sealed(memory, own).map(|needed| needed.into_iter().chain(crate::share::own_sealed(memory, own).into_keys()).collect());
                    blobs_looked(state, folder, listing, keep.as_ref(), (&sent_before, &fetched_before), &mut pulled);
                    state.folders.insert("blobs/".into(), Looked { etag, at: now });
                    (state.blobs_tries, state.blobs_again) = (0, 0);
                }
                // Too slow, cut, refused: said in the log, tried again after its backoff, an hour at least.
                Err(_) => {
                    state.blobs_tries += 1;
                    state.blobs_again = now + backoff(state.blobs_tries).max(BLOBS_AGAIN);
                    pulled.listing_failed = true;
                }
            });
        }
        if let Err(e) = fetch_wanted_into_copy(&server, memory, folder, (own, &login.account), (key, frugal), now, &url, &mut pulled) {
            pulled.problem = Some(code(&e, &state.host()));
        }
        pulled.listed_bytes = server.listed_bytes();
        pulled
    })
}

/// A change to the state under the step's lock (`mirror.step`), over the
/// state as it is then, saved: no step runs meanwhile, nor saves over it.
/// None, nothing changed, when Sioul no longer keeps that folder with that account.
fn in_step<T>(memory: &Path, folder: &Path, account: &str, change: impl FnOnce(&mut State) -> T) -> Option<T> {
    sioul_core::filelock::with_lock(&memory.with_file_name("mirror.step"), || {
        let mut state = State::load(memory);
        if state.mode != MIRROR || !state.confirmed_for(folder) || state.account != account {
            return None;
        }
        let out = change(&mut state);
        let _ = state.save(memory);
        Some(out)
    })
}

/// What a listing of `blobs/` tells (`sealed_step`): this device's own
/// sealed files sent before it and gone there go up again at the next push
/// (forgotten as sent); the others' its copy fetched before it that the
/// server no longer lists are let go here (their writer swept them), but
/// those this device still needs (`keep`: changes waiting name them, a
/// version kept here by reference may, its own); none while this device's
/// memory does not say what it needs (`keep` none: an older Sioul's, until
/// this one's first exchange). Until 17 October 2026 the copy kept every
/// sealed file it ever fetched (the review's finding 1).
fn blobs_looked(state: &mut State, folder: &Path, listing: &Listing, keep: Option<&BTreeSet<String>>, (sent_before, fetched_before): (&BTreeSet<String>, &BTreeSet<String>), pulled: &mut Pulled) {
    pulled.listed += listing.items.len();
    let listed: BTreeSet<&str> = listing.items.iter().filter(|(_, item)| !item.dir).map(|(name, _)| name.as_str()).collect();
    let gone_there = |relative: &str| relative.strip_prefix("blobs/").is_some_and(|name| !listed.contains(name));
    state.sent.retain(|relative, _| !(sent_before.contains(relative) && gone_there(relative)));
    let Some(keep) = keep else { return };
    let gone: Vec<String> = state.files.keys().filter(|relative| fetched_before.contains(*relative) && gone_there(relative) && relative.strip_prefix("blobs/").is_some_and(|name| !keep.contains(name))).cloned().collect();
    for relative in gone {
        state.files.remove(&relative);
        let path = folder.join(&relative);
        if let Ok(meta) = std::fs::metadata(&path)
            && std::fs::remove_file(&path).is_ok()
        {
            pulled.let_go += 1;
            pulled.freed += meta.len();
        }
    }
}

/// The sealed files this device waits for (`wanted_in_copy`), fetched by
/// their names into its copy (`sealed_step`): the smallest first, 64 MiB
/// at most a step (the first whatever its size), as long as the step's
/// time lasts; on a metered or slow connection (`frugal`), one of
/// `SMALL_WANTED` or more at most every ten minutes. Each kept only once it
/// opens whole to its content (`blobs::check`), put in its place under the
/// step's lock some at a time (`place_fetched`). One not there, cut, or that
/// does not open, asked again after its backoff: within five minutes in its
/// first hour (a sync app still sending it), then less and less often.
/// `who`: this device's id, and the account.
#[allow(clippy::too_many_arguments)]
fn fetch_wanted_into_copy(server: &Server, memory: &Path, folder: &Path, (own, account): (&str, &str), (key, frugal): (&[u8; 32], bool), now: i64, url: &dyn Fn(&str) -> String, pulled: &mut Pulled) -> Result<(), SyncError> {
    let wanted = crate::blobs::Wanted::load(memory);
    let mut due = wanted_in_copy(&wanted, folder, &Departed::load(memory, own), now);
    if due.is_empty() {
        return Ok(());
    }
    due.sort_by(|a, b| (a.1.size, a.1.since, &a.0).cmp(&(b.1.size, b.1.since, &b.0)));
    let (mut tried, mut budget, mut first, mut large_at) = (BTreeMap::new(), MIRROR_WANTED_BYTES, true, wanted.large_at);
    let (mut stopped, mut ready) = (None, Vec::new());
    let place = |ready: &mut Vec<(String, PathBuf, u64)>, pulled: &mut Pulled| {
        for ((_, temporary, size), placed) in ready.iter().zip(place_fetched(memory, folder, account, ready)) {
            if placed {
                pulled.fetched += 1;
                pulled.bytes += size;
            }
            let _ = std::fs::remove_file(temporary);
        }
        ready.clear();
    };
    for (name, want) in due {
        if !first && want.size > budget {
            break;
        }
        let large = want.size >= SMALL_WANTED;
        if frugal && large && now - large_at < PACE {
            pulled.paced += 1;
            continue;
        }
        if frugal && large {
            large_at = now;
        }
        first = false;
        let failed = |soon: bool| {
            let tries = want.tries + 1;
            let soon = soon && now - want.since < 3600;
            (tries, now + if soon { backoff(tries).min(WANTED_AGAIN) } else { backoff(tries) })
        };
        let relative = format!("blobs/{name}");
        match server.download_aside(&url(&relative), &folder.join(&relative), BLOB_LIMIT) {
            Ok(Some((size, temporary))) => match crate::blobs::check(&temporary, key, &want.hash) {
                Ok(()) => {
                    budget = budget.saturating_sub(size);
                    tried.insert(name, (0, 0));
                    ready.push((relative, temporary, size));
                    if ready.len() >= PLACED_AT_ONCE {
                        place(&mut ready, pulled);
                    }
                }
                // Not whole, or another content: never kept, asked again after a while.
                Err(fault) => {
                    let _ = std::fs::remove_file(&temporary);
                    pulled.held += 1;
                    tried.insert(name, failed(!matches!(fault, crate::blobs::Fault::Broken)));
                }
            },
            // Not there yet (its writer has not sent it), or too large.
            Ok(None) => {
                tried.insert(name, failed(true));
            }
            // The step's time is out: the rest at the next one.
            Err(SyncError::Network(why)) if why == "out of time" => break,
            Err(e) => {
                tried.insert(name, failed(true));
                stopped = Some(e);
                break;
            }
        }
    }
    place(&mut ready, pulled);
    let _ = crate::blobs::Wanted::change(memory, |wanted| {
        for (name, (tries, again)) in tried {
            for want in [wanted.blobs.get_mut(&name), wanted.media.get_mut(&name)].into_iter().flatten() {
                (want.tries, want.again) = (tries, again);
            }
        }
        wanted.large_at = wanted.large_at.max(large_at);
    });
    stopped.map_or(Ok(()), Err)
}

/// How many sealed files that came are put in place under one hold of the
/// step's lock, one writing of the state for them all (review of 18 October
/// 2026, L-4: once per file, thousands of them rewrote a large state as many
/// times).
const PLACED_AT_ONCE: usize = 64;

/// Sealed files that came (`ready`: each one's place in the folder, the
/// name it came under, its size), put in their places in the copy under the
/// step's lock once the state says they were fetched (`State::files`): a
/// step never sees one there before, and never takes it for one of this
/// device's own. Never over a file there (sealed here meanwhile: the same
/// content). Whether each was put there.
fn place_fetched(memory: &Path, folder: &Path, account: &str, ready: &[(String, PathBuf, u64)]) -> Vec<bool> {
    if ready.is_empty() {
        return Vec::new();
    }
    sioul_core::filelock::with_lock(&memory.with_file_name("mirror.step"), || {
        let mut state = State::load(memory);
        if state.mode != MIRROR || !state.confirmed_for(folder) || state.account != account {
            return vec![false; ready.len()];
        }
        let free: Vec<bool> = ready.iter().map(|(relative, _, _)| !folder.join(relative).exists()).collect();
        for ((relative, _, size), free) in ready.iter().zip(&free) {
            if *free {
                state.files.insert(relative.clone(), Fetched { etag: String::new(), size: *size });
            }
        }
        if state.save(memory).is_err() {
            return vec![false; ready.len()];
        }
        let placed: Vec<bool> = ready.iter().zip(&free).map(|((relative, temporary, _), free)| *free && std::fs::rename(temporary, folder.join(relative)).is_ok()).collect();
        // One that could not be put there: the state says so again.
        if placed != free {
            for ((relative, _, _), (free, placed)) in ready.iter().zip(free.iter().zip(&placed)) {
                if *free && !placed {
                    state.files.remove(relative);
                }
            }
            let _ = state.save(memory);
        }
        placed
    })
}

/// The folder a file of the folder is in, as the server's listings are kept: "" the folder itself, "devices/", "leases/health/".
fn dir_of(relative: &str) -> &str {
    relative.rfind('/').map_or("", |at| &relative[..=at])
}

/// This device's own files in the folder (`MIRROR`), by their path in it, in
/// the order they go up: its records, its notes to the others, its claims,
/// its entry (it says how far its records went), then the sealed files it
/// made (in `blobs/`, not fetched). A large sealed file on a slow line never
/// holds back the records, the doses' answers among them; a record naming a
/// sealed file not there yet is read as a sync app's late copy is: the
/// others wait for it (docs/database.md, "Coming in").
fn own_files(folder: &Path, own: &str, state: &State, mine: &BTreeSet<String>) -> Vec<String> {
    let mut out = own_plain(folder, own);
    // Those it made, and one it fetched once that its own change names now (`share::seal_apart`).
    out.extend(file_names(&folder.join("blobs")).into_iter().filter(|n| !state.files.contains_key(&format!("blobs/{n}")) || mine.contains(n)).map(|n| format!("blobs/{n}")));
    out
}

/// The files of a folder, by name, hidden ones left out.
fn file_names(dir: &Path) -> Vec<String> {
    std::fs::read_dir(dir).into_iter().flatten().filter_map(Result::ok).filter(|e| e.file_type().is_ok_and(|t| t.is_file())).map(|e| e.file_name().to_string_lossy().to_string()).filter(|n| !n.starts_with('.')).collect()
}

/// This device's own files in the folder but its sealed ones, in the order
/// they go up: its records, its notes to the others, its claims, its entry.
fn own_plain(folder: &Path, own: &str) -> Vec<String> {
    let names = file_names;
    let mut out: Vec<String> = Vec::new();
    let mut records: Vec<(u8, u32, String)> = names(folder)
        .into_iter()
        .filter_map(|name| match kind_of(&name) {
            Some((Kind::Round, id)) if id == own => Some((0, name.trim_end_matches(".jsonl").rsplit('-').next().and_then(|n| n.parse().ok()).unwrap_or(0), name)),
            Some((Kind::Seen, id)) if id == own => Some((1, 0, name)),
            _ => None,
        })
        .collect();
    records.sort();
    out.extend(records.into_iter().map(|(_, _, name)| name));
    let mut parts: Vec<String> = std::fs::read_dir(folder.join("leases")).into_iter().flatten().filter_map(Result::ok).filter(|e| e.file_type().is_ok_and(|t| t.is_dir())).map(|e| e.file_name().to_string_lossy().to_string()).collect();
    parts.sort();
    out.extend(parts.into_iter().map(|part| format!("leases/{part}/{own}.lease")).filter(|claim| folder.join(claim).is_file()));
    let entry = format!("devices/{own}.device");
    if folder.join(&entry).is_file() {
        out.push(entry);
    }
    out
}

/// The highest round of this device's records in the folder here; none when it holds none.
fn own_latest(folder: &Path, own: &str) -> Option<u32> {
    std::fs::read_dir(folder)
        .into_iter()
        .flatten()
        .filter_map(Result::ok)
        .filter_map(|e| {
            let name = e.file_name().to_string_lossy().to_string();
            match kind_of(&name) {
                Some((Kind::Round, id)) if id == own => name.trim_end_matches(".jsonl").rsplit('-').next().and_then(|n| n.parse().ok()),
                _ => None,
            }
        })
        .max()
}

// ---------------------------------------------------------------- sent beside the sync app

/// A full check of what the server holds of this device's files, beside the
/// quick sends (each a few requests): every six hours, and when asked
/// ("Send everything again").
const CHECK_AGAIN: i64 = 6 * 3600;
/// A file past this size (bytes) is a large one: on a metered or slow
/// connection (`Sending::frugal`), sent at most every `PACE` seconds.
pub const LARGE_FILE: u64 = 256 << 10;
const PACE: i64 = 10 * 60;
/// Under this rate (bytes a second), measured on a file sent of 64 KiB at
/// least, the connection counts as slow: paced as a metered one.
pub const SLOW: u64 = 64 << 10;

/// How long a failed send waits before it is tried again, by how many failed
/// in a row: a minute, two, five, a quarter of an hour, half an hour, an hour.
pub fn backoff(tries: u32) -> i64 {
    [60, 120, 300, 900, 1800, 3600][tries.saturating_sub(1).min(5) as usize]
}

/// The two ways this device's files go (`send`, `send_urgent`), each with its
/// own lock and its own memory, so that a large file on a slow line, going
/// up for minutes, never holds back a text to send.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum Lane {
    /// Its records, notes, claims, entry and sealed files.
    Main,
    /// What must reach the others within minutes, in a small file of its own:
    /// its texts to send (`texts/send/<id>.jsonl`, `place_texts`), its
    /// replies to send (`phone-messages/ask/<id>.jsonl`, `place_asks`).
    Urgent,
}

impl Lane {
    fn memory(self, memory: &Path) -> PathBuf {
        memory.with_file_name(match self {
            Lane::Main => "sending.toml",
            Lane::Urgent => "sending-urgent.toml",
        })
    }

    fn lock(self, memory: &Path) -> PathBuf {
        memory.with_file_name(match self {
            Lane::Main => "send.step",
            Lane::Urgent => "send.urgent",
        })
    }
}

/// What sending this device's own files beside the sync app knows (`send`):
/// `share/sending.toml` (`share/sending-urgent.toml` for the urgent lane),
/// never shared, apart from the backup's state, so that a pull and a send
/// never write over each other's.
#[derive(Debug, Default, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct Sending {
    /// The folder there the files went to: another, and each is looked at again.
    #[serde(default, skip_serializing_if = "String::is_empty")]
    pub url: String,
    /// When a send last went through whole, and was last tried (Unix seconds).
    #[serde(default)]
    pub last: i64,
    #[serde(default)]
    pub tried: i64,
    /// When the server's copies were last listed and compared with the files here (Unix seconds).
    #[serde(default)]
    pub checked: i64,
    /// Why the last send stopped, a code as `State::said` has them; "" when it went through.
    #[serde(default, skip_serializing_if = "String::is_empty")]
    pub said: String,
    /// The last failure, in detail: which file, how, how long, how many of its bytes went.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub failure: Option<Failure>,
    /// The server unreachable (a connection, a certificate, a password
    /// refused): how many sends failed in a row, and none tried before
    /// `retry_at` (Unix seconds; "Send everything again" apart).
    #[serde(default)]
    pub tries: u32,
    #[serde(default)]
    pub retry_at: i64,
    /// Files that did not go (too slow, cut): how many tries in a row, and not
    /// tried again before when (`backoff`).
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    pub held: BTreeMap<String, Held>,
    /// The rate of the last file of 64 KiB or more that went, or of what went
    /// of one that failed (bytes a second); 0 unknown.
    #[serde(default)]
    pub rate: u64,
    /// When a large file was last sent or tried (Unix seconds), for the pace.
    #[serde(default)]
    pub large_at: i64,
    /// What "Send everything again" last did, in either mode.
    #[serde(default)]
    pub again: Again,
    /// This device's own files as they last went up, or were found there the same, by their path in the folder.
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    pub sent: BTreeMap<String, Sent>,
    /// Of those, the sealed files swept here that could not be taken out
    /// there: another answer than taken out or gone (`423` while a sync app
    /// sends that very file again, a server's error, `403`), or, after a
    /// `412`, a look that failed or a second refusal. Kept, and tried again
    /// at the next listing only, never at each send nor holding one back: no
    /// listing looks for them otherwise, and forgotten they would stay there
    /// for good (final review of 15 October 2026, RES-1).
    #[serde(default, skip_serializing_if = "BTreeSet::is_empty")]
    pub refused: BTreeSet<String>,
}

/// A failed send, in detail: what the panel and the log say of it.
#[derive(Debug, Default, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct Failure {
    /// "timeout" (slower than the floor), "stalled" (nothing moved for half
    /// a minute), "unreachable", "tls", "login", "server", "quota", "network".
    #[serde(default)]
    pub kind: String,
    /// The file, by kind: "records", "notes", "claim", "entry", "texts", "replies", "sealed".
    #[serde(default)]
    pub file: String,
    #[serde(default)]
    pub seconds: u64,
    #[serde(default)]
    pub sent: u64,
    #[serde(default)]
    pub total: u64,
    /// The error's own words, for the log.
    #[serde(default, skip_serializing_if = "String::is_empty")]
    pub words: String,
    /// When (Unix seconds).
    #[serde(default)]
    pub at: i64,
}

/// A file held back after it failed: tries in a row, and when to try again (Unix seconds).
#[derive(Debug, Default, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct Held {
    #[serde(default)]
    pub tries: u32,
    #[serde(default)]
    pub until: i64,
}

/// What "Send everything again" did: when (Unix seconds), how many files
/// went, how many were there already as they are here, and why it stopped
/// ("" when it went through).
#[derive(Debug, Default, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct Again {
    #[serde(default)]
    pub at: i64,
    #[serde(default)]
    pub sent: usize,
    #[serde(default)]
    pub same: usize,
    #[serde(default, skip_serializing_if = "String::is_empty")]
    pub said: String,
}

#[cfg(test)]
fn sending_path(memory: &Path) -> PathBuf {
    Lane::Main.memory(memory)
}

impl Sending {
    pub fn load(memory: &Path) -> Sending {
        Sending::load_lane(memory, Lane::Main)
    }

    /// The urgent lane's (`send_urgent`).
    pub fn load_urgent(memory: &Path) -> Sending {
        Sending::load_lane(memory, Lane::Urgent)
    }

    fn load_lane(memory: &Path, lane: Lane) -> Sending {
        std::fs::read_to_string(lane.memory(memory)).ok().and_then(|text| toml::from_str(&text).ok()).unwrap_or_default()
    }

    fn save(&self, memory: &Path, lane: Lane) -> Result<(), String> {
        let text = toml::to_string(self).map_err(|e| e.to_string())?;
        crate::share::write_atomically(&lane.memory(memory), format!("# Sioul: this device's files sent to the sharing folder's server beside the sync app (docs/database.md). Never shared.\n{text}").as_bytes())
    }

    /// "Send everything again" could not start (no account for the server,
    /// the folder not found, sending switched off): why, said as a code.
    pub fn note_again(memory: &Path, now: i64, why: &str) {
        let mut sending = Sending::load(memory);
        sending.again = Again { at: now, sent: 0, same: 0, said: why.to_string() };
        let _ = sending.save(memory, Lane::Main);
    }

    /// The connection measured slow: under `SLOW` on the last large file.
    pub fn slow(&self) -> bool {
        self.rate > 0 && self.rate < SLOW
    }

    /// When the next try is due, when a send waits (Unix seconds): the server
    /// unreachable, or a file held back; 0 when nothing waits.
    pub fn next_try(&self) -> i64 {
        self.held.values().map(|h| h.until).chain([self.retry_at]).filter(|at| *at > 0).min().unwrap_or(0)
    }
}

/// This device's own files sent to the server beside the sync app that
/// carries the folder (docs/database.md, "Sent to the server too"), once the
/// backup found the folder there under the same seal. Only its own files
/// (`own_plain`, and the sealed files it made, `sealed`: their name and the
/// size it sealed, sent whole only), each over what is there as it was seen;
/// a file found there as it is here is not sent again (the sync app sent it,
/// or will find it there as its own); records only grow (never one shorter
/// than what went, or than the server's), and go in order; never another
/// device's file. Each file is given the time its size asks (`FLOOR`); one
/// that does not go is held back (`backoff`), never tried sooner, the next
/// records with it, the other files still going. The server unreachable,
/// nothing is tried before its backoff. With `frugal` (a metered connection),
/// or the connection measured slow, a large file goes at most every ten
/// minutes. With `again`, or every six hours, or the first time, the server's
/// folders are listed and every file compared: one lost there is sent again.
/// This device's records past their time and the sealed files it swept are
/// taken out there. One send at a time on this device, whichever process runs it.
#[allow(clippy::too_many_arguments)]
pub fn send(memory: &Path, folder: &Path, own: &str, login: &Login, sealed: &BTreeMap<String, u64>, now: i64, again: bool, frugal: bool) -> Pulled {
    send_lane(Lane::Main, memory, folder, own, login, sealed, now, again, frugal, SEND_LIMITS)
}

/// This device's texts and replies to send (`texts/send/<id>.jsonl`,
/// `place_texts`; `phone-messages/ask/<id>.jsonl`, `place_asks`), on a lane of
/// their own: small files, sent first and alone, never waiting behind a large
/// one going up on a slow line; Sioul keeping the folder itself too (`MIRROR`).
/// A multimedia message's media go first on it (`media`: their sealed files'
/// names in `blobs/`, and the size each was sealed at), so that the phone
/// finds them there by the time it reads the request; each asked of the
/// server by its own name, never the whole of `blobs/` listed.
pub fn send_urgent(memory: &Path, folder: &Path, own: &str, login: &Login, now: i64, media: &BTreeMap<String, u64>) -> Pulled {
    send_lane(Lane::Urgent, memory, folder, own, login, media, now, false, false, SEND_LIMITS)
}

#[cfg(test)]
pub(crate) fn send_urgent_with(memory: &Path, folder: &Path, own: &str, login: &Login, now: i64, limits: Limits) -> Pulled {
    send_lane(Lane::Urgent, memory, folder, own, login, &BTreeMap::new(), now, false, false, limits)
}

#[cfg(test)]
pub(crate) fn send_urgent_media(memory: &Path, folder: &Path, own: &str, login: &Login, now: i64, media: &BTreeMap<String, u64>, limits: Limits) -> Pulled {
    send_lane(Lane::Urgent, memory, folder, own, login, media, now, false, false, limits)
}

#[cfg(test)]
#[allow(clippy::too_many_arguments)]
pub(crate) fn send_with(memory: &Path, folder: &Path, own: &str, login: &Login, sealed: &BTreeMap<String, u64>, now: i64, again: bool, limits: Limits) -> Pulled {
    send_lane(Lane::Main, memory, folder, own, login, sealed, now, again, false, limits)
}

#[allow(clippy::too_many_arguments)]
fn send_lane(lane: Lane, memory: &Path, folder: &Path, own: &str, login: &Login, sealed: &BTreeMap<String, u64>, now: i64, again: bool, frugal: bool, limits: Limits) -> Pulled {
    sioul_core::filelock::with_lock(&lane.lock(memory), || {
        let state = State::load(memory);
        let mut pulled = Pulled::default();
        let refused = if state.mode == MIRROR && lane == Lane::Main {
            Some("mirror")
        } else if !state.confirmed_for(folder) || state.account != login.account {
            Some("not-confirmed")
        } else if state.mode != MIRROR && !state.sending() {
            Some("off")
        } else {
            None
        };
        if let Some(why) = refused {
            if again {
                Sending::note_again(memory, now, why);
            }
            pulled.problem = Some(why.into());
            return pulled;
        }
        let mut sending = Sending::load_lane(memory, lane);
        if sending.url != state.url {
            sending = Sending { url: state.url.clone(), again: sending.again.clone(), ..Sending::default() };
        }
        // This device's entry listed there by a pull after this send last went
        // through, of another size than it was sent: an older copy put back
        // there (by another device's sync app, the server's own versions).
        // Looked at again now, and sent over it, rather than at the check of
        // every six hours.
        let entry = format!("devices/{own}.device");
        if lane == Lane::Main
            && let Some((size, at)) = state.own_entry
            && at > sending.last
            && sending.sent.get(&entry).is_some_and(|sent| sent.size != size)
        {
            sending.sent.remove(&entry);
        }
        let host = state.host();
        // The server unreachable a moment ago: not tried before its backoff.
        if !again && now < sending.retry_at {
            pulled.problem = Some(format!("waiting:{host}"));
            return pulled;
        }
        sending.tried = now;
        let check = again || sending.checked == 0 || now - sending.checked >= CHECK_AGAIN;
        let frugal = frugal || sending.slow();
        let files: Vec<String> = match lane {
            // A multimedia message's media before the request that names them.
            Lane::Urgent => {
                let mut names: Vec<&String> = sealed.keys().collect();
                names.sort();
                let mut files: Vec<String> = names.into_iter().map(|name| format!("blobs/{name}")).filter(|relative| folder.join(relative).is_file()).collect();
                files.extend(own_urgent(folder, own));
                files
            }
            Lane::Main => {
                let mut files = own_plain(folder, own);
                let mut names: Vec<&String> = sealed.keys().collect();
                names.sort();
                files.extend(names.into_iter().map(|name| format!("blobs/{name}")).filter(|relative| folder.join(relative).is_file()));
                files
            }
        };
        // Listed, its records past their time still there are taken out (`Sender::take_out_past`).
        let past = if lane == Lane::Main && check { crate::share::rounds_past(folder, memory, own, now * 1000) } else { None };
        // And what it took out here of the devices that no longer count (`Sender::take_out_departed`).
        let departed = if lane == Lane::Main && check { Departed::load(memory, own) } else { Departed::default() };
        let outcome = Server::new(login, limits).map_err(Stop::Failed).and_then(|server| {
            let ran = Sender { server: &server, folder, memory, own, url: &state.url, sealed, sending: &mut sending, pulled: &mut pulled, now, frugal, lane, past, departed, known: &state.files, unlisted: BTreeSet::new() }.run(&files, check, again);
            pulled.listed_bytes += server.listed_bytes();
            ran
        });
        match outcome {
            Ok(()) => {
                sending.tries = 0;
                sending.retry_at = 0;
                if sending.held.is_empty() {
                    sending.last = now;
                    sending.said.clear();
                    sending.failure = None;
                } else if let Some(failure) = &sending.failure {
                    sending.said = format!("network:{host}");
                    pulled.failure = Some(failure.clone());
                }
                if check {
                    sending.checked = now;
                }
            }
            Err(Stop::Unconfirmed(why)) => sending.said = why,
            Err(Stop::Failed(e)) => {
                // Unreachable, refused, out of time: nothing more before the backoff.
                sending.tries += 1;
                sending.retry_at = now + backoff(sending.tries);
                sending.said = code(&e, &host);
                if sending.failure.as_ref().is_none_or(|f| f.at != now) {
                    sending.failure = Some(Failure { kind: kind_of_error(&e).into(), file: String::new(), words: e.to_string(), at: now, ..Failure::default() });
                }
                pulled.failure = sending.failure.clone();
            }
        }
        if again {
            sending.again = Again { at: now, sent: pulled.sent, same: pulled.same, said: sending.said.clone() };
        }
        // The urgent lane remembers only the media it carries now, never every message's for good.
        if lane == Lane::Urgent {
            sending.sent.retain(|relative, _| relative.strip_prefix("blobs/").is_none_or(|name| sealed.contains_key(name)));
        }
        let _ = sending.save(memory, lane);
        pulled.problem = (!sending.said.is_empty()).then(|| sending.said.clone());
        pulled
    })
}

/// A failure's kind, from its error alone (no file under way).
fn kind_of_error(e: &SyncError) -> &'static str {
    match e {
        SyncError::Login(_) | SyncError::AppPassword(_) => "login",
        SyncError::Tls(_) => "tls",
        SyncError::Server(d) if d == "quota" => "quota",
        SyncError::Server(_) => "server",
        SyncError::Disk(_) => "disk",
        SyncError::Network(d) if d == "out of time" => "out-of-time",
        _ => "unreachable",
    }
}

/// Sioul keeping the folder itself (`MIRROR`): "Send everything again". What
/// it remembers of sending this device's own files is forgotten (its sealed
/// files apart, which tell its own from the others'), and the server's
/// folders are looked through again: each own file goes over what is there
/// now, the others' newer files come. Said as `Sending::again` says it.
pub fn again_mirror(memory: &Path, folder: &Path, own: &str, login: &Login, now: i64) -> Pulled {
    again_mirror_with(memory, folder, own, login, now, LIMITS)
}

pub(crate) fn again_mirror_with(memory: &Path, folder: &Path, own: &str, login: &Login, now: i64, limits: Limits) -> Pulled {
    let forgot = sioul_core::filelock::with_lock(&memory.with_file_name("mirror.step"), || {
        let mut state = State::load(memory);
        if state.mode != MIRROR {
            return false;
        }
        state.sent.retain(|relative, _| relative.starts_with("blobs/"));
        state.folders.clear();
        state.save(memory).is_ok()
    });
    let pulled = if forgot { step_with(memory, folder, own, login, now, true, limits) } else { Pulled { problem: Some("not-confirmed".into()), ..Pulled::default() } };
    let mut sending = Sending::load(memory);
    sending.again = Again { at: now, sent: pulled.sent, same: 0, said: pulled.problem.clone().unwrap_or_default() };
    let _ = sending.save(memory, Lane::Main);
    pulled
}

/// This device's texts to send copied into the sharing folder as a small
/// file of its own, `texts/send/<id>.jsonl` (`source`: its own file of the
/// part "texts", every line sealed already): the sync app carries it, Sioul
/// sends it first (`send_urgent`), the others read it beside the records'
/// copy, so that a request reaches the phone within its quarter of an hour
/// whatever the records' size. None here, none there. Whether it changed.
pub fn place_texts(folder: &Path, own: &str, source: &Path) -> Result<bool, String> {
    place_urgent(&texts_file(folder, own), source)
}

/// This device's replies to send copied into the sharing folder as a small
/// file of its own, `phone-messages/ask/<id>.jsonl` (`source`: its own file of
/// the phone's messages' requests, every line sealed already), as its texts
/// to send are (`place_texts`). Whether it changed.
pub fn place_asks(folder: &Path, own: &str, source: &Path) -> Result<bool, String> {
    place_urgent(&asks_file(folder, own), source)
}

/// An urgent small file put in the sharing folder (`target`) as its source holds it: none there when none here.
fn place_urgent(target: &Path, source: &Path) -> Result<bool, String> {
    let target = target.to_path_buf();
    let Ok(bytes) = std::fs::read(source) else {
        return Ok(std::fs::remove_file(&target).is_ok());
    };
    if std::fs::read(&target).ok().as_deref() == Some(&bytes[..]) {
        return Ok(false);
    }
    if let Some(parent) = target.parent() {
        crate::share::private_dirs(parent).map_err(|e| format!("{}: {e}", parent.display()))?;
    }
    crate::share::write_atomically(&target, &bytes).map(|()| true)
}

/// Where a device's texts to send are, in the sharing folder (or a copy fetched from its server).
pub fn texts_file(folder: &Path, device: &str) -> PathBuf {
    folder.join("texts").join("send").join(format!("{device}.jsonl"))
}

/// Where a device's replies to send are, in the sharing folder (or a copy fetched from its server).
pub fn asks_file(folder: &Path, device: &str) -> PathBuf {
    folder.join("phone-messages").join("ask").join(format!("{device}.jsonl"))
}

/// This device's urgent files in the folder: its texts and its replies to send.
fn own_urgent(folder: &Path, own: &str) -> Vec<String> {
    URGENT.iter().map(|(top, sub)| format!("{top}/{sub}/{own}.jsonl")).filter(|relative| folder.join(relative).is_file()).collect()
}

/// A file of the folder, by its kind, for what is said: never its name.
fn file_kind(relative: &str) -> &'static str {
    match kind_of(relative) {
        Some((Kind::Round, _)) => "records",
        Some((Kind::Seen, _)) => "notes",
        Some((Kind::Device, _)) => "entry",
        Some((Kind::Claim, _)) => "claim",
        Some((Kind::Urgent, _)) if relative.starts_with("phone-messages/") => "replies",
        Some((Kind::Urgent, _)) => "texts",
        None => "sealed",
    }
}

/// What came of one file: gone or the same there, left (unchanged, paced,
/// longer there), or held back after a failure.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum Went {
    Done,
    Left,
    Held,
}

/// One send beside the sync app.
struct Sender<'a> {
    server: &'a Server,
    folder: &'a Path,
    /// The sharing's memory (`share::rounds_past` reads where its rounds stand).
    memory: &'a Path,
    own: &'a str,
    /// The folder there, an address ending with "/".
    url: &'a str,
    sealed: &'a BTreeMap<String, u64>,
    sending: &'a mut Sending,
    pulled: &'a mut Pulled,
    now: i64,
    frugal: bool,
    lane: Lane,
    /// With a listing: this device's rounds below this one are past their
    /// time (`share::rounds_past`), taken out there when still listed.
    past: Option<u32>,
    /// With a listing: what this device took out here of the devices that
    /// no longer count (`Departed`), taken out there too.
    departed: Departed,
    /// The others' files as the pull last saw them there (`State::files`): a
    /// removed device's file is taken out only while still as seen.
    known: &'a BTreeMap<String, Fetched>,
    /// The folders a check could not list (`list_own`).
    unlisted: BTreeSet<String>,
}

/// What a device took out of its folder of the devices that no longer count
/// by a sealed fact (they left, you forgot them, another device replaces
/// them), as its last exchange said (`share::departed_past`,
/// `share::swept_theirs`): each one's rounds below a round, and the sealed
/// files it wrote that no record names any more, swept, with when. Never
/// fetched here again; taken out of the server at a listing (beside a sync
/// app, `Sender`; Sioul keeping the folder itself, `Puller::push`), each over
/// what is there as it is now (`If-Match`): a sync app, or another device
/// doing the same, makes it gone (`404`) or changed (`412`), and it is left.
#[derive(Debug, Default, Clone)]
pub(crate) struct Departed {
    rounds: BTreeMap<String, u32>,
    blobs: BTreeMap<String, i64>,
    /// The devices whose files you removed here ("Remove its files",
    /// `share::removed_devices`): their rounds before the last are below
    /// `rounds`; their last round while no longer than it was, and each
    /// small file of theirs that went (claims, texts to send, the entry and
    /// the note of how far it read when they went too) still as it was last
    /// seen there (`State::files`: never one it wrote since), are not fetched
    /// again, and taken out when gone here (`removed_as_known`).
    devices: BTreeMap<String, crate::share::RemovedDevice>,
}

impl Departed {
    fn load(memory: &Path, own: &str) -> Departed {
        Departed { rounds: crate::share::departed_past(memory, own), blobs: crate::share::swept_theirs(memory, own), devices: crate::share::removed_devices(memory, own) }
    }

    /// Whether a file there is one that went with a removed device's files
    /// as it had it when you removed them: its last round no longer than it
    /// was then (`share::RemovedDevice::holds_round`; those before by the
    /// floor, `past_round`), its claims, its texts to send, its entry and
    /// its note when they went too, still as `known` last saw them there.
    /// One it wrote since (a device still in use goes on writing) is not.
    fn removed_as_known(&self, relative: &str, item: &Item, known: &BTreeMap<String, Fetched>) -> bool {
        let Some((kind, id)) = kind_of(relative) else { return false };
        let Some(removed) = self.devices.get(id) else { return false };
        let went = match kind {
            Kind::Round => return round_of(relative).is_some_and(|round| removed.holds_round(round, item.size)),
            Kind::Device => removed.entry,
            Kind::Seen => removed.notes,
            Kind::Claim | Kind::Urgent => true,
        };
        went && !item.etag.is_empty() && known.get(relative).is_some_and(|seen| seen.etag == item.etag)
    }

    /// Whether a file of the folder is a round past its time of a device that no longer counts.
    fn past_round(&self, relative: &str) -> bool {
        match kind_of(relative) {
            Some((Kind::Round, id)) => self.rounds.get(id).is_some_and(|below| round_of(relative).is_some_and(|round| round < *below)),
            _ => false,
        }
    }

    /// Whether a sealed file (its name in `blobs/`) was swept here as such a device's.
    fn swept(&self, name: &str) -> bool {
        self.blobs.contains_key(name)
    }
}

/// A round's number, from its file's name (`<id>-<round>.jsonl`).
fn round_of(relative: &str) -> Option<u32> {
    relative.trim_end_matches(".jsonl").rsplit('-').next().and_then(|n| n.parse::<u32>().ok())
}

/// A sealed file this device swept as written by a device that no longer
/// counts (`Departed::blobs`), taken out there when it is still as old there
/// as it was here (its time there, `getlastmodified`, two weeks at least
/// before it was swept: another device that uses that content again makes it
/// fresh, `blobs::put`, and its sync app sends the new time), over its ETag
/// there now. Whether it went. Any failure, any other answer: left there.
fn take_out_swept(server: &Server, url: &str, swept_ms: i64) -> bool {
    let Ok(Some(there)) = server.stat(url) else { return false };
    let old = there.modified.is_some_and(|at| at <= swept_ms / 1000 - crate::blobs::UNUSED_DAYS * 86_400);
    if there.dir || there.etag.is_empty() || !old {
        return false;
    }
    matches!(server.delete(url, Some(&there.etag)), Ok(200 | 204))
}

impl Sender<'_> {
    fn url(&self, relative: &str) -> String {
        format!("{}{}", self.url, encode_path(relative))
    }

    /// `files` in their order (records first, by round, then the notes to
    /// the others, the claims, the entry, the sealed files last): nothing
    /// large holds back what the others wait for. A records file held back
    /// holds the next ones (records go in order); the other files still go.
    fn run(&mut self, files: &[String], check: bool, again: bool) -> Result<(), Stop> {
        let listed = if check { Some(self.list_own()?) } else { None };
        // A folder that could not be listed (`blobs/`, thousands of names on a
        // slow line): its files are sent as when no check lists them.
        let unlisted = std::mem::take(&mut self.unlisted);
        let mut records_held = false;
        for relative in files {
            let records = matches!(kind_of(relative), Some((Kind::Round, _)));
            if records && records_held {
                continue;
            }
            let there = listed.as_ref().filter(|_| !unlisted.contains(dir_of(relative))).map(|listed| listed.get(relative).cloned());
            // "Send everything again" while its folder could not be listed: each asked there itself.
            let look = again && listed.is_some() && unlisted.contains(dir_of(relative));
            let went = self.one(relative, there, again, look)?;
            records_held |= records && went == Went::Held;
        }
        if self.lane == Lane::Main {
            self.take_out_gone(check)?;
            if let (Some(listed), Some(past)) = (&listed, self.past) {
                self.take_out_past(listed, past)?;
            }
            if let Some(listed) = &listed {
                self.take_out_departed(listed);
            }
        }
        Ok(())
    }

    /// The server's copies of this device's files, by their path in the
    /// folder: the folder itself, `devices/`, each part's claims, `blobs/`
    /// (when this device sealed any), `texts/send/`, `phone-messages/ask/`. A folder not there holds none.
    fn list_own(&mut self) -> Result<BTreeMap<String, Item>, Stop> {
        let mut out = BTreeMap::new();
        let root = self.server.list(self.url).map_err(|e| match e {
            SyncError::NotFound(_) => Stop::Unconfirmed(format!("seal-gone:{}", host_of(self.url))),
            e => Stop::Failed(e),
        })?;
        self.pulled.listed += root.items.len();
        let mut dirs: Vec<String> = Vec::new();
        for (name, item) in &root.items {
            if item.dir {
                if name == "devices" || (name == "blobs" && !self.sealed.is_empty() && self.lane == Lane::Main) {
                    dirs.push(format!("{name}/"));
                }
                // The urgent lane's media, each asked by its own name: never thousands listed there.
                if name == "blobs" && !self.sealed.is_empty() && self.lane == Lane::Urgent {
                    self.unlisted.insert("blobs/".into());
                }
                if let Some((top, sub)) = URGENT.iter().find(|(top, _)| name == top) {
                    dirs.push(format!("{top}/{sub}/"));
                }
                if name == "leases" {
                    match self.server.list(&self.url("leases/")) {
                        Ok(parts) => dirs.extend(parts.items.iter().filter(|(_, item)| item.dir).map(|(part, _)| format!("leases/{part}/"))),
                        Err(SyncError::NotFound(_)) => {}
                        Err(e) => return Err(Stop::Failed(e)),
                    }
                }
            } else {
                out.insert(name.clone(), item.clone());
            }
        }
        for dir in dirs {
            // `blobs/` given a minute: thousands of names on a slow line.
            let listing = if dir == "blobs/" { self.server.list_within(self.server.limits.large, &self.url(&dir)) } else { self.server.list(&self.url(&dir)) };
            match listing {
                Ok(listing) => {
                    self.pulled.listed += listing.items.len();
                    out.extend(listing.items.into_iter().filter(|(_, item)| !item.dir).map(|(name, item)| (format!("{dir}{name}"), item)));
                }
                Err(SyncError::NotFound(_)) => {}
                // Too slow, cut: this check goes on without it, said in the
                // log; its sealed files are sent as without a check. Until 17
                // October 2026 such a failure failed the whole check, and the
                // next, and every send after became a check again (review of
                // 17 October 2026, M4).
                Err(_) if dir == "blobs/" => {
                    self.pulled.listing_failed = true;
                    self.unlisted.insert(dir);
                }
                Err(e) => return Err(Stop::Failed(e)),
            }
        }
        Ok(out)
    }

    /// Whether the server's copy is this file as it is here: a sealed file
    /// by its size (its name is its content's); records by their size (they
    /// only grow, one writer) and their checksum when the server keeps one;
    /// the rest by their checksum, else read there and compared.
    fn same(&self, relative: &str, there: &Item, bytes: &[u8], sha1: &str) -> Result<bool, Stop> {
        if there.dir || there.size != bytes.len() as u64 {
            return Ok(false);
        }
        if relative.starts_with("blobs/") {
            return Ok(true);
        }
        if let Some(theirs) = sha1_of(&there.checksum) {
            return Ok(theirs == sha1);
        }
        if matches!(kind_of(relative), Some((Kind::Round, _))) {
            return Ok(true);
        }
        Ok(self.server.small_up_to(&self.url(relative), TEXTS_LARGEST)?.is_some_and(|(theirs, _)| theirs == bytes))
    }

    /// One of this device's files, sent when it changed here since it went
    /// (or, `there` listed, when the server's copy is not this one), over
    /// what is there as it was seen. Refused because it changed there
    /// meanwhile (`412`): the server's copy looked at; the same as here (the
    /// sync app sent it), nothing more; else sent over it. A folder missing
    /// there (`409`), made first. Too slow or cut: held back (`backoff`).
    /// `look`: "Send everything again" while its folder could not be listed:
    /// what is there asked of the server itself, never taken as unchanged
    /// (review of 18 October 2026, L-7).
    fn one(&mut self, relative: &str, listed: Option<Option<Item>>, again: bool, look: bool) -> Result<Went, Stop> {
        let path = self.folder.join(relative);
        let Ok(meta) = std::fs::metadata(&path) else { return Ok(Went::Left) };
        let (size, modified) = (meta.len(), crate::share::modified_ns(&meta));
        let blob = relative.strip_prefix("blobs/");
        // A sealed file goes whole, as this device sealed it, or not at all.
        if blob.is_some_and(|name| self.sealed.get(name) != Some(&size)) {
            return Ok(Went::Left);
        }
        let records = matches!(kind_of(relative), Some((Kind::Round, _)));
        let sent = self.sending.sent.get(relative).cloned();
        let same_here = sent.as_ref().is_some_and(|s| s.size == size && s.modified == modified);
        match &listed {
            None if same_here && !look => return Ok(Went::Left),
            Some(there) if same_here && !again && there.as_ref().is_some_and(|t| t.etag == sent.as_ref().map_or("", |s| s.etag.as_str())) => return Ok(Went::Left),
            _ => {}
        }
        // Held back after a failure: never tried before its backoff.
        if !again && self.sending.held.get(relative).is_some_and(|held| self.now < held.until) {
            return Ok(Went::Held);
        }
        // Records only grow: one cut here (a sync app put an older copy back)
        // is never sent over a longer one; the exchange opens a new round.
        if records && sent.as_ref().is_some_and(|s| size < s.size) {
            self.pulled.longer += 1;
            return Ok(Went::Left);
        }
        // A large file on a metered or slow connection: at most every ten minutes.
        let large = size > LARGE_FILE;
        if large && self.frugal && !again && self.now - self.sending.large_at < PACE {
            self.pulled.paced += 1;
            return Ok(if records { Went::Held } else { Went::Left });
        }
        let bytes = std::fs::read(&path).map_err(|e| Stop::Failed(SyncError::Disk(format!("{relative}: {e}"))))?;
        // Read while it grew: what was read is what goes, said as it is.
        let size = bytes.len() as u64;
        let sha1 = sha1_hex(&bytes);
        let url = self.url(relative);
        // What is there: as listed; else, never sent or its ETag unsaid, asked.
        let mut there: Option<Option<Item>> = listed;
        if there.is_none() && (look || sent.as_ref().is_none_or(|s| s.etag.is_empty())) {
            there = Some(self.server.stat(&url)?);
        }
        let modified_s = modified / 1_000_000_000;
        for attempt in 0..3 {
            if let Some(Some(item)) = &there {
                if self.same(relative, item, &bytes, &sha1)? {
                    self.sending.sent.insert(relative.to_string(), Sent { size, modified, etag: item.etag.clone() });
                    self.sending.held.remove(relative);
                    self.pulled.same += 1;
                    return Ok(Went::Done);
                }
                // Not the same: said by kind and size, for the log (nothing of its name or content).
                if self.pulled.differ.len() < 8 {
                    self.pulled.differ.push(format!("{} {size} here, {} there", file_kind(relative), item.size));
                }
                // Longer there than here: never cut. Remembered at the server's
                // size, so that what is appended here later, while still
                // shorter, is never sent over it either.
                if records && item.size > size {
                    self.sending.sent.insert(relative.to_string(), Sent { size: item.size, modified, etag: item.etag.clone() });
                    self.pulled.longer += 1;
                    return Ok(Went::Left);
                }
            }
            let seen: Option<String> = match &there {
                Some(Some(item)) => Some(item.etag.clone()),
                Some(None) => None,
                None => sent.as_ref().map(|s| s.etag.clone()),
            };
            if large {
                self.sending.large_at = self.now;
            }
            let started = Instant::now();
            let (status, etag) = match self.server.put_file(&url, bytes.clone(), seen.as_deref(), modified_s, &sha1) {
                Ok(answer) => answer,
                Err(failed) => return self.failed(relative, failed),
            };
            match status {
                200 | 201 | 204 => {
                    self.sending.sent.insert(relative.to_string(), Sent { size, modified, etag: etag.unwrap_or_default() });
                    self.sending.held.remove(relative);
                    self.pulled.sent += 1;
                    self.pulled.bytes += size;
                    if size >= 64 << 10 {
                        self.sending.rate = size * 1000 / (started.elapsed().as_millis() as u64).max(1);
                    }
                    return Ok(Went::Done);
                }
                // Changed there meanwhile, or gone: looked at again.
                412 | 404 => there = Some(self.server.stat(&url)?),
                409 if attempt == 0 => self.make_folders(relative)?,
                507 => return Err(Stop::Failed(SyncError::Server("quota".into()))),
                status => return Err(Stop::Failed(SyncError::Server(format!("PUT: {status}")))),
            }
        }
        Err(Stop::Failed(SyncError::Server("PUT: 412".into())))
    }

    /// A file that did not go, said in detail (`Sending::failure`). Too slow
    /// or cut on its way (the connection made, its bytes moving): that file
    /// held back (`backoff`), the others still going. Else (the server
    /// unreachable, refused, out of time): the send stops.
    fn failed(&mut self, relative: &str, failed: PutFailed) -> Result<Went, Stop> {
        self.sending.failure = Some(Failure { kind: failed.kind.into(), file: file_kind(relative).into(), seconds: failed.seconds, sent: failed.sent, total: failed.total, words: failed.words.clone(), at: self.now });
        if failed.sent > 0 && failed.seconds > 0 {
            self.sending.rate = failed.sent / failed.seconds;
        }
        if matches!(failed.kind, "timeout" | "stalled" | "network") && failed.sent > 0 {
            let held = self.sending.held.entry(relative.to_string()).or_default();
            held.tries += 1;
            held.until = self.now + backoff(held.tries);
            self.pulled.held += 1;
            return Ok(Went::Held);
        }
        Err(Stop::Failed(failed.error))
    }

    /// The folders a file's path goes through, made there (`MKCOL`) when missing.
    fn make_folders(&mut self, relative: &str) -> Result<(), Stop> {
        let mut at = String::new();
        let names: Vec<&str> = relative.split('/').collect();
        for name in &names[..names.len().saturating_sub(1)] {
            at = format!("{at}{name}/");
            match self.server.mkcol(&self.url(&at))? {
                201 | 405 => {}
                status => return Err(Stop::Failed(SyncError::Server(format!("MKCOL: {status}")))),
            }
        }
        Ok(())
    }

    /// What this device sent and let go here, taken out there as it was
    /// sent (`If-Match`): its records past their time (removed here once
    /// every device read past them), never its last round, and nothing while
    /// none of its records is here; the sealed files it swept. Gone there
    /// already: forgotten. Changed there since (`412`): looked at there, and
    /// taken out when it is still what this device sent (`again_after_412`).
    /// Any other answer (`423` while a sync app sends that very file again, a
    /// server's error, `403`), or a look that fails: left there, the send
    /// going on, never held back for it; a round forgotten here and looked
    /// for again at the next listing (`take_out_past`), a sealed file kept
    /// here and tried again at the next listing (`Sending::refused`; `check`:
    /// this send lists). Until the final review of 15 October 2026 (RES-1)
    /// such an answer failed the whole send, after its files went, and held
    /// the next sends back, the records with them. Another file gone here (a
    /// claim of a part no longer kept) is forgotten, left there.
    fn take_out_gone(&mut self, check: bool) -> Result<(), Stop> {
        let latest = own_latest(self.folder, self.own);
        let gone: Vec<(String, Sent)> = self.sending.sent.iter().filter(|(relative, _)| !self.folder.join(relative).exists()).map(|(relative, sent)| (relative.clone(), sent.clone())).collect();
        // Refused there, then here again (its content used again, or brought back): no longer waiting.
        let (folder, Sending { refused, sent, .. }) = (self.folder, &mut *self.sending);
        refused.retain(|relative| sent.contains_key(relative) && !folder.join(relative).exists());
        // A round gone here is past its time only below the readers' floor
        // (`share::rounds_past`), as `remove_old_rounds` judged it: one gone
        // from a folder synced again in part, a backup put back or a file
        // kept on demand stays there for a reader that has not read it
        // (review of 15 October 2026, L2). Read only when a round went.
        let rounds = gone.iter().any(|(relative, _)| matches!(kind_of(relative), Some((Kind::Round, _))));
        let floor = if rounds { crate::share::rounds_past(self.folder, self.memory, self.own, self.now * 1000) } else { None };
        for (relative, sent) in gone {
            let round = relative.trim_end_matches(".jsonl").rsplit('-').next().and_then(|n| n.parse::<u32>().ok());
            let past = matches!(kind_of(&relative), Some((Kind::Round, _))) && round.zip(latest).is_some_and(|(round, latest)| round < latest) && round.zip(floor).is_some_and(|(round, floor)| round < floor);
            let swept = relative.strip_prefix("blobs/").is_some_and(|name| !self.sealed.contains_key(name));
            if swept && !check && self.sending.refused.contains(&relative) {
                continue;
            }
            let mut settled = true;
            if past || swept {
                settled = match self.server.delete(&self.url(&relative), Some(&sent.etag).filter(|e| !e.is_empty()).map(String::as_str))? {
                    200 | 204 => {
                        self.pulled.taken_out += 1;
                        true
                    }
                    412 => self.again_after_412(&relative, &sent, past),
                    // Gone there already.
                    404 => true,
                    // Any other answer: left there.
                    _ => false,
                };
            }
            if swept && !settled {
                self.sending.refused.insert(relative);
            } else if past || swept || !matches!(kind_of(&relative), Some((Kind::Round, _))) {
                self.sending.sent.remove(&relative);
                self.sending.held.remove(&relative);
                self.sending.refused.remove(&relative);
            }
        }
        Ok(())
    }

    /// One of this device's files to take out there, refused as changed
    /// there since it went (`412`). A sync app sends the same file again:
    /// eDrive sends each file Sioul sent, the same bytes, and Nextcloud gives
    /// it a new ETag. Until 15 October 2026 such a file was forgotten here and
    /// stayed on the server for good (a phone's past full rounds, 47 MB on the
    /// owner's). Looked at there now: of the size this device sent (records
    /// only grow and only this device writes them; a sealed file's name is
    /// its content's), and for a sealed file still dated as this device sent
    /// it, it is taken out, over its ETag there now. A sealed file dated
    /// otherwise was sent there again by another device that uses that
    /// content again (`blobs::put` makes it fresh, and its sync app sends the
    /// new time): its use, never taken out. Of another size there (a round
    /// grown there): left there, forgotten here; this device's past rounds
    /// are looked for again at each listing (`take_out_past`). Refused again,
    /// or any other answer, a failure too (a server's error, a timeout): left
    /// there, the send going on and not held back (review of 15 October 2026,
    /// L1), a round forgotten here as above, a sealed file kept here and tried
    /// again at the next listing (`Sending::refused`). Whether it is settled:
    /// taken out, gone there, or not this device's to take out.
    fn again_after_412(&mut self, relative: &str, sent: &Sent, records: bool) -> bool {
        let url = self.url(relative);
        let there = match self.server.stat(&url) {
            Ok(Some(there)) => there,
            Ok(None) => return true,
            Err(_) => return false,
        };
        let dated = records || there.modified == Some((sent.modified / 1_000_000_000) as i64);
        if there.dir || there.etag.is_empty() || there.size != sent.size || !dated {
            return true;
        }
        match self.server.delete(&url, Some(&there.etag)) {
            Ok(200 | 204) => {
                self.pulled.taken_out += 1;
                true
            }
            Ok(404) => true,
            _ => false,
        }
    }

    /// This device's records past their time still listed there (below
    /// `past`, `share::rounds_past`: every device heard lately read past
    /// them, and none is its last full round or one continuing it) and gone
    /// here: taken out over their ETag there, whatever sent them, so that
    /// those a sync app left there (eDrive passes no deletion on), or that
    /// were forgotten here before 15 October 2026, go too. Only files named
    /// as this device's records, never another device's file; nothing while
    /// none of its records is here. Refused, or any other answer: left for
    /// the next listing, the send going on.
    fn take_out_past(&mut self, listed: &BTreeMap<String, Item>, past: u32) -> Result<(), Stop> {
        if own_latest(self.folder, self.own).is_none() {
            return Ok(());
        }
        let old: Vec<(String, String)> = listed
            .iter()
            .filter(|(relative, item)| !item.dir && !item.etag.is_empty() && matches!(kind_of(relative), Some((Kind::Round, id)) if id == self.own))
            .filter(|(relative, _)| relative.trim_end_matches(".jsonl").rsplit('-').next().and_then(|n| n.parse::<u32>().ok()).is_some_and(|round| round < past))
            .filter(|(relative, _)| !self.folder.join(relative).exists())
            .map(|(relative, item)| (relative.clone(), item.etag.clone()))
            .collect();
        for (relative, etag) in old {
            if matches!(self.server.delete(&self.url(&relative), Some(&etag))?, 200 | 204) {
                self.pulled.taken_out += 1;
                self.sending.sent.remove(&relative);
                self.sending.held.remove(&relative);
            }
        }
        Ok(())
    }

    /// What this device took out here of the devices that no longer count
    /// (`Departed`), still listed there and gone here (from the folder and
    /// from what was fetched beside it): their past rounds over the ETag
    /// listed, the sealed files swept when still as old there
    /// (`take_out_swept`). Any device that counts does the same; a file
    /// another took out first is gone (`404`), one sent again since is
    /// changed (`412`): left, as any other answer or failure, for the next
    /// listing, the send going on.
    fn take_out_departed(&mut self, listed: &BTreeMap<String, Item>) {
        if self.departed.rounds.is_empty() && self.departed.blobs.is_empty() && self.departed.devices.is_empty() {
            return;
        }
        let fetched = overlay(self.folder);
        let here = |relative: &str| self.folder.join(relative).exists() || fetched.as_ref().is_some_and(|f| f.join(relative).exists());
        let rounds: Vec<(String, String)> = listed.iter().filter(|(relative, item)| !item.dir && !item.etag.is_empty() && (self.departed.past_round(relative) || self.departed.removed_as_known(relative, item, self.known)) && !here(relative)).map(|(relative, item)| (relative.clone(), item.etag.clone())).collect();
        let blobs: Vec<(String, i64)> = self.departed.blobs.iter().map(|(name, at)| (format!("blobs/{name}"), *at)).filter(|(relative, _)| !here(relative)).collect();
        for (relative, etag) in rounds {
            if matches!(self.server.delete(&self.url(&relative), Some(&etag)), Ok(200 | 204)) {
                self.pulled.taken_out += 1;
            }
        }
        for (relative, at) in blobs {
            if take_out_swept(self.server, &self.url(&relative), at) {
                self.pulled.taken_out += 1;
            }
        }
    }
}

#[cfg(test)]
pub(crate) mod fake {
    //! A Nextcloud in a test: an account's files, a folder on the disk,
    //! served over WebDAV on 127.0.0.1 (plain HTTP, which only a test build
    //! reaches: `dav::allowed`), a request and a thread per connection; faults
    //! to inject, and every request seen. Its sign-in in the browser too
    //! (Login Flow v2, `loginflow`): a flow begun, granted when a test says
    //! the person signed in (`grant_flows`), answered once, the app password
    //! it made then opening the account as the password does, until given
    //! back (`DELETE /ocs/v2.php/core/apppassword`); its principal names the
    //! homes of the calendars and the address books (`dav::discover_on`).

    use std::collections::hash_map::DefaultHasher;
    use std::hash::{Hash, Hasher};
    use std::io::{BufRead, BufReader, Read, Write};
    use std::net::{TcpListener, TcpStream};
    use std::path::{Path, PathBuf};
    use std::sync::{Arc, Mutex};
    use std::time::Duration;

    pub(crate) const USER: &str = "jane";
    pub(crate) const PASSWORD: &str = "correct horse battery staple";
    const FILES: &str = "/remote.php/dav/files/jane";
    /// The app passwords the sign-in makes: this, and a number.
    pub(crate) const APP_PASSWORD: &str = "stand-in-app-password-";

    /// A sign-in begun (Login Flow v2): its poll token, whether the person
    /// granted access in the browser, whether its answer was given (once).
    #[derive(Debug, Clone, Default)]
    pub(crate) struct Flow {
        pub(crate) token: String,
        pub(crate) granted: bool,
        pub(crate) answered: bool,
    }

    /// What the stand-in's sign-in says: where its poll address is ("" its
    /// own), which server its answer names ("" its own), the login name it gives.
    #[derive(Debug, Clone, Default)]
    pub(crate) struct Signing {
        pub(crate) endpoint: String,
        pub(crate) server: String,
        pub(crate) login: String,
    }

    /// How the server misbehaves, for one request.
    #[derive(Debug, Clone, Copy)]
    pub(crate) enum Fault {
        /// Answers this status, doing nothing.
        Status(u16),
        /// Waits this long, then answers.
        Late(Duration),
        /// Says the whole answer's length, sends this many bytes of it, and closes.
        Cut(usize),
        /// Closes without a word.
        Drop,
    }

    /// A request, as read: its path decoded.
    pub(crate) struct Request {
        pub method: String,
        pub path: String,
        headers: Vec<(String, String)>,
        pub body: Vec<u8>,
    }

    impl Request {
        pub fn header(&self, name: &str) -> Option<&str> {
            self.headers.iter().find(|(n, _)| n.eq_ignore_ascii_case(name)).map(|(_, v)| v.as_str())
        }
    }

    type Faults = Vec<Box<dyn FnMut(&Request) -> Option<Fault> + Send>>;
    pub(crate) type Reply = (u16, Vec<(&'static str, String)>, Vec<u8>);

    pub(crate) struct Fake {
        /// The account's files: `<files>/<path>` is `/remote.php/dav/files/jane/<path>`.
        pub(crate) files: PathBuf,
        pub(crate) base: String,
        /// The checksums files were sent with (`OC-Checksum`), as Nextcloud
        /// keeps them: by file, with its ETag then; a file changed since by
        /// other hands (a test's own copy) has none.
        sums: Mutex<std::collections::BTreeMap<PathBuf, (String, String)>>,
        /// An uplink this slow (bytes a second) for what is sent to it; none: as fast as it comes.
        pub(crate) throttle: Mutex<Option<u64>>,
        /// The bytes of every `PUT` it took, whole or not: what a sending costs.
        pub(crate) received: std::sync::atomic::AtomicU64,
        faults: Mutex<Faults>,
        seen: Mutex<Vec<String>>,
        /// Serving one request at a time: a listing never sees a file half written by a test's own copy.
        pub(crate) turn: Mutex<()>,
        /// The sign-ins begun (`loginflow`), and what they say.
        pub(crate) flows: Mutex<Vec<Flow>>,
        pub(crate) signing: Mutex<Signing>,
        /// The app passwords it made and that still open the account.
        pub(crate) app_passwords: Mutex<Vec<String>>,
    }

    impl Fake {
        pub(crate) fn start(files: &Path) -> Arc<Fake> {
            let listener = TcpListener::bind("127.0.0.1:0").unwrap();
            let base = format!("http://127.0.0.1:{}", listener.local_addr().unwrap().port());
            let fake = Arc::new(Fake {
                files: files.to_path_buf(),
                base,
                sums: Mutex::new(std::collections::BTreeMap::new()),
                throttle: Mutex::new(None),
                received: std::sync::atomic::AtomicU64::new(0),
                faults: Mutex::new(Vec::new()),
                seen: Mutex::new(Vec::new()),
                turn: Mutex::new(()),
                flows: Mutex::new(Vec::new()),
                signing: Mutex::new(Signing::default()),
                app_passwords: Mutex::new(Vec::new()),
            });
            let serving = Arc::clone(&fake);
            std::thread::spawn(move || {
                for stream in listener.incoming().filter_map(Result::ok) {
                    let fake = Arc::clone(&serving);
                    std::thread::spawn(move || fake.exchange(stream));
                }
            });
            fake
        }

        /// The account, as a contacts-and-calendars account found it: at its calendars' address.
        pub(crate) fn login(&self) -> super::Login {
            super::Login { account: "cloud".into(), url: format!("{}/remote.php/dav/calendars/{USER}/", self.base), user: USER.into(), password: Some(PASSWORD.into()) }
        }

        /// A folder of the account's files, as an address ending with "/".
        pub(crate) fn folder_url(&self, path: &str) -> String {
            format!("{}{FILES}/{}/", self.base, path.trim_matches('/'))
        }

        /// A fault, asked of each request until one says one.
        pub(crate) fn fault(&self, fault: impl FnMut(&Request) -> Option<Fault> + Send + 'static) {
            self.faults.lock().unwrap().push(Box::new(fault));
        }

        pub(crate) fn clear_faults(&self) {
            self.faults.lock().unwrap().clear();
        }

        /// The requests seen, in order: "GET /remote.php/dav/files/jane/Documents/Sioul/seal.toml 200".
        pub(crate) fn seen(&self) -> Vec<String> {
            self.seen.lock().unwrap().clone()
        }

        pub(crate) fn forget_seen(&self) {
            self.seen.lock().unwrap().clear();
        }

        fn exchange(&self, mut stream: TcpStream) {
            let throttle = *self.throttle.lock().unwrap();
            let Some(request) = read(&stream, throttle, &self.received) else { return };
            let fault = self.faults.lock().unwrap().iter_mut().find_map(|f| f(&request));
            let (status, headers, body) = match fault {
                Some(Fault::Drop) => {
                    self.note(&request, "dropped");
                    return;
                }
                Some(Fault::Status(status)) => (status, Vec::new(), Vec::new()),
                Some(Fault::Late(wait)) => {
                    std::thread::sleep(wait);
                    self.answer(&request)
                }
                _ => self.answer(&request),
            };
            self.note(&request, &status.to_string());
            let mut head = format!("HTTP/1.1 {status} Fake\r\nContent-Length: {}\r\nConnection: close\r\n", body.len());
            for (name, value) in &headers {
                head.push_str(&format!("{name}: {value}\r\n"));
            }
            head.push_str("\r\n");
            if stream.write_all(head.as_bytes()).is_err() {
                return;
            }
            let sent = match fault {
                Some(Fault::Cut(n)) => &body[..n.min(body.len())],
                _ => &body[..],
            };
            let _ = stream.write_all(sent);
            let _ = stream.flush();
        }

        /// A file's checksums as kept, while it is as it was sent.
        fn sum_of(&self, path: &Path) -> Option<String> {
            let sums = self.sums.lock().unwrap();
            sums.get(path).filter(|(etag, _)| *etag == etag_of(path)).map(|(_, sum)| sum.clone())
        }

        fn propfind(&self, request: &Request, relative: &str, path: &Path) -> Reply {
            let Ok(meta) = std::fs::metadata(path) else { return (404, Vec::new(), Vec::new()) };
            let mut out = entry(&href(relative, meta.is_dir()), meta.is_dir(), &etag_of(path), meta.len(), self.sum_of(path), date_of(path));
            if meta.is_dir() && request.header("Depth") != Some("0") {
                let mut children: Vec<_> = std::fs::read_dir(path).into_iter().flatten().filter_map(Result::ok).collect();
                children.sort_by_key(|e| e.file_name());
                for child in children {
                    let name = child.file_name().to_string_lossy().to_string();
                    let inside = if relative.is_empty() { name } else { format!("{relative}/{name}") };
                    let dir = child.file_type().is_ok_and(|t| t.is_dir());
                    out += &entry(&href(&inside, dir), dir, &etag_of(&child.path()), child.metadata().map_or(0, |m| m.len()), self.sum_of(&child.path()), date_of(&child.path()));
                }
            }
            (207, vec![("Content-Type", "application/xml; charset=utf-8".into())], multistatus(&out))
        }

        /// A file written whole (`PUT`), as Nextcloud does: its folder there,
        /// the precondition met (`If-None-Match: *` none there, `If-Match` its
        /// ETag); dated as `X-OC-Mtime` says, its `OC-Checksum` kept.
        fn put(&self, request: &Request, path: &Path) -> Reply {
            let reply = put(request, path);
            if matches!(reply.0, 201 | 204) {
                if let Some(seconds) = request.header("X-OC-Mtime").and_then(|t| t.parse::<u64>().ok())
                    && let Ok(file) = std::fs::File::options().write(true).open(path)
                {
                    let _ = file.set_modified(std::time::SystemTime::UNIX_EPOCH + Duration::from_secs(seconds));
                }
                let mut sums = self.sums.lock().unwrap();
                match request.header("OC-Checksum") {
                    Some(sum) => sums.insert(path.to_path_buf(), (etag_of(path), sum.to_string())),
                    None => sums.remove(path),
                };
            }
            reply
        }

        fn note(&self, request: &Request, what: &str) {
            self.seen.lock().unwrap().push(format!("{} {} {what}", request.method, request.path));
        }

        /// The person signed in and granted access in the browser, for every sign-in begun.
        pub(crate) fn grant_flows(&self) {
            for flow in self.flows.lock().unwrap().iter_mut() {
                flow.granted = true;
            }
        }

        /// A sign-in begun: its poll token, and the page to open, a token of its own in it.
        fn flow_begin(&self) -> Reply {
            let mut flows = self.flows.lock().unwrap();
            let token = format!("polltoken{}x{}", flows.len(), "A".repeat(100));
            flows.push(Flow { token: token.clone(), ..Flow::default() });
            let signing = self.signing.lock().unwrap().clone();
            let endpoint = if signing.endpoint.is_empty() { format!("{}/login/v2/poll", self.base) } else { signing.endpoint };
            let body = serde_json::json!({ "poll": { "token": token, "endpoint": endpoint }, "login": format!("{}/login/v2/flow/pagetoken{}", self.base, flows.len()) });
            (200, vec![("Content-Type", "application/json".into())], body.to_string().into_bytes())
        }

        /// A poll: 404 until granted, then the server, the login name and a new app password, once.
        fn flow_poll(&self, request: &Request) -> Reply {
            let body = String::from_utf8_lossy(&request.body).to_string();
            let Some(token) = body.strip_prefix("token=") else { return (404, Vec::new(), b"[]".to_vec()) };
            let mut flows = self.flows.lock().unwrap();
            let Some(flow) = flows.iter_mut().find(|f| f.token == token) else { return (404, Vec::new(), b"[]".to_vec()) };
            if !flow.granted || flow.answered {
                return (404, Vec::new(), b"[]".to_vec());
            }
            flow.answered = true;
            let mut made = self.app_passwords.lock().unwrap();
            let password = format!("{APP_PASSWORD}{}", made.len() + 1);
            made.push(password.clone());
            let signing = self.signing.lock().unwrap().clone();
            let server = if signing.server.is_empty() { self.base.clone() } else { signing.server };
            let login = if signing.login.is_empty() { USER.to_string() } else { signing.login };
            let body = serde_json::json!({ "server": server, "loginName": login, "appPassword": password });
            (200, vec![("Content-Type", "application/json".into())], body.to_string().into_bytes())
        }

        pub(crate) fn answer(&self, request: &Request) -> Reply {
            let _turn = self.turn.lock().unwrap();
            // The sign-in in the browser, before any login.
            if request.method == "POST" && request.path == "/index.php/login/v2" {
                return self.flow_begin();
            }
            if request.method == "POST" && request.path == "/login/v2/poll" {
                return self.flow_poll(request);
            }
            let basic = |login: &str, password: &str| format!("Basic {}", sioul_core::lines::base64_encode(format!("{login}:{password}").as_bytes()));
            let given = request.header("Authorization").unwrap_or_default().to_string();
            let app = self.app_passwords.lock().unwrap().iter().find(|password| given == basic(USER, password)).cloned();
            if given != basic(USER, PASSWORD) && app.is_none() {
                return (401, Vec::new(), Vec::new());
            }
            // An app password given back: it opens nothing any more.
            if request.method == "DELETE" && request.path == "/ocs/v2.php/core/apppassword" {
                return match app {
                    Some(password) => {
                        self.app_passwords.lock().unwrap().retain(|p| *p != password);
                        (200, Vec::new(), Vec::new())
                    }
                    None => (403, Vec::new(), Vec::new()),
                };
            }
            if request.method == "PROPFIND" && request.path == "/remote.php/dav" {
                let principal = format!("<d:response><d:href>/remote.php/dav/</d:href><d:propstat><d:prop><d:current-user-principal><d:href>/remote.php/dav/principals/users/{USER}/</d:href></d:current-user-principal></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat></d:response>");
                return (207, vec![("Content-Type", "application/xml".into())], multistatus(&principal));
            }
            // The principal's homes: its calendars' and its address books'.
            if request.method == "PROPFIND" && request.path == format!("/remote.php/dav/principals/users/{USER}") {
                let homes = format!("<d:response><d:href>/remote.php/dav/principals/users/{USER}/</d:href><d:propstat><d:prop><c:calendar-home-set xmlns:c=\"urn:ietf:params:xml:ns:caldav\"><d:href>/remote.php/dav/calendars/{USER}/</d:href></c:calendar-home-set><a:addressbook-home-set xmlns:a=\"urn:ietf:params:xml:ns:carddav\"><d:href>/remote.php/dav/addressbooks/users/{USER}/</d:href></a:addressbook-home-set></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat></d:response>");
                return (207, vec![("Content-Type", "application/xml".into())], multistatus(&homes));
            }
            let Some(relative) = request.path.strip_prefix(FILES).map(|r| r.trim_start_matches('/').to_string()) else { return (404, Vec::new(), Vec::new()) };
            let path = if relative.is_empty() { self.files.clone() } else { self.files.join(&relative) };
            match request.method.as_str() {
                "PROPFIND" => self.propfind(request, &relative, &path),
                "GET" => get(request, &path),
                "PUT" => self.put(request, &path),
                "MKCOL" => mkcol(&path),
                "DELETE" => delete(request, &path),
                _ => (405, Vec::new(), Vec::new()),
            }
        }
    }

    /// A request as it comes, its body at `throttle` bytes a second at most (a slow uplink).
    fn read(stream: &TcpStream, throttle: Option<u64>, received: &std::sync::atomic::AtomicU64) -> Option<Request> {
        let mut reader = BufReader::new(stream);
        let mut line = String::new();
        reader.read_line(&mut line).ok()?;
        let mut words = line.split_whitespace();
        let (method, raw) = (words.next()?.to_string(), words.next()?.to_string());
        let mut headers: Vec<(String, String)> = Vec::new();
        loop {
            let mut line = String::new();
            reader.read_line(&mut line).ok()?;
            let Some((name, value)) = line.trim_end().split_once(':') else { break };
            headers.push((name.trim().to_string(), value.trim().to_string()));
        }
        let length = headers.iter().find(|(n, _)| n.eq_ignore_ascii_case("content-length")).and_then(|(_, v)| v.parse().ok()).unwrap_or(0);
        let mut body = vec![0; length];
        let piece = throttle.map_or(length.max(1), |rate| usize::try_from(rate / 20).unwrap_or(usize::MAX).max(1));
        let mut at = 0;
        while at < length {
            let end = (at + piece).min(length);
            let read = reader.read_exact(&mut body[at..end]);
            if method == "PUT" {
                received.fetch_add((end - at) as u64, std::sync::atomic::Ordering::Relaxed);
            }
            read.ok()?;
            at = end;
            if throttle.is_some() && at < length {
                std::thread::sleep(Duration::from_millis(50));
            }
        }
        Some(Request { method, path: crate::dav::path_key(&raw), headers, body })
    }

    pub(crate) fn multistatus(responses: &str) -> Vec<u8> {
        format!(r#"<?xml version="1.0" encoding="utf-8"?><d:multistatus xmlns:d="DAV:" xmlns:oc="http://owncloud.org/ns">{responses}</d:multistatus>"#).into_bytes()
    }

    /// A file's ETag, from its content; a folder's, from all it holds, as Nextcloud's change with anything below them.
    pub(crate) fn etag_of(path: &Path) -> String {
        let mut hasher = DefaultHasher::new();
        if path.is_dir() {
            let mut names: Vec<_> = std::fs::read_dir(path).into_iter().flatten().filter_map(Result::ok).map(|e| e.file_name()).collect();
            names.sort();
            for name in names {
                name.hash(&mut hasher);
                etag_of(&path.join(&name)).hash(&mut hasher);
            }
        } else {
            std::fs::read(path).unwrap_or_default().hash(&mut hasher);
            GENERATIONS.lock().unwrap().get(path).copied().unwrap_or(0).hash(&mut hasher);
        }
        format!("{:016x}", hasher.finish())
    }

    /// How many times each file was written whole there: Nextcloud gives a
    /// file a new ETag at each `PUT`, the same bytes sent again included.
    static GENERATIONS: Mutex<std::collections::BTreeMap<PathBuf, u64>> = Mutex::new(std::collections::BTreeMap::new());

    /// A file written there anew (a `PUT`, or a test's sync app sending it): a new ETag, whatever it holds.
    pub(crate) fn bump(path: &Path) {
        *GENERATIONS.lock().unwrap().entry(path.to_path_buf()).or_insert(0) += 1;
    }

    fn entry(href: &str, dir: bool, etag: &str, size: u64, sum: Option<String>, modified: Option<String>) -> String {
        let kind = if dir { "<d:resourcetype><d:collection/></d:resourcetype>" } else { "<d:resourcetype/>" };
        let length = if dir { String::new() } else { format!("<d:getcontentlength>{size}</d:getcontentlength>") };
        let sums = sum.map(|sum| format!("<oc:checksums><oc:checksum>{sum}</oc:checksum></oc:checksums>")).unwrap_or_default();
        let modified = modified.map(|at| format!("<d:getlastmodified>{at}</d:getlastmodified>")).unwrap_or_default();
        format!("<d:response><d:href>{href}</d:href><d:propstat><d:prop>{kind}<d:getetag>&quot;{etag}&quot;</d:getetag>{length}{modified}{sums}</d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat></d:response>")
    }

    /// A file's time there, as Nextcloud says it (an HTTP date, to the second):
    /// the `X-OC-Mtime` its last `PUT` gave, or its time on the disk.
    fn date_of(path: &Path) -> Option<String> {
        let seconds = std::fs::metadata(path).ok()?.modified().ok()?.duration_since(std::time::UNIX_EPOCH).ok()?.as_secs();
        jiff::fmt::rfc2822::DateTimePrinter::new().timestamp_to_rfc9110_string(&jiff::Timestamp::from_second(seconds as i64).ok()?).ok()
    }

    pub(crate) fn href(relative: &str, dir: bool) -> String {
        let path = super::encode_path(relative);
        match (relative.is_empty(), dir) {
            (true, _) => format!("{FILES}/"),
            (false, true) => format!("{FILES}/{path}/"),
            (false, false) => format!("{FILES}/{path}"),
        }
    }

    /// A file written whole (`PUT`), as Nextcloud does: its folder there, the
    /// precondition met (`If-None-Match: *` none there, `If-Match` its ETag).
    fn put(request: &Request, path: &Path) -> Reply {
        if !path.parent().is_some_and(Path::is_dir) {
            return (409, Vec::new(), Vec::new());
        }
        let reply = put_once(request, path);
        if matches!(reply.0, 201 | 204) {
            bump(path);
            return (reply.0, vec![("ETag", format!("\"{}\"", etag_of(path)))], Vec::new());
        }
        reply
    }

    fn put_once(request: &Request, path: &Path) -> Reply {
        let current = path.is_file().then(|| format!("\"{}\"", etag_of(path)));
        let refused = match (request.header("If-None-Match"), request.header("If-Match")) {
            (Some("*"), _) => current.is_some(),
            (_, Some(wanted)) => current.as_deref() != Some(wanted),
            _ => false,
        };
        if refused {
            return (412, Vec::new(), Vec::new());
        }
        std::fs::write(path, &request.body).unwrap();
        (if current.is_some() { 204 } else { 201 }, vec![("ETag", format!("\"{}\"", etag_of(path)))], Vec::new())
    }

    fn mkcol(path: &Path) -> Reply {
        if path.exists() {
            return (405, Vec::new(), Vec::new());
        }
        if !path.parent().is_some_and(Path::is_dir) {
            return (409, Vec::new(), Vec::new());
        }
        std::fs::create_dir(path).unwrap();
        (201, Vec::new(), Vec::new())
    }

    fn delete(request: &Request, path: &Path) -> Reply {
        if !path.exists() {
            return (404, Vec::new(), Vec::new());
        }
        if request.header("If-Match").is_some_and(|wanted| format!("\"{}\"", etag_of(path)) != wanted) {
            return (412, Vec::new(), Vec::new());
        }
        if path.is_dir() {
            std::fs::remove_dir_all(path).unwrap();
        } else {
            std::fs::remove_file(path).unwrap();
        }
        (204, Vec::new(), Vec::new())
    }

    fn get(request: &Request, path: &Path) -> Reply {
        let Ok(bytes) = std::fs::read(path) else { return (404, Vec::new(), Vec::new()) };
        let etag = format!("\"{}\"", etag_of(path));
        let from = request.header("Range").and_then(|r| r.strip_prefix("bytes=")).and_then(|r| r.strip_suffix('-')).and_then(|s| s.parse::<usize>().ok());
        match from {
            Some(from) if from >= bytes.len() => (416, vec![("Content-Range", format!("bytes */{}", bytes.len()))], Vec::new()),
            Some(from) => (206, vec![("ETag", etag), ("Content-Range", format!("bytes {from}-{}/{}", bytes.len() - 1, bytes.len()))], bytes[from..].to_vec()),
            None => (200, vec![("ETag", etag)], bytes),
        }
    }
}

#[cfg(test)]
mod tests {
    use super::fake::{Fake, Fault, PASSWORD};
    use super::*;
    use crate::devices::{COMPUTER, Entry, PHONE};
    use crate::share::{Outcome, Roots, Sharing, Store};
    use sioul_core::config::Config;
    use sioul_core::everywhere::{Press, Switch, change_own};
    use sioul_core::health::{Doubt, Peer, doubts_now};
    use std::sync::Arc;

    const KEY: [u8; 32] = [11u8; 32];
    const SEAL: &str = "# Sioul: how your devices' shared records are sealed (docs/database.md).\nversion = 1\nsalt = \"AAAAAAAAAAAAAAAAAAAAAA==\"\nmemory_kib = 65536\npasses = 3\ncheck = \"one\"\n";
    const OTHER_SEAL: &str = "# Sioul: how your devices' shared records are sealed (docs/database.md).\nversion = 1\nsalt = \"BBBBBBBBBBBBBBBBBBBBBB==\"\nmemory_kib = 65536\npasses = 3\ncheck = \"two\"\n";
    /// The network's limits, short: a test does not wait ten seconds.
    const TEST: Limits = Limits { wait: Duration::from_millis(700), small: Duration::from_secs(3), large: Duration::from_secs(5), pull: Duration::from_secs(30), blob: Duration::from_secs(5), floor: 1 << 30, stall: Duration::from_millis(700) };
    thread_local! {
        /// The longest round a pull brings, in this test's thread (`round_cap`).
        pub(super) static ROUND_CAP: std::cell::Cell<Option<u64>> = const { std::cell::Cell::new(None) };
    }
    /// For a stand-in that answers slowly (thousands of files below a folder,
    /// hashed for its ETag before it answers, on Windows' disks): a minute's
    /// limits, two for a step.
    const SLOW_STAND_IN: Limits = Limits { wait: Duration::from_secs(30), small: Duration::from_secs(60), large: Duration::from_secs(60), pull: Duration::from_secs(120), ..TEST };
    const DUE: i64 = 1_800_000_000;

    fn scratch(name: &str) -> PathBuf {
        let dir = std::env::temp_dir().join(format!("sioul-remote-{name}-{}", std::process::id()));
        let _ = std::fs::remove_dir_all(&dir);
        std::fs::create_dir_all(&dir).unwrap();
        dir
    }

    /// A server whose principal it names on another server: the files are
    /// not looked for there, and nothing is asked there with the login.
    #[test]
    fn the_files_stay_on_the_account_s_server() {
        use crate::dav::stand_in::{Reply, Request, Server as StandIn, serve};
        /// Notes what it is asked, and with what login.
        struct Noted(std::sync::Mutex<Vec<String>>);
        impl StandIn for Noted {
            fn misbehaves(&self, _: &Request) -> Option<crate::dav::stand_in::Fault> {
                None
            }
            fn answer(&self, request: &Request) -> Reply {
                self.0.lock().unwrap().push(format!("{} {} {}", request.method, request.path, request.header("Authorization").unwrap_or("")));
                Reply::new(404, "")
            }
        }
        /// Names its principal at the address it is given.
        struct Pointing(String);
        impl StandIn for Pointing {
            fn misbehaves(&self, _: &Request) -> Option<crate::dav::stand_in::Fault> {
                None
            }
            fn answer(&self, _: &Request) -> Reply {
                Reply::new(207, format!(r#"<?xml version="1.0" encoding="utf-8"?><d:multistatus xmlns:d="DAV:"><d:response><d:href>/remote.php/dav/</d:href><d:propstat><d:prop><d:current-user-principal><d:href>{}</d:href></d:current-user-principal></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat></d:response></d:multistatus>"#, self.0))
            }
        }
        let noted = Arc::new(Noted(std::sync::Mutex::new(Vec::new())));
        let there = serve(noted.clone());
        let here = serve(Arc::new(Pointing(format!("{there}/remote.php/dav/principals/users/jane/"))));
        let login = Login { account: "cloud".into(), url: format!("{here}/remote.php/dav/calendars/jane/"), user: "jane".into(), password: Some("secret".into()) };
        let found = files_root(&Server::new(&login, TEST).unwrap(), &login);
        assert!(matches!(&found, Err(SyncError::Elsewhere(root)) if root.starts_with(&there)), "{found:?}");
        assert!(noted.0.lock().unwrap().is_empty());
        // Named on its own server, as Nextcloud does: the files are there.
        let own = serve(Arc::new(Pointing("/remote.php/dav/principals/users/jane/".into())));
        let login = Login { url: format!("{own}/remote.php/dav/calendars/jane/"), ..login };
        assert_eq!(files_root(&Server::new(&login, TEST).unwrap(), &login).unwrap(), Some(format!("{own}/remote.php/dav/files/jane/")));
    }

    fn put(dir: &Path, relative: &str, text: &str) {
        let path = dir.join(relative);
        std::fs::create_dir_all(path.parent().unwrap()).unwrap();
        std::fs::write(path, text).unwrap();
    }

    /// The files under a folder, hidden ones left out, by their path in it.
    fn walk(dir: &Path) -> BTreeMap<String, Vec<u8>> {
        let mut out = BTreeMap::new();
        let mut stack = vec![dir.to_path_buf()];
        while let Some(at) = stack.pop() {
            for entry in std::fs::read_dir(&at).into_iter().flatten().filter_map(Result::ok) {
                let path = entry.path();
                if entry.file_name().to_string_lossy().starts_with('.') {
                    continue;
                }
                if path.is_dir() {
                    stack.push(path);
                } else {
                    let relative = path.strip_prefix(dir).unwrap().to_string_lossy().replace('\\', "/");
                    out.insert(relative, std::fs::read(&path).unwrap());
                }
            }
        }
        out
    }

    fn copy_dir(from: &Path, to: &Path) {
        for (relative, bytes) in walk(from) {
            put_bytes(to, &relative, &bytes);
        }
    }

    fn put_bytes(dir: &Path, relative: &str, bytes: &[u8]) {
        let path = dir.join(relative);
        std::fs::create_dir_all(path.parent().unwrap()).unwrap();
        std::fs::write(path, bytes).unwrap();
    }

    /// A device of its own: its folders, its id, its memory.
    struct Device {
        roots: Roots,
        id: String,
        memory: PathBuf,
        kind: &'static str,
    }

    impl Device {
        fn new(base: &Path, name: &str, kind: &'static str) -> Device {
            let root = base.join(name);
            let roots = Roots { config: root.join("config"), data: root.join("data"), state: root.join("state") };
            for dir in [&roots.config, &roots.data, &roots.state] {
                std::fs::create_dir_all(dir).unwrap();
            }
            let memory = roots.state.join("share").join("memory.json");
            Device { roots, id: uuid::Uuid::new_v4().to_string(), memory, kind }
        }

        fn stores(&self) -> Vec<Store> {
            crate::share::stores(&Config::default(), &self.roots)
        }

        /// An exchange (seconds), then its entry says what it read and wrote.
        fn exchange(&self, folder: &Path, now: i64) -> Outcome {
            let outcome = crate::share::exchange(&Sharing { folder, computer: &self.id, key: &KEY, memory: &self.memory, files: false, hurry: None }, &self.stores(), now * 1000).unwrap();
            crate::devices::change(&crate::devices::own_path(&self.roots.state), Some((folder, &KEY)), |e| e.exported(now * 1000, outcome.wrote, now)).unwrap();
            outcome
        }

        /// This device's stores with `notes` as its notes folder: notes,
        /// papers and texts shared besides the parts shared by default.
        fn all_parts(&self, notes: &Path) -> Vec<Store> {
            let config = Config { notes_root: Some(notes.display().to_string()), ..Config::default() };
            crate::share::stores_of(&config, &self.roots, &|part| matches!(part, "notes" | "papers" | "texts") || crate::share::shared_by_default(part, &config))
        }

        /// A whole exchange (seconds) with `notes` as its notes folder, notes,
        /// papers and texts shared besides the parts shared by default.
        fn exchange_all_parts(&self, folder: &Path, now: i64, notes: &Path) -> Outcome {
            self.exchange_parts(folder, now, notes, true)
        }

        /// The same, its notes and papers read or not (`files`: a phone's
        /// background step reads none).
        fn exchange_parts(&self, folder: &Path, now: i64, notes: &Path, files: bool) -> Outcome {
            let stores = self.all_parts(notes);
            let outcome = crate::share::exchange(&Sharing { folder, computer: &self.id, key: &KEY, memory: &self.memory, files, hurry: None }, &stores, now * 1000).unwrap();
            // As this Sioul's window says it: it keeps sealed files two weeks.
            crate::devices::change(&crate::devices::own_path(&self.roots.state), Some((folder, &KEY)), |e| {
                e.exported(now * 1000, outcome.wrote, now);
                e.keeping = crate::blobs::KEEPING;
            })
            .unwrap();
            outcome
        }

        fn session(&self, folder: &Path, f: impl FnOnce(&mut Entry)) {
            let (kind, id) = (self.kind, self.id.clone());
            crate::devices::change(&crate::devices::own_path(&self.roots.state), Some((folder, &KEY)), |e| {
                e.id = id;
                e.kind = kind.into();
                e.doses = true;
                f(e);
            })
            .unwrap();
        }

        fn switch(&self) -> PathBuf {
            self.roots.state.join(sioul_core::everywhere::SWITCH_FILE)
        }

        /// Do-not-disturb pressed here (seconds).
        fn press(&self, on: bool, at: i64) {
            change_own(&self.switch(), &self.id, |s| {
                s.press(&self.id, on, 0, at * 1000);
                true
            })
            .unwrap();
        }

        fn dnd(&self) -> Option<Press> {
            Switch::read(&self.switch()).unwrap().latest()
        }

        fn write(&self, relative: &str, text: &str) {
            put(&self.roots.state, relative, text);
        }

        fn read(&self, relative: &str) -> String {
            std::fs::read_to_string(self.roots.state.join(relative)).unwrap_or_default()
        }

        /// What this device knows of `other`, as the window's `know` builds it.
        fn sees(&self, folder: &Path, other: &Device, now: i64) -> Peer {
            let entry = crate::devices::all(folder, &KEY).0.into_iter().find(|e| e.id == other.id).expect("its entry");
            let heard = crate::share::heard(&self.memory, &self.id);
            Peer { id: other.id.clone(), name: entry.name.clone(), said: Some(entry.said()), complete: entry.wrote.is_none_or(|wrote| heard.complete(&other.id, wrote)), seen: now, heard: entry.exported, ..Peer::default() }
        }

        /// What it keeps of its own, as files: the shared ones, written by the exchanges (not its memory).
        fn kept(&self) -> BTreeMap<String, Vec<u8>> {
            let mut out = BTreeMap::new();
            for (root, dir) in [("config", &self.roots.config), ("data", &self.roots.data), ("state", &self.roots.state)] {
                for (relative, bytes) in walk(dir) {
                    if !relative.starts_with("share/") {
                        out.insert(format!("{root}/{relative}"), bytes);
                    }
                }
            }
            out
        }
    }

    /// A desk and a phone sharing through a Nextcloud: the desk's folder is the
    /// server's (its client keeps the two equal); the phone's sync app carried
    /// the folder down once, then only carries the phone's own files up (eDrive
    /// tonight, 6 October 2026).
    struct World {
        base: PathBuf,
        fake: Arc<Fake>,
        server: PathBuf,
        phone_folder: PathBuf,
        desk: Device,
        phone: Device,
    }

    impl World {
        fn new(name: &str) -> World {
            let base = scratch(name);
            let files = base.join("cloud");
            let server = files.join("Documents").join("Sioul");
            let phone_folder = base.join("phone").join("storage").join("Documents").join("Sioul");
            put(&server, "seal.toml", SEAL);
            put(&phone_folder, "seal.toml", SEAL);
            let fake = Fake::start(&files);
            let desk = Device::new(&base, "desk", COMPUTER);
            let phone = Device::new(&base, "phone-state", PHONE);
            let world = World { base, fake, server, phone_folder, desk, phone };
            world.desk.session(&world.server, |e| e.start(DUE - 7_200));
            world.desk.exchange(&world.server, DUE - 7_100);
            world.down();
            world.phone.session(&world.phone_folder, |e| e.start(DUE - 7_050));
            world.phone.exchange(&world.phone_folder, DUE - 7_000);
            world.up();
            world.desk.exchange(&world.server, DUE - 6_900);
            world.down();
            world
        }

        /// The phone's sync app carries its own files up.
        fn up(&self) {
            let _turn = self.fake.turn.lock().unwrap();
            for (relative, bytes) in walk(&self.phone_folder).into_iter().filter(|(r, _)| r.contains(&self.phone.id)) {
                put_bytes(&self.server, &relative, &bytes);
            }
        }

        /// The phone's sync app brings the others' files down, as it should.
        fn down(&self) {
            for (relative, bytes) in walk(&self.server).into_iter().filter(|(r, _)| !r.contains(&self.phone.id)) {
                put_bytes(&self.phone_folder, &relative, &bytes);
            }
        }

        fn find(&self, now: i64) -> State {
            find_with(&self.phone.memory, &self.phone_folder, &[self.fake.login()], &places(&self.phone_folder, &[]), now, TEST)
        }

        fn pull(&self, now: i64) -> Pulled {
            pull_with(&self.phone.memory, &self.phone_folder, &self.phone.id, &self.fake.login(), now, TEST)
        }

        fn cache(&self) -> PathBuf {
            cache_of(&self.phone.memory)
        }

        /// The desk's last records' file, by its name in the folder.
        fn desk_round(&self) -> String {
            let mut names: Vec<String> = walk(&self.server).into_keys().filter(|n| n.starts_with(&self.desk.id) && n.ends_with(".jsonl")).collect();
            names.sort_by_key(|n| n.trim_end_matches(".jsonl").rsplit('-').next().unwrap().parse::<u32>().unwrap());
            names.pop().unwrap()
        }

        /// The phone as it is now, aside, to put back (`restore`): the same device run twice.
        fn snapshot(&self) -> PathBuf {
            let aside = self.base.join("aside");
            let _ = std::fs::remove_dir_all(&aside);
            copy_dir(&self.base.join("phone-state"), &aside.join("phone-state"));
            copy_dir(&self.phone_folder, &aside.join("folder"));
            aside
        }

        fn restore(&self, aside: &Path) {
            let _ = std::fs::remove_dir_all(self.base.join("phone-state"));
            let _ = std::fs::remove_dir_all(&self.phone_folder);
            copy_dir(&aside.join("phone-state"), &self.base.join("phone-state"));
            copy_dir(&aside.join("folder"), &self.phone_folder);
        }

        /// The other devices' files in the phone's synced folder.
        fn others_here(&self) -> BTreeMap<String, Vec<u8>> {
            walk(&self.phone_folder).into_iter().filter(|(r, _)| !r.contains(&self.phone.id)).collect()
        }
    }

    impl Drop for World {
        fn drop(&mut self) {
            let _ = std::fs::remove_dir_all(&self.base);
        }
    }

    /// Only once, then never again.
    fn once(matches: impl Fn(&super::fake::Request) -> bool + Send + 'static, fault: Fault) -> impl FnMut(&super::fake::Request) -> Option<Fault> + Send + 'static {
        let mut done = false;
        move |request| {
            if done || !matches(request) {
                return None;
            }
            done = true;
            Some(fault)
        }
    }

    #[test]
    fn a_stale_folder_is_caught_up_from_the_server() {
        let w = World::new("stale");
        // The dose falls due; the desk, in use, turns do-not-disturb on and
        // shares after it. Its client carries it to the server at once; the
        // phone's sync app carries the phone's files up, and brings nothing down.
        w.desk.press(true, DUE + 30);
        w.desk.exchange(&w.server, DUE + 150);
        w.up();
        let alone = w.phone.exchange(&w.phone_folder, DUE + 170);
        assert!(alone.problems.is_empty(), "{:?}", alone.problems);
        assert!(w.phone.dnd().is_none_or(|p| !p.on), "nothing came yet");
        let stale = w.phone.sees(&w.phone_folder, &w.desk, DUE + 180);
        assert!(matches!(doubts_now(DUE, DUE + 180, None, &[stale]).as_slice(), [Doubt::Working { .. }]), "the desk's news has not come: a doubt");
        // The backup: the folder found on the server under the same seal, the desk's news fetched.
        let state = w.find(DUE + 180);
        assert!(state.confirmed_for(&w.phone_folder), "{state:?}");
        assert_eq!(state.url, w.fake.folder_url("Documents/Sioul"));
        let before = w.others_here();
        let pulled = w.pull(DUE + 181);
        assert!(pulled.problem.is_none() && pulled.fetched >= 2, "{pulled:?}");
        assert_eq!(w.others_here(), before, "nothing written into the synced folder");
        let outcome = w.phone.exchange(&w.phone_folder, DUE + 182);
        assert!(outcome.problems.is_empty(), "{:?}", outcome.problems);
        let press = w.phone.dnd().expect("the desk's press");
        assert!(press.on && press.from == w.desk.id, "{press:?}");
        // Its entry the fresh one: the dose known not taken, as with the folder fresh.
        let fresh = w.phone.sees(&w.phone_folder, &w.desk, DUE + 183);
        assert!(doubts_now(DUE, DUE + 183, None, std::slice::from_ref(&fresh)).is_empty(), "{fresh:?}");
        let direct = crate::devices::all(&w.server, &KEY).0.into_iter().find(|e| e.id == w.desk.id).unwrap();
        assert_eq!(fresh.said, Some(direct.said()), "the same as the server's folder says");
        assert!(crate::share::others(&w.phone_folder, &w.phone.id).iter().any(|o| o.id == w.desk.id && o.heard >= DUE + 150));
        // Read only, never one of the phone's own files; the password nowhere in what it keeps.
        for line in w.fake.seen() {
            assert!(line.starts_with("PROPFIND ") || line.starts_with("GET "), "{line}");
            assert!(!(line.starts_with("GET ") && line.contains(&w.phone.id)), "{line}");
        }
        let kept = std::fs::read_to_string(state_path(&w.phone.memory)).unwrap();
        assert!(!kept.contains(PASSWORD) && !kept.contains("Basic"), "{kept}");
        assert!(walk(&w.cache()).keys().all(|name| !name.contains(&w.phone.id)), "never the phone's own");
    }

    #[test]
    fn with_the_folder_fresh_the_backup_changes_nothing() {
        let w = World::new("fresh");
        w.desk.press(true, DUE + 30);
        w.desk.exchange(&w.server, DUE + 150);
        crate::lease::renew(&w.server, &KEY, "health", &w.desk.id, DUE + 150, DUE + 150, false, crate::lease::Rule::FollowsYou, crate::share::written(&w.desk.memory, &w.desk.id)).unwrap();
        w.up();
        w.down();
        // The phone exchanges without the backup...
        let aside = w.snapshot();
        let without = w.phone.exchange(&w.phone_folder, DUE + 200);
        let kept_without = w.phone.kept();
        // ...and, put back as it was, with it: the same.
        w.restore(&aside);
        assert!(w.find(DUE + 190).confirmed_for(&w.phone_folder));
        w.fake.forget_seen();
        let pulled = w.pull(DUE + 195);
        assert!(pulled.problem.is_none(), "{pulled:?}");
        assert_eq!(pulled.fetched, 0, "nothing the folder holds is kept twice");
        assert!(w.fake.seen().iter().all(|line| !(line.starts_with("GET ") && line.contains(".jsonl"))), "no records fetched: {:?}", w.fake.seen());
        assert_eq!(walk(&w.cache()).into_keys().collect::<Vec<_>>(), ["seal.toml"]);
        let with = w.phone.exchange(&w.phone_folder, DUE + 200);
        assert_eq!((with.received, with.sent, &with.problems), (without.received, without.sent, &without.problems));
        assert_eq!(w.phone.kept(), kept_without, "the same files, byte for byte");
        // Fetched again: nothing, the server's files known by their ETag.
        w.fake.forget_seen();
        w.pull(DUE + 260);
        assert!(w.fake.seen().iter().all(|line| line.starts_with("PROPFIND ")), "{:?}", w.fake.seen());
    }

    #[test]
    fn a_half_downloaded_file_is_never_read_as_whole() {
        let w = World::new("half");
        // Two doses marked on the desk, carried to the phone as they should be.
        let first = "\"first@1800000000\" = 1800000000\n\"second@1800000000\" = 1800000001\n";
        w.desk.write("health-state.toml", &format!("[taken]\n{first}"));
        w.desk.exchange(&w.server, DUE + 50);
        w.down();
        // Forty more: forty lines of records, carried to the server only.
        let marks: String = (0..40).map(|n| format!("\"dose-{n}@1800000000\" = {}\n", DUE + n)).collect();
        w.desk.write("health-state.toml", &format!("[taken]\n{first}{marks}"));
        w.desk.exchange(&w.server, DUE + 100);
        assert!(w.find(DUE + 110).confirmed_for(&w.phone_folder));
        let round = w.desk_round();
        let whole = std::fs::read(w.server.join(&round)).unwrap();
        let (end, last) = whole_end(&w.phone_folder.join(&round));
        assert!(end > 0 && whole.len() as u64 > end, "the phone's copy is behind");
        // The records come cut in the middle of a line.
        let cut = (whole.len() - last as usize) / 2;
        let name = round.clone();
        w.fake.fault(once(move |r| r.method == "GET" && r.path.ends_with(&name), Fault::Cut(cut)));
        let pulled = w.pull(DUE + 120);
        assert!(pulled.problem.as_deref().is_some_and(|p| p.starts_with("network:")), "{pulled:?}");
        assert!(w.fake.seen().iter().any(|l| l.starts_with("GET ") && l.contains(&round) && l.ends_with(" 206")), "asked from where the phone's copy ends: {:?}", w.fake.seen());
        let cached = w.cache().join(&round);
        let arrived = std::fs::read(&cached).unwrap_or_default();
        assert!(arrived.is_empty() || (arrived.ends_with(b"\n") && whole.starts_with(&arrived) && arrived.len() < whole.len()), "whole lines only: {} of {}", arrived.len(), whole.len());
        let first = w.phone.exchange(&w.phone_folder, DUE + 130);
        assert!(first.problems.iter().all(|p| !p.starts_with("share-other")), "{:?}", first.problems);
        // Then the desk's entry comes cut: never kept, never read.
        let entry = format!("devices/{}.device", w.desk.id);
        let name = entry.clone();
        w.fake.fault(once(move |r| r.method == "GET" && r.path.ends_with(&name), Fault::Cut(40)));
        let pulled = w.pull(DUE + 140);
        assert!(pulled.problem.as_deref().is_some_and(|p| p.starts_with("network:")), "{pulled:?}");
        assert_eq!(std::fs::read(&cached).unwrap(), whole, "the records whole now");
        assert!(!w.cache().join(&entry).exists(), "an entry cut is not kept");
        let (entries, unread) = crate::devices::all(&w.phone_folder, &KEY);
        assert!(entries.iter().any(|e| e.id == w.desk.id) && !unread.contains(&w.desk.id), "the folder's copy read meanwhile");
        let second = w.phone.exchange(&w.phone_folder, DUE + 150);
        assert!(second.problems.iter().all(|p| !p.starts_with("share-other")), "{:?}", second.problems);
        assert!(w.pull(DUE + 160).problem.is_none());
        assert!(w.cache().join(&entry).exists());
        // Every dose came, each line read once, as far as the desk wrote.
        let record = w.phone.read("health-state.toml");
        for n in 0..40 {
            assert!(record.contains(&format!("dose-{n}@")), "dose-{n}:\n{record}");
        }
        let heard = crate::share::heard(&w.phone.memory, &w.phone.id);
        assert!(heard.complete(&w.desk.id, crate::share::written(&w.desk.memory, &w.desk.id).unwrap()), "{heard:?}");
        assert!(!heard.broken.contains_key(&w.desk.id), "no line lost nor read twice: {heard:?}");
    }

    #[test]
    fn a_seal_that_differs_is_never_used() {
        let w = World::new("seal");
        // A folder of the same name on the server, sealed otherwise: refused, and nothing fetched from it.
        put(&w.server, "seal.toml", OTHER_SEAL);
        let state = w.find(DUE);
        assert!(!state.confirmed_for(&w.phone_folder) && state.said.starts_with("seal-differs:"), "{state:?}");
        assert!(attach(&w.phone_folder, &w.phone.memory).is_none());
        assert_eq!(w.pull(DUE + 1).problem.as_deref(), Some("not-confirmed"));
        assert!(w.fake.seen().iter().filter(|l| l.starts_with("GET ")).all(|l| l.ends_with("seal.toml 200") || l.ends_with("seal.toml 404")), "{:?}", w.fake.seen());
        // Sealed the same: confirmed. Then sealed otherwise there: nothing more fetched.
        put(&w.server, "seal.toml", SEAL);
        State::choose(&w.phone.memory, |s| s.asked = DUE + 2).unwrap();
        assert!(w.find(DUE + 3).confirmed_for(&w.phone_folder));
        assert!(w.pull(DUE + 4).problem.is_none());
        put(&w.server, "seal.toml", OTHER_SEAL);
        w.desk.press(true, DUE + 5);
        w.desk.exchange(&w.server, DUE + 6);
        w.fake.forget_seen();
        let pulled = w.pull(DUE + 7);
        assert!(pulled.problem.as_deref().is_some_and(|p| p.starts_with("seal-differs:")), "{pulled:?}");
        assert!(w.fake.seen().iter().filter(|l| l.starts_with("GET ")).all(|l| l.contains("seal.toml")), "{:?}", w.fake.seen());
        assert!(!State::load(&w.phone.memory).confirmed_for(&w.phone_folder));
        // Sharing started again here, under another seal: what was fetched is not read.
        put(&w.server, "seal.toml", SEAL);
        State::choose(&w.phone.memory, |s| s.asked = DUE + 8).unwrap();
        assert!(w.find(DUE + 9).confirmed_for(&w.phone_folder));
        assert!(w.pull(DUE + 10).problem.is_none());
        assert!(attach(&w.phone_folder, &w.phone.memory).is_some());
        put(&w.phone_folder, "seal.toml", OTHER_SEAL);
        assert!(attach(&w.phone_folder, &w.phone.memory).is_none(), "another sharing's");
        assert_eq!(w.pull(DUE + 11).problem.as_deref(), Some("no-seal"));
        assert!(!w.cache().exists());
    }

    #[test]
    fn server_errors_and_timeouts_leave_the_exchange_as_before() {
        let w = World::new("errors");
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        w.desk.press(true, DUE + 30);
        w.desk.exchange(&w.server, DUE + 60);
        w.up();
        for (n, fault) in [Fault::Status(500), Fault::Status(503), Fault::Late(Duration::from_secs(2)), Fault::Drop, Fault::Cut(20)].into_iter().enumerate() {
            w.fake.clear_faults();
            w.fake.fault(move |_| Some(fault));
            let pulled = w.pull(DUE + 100 + n as i64);
            let said = pulled.problem.clone().unwrap_or_default();
            assert!(said.starts_with("server:") || said.starts_with("network:"), "{fault:?}: {pulled:?}");
            assert_eq!(walk(&w.cache()).into_keys().collect::<Vec<_>>(), ["seal.toml"], "{fault:?}: nothing kept");
            assert_eq!(State::load(&w.phone.memory).said, said);
        }
        w.fake.clear_faults();
        // The exchange then is the one without the backup, byte for byte.
        let aside = w.snapshot();
        let with = w.phone.exchange(&w.phone_folder, DUE + 200);
        let kept_with = w.phone.kept();
        w.restore(&aside);
        forget(&w.phone.memory, &w.phone_folder);
        let without = w.phone.exchange(&w.phone_folder, DUE + 200);
        assert_eq!((with.received, &with.problems), (without.received, &without.problems));
        assert_eq!(w.phone.kept(), kept_with);
    }

    #[test]
    fn what_was_fetched_never_wins_over_a_newer_synced_copy() {
        let w = World::new("older");
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        let renew = |now: i64| crate::lease::renew(&w.server, &KEY, "health", &w.desk.id, now, now, false, crate::lease::Rule::FollowsYou, crate::share::written(&w.desk.memory, &w.desk.id)).unwrap();
        w.desk.press(true, DUE + 30);
        w.desk.exchange(&w.server, DUE + 60);
        renew(DUE + 60);
        assert!(w.pull(DUE + 70).problem.is_none());
        let round = w.desk_round();
        assert!(w.cache().join(&round).exists() && w.cache().join(format!("devices/{}.device", w.desk.id)).exists());
        // The desk goes on, a quarter of an hour later; the sync app brings it all at last: the folder's copies newer.
        w.desk.press(false, DUE + 1_000);
        w.desk.exchange(&w.server, DUE + 1_100);
        renew(DUE + 1_100);
        w.up();
        w.down();
        let entry = crate::devices::all(&w.phone_folder, &KEY).0.into_iter().find(|e| e.id == w.desk.id).unwrap();
        assert_eq!(entry.exported, DUE + 1_100, "the folder's entry");
        let claim = crate::lease::claims(&w.phone_folder, &KEY, "health").into_iter().find(|c| c.computer == w.desk.id).unwrap();
        assert_eq!(claim.renewed, DUE + 1_100, "the folder's claim");
        let heard = crate::share::others(&w.phone_folder, &w.phone.id).into_iter().find(|o| o.id == w.desk.id).unwrap().heard;
        assert_eq!(heard, DUE + 1_100, "the folder's notes");
        w.phone.exchange(&w.phone_folder, DUE + 1_200);
        assert!(!w.phone.dnd().unwrap().on, "the later press, from the folder's longer records");
        // What the folder caught up with goes from the cache.
        tidy(&w.phone.memory, &w.phone_folder, &w.phone.id);
        assert!(!w.cache().join(&round).exists());
        // The backup switched off: the entries and notes fetched go too; records longer than the folder's would stay.
        State::choose(&w.phone.memory, |s| s.on = Some(false)).unwrap();
        tidy(&w.phone.memory, &w.phone_folder, &w.phone.id);
        assert_eq!(walk(&w.cache()).into_keys().collect::<Vec<_>>(), ["seal.toml"]);
        w.fake.forget_seen();
        assert_eq!(w.pull(DUE + 1_300).problem.as_deref(), Some("off"));
        assert!(w.fake.seen().is_empty(), "switched off: not a request");
    }

    /// The doses' rule (docs/health.md, "Knowing") with the phone's sync app
    /// stuck, bringing nothing down, and the backup fetching each minute:
    /// what the phone takes as known is there, and every dose comes.
    #[test]
    fn doses_are_never_known_wrongly_with_a_stuck_sync_app_and_the_backup() {
        let w = World::new("stuck");
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        let mut marked: Vec<(String, i64)> = Vec::new();
        for minute in 0..90 {
            let now = DUE + minute * 60;
            if minute % 10 == 0 {
                marked.push((format!("dose@{minute}"), minute));
                let record: String = marked.iter().map(|(d, m)| format!("\"{d}\" = {m}\n")).collect();
                w.desk.write("health-state.toml", &format!("[taken]\n{record}"));
            }
            w.desk.exchange(&w.server, now);
            crate::lease::renew(&w.server, &KEY, "health", &w.desk.id, now, now, false, crate::lease::Rule::FollowsYou, crate::share::written(&w.desk.memory, &w.desk.id)).unwrap();
            w.up();
            let _ = w.pull(now + 20);
            w.phone.exchange(&w.phone_folder, now + 30);
            if let Some(claim) = crate::lease::claims(&w.phone_folder, &KEY, "health").into_iter().find(|c| c.computer == w.desk.id)
                && let Some(wrote) = claim.wrote
                && crate::share::heard(&w.phone.memory, &w.phone.id).complete(&w.desk.id, wrote)
            {
                let record = w.phone.read("health-state.toml");
                let claimed = (claim.renewed - DUE) / 60;
                for (dose, at) in marked.iter().filter(|(_, m)| *m < claimed) {
                    assert!(record.contains(dose.as_str()), "minute {minute}: {dose} ({at}) taken as known, not there:\n{record}");
                }
            }
        }
        let record = w.phone.read("health-state.toml");
        for (dose, _) in &marked {
            assert!(record.contains(dose.as_str()), "{dose} never came:\n{record}");
        }
        // The synced folder never had them: the backup brought them.
        let synced = std::fs::read(w.phone_folder.join(w.desk_round())).map(|b| b.len()).unwrap_or(0);
        assert!(synced < std::fs::read(w.server.join(w.desk_round())).unwrap().len());
    }

    /// An alarm's waits, short: a test does not wait twenty-five seconds.
    const QUICK: AlarmTimes = AlarmTimes { alone: Duration::from_secs(2), most: Duration::from_secs(5) };

    /// A dose's alarm on the phone (`health::alarm_decide`, through the app's
    /// `exchange_here`) on its own pull while it works (`alarm_news`): a pull
    /// begun since the alarm, gone through, and the sync app neither asked to
    /// look nor waited for. Minute after minute, the desk in use marking
    /// doses, the phone's sync app bringing nothing down: from the same
    /// moment, the alarm on its pull knows exactly what it knows with the sync
    /// app asked as before (it brought everything down), its doubt never
    /// weaker, and a dose marked elsewhere is never known not taken.
    #[test]
    fn a_doses_alarm_on_its_pull_knows_what_it_knew_with_the_sync_app_asked() {
        static ONE_PULL: Mutex<()> = Mutex::new(());
        let w = World::new("alarm-alone");
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        assert!(w.pull(DUE).problem.is_none());
        let mut marked: Vec<(String, i64)> = Vec::new();
        for minute in 0..16 {
            let now = DUE + minute * 60;
            if minute % 3 == 0 {
                marked.push((format!("dose@{minute}"), now));
                let record: String = marked.iter().map(|(d, at)| format!("\"{d}\" = {at}\n")).collect();
                w.desk.write("health-state.toml", &format!("[taken]\n{record}"));
            }
            w.desk.exchange(&w.server, now);
            w.up();
            // As before: the sync app asked brings the server's files down, the pull meanwhile.
            let aside = w.snapshot();
            w.down();
            let _ = w.pull(now + 20);
            w.phone.exchange(&w.phone_folder, now + 25);
            let asked = (w.phone.read("health-state.toml"), w.phone.sees(&w.phone_folder, &w.desk, now + 30));
            // The alarm on its pull, from the same moment: the phone's folder as stale as the sync app left it.
            w.restore(&aside);
            assert!(State::load(&w.phone.memory).pulls_well(&w.phone_folder), "minute {minute}");
            let mut ask = || -> Duration { panic!("minute {minute}: the pull went through, the sync app is not asked") };
            let came = alarm_news_with(&w.phone.memory, &w.phone_folder, &w.phone.id, KEY, Some(w.fake.login()), &ONE_PULL, now + 20, QUICK, Arc::new(move || now + 20), &mut ask, TEST);
            assert_eq!(came, AlarmNews::Pulled, "minute {minute}");
            w.phone.exchange(&w.phone_folder, now + 25);
            let alone = (w.phone.read("health-state.toml"), w.phone.sees(&w.phone_folder, &w.desk, now + 30));
            assert_eq!(alone.0, asked.0, "minute {minute}: the same answers here");
            for (dose, due) in &marked {
                let doubted = |peer: &Peer| !doubts_now(*due, now + 30, None, std::slice::from_ref(peer)).is_empty();
                assert_eq!(doubted(&alone.1), doubted(&asked.1), "minute {minute}, {dose}: the same doubt");
                assert!(alone.0.contains(dose.as_str()) || doubted(&alone.1), "minute {minute}: {dose}, marked on the desk, known not taken");
            }
        }
        // The synced folder never had them: the pull brought them.
        assert!(std::fs::read(w.phone_folder.join(w.desk_round())).map_or(0, |b| b.len()) < std::fs::read(w.server.join(w.desk_round())).unwrap().len());
    }

    /// The desk closed an hour before the dose, the phone heard it through a
    /// good pull; a minute before the dose the desk opens, the dose is marked
    /// taken there and shared. The phone's alarm: its own pull fails. It never
    /// decides on what the last good pull said (the desk closed: the dose
    /// "known" not taken); it asks the sync app, as before Sioul's own pull,
    /// and waits for it: the answer comes, or the doubt is said. The next
    /// alarm asks the sync app first; the server back, the pull is trusted
    /// again (review of battery part B, F2).
    #[test]
    fn a_doses_alarm_whose_pull_fails_asks_the_sync_app_and_never_knows_wrongly() {
        static ONE_PULL: Mutex<()> = Mutex::new(());
        let w = World::new("alarm-fails");
        assert!(w.find(DUE - 3_000).confirmed_for(&w.phone_folder));
        w.desk.exchange(&w.server, DUE - 3_600);
        w.desk.session(&w.server, |e| e.close(DUE - 3_590));
        assert!(w.pull(DUE - 3_000).problem.is_none());
        w.phone.exchange(&w.phone_folder, DUE - 2_990);
        assert!(State::load(&w.phone.memory).pulls_well(&w.phone_folder), "the pull works");
        assert!(doubts_now(DUE, DUE + 10, None, &[w.phone.sees(&w.phone_folder, &w.desk, DUE + 10)]).is_empty(), "the desk closed before the dose: known");
        w.desk.session(&w.server, |e| e.start(DUE - 60));
        w.desk.write("health-state.toml", "[taken]\n\"dose@0\" = 1\n");
        w.desk.exchange(&w.server, DUE + 30);
        // The alarm at DUE + 60: its pull refused (503); the sync app asked brings the server's files down.
        w.fake.fault(|_| Some(Fault::Status(503)));
        let mut asked = 0;
        let mut ask = || {
            asked += 1;
            w.down();
            Duration::from_millis(200)
        };
        let came = alarm_news_with(&w.phone.memory, &w.phone_folder, &w.phone.id, KEY, Some(w.fake.login()), &ONE_PULL, DUE + 60, QUICK, Arc::new(|| DUE + 60), &mut ask, TEST);
        assert!(matches!(came, AlarmNews::SyncApp { ref heard } if heard.contains(&w.desk.id)) && asked == 1, "the pull failed: the sync app asked, once, the desk's entry brought: {came:?}");
        w.phone.exchange(&w.phone_folder, DUE + 65);
        let taken = w.phone.read("health-state.toml").contains("dose@0");
        let doubts = doubts_now(DUE, DUE + 70, None, &[w.phone.sees(&w.phone_folder, &w.desk, DUE + 70)]);
        assert!(taken || !doubts.is_empty(), "the dose marked on the desk is never known not taken: {doubts:?}");
        assert!(taken, "the sync app brought it");
        assert!(!State::load(&w.phone.memory).pulls_well(&w.phone_folder), "the next alarm asks the sync app first, as before");
        // The server back: the pull is trusted again.
        w.fake.clear_faults();
        assert!(w.pull(DUE + 180).problem.is_none());
        assert!(State::load(&w.phone.memory).pulls_well(&w.phone_folder));
    }

    /// Two doses due at the same minute: two alarms at once, each on its own
    /// thread (review of battery part B, F1). The second finds the first one
    /// pulling: it waits for that pull, never decides on what came before it,
    /// and knows what it brought; the sync app is asked by neither.
    #[test]
    fn two_doses_at_once_the_second_alarm_waits_for_the_first_ones_pull() {
        static ONE_PULL: Mutex<()> = Mutex::new(());
        let w = World::new("alarm-twice");
        assert!(w.find(DUE - 3_000).confirmed_for(&w.phone_folder));
        w.desk.session(&w.server, |e| e.close(DUE - 3_590));
        assert!(w.pull(DUE - 3_000).problem.is_none());
        w.phone.exchange(&w.phone_folder, DUE - 2_990);
        // The desk opens a minute before, the doses are marked taken there.
        w.desk.session(&w.server, |e| e.start(DUE - 60));
        w.desk.write("health-state.toml", "[taken]\n\"a@0\" = 1\n\"b@0\" = 2\n");
        w.desk.exchange(&w.server, DUE + 10);
        // The first alarm's pull is slow: its first listing takes half a second (within the test's wait for an answer).
        w.fake.fault(once(|r| r.method == "PROPFIND", Fault::Late(Duration::from_millis(450))));
        let outcomes: Vec<(AlarmNews, Duration)> = std::thread::scope(|scope| {
            let alarm = |pause: u64| {
                let w = &w;
                scope.spawn(move || {
                    std::thread::sleep(Duration::from_millis(pause));
                    let begun = Instant::now();
                    let mut ask = || -> Duration { panic!("the pull went through: the sync app is not asked") };
                    (alarm_news_with(&w.phone.memory, &w.phone_folder, &w.phone.id, KEY, Some(w.fake.login()), &ONE_PULL, DUE + 60, QUICK, Arc::new(|| DUE + 60), &mut ask, TEST), begun.elapsed())
                })
            };
            let (first, second) = (alarm(0), alarm(150));
            vec![first.join().unwrap(), second.join().unwrap()]
        });
        assert!(outcomes.iter().all(|(came, _)| *came == AlarmNews::Pulled), "{outcomes:?}");
        assert!(outcomes[1].1 >= Duration::from_millis(250), "the second waited for the first one's pull: {outcomes:?}");
        w.phone.exchange(&w.phone_folder, DUE + 70);
        let record = w.phone.read("health-state.toml");
        assert!(record.contains("a@0") && record.contains("b@0"), "{record}");
        let seen = w.phone.sees(&w.phone_folder, &w.desk, DUE + 70);
        assert!(seen.said.as_ref().is_some_and(|s| s.working), "the desk known in use, from the pull: {seen:?}");
    }

    /// An alarm while the window's pull runs (Sioul on the screen, its minute's
    /// pull begun before the alarm): the alarm waits for it, then, that pull
    /// begun before it, pulls again itself, and knows what came since (review
    /// of battery part B, F1).
    #[test]
    fn an_alarm_while_the_windows_pull_runs_pulls_again_after_it() {
        static ONE_PULL: Mutex<()> = Mutex::new(());
        let w = World::new("alarm-window");
        assert!(w.find(DUE - 3_000).confirmed_for(&w.phone_folder));
        w.desk.session(&w.server, |e| e.close(DUE - 3_590));
        assert!(w.pull(DUE - 3_000).problem.is_none());
        w.phone.exchange(&w.phone_folder, DUE - 2_990);
        w.desk.session(&w.server, |e| e.start(DUE - 60));
        w.desk.write("health-state.toml", "[taken]\n\"dose@0\" = 1\n");
        w.desk.exchange(&w.server, DUE + 10);
        w.fake.fault(once(|r| r.method == "PROPFIND", Fault::Late(Duration::from_millis(450))));
        let came = std::thread::scope(|scope| {
            // The window's pull, begun at DUE + 50, holding the one pull at a time.
            let window = scope.spawn(|| {
                let _one = ONE_PULL.lock().unwrap();
                pull_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), DUE + 50, TEST)
            });
            std::thread::sleep(Duration::from_millis(200));
            let mut ask = || -> Duration { panic!("a pull went through: the sync app is not asked") };
            let came = alarm_news_with(&w.phone.memory, &w.phone_folder, &w.phone.id, KEY, Some(w.fake.login()), &ONE_PULL, DUE + 60, QUICK, Arc::new(|| DUE + 61), &mut ask, TEST);
            assert!(window.join().unwrap().problem.is_none());
            came
        });
        assert_eq!(came, AlarmNews::Pulled);
        assert_eq!(State::load(&w.phone.memory).last, DUE + 61, "pulled again, after the window's");
        w.phone.exchange(&w.phone_folder, DUE + 70);
        assert!(w.phone.read("health-state.toml").contains("dose@0"));
    }

    /// An alarm whose pull is slower than its wait (a large round first, a
    /// slow network): the sync app is asked after the pull's few seconds, and
    /// waited for; the alarm decides on what it brought, never on what came
    /// before it (review of battery part B, F2 and F7).
    #[test]
    fn an_alarm_whose_pull_does_not_go_through_in_time_asks_the_sync_app() {
        static ONE_PULL: Mutex<()> = Mutex::new(());
        let w = World::new("alarm-slow");
        assert!(w.find(DUE - 3_000).confirmed_for(&w.phone_folder));
        w.desk.session(&w.server, |e| e.close(DUE - 3_590));
        assert!(w.pull(DUE - 3_000).problem.is_none());
        w.phone.exchange(&w.phone_folder, DUE - 2_990);
        w.desk.session(&w.server, |e| e.start(DUE - 60));
        w.desk.write("health-state.toml", "[taken]\n\"dose@0\" = 1\n");
        w.desk.exchange(&w.server, DUE + 10);
        // Every answer of the server comes after six seconds: past the alarm's wait.
        w.fake.fault(|_| Some(Fault::Late(Duration::from_secs(6))));
        let mut asked = 0;
        let mut ask = || {
            asked += 1;
            w.down();
            Duration::from_millis(300)
        };
        let begun = Instant::now();
        let came = alarm_news_with(&w.phone.memory, &w.phone_folder, &w.phone.id, KEY, Some(w.fake.login()), &ONE_PULL, DUE + 60, QUICK, Arc::new(|| DUE + 60), &mut ask, TEST);
        let waited = begun.elapsed();
        assert!(matches!(came, AlarmNews::SyncApp { .. }) && asked == 1, "not through in time: the sync app asked, once: {came:?}");
        assert!(waited < QUICK.most, "never past the alarm's wait: {waited:?}");
        w.phone.exchange(&w.phone_folder, DUE + 65);
        assert!(w.phone.read("health-state.toml").contains("dose@0"), "what the sync app brought is read");
        w.fake.clear_faults();
    }

    /// The scene of the review's F2: the desk closed an hour before the dose,
    /// heard through a good pull (`pulled_at`, by the phone's clock then);
    /// then, if `opens`, it opens a minute before the dose, the dose is marked
    /// taken there and shared.
    fn alarm_scene(name: &str, pulled_at: i64, opens: bool) -> World {
        let w = World::new(name);
        assert!(w.find(DUE - 3_000).confirmed_for(&w.phone_folder));
        w.desk.exchange(&w.server, DUE - 3_600);
        w.desk.session(&w.server, |e| e.close(DUE - 3_590));
        assert!(w.pull(pulled_at).problem.is_none());
        w.phone.exchange(&w.phone_folder, DUE - 2_990);
        assert!(State::load(&w.phone.memory).pulls_well(&w.phone_folder));
        if opens {
            w.desk.session(&w.server, |e| e.start(DUE - 60));
            w.desk.write("health-state.toml", "[taken]\n\"dose@0\" = 1\n");
            w.desk.exchange(&w.server, DUE + 30);
        }
        w
    }

    /// The phone's clock an hour ahead when it last pulled, then set right
    /// (review of battery part B, S1). That pull, said begun after the alarm,
    /// is never taken for one since it: pulled again (refused here), the sync
    /// app asked; nothing came, so the doubt is said (S2). The clock set back
    /// never stops the background pulls either.
    #[test]
    fn an_alarm_never_takes_a_pull_from_before_the_clock_was_set_back() {
        static ONE_PULL: Mutex<()> = Mutex::new(());
        let w = alarm_scene("alarm-clock", DUE + 600, true);
        w.fake.fault(|_| Some(Fault::Status(503)));
        let mut asked = 0;
        let mut ask = || {
            asked += 1;
            Duration::from_millis(200)
        };
        let came = alarm_news_with(&w.phone.memory, &w.phone_folder, &w.phone.id, KEY, Some(w.fake.login()), &ONE_PULL, DUE + 60, QUICK, Arc::new(|| DUE + 60), &mut ask, TEST);
        assert_eq!((&came, asked), (&AlarmNews::SyncApp { heard: BTreeSet::new() }, 1), "the old pull not taken: pulled again, refused; the sync app asked, nothing came");
        w.phone.exchange(&w.phone_folder, DUE + 65);
        assert!(!w.phone.read("health-state.toml").contains("dose@0"));
        let peer = w.phone.sees(&w.phone_folder, &w.desk, DUE + 70);
        assert!(doubts_now(DUE, DUE + 70, None, std::slice::from_ref(&peer)).is_empty(), "what was read before the alarm says the desk closed");
        assert!(!sioul_core::health::doubts_unread(DUE, DUE + 70, None, std::slice::from_ref(&peer), DUE + 60, &BTreeSet::new()).is_empty(), "nothing read since the alarm: the doubt said, never known");
        let state = State::load(&w.phone.memory);
        assert!(!state.pulls_well(&w.phone_folder), "the refused pull is the later one, whatever the clock said: {state:?}");
        let pace = Pace { phone: true, shown: false, in_use: false, urgent: false, step: 5 * 60 };
        assert!(due(&State { tried: DUE + 600, ..state }, DUE + 120, pace), "tried \"later\" than now: due at once");
        w.fake.clear_faults();
    }

    /// Neither route brings anything at an alarm (the server out of reach, the
    /// sync app bringing nothing): the desk, known closed before the dose by
    /// what was read before, may have opened since and answered; the doubt is
    /// said, never "not taken" (review of battery part B, S2). An alarm whose
    /// pull went through is not doubted by that rule: the desk still closed,
    /// the dose known.
    #[test]
    fn an_alarm_that_reads_no_news_says_the_doubt_and_one_that_pulls_does_not() {
        static ONE_PULL: Mutex<()> = Mutex::new(());
        let w = alarm_scene("alarm-nothing", DUE - 3_000, true);
        w.fake.fault(|_| Some(Fault::Status(503)));
        let mut ask = || Duration::from_millis(200);
        let came = alarm_news_with(&w.phone.memory, &w.phone_folder, &w.phone.id, KEY, Some(w.fake.login()), &ONE_PULL, DUE + 60, QUICK, Arc::new(|| DUE + 60), &mut ask, TEST);
        assert_eq!(came, AlarmNews::SyncApp { heard: BTreeSet::new() });
        w.phone.exchange(&w.phone_folder, DUE + 65);
        let peer = w.phone.sees(&w.phone_folder, &w.desk, DUE + 70);
        assert!(!w.phone.read("health-state.toml").contains("dose@0"));
        let doubts = sioul_core::health::doubts_unread(DUE, DUE + 70, None, std::slice::from_ref(&peer), DUE + 60, &BTreeSet::new());
        assert!(matches!(doubts.as_slice(), [Doubt::Unheard { closed: true, until, .. }] if *until == DUE - 3_590), "the desk as last heard, closed: {doubts:?}");
        w.fake.clear_faults();
        // The desk stays closed; the alarm's pull goes through: known, no doubt.
        static ANOTHER: Mutex<()> = Mutex::new(());
        let quiet = alarm_scene("alarm-pulled", DUE - 3_000, false);
        let mut never = || -> Duration { panic!("the pull went through: the sync app is not asked") };
        let came = alarm_news_with(&quiet.phone.memory, &quiet.phone_folder, &quiet.phone.id, KEY, Some(quiet.fake.login()), &ANOTHER, DUE + 60, QUICK, Arc::new(|| DUE + 60), &mut never, TEST);
        assert_eq!(came, AlarmNews::Pulled);
        quiet.phone.exchange(&quiet.phone_folder, DUE + 65);
        assert!(doubts_now(DUE, DUE + 70, None, &[quiet.phone.sees(&quiet.phone_folder, &quiet.desk, DUE + 70)]).is_empty(), "pulled since the alarm, the desk closed: known");
    }

    /// What the phone's alarm decides of the desk once its news came (as
    /// `alarm_decide` does: `doubts_unread` when no pull went through since
    /// it began): whether the dose is known wrongly, read taken, the doubts.
    fn alarm_verdict(w: &World, came: &AlarmNews, since: i64, at: i64) -> (bool, bool, Vec<Doubt>) {
        w.phone.exchange(&w.phone_folder, at);
        let taken = w.phone.read("health-state.toml").contains("dose@0");
        let peer = w.phone.sees(&w.phone_folder, &w.desk, at + 5);
        let doubts = match came {
            AlarmNews::SyncApp { heard } => sioul_core::health::doubts_unread(DUE, at + 5, None, std::slice::from_ref(&peer), since, heard),
            AlarmNews::Pulled => doubts_now(DUE, at + 5, None, std::slice::from_ref(&peer)),
        };
        (!taken && doubts.is_empty(), taken, doubts)
    }

    /// The pull refused; the sync app brings one file of the desk's that says
    /// nothing of its session (its notes), not its entry: the desk, opened
    /// since and marked the dose there, is never known closed by what was read
    /// before; the doubt is said (review of battery part B, T2). Its entry
    /// brought, it is as its entry says.
    #[test]
    fn an_alarm_doubts_each_device_whose_own_entry_did_not_come() {
        static ONE_PULL: Mutex<()> = Mutex::new(());
        let w = alarm_scene("alarm-unrelated", DUE - 3_000, true);
        w.fake.fault(|_| Some(Fault::Status(503)));
        let notes = format!("{}.toml", w.desk.id);
        let mut ask = || {
            // The sync app brings only the desk's notes (how far it read): not its entry, not its records.
            std::fs::copy(w.server.join(&notes), w.phone_folder.join(&notes)).unwrap();
            std::fs::File::options().write(true).open(w.phone_folder.join(&notes)).unwrap().set_modified(std::time::SystemTime::now()).unwrap();
            Duration::from_millis(200)
        };
        let came = alarm_news_with(&w.phone.memory, &w.phone_folder, &w.phone.id, KEY, Some(w.fake.login()), &ONE_PULL, DUE + 60, QUICK, Arc::new(|| DUE + 60), &mut ask, TEST);
        w.fake.clear_faults();
        assert_eq!(came, AlarmNews::SyncApp { heard: BTreeSet::new() }, "the notes are no news of the desk's session");
        let (wrong, taken, doubts) = alarm_verdict(&w, &came, DUE + 60, DUE + 65);
        assert!(!wrong && !taken && matches!(doubts.as_slice(), [Doubt::Unheard { closed: true, .. }]), "{doubts:?}");
        // The sync app brings the desk's entry too: news of it came, as it says (in use, not after the dose: a doubt of its own).
        static AGAIN: Mutex<()> = Mutex::new(());
        let other = alarm_scene("alarm-entry-came", DUE - 3_000, true);
        other.fake.fault(|_| Some(Fault::Status(503)));
        let entry = format!("devices/{}.device", other.desk.id);
        let mut ask = || {
            std::fs::copy(other.server.join(&entry), other.phone_folder.join(&entry)).unwrap();
            Duration::from_millis(200)
        };
        let came = alarm_news_with(&other.phone.memory, &other.phone_folder, &other.phone.id, KEY, Some(other.fake.login()), &AGAIN, DUE + 60, QUICK, Arc::new(|| DUE + 60), &mut ask, TEST);
        other.fake.clear_faults();
        assert!(matches!(came, AlarmNews::SyncApp { ref heard } if heard.contains(&other.desk.id)), "{came:?}");
        let (wrong, _, doubts) = alarm_verdict(&other, &came, DUE + 60, DUE + 65);
        assert!(!wrong && matches!(doubts.as_slice(), [Doubt::Working { .. }] | [Doubt::Coming { .. }]), "the desk in use, as its entry says: {doubts:?}");
    }

    /// The clock set forward, a pull in this process, then set back: the
    /// alarm's own pull goes through and the desk is truly closed: counted,
    /// known, no needless doubt (review of battery part B, T1).
    #[test]
    fn a_clock_set_back_never_hides_the_alarms_own_pull() {
        static ONE_PULL: Mutex<()> = Mutex::new(());
        let w = alarm_scene("alarm-forward-back", DUE - 3_000, false);
        assert!(w.pull(DUE + 600).problem.is_none());
        let mut never = || -> Duration { panic!("the alarm's own pull went through: the sync app is not asked") };
        let came = alarm_news_with(&w.phone.memory, &w.phone_folder, &w.phone.id, KEY, Some(w.fake.login()), &ONE_PULL, DUE + 60, QUICK, Arc::new(|| DUE + 60), &mut never, TEST);
        assert_eq!(came, AlarmNews::Pulled);
        assert_eq!(State::load(&w.phone.memory).last, DUE + 60, "the time from before the set-back gives way");
        let (_, _, doubts) = alarm_verdict(&w, &came, DUE + 60, DUE + 65);
        assert!(doubts.is_empty(), "{doubts:?}");
    }

    /// A pull that began with a round left to the sync app and found it again,
    /// grown, while the other process's save found it brought: still left, its
    /// own finding (review of battery part B, T3).
    #[test]
    fn a_round_found_again_grown_stays_left_in_the_merge() {
        let w = World::new("left-regrown");
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        assert!(w.pull(DUE + 10).problem.is_none());
        let disk = State::load(&w.phone.memory);
        // The other process saved first: R brought, nothing left.
        State { left: BTreeMap::new(), tried: DUE + 20, last: DUE + 20, ..disk.clone() }.write(&w.phone.memory).unwrap();
        // This pull began with R left at 100 bytes; its look found it at 200.
        let loaded: BTreeMap<String, u64> = [("r-1.jsonl".to_string(), 100)].into();
        let ours = State { tried: DUE + 21, last: DUE + 21, left: [("r-1.jsonl".to_string(), 200)].into(), ..disk };
        ours.save_pulled(&w.phone.memory, DUE + 25, &loaded).unwrap();
        let merged = State::load(&w.phone.memory);
        assert_eq!(merged.left.get("r-1.jsonl"), Some(&200), "{:?}", merged.left);
        assert!(!merged.pulls_well(&w.phone_folder));
    }

    /// Only what the doses read of a device is news of its session (review of
    /// battery part B, fourth pass): its claim on another part (notices),
    /// brought alone, is none (U1); its stale entry merely touched, same bytes
    /// at a new time, is none either (U2). Either way the desk, opened since and
    /// the dose marked there, is said in doubt, never known closed.
    #[test]
    fn only_a_newer_entry_or_health_claim_is_news_of_a_device() {
        static ONE_PULL: Mutex<()> = Mutex::new(());
        let w = alarm_scene("alarm-notices", DUE - 3_000, true);
        crate::lease::renew(&w.server, &KEY, "notices", &w.desk.id, DUE + 20, DUE + 20, false, crate::lease::Rule::FollowsYou, crate::share::written(&w.desk.memory, &w.desk.id)).unwrap();
        w.fake.fault(|_| Some(Fault::Status(503)));
        let lease = format!("leases/notices/{}.lease", w.desk.id);
        let mut ask = || {
            let to = w.phone_folder.join(&lease);
            std::fs::create_dir_all(to.parent().unwrap()).unwrap();
            std::fs::copy(w.server.join(&lease), &to).unwrap();
            Duration::from_millis(200)
        };
        let came = alarm_news_with(&w.phone.memory, &w.phone_folder, &w.phone.id, KEY, Some(w.fake.login()), &ONE_PULL, DUE + 60, QUICK, Arc::new(|| DUE + 60), &mut ask, TEST);
        w.fake.clear_faults();
        assert_eq!(came, AlarmNews::SyncApp { heard: BTreeSet::new() }, "a notices claim is no news of the session");
        let (wrong, _, doubts) = alarm_verdict(&w, &came, DUE + 60, DUE + 65);
        assert!(!wrong && !doubts.is_empty(), "{doubts:?}");
        // The stale entry touched: same bytes, a new time.
        static AGAIN: Mutex<()> = Mutex::new(());
        let touched = alarm_scene("alarm-touched", DUE - 3_000, true);
        touched.fake.fault(|_| Some(Fault::Status(503)));
        let entry = touched.phone_folder.join(format!("devices/{}.device", touched.desk.id));
        let mut ask = || {
            std::fs::File::options().write(true).open(&entry).unwrap().set_modified(std::time::SystemTime::now()).unwrap();
            Duration::from_millis(200)
        };
        let came = alarm_news_with(&touched.phone.memory, &touched.phone_folder, &touched.phone.id, KEY, Some(touched.fake.login()), &AGAIN, DUE + 60, QUICK, Arc::new(|| DUE + 60), &mut ask, TEST);
        touched.fake.clear_faults();
        assert_eq!(came, AlarmNews::SyncApp { heard: BTreeSet::new() }, "the same entry at a new time is no news");
        let (wrong, _, doubts) = alarm_verdict(&touched, &came, DUE + 60, DUE + 65);
        assert!(!wrong && !doubts.is_empty(), "{doubts:?}");
    }

    /// Two pulls at once in two processes (the window's or an alarm's, and the
    /// background step's), here two threads without a common lock: neither
    /// undoes the other (review of battery part B, S3). The one begun later says
    /// when a pull was tried and went through; a round left to the sync app,
    /// found by the slower one, stays left after the other's save.
    #[test]
    fn two_pulls_at_once_keep_what_each_found() {
        let w = World::new("two-pulls");
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        w.desk.write("health-state.toml", "[taken]\n\"dose@0\" = 1\n");
        w.desk.exchange(&w.server, DUE + 10);
        w.fake.fault(once(|r| r.method == "PROPFIND", Fault::Late(Duration::from_millis(450))));
        std::thread::scope(|scope| {
            let slow = scope.spawn(|| pull_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), DUE + 50, TEST));
            std::thread::sleep(Duration::from_millis(100));
            // This one's look (begun later, done first): rounds past 64 bytes are left to the sync app.
            ROUND_CAP.with(|cap| cap.set(Some(64)));
            // Begun a moment later by the same clock (within the slower one's run, as a real one would).
            let quick = pull_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), DUE + 51, TEST);
            ROUND_CAP.with(|cap| cap.set(None));
            assert!(quick.problem.is_none() && quick.left >= 1, "{quick:?}");
            let slow = slow.join().unwrap();
            assert!(slow.problem.is_none(), "{slow:?}");
        });
        let state = State::load(&w.phone.memory);
        assert_eq!((state.tried, state.last), (DUE + 51, DUE + 51), "the later begun says when");
        assert!(!state.left.is_empty() && !state.pulls_well(&w.phone_folder), "found left by the other, never erased by the slower one's save: {:?}", state.left);
        // A look that finds it brought (the slower one fetched it) clears it.
        assert!(w.pull(DUE + 120).problem.is_none());
        assert!(State::load(&w.phone.memory).pulls_well(&w.phone_folder));
    }

    /// A round on the server past what a pull brings (`LARGEST`; a small cap
    /// in this test) is left to the sync app, and said: the pull alone is no
    /// longer trusted while it lasts; once the sync app brought it, the pull is
    /// again (review of battery part B, F4).
    #[test]
    fn a_round_too_large_for_the_pull_is_said_and_left_to_the_sync_app() {
        let w = World::new("too-large");
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        w.desk.write("health-state.toml", "[taken]\n\"dose@0\" = 1\n");
        w.desk.exchange(&w.server, DUE + 10);
        ROUND_CAP.with(|cap| cap.set(Some(64)));
        let pulled = w.pull(DUE + 20);
        assert!(pulled.problem.is_none() && pulled.left >= 1, "{pulled:?}");
        let state = State::load(&w.phone.memory);
        assert!(!state.left.is_empty() && !state.pulls_well(&w.phone_folder) && !state.went_through_since(&w.phone_folder, DUE + 20, DUE + 20), "{:?}", state.left);
        // The sync app brings it: nothing left there that is not here.
        w.down();
        let pulled = w.pull(DUE + 100);
        ROUND_CAP.with(|cap| cap.set(None));
        assert_eq!(pulled.left, 0, "{pulled:?}");
        assert!(State::load(&w.phone.memory).pulls_well(&w.phone_folder));
    }

    /// The phone's entry on the server put back to an older copy (another
    /// device's sync app, the server's versions): the next pull lists it of
    /// another size than the phone sent, and the next send sends it over that
    /// copy, rather than at the check of every six hours (review of battery
    /// part B, F6).
    #[test]
    fn the_phones_entry_put_back_older_on_the_server_is_sent_again() {
        let w = World::new("entry-back");
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        let entry = format!("devices/{}.device", w.phone.id);
        let older = std::fs::read(w.phone_folder.join(&entry)).unwrap();
        w.phone.session(&w.phone_folder, |e| e.close(DUE + 10));
        assert!(phone_sends(&w, DUE + 20, false).problem.is_none());
        let current = std::fs::read(w.phone_folder.join(&entry)).unwrap();
        assert_eq!(std::fs::read(w.server.join(&entry)).unwrap(), current);
        assert_ne!(older.len(), current.len());
        // Put back there; the desk changes too, so that the folder's listing is looked at again.
        std::fs::write(w.server.join(&entry), &older).unwrap();
        w.desk.exchange(&w.server, DUE + 30);
        assert!(w.pull(DUE + 40).problem.is_none());
        assert_eq!(State::load(&w.phone.memory).own_entry.map(|(size, _)| size), Some(older.len() as u64));
        assert!(phone_sends(&w, DUE + 50, false).problem.is_none());
        assert_eq!(std::fs::read(w.server.join(&entry)).unwrap(), current, "sent over the copy put back");
    }

    /// The owner's phone, 6 October 2026, 23:30: the folder found on the
    /// server at night, the phone in the background, its folder telling the
    /// desk closed hours ago (eDrive left it so) while the desk is in use.
    /// The first pull comes at once; then the desk is known in use, and
    /// followed once a minute, night or not; closed, at the night's pace.
    #[test]
    fn found_at_night_the_first_pull_comes_at_once() {
        let w = World::new("night");
        w.desk.press(true, DUE + 30);
        w.desk.exchange(&w.server, DUE + 60);
        w.up();
        let in_use = |now: i64| crate::devices::all(&w.phone_folder, &KEY).0.iter().any(|e| e.id == w.desk.id && e.working && !e.left && now - e.exported <= sioul_core::health::FRESH + sioul_core::health::SKEW);
        let night = |now: i64| Pace { phone: true, shown: false, in_use: in_use(now), urgent: false, step: 15 * 60 };
        assert!(!in_use(DUE + 70), "the stale folder tells the desk not in use");
        let state = w.find(DUE + 70);
        assert!(state.confirmed_for(&w.phone_folder));
        attach(&w.phone_folder, &w.phone.memory);
        assert!(due(&State::load(&w.phone.memory), DUE + 80, night(DUE + 80)), "found: pulled at once, whatever the hour");
        let pulled = w.pull(DUE + 80);
        assert!(pulled.problem.is_none() && pulled.listed > 0 && pulled.fetched > 0, "{pulled:?}");
        assert!(in_use(DUE + 90), "the desk known in use, from the server");
        w.phone.exchange(&w.phone_folder, DUE + 90);
        assert!(w.phone.dnd().is_some_and(|p| p.on), "its do-not-disturb too");
        let state = State::load(&w.phone.memory);
        assert!(!due(&state, DUE + 100, night(DUE + 100)), "not twice in a minute");
        w.desk.exchange(&w.server, DUE + 130);
        assert!(w.pull(DUE + 140).problem.is_none(), "once a minute while the desk is in use, at night too");
        // The desk closes: at the night's pace again, fifteen minutes.
        w.desk.session(&w.server, |e| e.close(DUE + 150));
        assert!(w.pull(DUE + 200).problem.is_none());
        let state = State::load(&w.phone.memory);
        assert!(!in_use(DUE + 260) && !due(&state, DUE + 260, night(DUE + 260)));
        assert!(due(&state, DUE + 200 + 15 * 60, night(DUE + 200 + 15 * 60)), "a device opened at night is noticed within the step's fifteen minutes");
    }

    #[test]
    fn the_pace_of_pulls() {
        let state = State { confirmed: 1_000, tried: 1_000, ..State::default() };
        let pace = |phone, shown, in_use, urgent| Pace { phone, shown, in_use, urgent, step: 5 * 60 };
        // A computer, a phone on its screen or another device in use: once a minute.
        assert!(due(&state, 1_060, pace(false, false, false, false)) && !due(&state, 1_059, pace(false, false, false, false)));
        assert!(due(&state, 1_060, pace(true, true, false, false)));
        assert!(due(&state, 1_060, pace(true, false, true, false)));
        // A phone in the background, nobody at another device: at its step's pace.
        assert!(!due(&state, 1_120, pace(true, false, false, false)) && due(&state, 1_270, pace(true, false, false, false)));
        // Asked for news: twenty seconds after the last.
        assert!(due(&state, 1_020, pace(true, false, false, true)) && !due(&state, 1_010, pace(true, false, false, true)));
        // Found again since the last pull: at once.
        assert!(due(&State { confirmed: 1_005, ..state }, 1_006, pace(true, false, false, false)));
    }

    /// A phone's background step leaves the sync app alone only while its own
    /// pull works: on, confirmed for this folder, gone through, and not failing.
    #[test]
    fn the_pull_alone_is_trusted_only_while_it_goes_through() {
        let folder = Path::new("/storage/emulated/0/Documents/Sioul");
        let well = State { folder: shown(folder), url: "https://cloud.example.org/remote.php/dav/files/jane/Documents/Sioul/".into(), confirmed: 1_000, last: 1_200, tried: 1_200, ..State::default() };
        assert!(well.pulls_well(folder));
        assert!(!State { on: Some(false), ..well.clone() }.pulls_well(folder), "switched off here");
        assert!(State { on: Some(true), ..well.clone() }.pulls_well(folder));
        assert!(!State { confirmed: 0, ..well.clone() }.pulls_well(folder), "not confirmed");
        assert!(!State { last: 0, ..well.clone() }.pulls_well(folder), "never pulled yet");
        assert!(!State { said: "network:cloud.example.org".into(), ..well.clone() }.pulls_well(folder), "the last pull failed");
        assert!(!State { said: "not-found:cloud.example.org".into(), ..well.clone() }.pulls_well(folder), "looked for again, not found");
        assert!(!State { mode: MIRROR.into(), ..well.clone() }.pulls_well(folder), "Sioul keeping the folder: no sync app to ask anyway");
        assert!(!well.pulls_well(Path::new("/storage/emulated/0/Documents/Other")), "another folder");
    }

    /// A step's requests, a pull's then a send's (each a `Server` of its own,
    /// as `pull` and `send` make them, with their own limits), go through one
    /// connection while it stays open: the process's one agent. On mobile
    /// data, one TLS handshake a step instead of one per pull, per send and
    /// per file sent.
    #[test]
    fn a_steps_requests_go_through_one_connection() {
        use std::io::{BufRead, BufReader, Write};
        use std::sync::atomic::{AtomicUsize, Ordering};
        let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
        let base = format!("http://127.0.0.1:{}", listener.local_addr().unwrap().port());
        let (connections, requests) = (Arc::new(AtomicUsize::new(0)), Arc::new(AtomicUsize::new(0)));
        let (counted, served) = (Arc::clone(&connections), Arc::clone(&requests));
        // A server that keeps its connections open (HTTP/1.1's default), as Nextcloud's does.
        std::thread::spawn(move || {
            for stream in listener.incoming().filter_map(Result::ok) {
                counted.fetch_add(1, Ordering::SeqCst);
                let served = Arc::clone(&served);
                std::thread::spawn(move || {
                    let mut reader = BufReader::new(stream.try_clone().unwrap());
                    let mut stream = stream;
                    loop {
                        let mut line = String::new();
                        if reader.read_line(&mut line).unwrap_or(0) == 0 {
                            return;
                        }
                        let mut length = 0;
                        loop {
                            let mut header = String::new();
                            reader.read_line(&mut header).unwrap();
                            if header.trim().is_empty() {
                                break;
                            }
                            if let Some((name, value)) = header.split_once(':')
                                && name.eq_ignore_ascii_case("content-length")
                            {
                                length = value.trim().parse().unwrap();
                            }
                        }
                        let mut body = vec![0; length];
                        reader.read_exact(&mut body).unwrap();
                        served.fetch_add(1, Ordering::SeqCst);
                        let (status, answer) = match line.split_whitespace().next() {
                            // The folder's own response, as every server gives it (a listing without it is none).
                            Some("PROPFIND") => {
                                let path = line.split_whitespace().nth(1).unwrap_or("/");
                                ("207 Multi-Status", super::fake::multistatus(&format!("<d:response><d:href>{path}</d:href><d:propstat><d:prop><d:resourcetype><d:collection/></d:resourcetype></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat></d:response>")))
                            }
                            Some("GET") => ("200 OK", b"version = 1\n".to_vec()),
                            _ => ("201 Created", Vec::new()),
                        };
                        let head = format!("HTTP/1.1 {status}\r\nContent-Length: {}\r\nETag: \"e\"\r\n\r\n", answer.len());
                        if stream.write_all(head.as_bytes()).and_then(|()| stream.write_all(&answer)).is_err() {
                            return;
                        }
                    }
                });
            }
        });
        let login = Login { account: "cloud".into(), url: format!("{base}/remote.php/dav/"), user: "jane".into(), password: Some(PASSWORD.into()) };
        let folder = format!("{base}/remote.php/dav/files/jane/Documents/Sioul/");
        // The pull: a listing and a small file.
        let pull = Server::new(&login, TEST).unwrap();
        pull.list(&folder).unwrap();
        assert!(pull.small(&format!("{folder}seal.toml")).unwrap().is_some());
        // The send after the exchange, with a send's limits: a look and a file sent whole.
        let send = Server::new(&login, Limits { wait: Duration::from_secs(2), stall: Duration::from_secs(3), ..TEST }).unwrap();
        assert!(send.stat(&format!("{folder}devices/")).unwrap().is_none_or(|item| item.etag.is_empty()));
        let (status, _) = send.put_file(&format!("{folder}phone.toml"), b"read = 1\n".to_vec(), None, 1, &sha1_hex(b"read = 1\n")).unwrap();
        assert_eq!(status, 201);
        // The second send of a step.
        let again = Server::new(&login, TEST).unwrap();
        again.list(&folder).unwrap();
        assert_eq!(requests.load(Ordering::SeqCst), 5);
        assert_eq!(connections.load(Ordering::SeqCst), 1, "one connection for the whole step");
    }

    #[test]
    fn where_the_folder_may_be_on_the_server() {
        let found = |folder: &str, configs: &[&str]| places(Path::new(folder), &configs.iter().map(|c| c.to_string()).collect::<Vec<_>>());
        // A phone: eDrive carries its storage as the cloud's root, whatever name the storage goes by.
        assert_eq!(found("/storage/emulated/0/Documents/Sioul", &[]), ["Documents/Sioul", "Sioul", "0/Documents/Sioul"]);
        assert_eq!(found("/sdcard/Documents/Sioul/", &[])[0], "Documents/Sioul");
        // The Nextcloud app's own folder: after its account's.
        assert_eq!(found("/storage/emulated/0/Android/media/com.nextcloud.client/nextcloud/jane@murena.io/Shared/Sioul", &[])[0], "Shared/Sioul");
        // A computer: the Nextcloud client's folders, by their target there.
        let cfg = "[Accounts]\n0\\Folders\\1\\localPath=/home/me/Nextcloud/\n0\\Folders\\1\\targetPath=/\n0\\Folders\\2\\localPath=/home/me/Work\n0\\Folders\\2\\targetPath=/Projects/Work\n0\\url=https://cloud.example.org\n";
        assert_eq!(found("/home/me/Nextcloud/Documents/Sioul", &[cfg])[0], "Documents/Sioul");
        assert_eq!(found("/home/me/Work/Sioul", &[cfg])[0], "Projects/Work/Sioul");
        assert_eq!(found("/home/me/Workshop/Sioul", &[cfg]), ["Sioul", "Workshop/Sioul", "me/Workshop/Sioul"], "not inside /home/me/Work");
        // Addresses and names.
        assert_eq!(encode_path("Mes documents/Sioul"), "Mes%20documents/Sioul");
        assert_eq!(host_of("https://jane@murena.io/remote.php/dav/"), "murena.io");
        assert_eq!(kind_of("devices/0f8fad5b-d9cb-469f-a165-70867728950e.device").map(|k| k.0), Some(Kind::Device));
        assert_eq!(kind_of("0f8fad5b-d9cb-469f-a165-70867728950e-12.jsonl").map(|k| k.0), Some(Kind::Round));
        assert_eq!(kind_of("0f8fad5b-d9cb-469f-a165-70867728950e-12 (conflicted copy).jsonl"), None);
        assert_eq!(kind_of("leases/health/desktop.lease").map(|k| k.0), Some(Kind::Claim));
    }

    #[test]
    fn found_on_the_account_given_by_hand_or_not_at_all() {
        let w = World::new("given");
        // Given by hand, a path in the account's files.
        State::choose(&w.phone.memory, |s| s.given = "Documents/Sioul".into()).unwrap();
        let state = find_with(&w.phone.memory, &w.phone_folder, &[w.fake.login()], &[], DUE, TEST);
        assert!(state.confirmed_for(&w.phone_folder), "{state:?}");
        // Given as an address.
        State::choose(&w.phone.memory, |s| s.given = w.fake.folder_url("Documents/Sioul")).unwrap();
        assert!(find_with(&w.phone.memory, &w.phone_folder, &[w.fake.login()], &[], DUE + 1, TEST).confirmed_for(&w.phone_folder));
        // Given wrong: not found, said, and nothing looked for by itself meanwhile.
        State::choose(&w.phone.memory, |s| s.given = "Elsewhere".into()).unwrap();
        let state = find_with(&w.phone.memory, &w.phone_folder, &[w.fake.login()], &places(&w.phone_folder, &[]), DUE + 2, TEST);
        assert!(state.said.starts_with("not-found:") && !state.confirmed_for(&w.phone_folder), "{state:?}");
        State::choose(&w.phone.memory, |s| s.given.clear()).unwrap();
        // A refused password, said; no password kept, said; no account, said.
        let wrong = Login { password: Some("wrong".into()), ..w.fake.login() };
        assert!(find_with(&w.phone.memory, &w.phone_folder, &[wrong], &places(&w.phone_folder, &[]), DUE + 3, TEST).said.starts_with("login:"));
        let none = Login { password: None, ..w.fake.login() };
        assert_eq!(find_with(&w.phone.memory, &w.phone_folder, &[none], &[], DUE + 4, TEST).said, "no-password:cloud");
        assert_eq!(find_with(&w.phone.memory, &w.phone_folder, &[], &[], DUE + 5, TEST).said, "no-account");
        // A server of another kind (no Nextcloud files): not looked on.
        let other = Login { url: format!("{}/dav/calendars/jane/", w.fake.base), ..w.fake.login() };
        assert_eq!(find_with(&w.phone.memory, &w.phone_folder, &[other], &places(&w.phone_folder, &[]), DUE + 6, TEST).said, "no-account");
        // When to look again: at once when asked, else six hours on.
        let state = State::load(&w.phone.memory);
        assert!(!state.look_due(&w.phone_folder, DUE + 7) && state.look_due(&w.phone_folder, DUE + 6 + LOOK_AGAIN));
        State::choose(&w.phone.memory, |s| s.asked = DUE + 8).unwrap();
        assert!(State::load(&w.phone.memory).look_due(&w.phone_folder, DUE + 9));
    }

    #[test]
    fn your_choices_are_never_written_over_by_a_pull() {
        let w = World::new("choices");
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        // A pull holds the state while it works; you switch it off meanwhile: off stays.
        let held = State::load(&w.phone.memory);
        State::choose(&w.phone.memory, |s| s.on = Some(false)).unwrap();
        held.save(&w.phone.memory).unwrap();
        assert_eq!(State::load(&w.phone.memory).on, Some(false));
        State::choose(&w.phone.memory, |s| s.on = None).unwrap();
        assert!(State::load(&w.phone.memory).fetching());
    }

    // ------------------------------------------------ kept in step by Sioul itself

    /// Two devices with no sync app at all, each keeping its own copy of the
    /// folder in step with the server through Sioul alone (`MIRROR`).
    struct Pair {
        base: PathBuf,
        fake: Arc<Fake>,
        desk: Device,
        desk_folder: PathBuf,
        phone: Device,
        phone_folder: PathBuf,
    }

    impl Pair {
        fn new(name: &str) -> Pair {
            let base = scratch(name);
            let files = base.join("cloud");
            std::fs::create_dir_all(&files).unwrap();
            let fake = Fake::start(&files);
            let desk = Device::new(&base, "desk", COMPUTER);
            let phone = Device::new(&base, "phone", PHONE);
            let (desk_folder, phone_folder) = (mirror_of(&desk.memory), mirror_of(&phone.memory));
            let login = fake.login();
            // The desk starts sharing there: the folder made, its seal sent.
            let opened = open_with(&login, "Documents/Sioul", TEST).unwrap();
            assert!(opened.seal.is_none(), "nothing there yet");
            put(&desk_folder, "seal.toml", SEAL);
            create_with(&login, &opened, &desk_folder, TEST).unwrap();
            begin(&desk.memory, &desk_folder, &login, &opened, DUE - 7_300).unwrap();
            // A second start there at once finds it sealed: never sealed twice.
            assert_eq!(create_with(&login, &opened, &desk_folder, TEST), Err("sealed-meanwhile".to_string()));
            // The phone joins it: the seal brought into its own copy.
            let joined = open_with(&login, "/Documents/Sioul/", TEST).unwrap();
            assert_eq!(joined.seal.as_deref(), Some(SEAL.as_bytes()));
            put_bytes(&phone_folder, "seal.toml", joined.seal.as_deref().unwrap());
            begin(&phone.memory, &phone_folder, &login, &joined, DUE - 7_250).unwrap();
            let pair = Pair { base, fake, desk, desk_folder, phone, phone_folder };
            pair.desk.session(&pair.desk_folder, |e| e.start(DUE - 7_200));
            pair.phone.session(&pair.phone_folder, |e| e.start(DUE - 7_200));
            pair.turn(true, DUE - 7_100);
            pair.turn(false, DUE - 7_090);
            pair.turn(true, DUE - 7_080);
            pair
        }

        fn device(&self, desk: bool) -> (&Device, &Path) {
            if desk { (&self.desk, &self.desk_folder) } else { (&self.phone, &self.phone_folder) }
        }

        fn step(&self, desk: bool, now: i64, whole: bool) -> Pulled {
            let (device, folder) = self.device(desk);
            step_with(&device.memory, folder, &device.id, &self.fake.login(), now, whole, TEST)
        }

        /// The others' sealed files, after a step (`sealed_step`).
        fn sealed(&self, desk: bool, now: i64) -> Pulled {
            let (device, folder) = self.device(desk);
            sealed_step_with(&device.memory, folder, &device.id, &self.fake.login(), &KEY, now, false, TEST)
        }

        /// As the window does each minute: the server looked through, an
        /// exchange, what it wrote sent; then the others' sealed files, and
        /// another exchange at once when some came.
        fn turn(&self, desk: bool, now: i64) -> Outcome {
            let before = self.step(desk, now, true);
            assert!(before.problem.is_none(), "{before:?}");
            let outcome = self.device(desk).0.exchange(self.device(desk).1, now);
            let after = self.step(desk, now, false);
            assert!(after.problem.is_none(), "{after:?}");
            if self.sealed(desk, now).fetched > 0 {
                self.device(desk).0.exchange(self.device(desk).1, now);
                let _ = self.step(desk, now, false);
            }
            outcome
        }
    }

    impl Drop for Pair {
        fn drop(&mut self) {
            let _ = std::fs::remove_dir_all(&self.base);
        }
    }

    #[test]
    fn two_devices_without_a_sync_app_share_through_the_server_alone() {
        let p = Pair::new("mirror");
        // Do-not-disturb turned on at the desk: on the phone at its next turn.
        p.desk.press(true, DUE + 10);
        p.turn(true, DUE + 20);
        p.turn(false, DUE + 30);
        let press = p.phone.dnd().expect("the desk's press");
        assert!(press.on && press.from == p.desk.id, "{press:?}");
        // A dose marked taken on the phone: on the desk at its next turn.
        p.phone.write("health-state.toml", "[taken]\n\"levo@1800000000\" = 1800000040\n");
        p.turn(false, DUE + 40);
        p.turn(true, DUE + 50);
        assert!(p.desk.read("health-state.toml").contains("levo@1800000000"));
        // Turned off on the phone: off on the desk.
        p.phone.press(false, DUE + 60);
        p.turn(false, DUE + 70);
        p.turn(true, DUE + 80);
        assert!(!p.desk.dnd().unwrap().on);
        // Each knows how the other is, from the server alone.
        let phone = p.desk.sees(&p.desk_folder, &p.phone, DUE + 90);
        assert!(phone.complete && phone.said.as_ref().is_some_and(|s| s.working && s.exported >= DUE + 70), "{phone:?}");
        assert!(doubts_now(DUE - 100, DUE + 90, None, &[phone]).is_empty(), "a dose due before its last export is known");
        // Neither the backup nor its reading beside the folder ever run on a folder Sioul keeps itself.
        assert_eq!(pull_with(&p.phone.memory, &p.phone_folder, &p.phone.id, &p.fake.login(), DUE + 95, TEST).problem.as_deref(), Some("mirror"));
        assert!(attach(&p.phone_folder, &p.phone.memory).is_none());
    }

    #[test]
    fn a_device_never_writes_another_devices_file() {
        let p = Pair::new("own");
        for minute in 0..6 {
            for desk in [true, false] {
                let device = p.device(desk).0;
                if minute % 2 == 0 {
                    device.press(minute % 4 == 0, DUE + minute * 60 + 1);
                }
                p.fake.forget_seen();
                p.turn(desk, DUE + minute * 60 + if desk { 0 } else { 30 });
                for line in p.fake.seen() {
                    let path = line.split(' ').nth(1).unwrap_or_default();
                    if line.starts_with("PUT ") || line.starts_with("DELETE ") {
                        assert!(path.contains(&device.id) || path.contains("/blobs/"), "{line}");
                    } else {
                        assert!(line.starts_with("GET ") || line.starts_with("PROPFIND ") || line.starts_with("MKCOL "), "{line}");
                    }
                }
            }
        }
    }

    #[test]
    fn a_refused_or_failed_upload_is_never_lost() {
        let p = Pair::new("refused");
        p.phone.write("health-state.toml", "[taken]\n\"levo@1800000000\" = 1800000040\n");
        for (n, fault) in [Fault::Status(412), Fault::Status(500), Fault::Drop].into_iter().enumerate() {
            p.fake.clear_faults();
            let id = p.phone.id.clone();
            p.fake.fault(move |r| (r.method == "PUT" && r.path.contains(&id) && r.path.ends_with(".jsonl")).then_some(fault));
            let now = DUE + 40 + n as i64 * 10;
            // Its step looks through the server, and sends what waits: refused again.
            let _ = p.step(false, now, true);
            p.phone.exchange(&p.phone_folder, now);
            let pushed = p.step(false, now, false);
            assert!(pushed.problem.is_some(), "{fault:?}: {pushed:?}");
            assert!(p.phone.read("health-state.toml").contains("levo@"), "nothing lost here");
            p.turn(true, now + 5);
            assert!(!p.desk.read("health-state.toml").contains("levo@"), "{fault:?}: not there yet");
        }
        // The server takes it again: it goes, and the desk has it.
        p.fake.clear_faults();
        p.turn(false, DUE + 100);
        p.turn(true, DUE + 110);
        assert!(p.desk.read("health-state.toml").contains("levo@1800000000"));
        let heard = crate::share::heard(&p.desk.memory, &p.desk.id);
        assert!(!heard.broken.contains_key(&p.phone.id), "{heard:?}");
    }

    #[test]
    fn its_copy_lost_a_device_goes_on_after_its_last_record() {
        let p = Pair::new("lost");
        p.phone.write("health-state.toml", "[taken]\n\"one@1800000000\" = 1800000010\n");
        p.turn(false, DUE + 20);
        p.turn(true, DUE + 25);
        // The phone's copy of the folder lost, its memory kept: its records come back from the server, numbering goes on.
        for entry in std::fs::read_dir(&p.phone_folder).unwrap().filter_map(Result::ok) {
            if entry.file_name() != "seal.toml" {
                let _ = std::fs::remove_dir_all(entry.path());
                let _ = std::fs::remove_file(entry.path());
            }
        }
        p.phone.write("health-state.toml", "[taken]\n\"one@1800000000\" = 1800000010\n\"two@1800000000\" = 1800000030\n");
        let outcome = p.turn(false, DUE + 40);
        assert!(outcome.problems.iter().all(|p| !p.starts_with("share-own")), "{:?}", outcome.problems);
        p.turn(true, DUE + 50);
        let record = p.desk.read("health-state.toml");
        assert!(record.contains("one@") && record.contains("two@"), "{record}");
        let heard = crate::share::heard(&p.desk.memory, &p.desk.id);
        assert!(!heard.broken.contains_key(&p.phone.id), "no gap nor cut on the desk: {heard:?}");
        // The others' files came back too.
        assert!(p.phone_folder.join(format!("devices/{}.device", p.desk.id)).exists());
    }

    #[test]
    fn sealed_files_travel_whole_and_go_when_swept() {
        let p = Pair::new("blobs");
        let source = p.base.join("note.md");
        std::fs::write(&source, "a note\n".repeat(1000)).unwrap();
        let (hash, _) = crate::blobs::hash_file(&source).unwrap();
        crate::blobs::put(&p.desk_folder, &KEY, &source, &hash).unwrap();
        let name = crate::blobs::name(&KEY, &hash);
        p.turn(true, DUE + 10);
        // Waited for on the phone (a text's medium a computer lacks, here): fetched by its name, whole.
        let size = std::fs::metadata(p.desk_folder.join("blobs").join(&name)).unwrap().len();
        crate::blobs::Wanted::change(&p.phone.memory, |w| {
            w.media.insert(name.clone(), crate::blobs::Want { hash: hash.clone(), size, since: DUE, ..Default::default() });
        })
        .unwrap();
        p.turn(false, DUE + 20);
        let sealed = std::fs::read(p.desk_folder.join("blobs").join(&name)).unwrap();
        assert_eq!(std::fs::read(p.phone_folder.join("blobs").join(&name)).unwrap(), sealed);
        crate::blobs::Wanted::change(&p.phone.memory, |w| w.media.clear()).unwrap();
        // Never sent back by the phone, which did not make it.
        p.fake.forget_seen();
        p.turn(false, DUE + 30);
        assert!(p.fake.seen().iter().all(|l| !(l.starts_with("PUT ") && l.contains("/blobs/"))), "{:?}", p.fake.seen());
        // Swept on the desk: taken out there.
        std::fs::remove_file(p.desk_folder.join("blobs").join(&name)).unwrap();
        p.turn(true, DUE + 40);
        assert!(!p.fake.files.join("Documents/Sioul/blobs").join(&name).exists());
        // The phone's next listing no longer shows it: never let go while its
        // memory says nothing of what it needs (an older Sioul's, until this
        // one's first exchange); then let go there too, nothing needing it.
        let _ = p.step(false, DUE + 50 + BLOBS_AGAIN, true);
        let files = p.phone.memory.with_file_name("files.json");
        let mut said: serde_json::Value = serde_json::from_slice(&std::fs::read(&files).unwrap()).unwrap();
        assert!(said.as_object_mut().unwrap().remove("needed").is_some(), "said by each exchange of this Sioul");
        std::fs::write(&files, serde_json::to_vec(&said).unwrap()).unwrap();
        let sealed = p.sealed(false, DUE + 50 + BLOBS_AGAIN);
        assert!(sealed.listed_bytes > 0 && sealed.let_go == 0 && p.phone_folder.join("blobs").join(&name).exists(), "listed, none let go: {sealed:?}");
        p.turn(false, DUE + 60 + BLOBS_AGAIN + CHECK_AGAIN);
        assert!(!p.phone_folder.join("blobs").join(&name).exists(), "let go on the phone");
    }

    /// A sealed file going up slowly or not at all, or coming down slowly,
    /// never holds back a device's records: its own records go up first, the
    /// doses' answers among them, sealed files last (the spam filter's table
    /// here, made by a training on the desk).
    #[test]
    fn a_slow_or_failing_sealed_file_never_holds_back_the_records() {
        let p = Pair::new("sealed-last");
        let made = |seed: u32| {
            let mut x = seed.wrapping_mul(2_654_435_761) | 1;
            (0..600_000)
                .map(|_| {
                    x ^= x << 13;
                    x ^= x >> 17;
                    x ^= x << 5;
                    x as u8
                })
                .collect::<Vec<u8>>()
        };
        let table = p.desk.roots.data.join("spam").join("table.bin");
        std::fs::create_dir_all(table.parent().unwrap()).unwrap();
        std::fs::write(&table, made(1)).unwrap();
        let mut taken = String::from("[taken]\n");
        // Late past the time a file's size asks (an upload's answer is awaited that long, `put_file`).
        for (n, fault) in [Fault::Status(500), Fault::Drop, Fault::Late(Duration::from_secs(6))].into_iter().enumerate() {
            p.fake.clear_faults();
            p.fake.fault(move |r| (r.method == "PUT" && r.path.contains("/blobs/")).then_some(fault));
            let now = DUE + 100 + n as i64 * 60;
            // A dose marked on the desk, beside its new table that cannot go up.
            taken.push_str(&format!("\"levo@{}\" = {}\n", 1_800_000_000 + n, 1_800_000_040 + n));
            p.desk.write("health-state.toml", &taken);
            let _ = p.step(true, now, true);
            p.desk.exchange(&p.desk_folder, now);
            let pushed = p.step(true, now, false);
            assert!(pushed.problem.is_some(), "{fault:?}: {pushed:?}");
            // The phone has the dose all the same; the table waits for its sealed file.
            p.turn(false, now + 30);
            assert!(p.phone.read("health-state.toml").contains(&format!("levo@{}", 1_800_000_000 + n)), "{fault:?}");
        }
        // The server takes it: it goes, and comes.
        p.fake.clear_faults();
        p.turn(true, DUE + 400);
        p.turn(false, DUE + 410);
        let phone_table = p.phone.roots.data.join("spam").join("table.bin");
        assert_eq!(std::fs::read(&phone_table).unwrap(), std::fs::read(&table).unwrap());
        // A new table coming down slowly to the phone: its step sends the
        // phone's own answer and never waits for the table, which comes after
        // the step (`sealed_step`), at its own pace.
        std::fs::write(&table, made(2)).unwrap();
        p.turn(true, DUE + 500);
        let _ = p.step(false, DUE + 505, true);
        p.phone.write("health-state.toml", &format!("{taken}\"two@1800000000\" = 1800000090\n"));
        p.phone.exchange(&p.phone_folder, DUE + 506);
        p.fake.fault(|r| (r.method == "GET" && r.path.contains("/blobs/")).then_some(Fault::Late(Duration::from_secs(2))));
        let stepped = p.step(false, DUE + 510, false);
        assert!(stepped.problem.is_none() && stepped.sent > 0, "{stepped:?}");
        let sealed = p.sealed(false, DUE + 510);
        assert!(sealed.problem.is_some() && sealed.fetched == 0, "{sealed:?}");
        p.fake.clear_faults();
        p.turn(true, DUE + 520);
        assert!(p.desk.read("health-state.toml").contains("two@1800000000"));
        // The table comes once its backoff is over (a minute at first).
        p.turn(false, DUE + 530);
        assert_ne!(std::fs::read(&phone_table).unwrap(), std::fs::read(&table).unwrap(), "within its backoff");
        p.turn(false, DUE + 580);
        assert_eq!(std::fs::read(&phone_table).unwrap(), std::fs::read(&table).unwrap());
    }

    /// A device beside its sync app (the desk: its folder is the server's) and
    /// a phone with none, Sioul keeping its copy: one folder, both ways.
    #[test]
    fn a_device_with_a_sync_app_and_one_without_share_one_folder() {
        let w = World::new("mixed");
        let lone = Device::new(&w.base, "lone", PHONE);
        let folder = mirror_of(&lone.memory);
        let login = w.fake.login();
        let opened = open_with(&login, "Documents/Sioul", TEST).unwrap();
        put_bytes(&folder, "seal.toml", opened.seal.as_deref().expect("sealed by the desk"));
        begin(&lone.memory, &folder, &login, &opened, DUE).unwrap();
        lone.session(&folder, |e| e.start(DUE));
        let turn = |now: i64| {
            assert!(step_with(&lone.memory, &folder, &lone.id, &login, now, true, TEST).problem.is_none());
            lone.exchange(&folder, now);
            assert!(step_with(&lone.memory, &folder, &lone.id, &login, now, false, TEST).problem.is_none());
        };
        turn(DUE + 10);
        // Do-not-disturb turned on at the desk: the phone without a sync app has it.
        w.desk.press(true, DUE + 20);
        w.desk.exchange(&w.server, DUE + 30);
        turn(DUE + 40);
        assert!(lone.dnd().is_some_and(|p| p.on && p.from == w.desk.id));
        // A dose answered on that phone: the desk reads it in its own folder.
        lone.write("health-state.toml", "[taken]\n\"levo@1800000000\" = 1800000050\n");
        turn(DUE + 50);
        w.desk.exchange(&w.server, DUE + 60);
        assert!(w.desk.read("health-state.toml").contains("levo@1800000000"));
        let seen = w.desk.sees(&w.server, &lone, DUE + 70);
        assert!(seen.complete && seen.said.is_some_and(|s| s.working), "the desk knows how the phone is");
    }

    #[test]
    fn keeping_the_folder_is_inert_until_set_up() {
        let w = World::new("inert");
        w.fake.forget_seen();
        let stepped = step_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), DUE, true, TEST);
        assert_eq!(stepped.problem.as_deref(), Some("not-confirmed"));
        assert!(w.fake.seen().is_empty(), "not a request");
        // The backup confirmed is not Sioul keeping the folder: nothing sent either.
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        w.fake.forget_seen();
        assert_eq!(step_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), DUE + 1, false, TEST).problem.as_deref(), Some("not-confirmed"));
        assert!(w.fake.seen().is_empty());
    }

    // ------------------------------------------------ sent beside the sync app

    fn mtime(path: &Path) -> Option<SystemTime> {
        std::fs::metadata(path).and_then(|m| m.modified()).ok()
    }

    fn set_mtime(path: &Path, at: SystemTime) {
        if let Ok(file) = std::fs::File::options().write(true).open(path) {
            let _ = file.set_modified(at);
        }
    }

    /// A file written there by a sync app, as a `PUT` writes it: a new ETag, dated as the file here.
    fn sync_up(local: &Path, server: &Path) {
        std::fs::create_dir_all(server.parent().unwrap()).unwrap();
        std::fs::write(server, std::fs::read(local).unwrap()).unwrap();
        fake::bump(server);
        if let Some(at) = mtime(local) {
            set_mtime(server, at);
        }
    }

    /// A file brought down by a sync app: a new file put in its place, dated as the server's.
    fn sync_down(server: &Path, local: &Path) {
        std::fs::create_dir_all(local.parent().unwrap()).unwrap();
        let temporary = local.with_file_name(format!(".{}.download", local.file_name().unwrap().to_string_lossy()));
        std::fs::write(&temporary, std::fs::read(server).unwrap()).unwrap();
        if let Some(at) = mtime(server) {
            set_mtime(&temporary, at);
        }
        std::fs::rename(&temporary, local).unwrap();
    }

    fn folder_of(relative: &str) -> &str {
        relative.rfind('/').map_or("", |at| &relative[..at])
    }

    /// Murena's eDrive as its source reads (eDrive `main`, 31 August 2026;
    /// docs/database.md, "Sent to the server too"): the server's files first,
    /// an ETag changed there brought down when the size differs, else taken
    /// as known; then the phone's, a time later than the one known sent up,
    /// `If-Match` the ETag it knows (the Documents folder is a "media"
    /// folder), replacing the download planned. A folder whose time did not
    /// change is not looked at here (a file appended in place changes none):
    /// the download planned then goes ahead over the phone's newer file. A
    /// refused upload holds the file back, and after four, for good. Never a
    /// conflicted copy.
    #[derive(Default)]
    struct EDrive {
        known: BTreeMap<String, (String, Option<SystemTime>)>,
        dirs: BTreeMap<String, Option<SystemTime>>,
        refused: BTreeMap<String, u32>,
        uploads: usize,
        refusals: usize,
        downloads_over_newer: usize,
    }

    impl EDrive {
        fn scan(&mut self, fake: &Fake, server: &Path, phone: &Path) {
            let _turn = fake.turn.lock().unwrap();
            let (there, here) = (walk(server), walk(phone));
            let mut downloads: BTreeSet<String> = BTreeSet::new();
            for (relative, bytes) in there.iter().filter(|(r, _)| *r != "seal.toml") {
                let etag = fake::etag_of(&server.join(relative));
                if self.known.get(relative).is_some_and(|(known, _)| *known == etag) {
                    continue;
                }
                if here.get(relative).map(Vec::len) == Some(bytes.len()) {
                    let time = self.known.get(relative).and_then(|(_, t)| *t);
                    self.known.insert(relative.clone(), (etag, time));
                } else {
                    downloads.insert(relative.clone());
                }
            }
            let mut uploads: Vec<String> = Vec::new();
            for relative in here.keys().filter(|r| *r != "seal.toml") {
                let dir = folder_of(relative).to_string();
                let looked = self.dirs.get(&dir).copied().flatten() != mtime(&phone.join(&dir));
                let later = self.known.get(relative).is_none_or(|(_, t)| mtime(&phone.join(relative)) > *t);
                if looked && later {
                    downloads.remove(relative);
                    uploads.push(relative.clone());
                }
            }
            for relative in downloads {
                if here.get(&relative).is_some_and(|mine| there[&relative].len() < mine.len()) {
                    self.downloads_over_newer += 1;
                }
                sync_down(&server.join(&relative), &phone.join(&relative));
                self.known.insert(relative.clone(), (fake::etag_of(&server.join(&relative)), mtime(&phone.join(&relative))));
            }
            for relative in uploads {
                self.upload(server, phone, &relative);
            }
            self.dirs = here.keys().map(|r| folder_of(r).to_string()).chain([String::new()]).map(|d| (d.clone(), mtime(&phone.join(&d)))).collect();
        }

        /// One file sent up, as eDrive sends it: `If-Match` the ETag it knows.
        fn upload(&mut self, server: &Path, phone: &Path, relative: &str) {
            if self.refused.get(relative).is_some_and(|n| *n >= 4) {
                return;
            }
            let there = server.join(relative);
            if let Some((known, _)) = self.known.get(relative)
                && there.is_file()
                && fake::etag_of(&there) != *known
            {
                self.refusals += 1;
                *self.refused.entry(relative.to_string()).or_insert(0) += 1;
                return;
            }
            sync_up(&phone.join(relative), &there);
            self.uploads += 1;
            self.known.insert(relative.to_string(), (fake::etag_of(&there), mtime(&phone.join(relative))));
        }

        /// A file closed after writing (`CLOSE_WRITE`), sent at once.
        fn closed(&mut self, fake: &Fake, server: &Path, phone: &Path, relative: &str) {
            let _turn = fake.turn.lock().unwrap();
            if phone.join(relative).is_file() {
                self.upload(server, phone, relative);
            }
        }
    }

    /// The Nextcloud desktop client as its source reads (v34; docs/database.md,
    /// "Sent to the server too"): a file changed on one side only goes the
    /// other way (`If-Match`); changed on both, the contents compared: the
    /// same, it takes the server's as its own; else the file here is renamed
    /// "(conflicted copy …)", which never goes up, and the server's takes its
    /// name. Hidden files left out.
    #[derive(Default)]
    struct Client {
        journal: BTreeMap<String, (String, u64, Option<SystemTime>)>,
        conflicts: usize,
        uploads: usize,
    }

    impl Client {
        fn stamp(path: &Path) -> Option<(u64, Option<SystemTime>)> {
            std::fs::metadata(path).ok().filter(|m| m.is_file()).map(|m| (m.len(), m.modified().ok()))
        }

        fn sync(&mut self, fake: &Fake, server: &Path, local: &Path) {
            let _turn = fake.turn.lock().unwrap();
            let names: BTreeSet<String> = walk(server).into_keys().chain(walk(local).into_keys()).filter(|r| r != "seal.toml" && !r.contains("(conflicted copy")).collect();
            for relative in names {
                let (there, here) = (server.join(&relative), local.join(&relative));
                let etag = there.is_file().then(|| fake::etag_of(&there));
                let stamp = Self::stamp(&here);
                let known = self.journal.get(&relative).cloned();
                let local_changed = known.as_ref().map(|(_, size, at)| Some((*size, *at))) != Some(stamp);
                let remote_changed = known.as_ref().map(|(e, ..)| e.clone()) != etag;
                let remember = |journal: &mut BTreeMap<String, (String, u64, Option<SystemTime>)>| {
                    let (size, at) = Self::stamp(&here).unwrap_or((0, None));
                    journal.insert(relative.clone(), (fake::etag_of(&there), size, at));
                };
                match (stamp.is_some(), etag.is_some()) {
                    (true, true) if !local_changed && !remote_changed => {}
                    (true, true) if !remote_changed => {
                        sync_up(&here, &there);
                        self.uploads += 1;
                        remember(&mut self.journal);
                    }
                    (true, true) if !local_changed => {
                        sync_down(&there, &here);
                        remember(&mut self.journal);
                    }
                    (true, true) => {
                        if std::fs::read(&here).ok() != std::fs::read(&there).ok() {
                            let name = here.file_name().unwrap().to_string_lossy().to_string();
                            let (stem, extension) = name.rsplit_once('.').unwrap_or((&name, ""));
                            std::fs::rename(&here, here.with_file_name(format!("{stem} (conflicted copy 20261008 104200).{extension}"))).unwrap();
                            sync_down(&there, &here);
                            self.conflicts += 1;
                        }
                        remember(&mut self.journal);
                    }
                    (true, false) if known.is_some() && !local_changed => {
                        let _ = std::fs::remove_file(&here);
                        self.journal.remove(&relative);
                    }
                    (true, false) => {
                        sync_up(&here, &there);
                        self.uploads += 1;
                        remember(&mut self.journal);
                    }
                    (false, true) if known.is_some() && !remote_changed => {
                        let _ = std::fs::remove_file(&there);
                        self.journal.remove(&relative);
                    }
                    (false, true) => {
                        sync_down(&there, &here);
                        remember(&mut self.journal);
                    }
                    (false, false) => {
                        self.journal.remove(&relative);
                    }
                }
            }
        }
    }

    /// The sizes of a device's records on the server, which must only grow.
    fn records_there(server: &Path, id: &str) -> BTreeMap<String, usize> {
        walk(server).into_iter().filter(|(r, _)| r.starts_with(id) && r.ends_with(".jsonl")).map(|(r, b)| (r, b.len())).collect()
    }

    fn never_shorter(before: &mut BTreeMap<String, usize>, now: BTreeMap<String, usize>, at: &str) {
        for (name, size) in &now {
            assert!(before.get(name).is_none_or(|was| size >= was), "{at}: {name} shorter there: {size} after {:?}", before.get(name));
        }
        before.extend(now);
    }

    /// The phone's own files sent beside its sync app.
    fn phone_sends(w: &World, now: i64, again: bool) -> Pulled {
        send_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), &BTreeMap::new(), now, again, TEST)
    }

    /// This device's own files go up at once, beside the sync app; the sync
    /// app sending the same file after is a no-op here; a file it sent before
    /// Sioul is taken as sent (`412`, then the same there); records never
    /// sent shorter; switched off, not a request; never another device's file.
    #[test]
    fn beside_a_sync_app_only_this_devices_files_go_up_and_never_twice() {
        let w = World::new("beside");
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        // A dose answered on the phone: its records and entry on the server within the send.
        w.phone.write("health-state.toml", "[taken]\n\"levo@1800000000\" = 1800000040\n");
        w.phone.exchange(&w.phone_folder, DUE + 40);
        w.fake.forget_seen();
        let sent = phone_sends(&w, DUE + 41, false);
        assert!(sent.problem.is_none() && sent.sent >= 2, "{sent:?}");
        let mine = |line: &String| line.split(' ').nth(1).is_some_and(|path| path.contains(&w.phone.id));
        for line in w.fake.seen() {
            if line.starts_with("PUT ") || line.starts_with("DELETE ") {
                assert!(mine(&line), "never another device's file: {line}");
            }
        }
        for (relative, bytes) in walk(&w.phone_folder).into_iter().filter(|(r, _)| r.contains(&w.phone.id)) {
            assert_eq!(std::fs::read(w.server.join(&relative)).ok(), Some(bytes), "{relative} there as here");
        }
        let kept = std::fs::read_to_string(sending_path(&w.phone.memory)).unwrap();
        assert!(!kept.contains(PASSWORD) && !kept.contains("Basic"), "{kept}");
        w.desk.exchange(&w.server, DUE + 45);
        assert!(w.desk.read("health-state.toml").contains("levo@1800000000"), "the desk has it, no sync app between");
        // The sync app sends them again, the same: nothing more from Sioul, not a request.
        w.up();
        for relative in walk(&w.phone_folder).into_keys().filter(|r| r.contains(&w.phone.id)) {
            fake::bump(&w.server.join(relative));
        }
        w.fake.forget_seen();
        let again = phone_sends(&w, DUE + 50, false);
        assert_eq!((again.sent, &again.problem), (0, &None));
        assert!(w.fake.seen().is_empty(), "{:?}", w.fake.seen());
        // Another answer: the sync app sends it first; Sioul finds it there (412, the same) and sends nothing twice.
        w.phone.write("health-state.toml", "[taken]\n\"levo@1800000000\" = 1800000040\n\"iron@1800000000\" = 1800000060\n");
        w.phone.exchange(&w.phone_folder, DUE + 60);
        {
            let _turn = w.fake.turn.lock().unwrap();
            for relative in walk(&w.phone_folder).into_keys().filter(|r| r.contains(&w.phone.id)) {
                sync_up(&w.phone_folder.join(&relative), &w.server.join(&relative));
            }
        }
        w.fake.forget_seen();
        let raced = phone_sends(&w, DUE + 61, false);
        assert!(raced.problem.is_none() && raced.sent == 0 && raced.same >= 2, "{raced:?} {:?}", w.fake.seen());
        assert!(w.fake.seen().iter().all(|l| !(l.starts_with("PUT ") && !l.ends_with(" 412"))), "{:?}", w.fake.seen());
        // The phone's records put back shorter here (a sync app's older copy): never sent over the longer one there.
        let round = walk(&w.phone_folder).into_keys().find(|r| r.starts_with(&w.phone.id) && r.ends_with(".jsonl")).unwrap();
        let longer = std::fs::read(w.server.join(&round)).unwrap();
        let first = longer.iter().position(|b| *b == b'\n').unwrap() + 1;
        std::fs::write(w.phone_folder.join(&round), &longer[..first]).unwrap();
        w.fake.forget_seen();
        let cut = phone_sends(&w, DUE + 70, false);
        assert!(cut.problem.is_none(), "{cut:?}");
        assert_eq!(std::fs::read(w.server.join(&round)).unwrap(), longer, "never shorter there");
        assert!(w.fake.seen().iter().all(|l| !(l.starts_with("PUT ") && l.contains(&round))), "{:?}", w.fake.seen());
        // Listed (every six hours), found longer there; then a line appended here, still shorter: never sent either.
        assert_eq!(phone_sends(&w, DUE + 72, true).longer, 1);
        let mut appended = longer[..first].to_vec();
        appended.extend_from_slice(&longer[first..first + (longer.len() - first) / 2]);
        appended.push(b'\n');
        std::fs::write(w.phone_folder.join(&round), &appended).unwrap();
        w.fake.forget_seen();
        assert!(phone_sends(&w, DUE + 75, false).problem.is_none());
        assert_eq!(std::fs::read(w.server.join(&round)).unwrap(), longer, "an append here, still shorter, never sent over the longer copy");
        assert!(w.fake.seen().iter().all(|l| !(l.starts_with("PUT ") && l.contains(&round))), "{:?}", w.fake.seen());
        // Switched off: not a request; the backup's fetching goes on.
        State::choose(&w.phone.memory, |s| s.send = Some(false)).unwrap();
        w.fake.forget_seen();
        assert_eq!(phone_sends(&w, DUE + 80, true).problem.as_deref(), Some("off"));
        assert!(w.fake.seen().is_empty());
        assert!(State::load(&w.phone.memory).fetching());
    }

    /// Sealed files: only those this device sealed, whole, and taken out there once swept.
    #[test]
    fn sealed_files_go_up_whole_and_only_this_devices() {
        let w = World::new("beside-blobs");
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        let source = w.base.join("note.md");
        std::fs::write(&source, "a note\n".repeat(500)).unwrap();
        let (hash, _) = crate::blobs::hash_file(&source).unwrap();
        crate::blobs::put(&w.phone_folder, &KEY, &source, &hash).unwrap();
        let name = crate::blobs::name(&KEY, &hash);
        let size = std::fs::metadata(w.phone_folder.join("blobs").join(&name)).unwrap().len();
        // Another device's sealed file, brought down by the sync app: never sent.
        put(&w.phone_folder, "blobs/0123456789abcdef", "another device's");
        // Not whole yet (the size sealed differs): not sent.
        let half: BTreeMap<String, u64> = [(name.clone(), size + 1)].into();
        send_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), &half, DUE + 10, false, TEST);
        assert!(!w.server.join("blobs").join(&name).exists());
        let whole: BTreeMap<String, u64> = [(name.clone(), size)].into();
        let sent = send_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), &whole, DUE + 20, false, TEST);
        assert!(sent.problem.is_none(), "{sent:?}");
        assert_eq!(std::fs::read(w.server.join("blobs").join(&name)).unwrap(), std::fs::read(w.phone_folder.join("blobs").join(&name)).unwrap());
        assert!(!w.server.join("blobs/0123456789abcdef").exists(), "never another device's");
        // Swept here: taken out there.
        std::fs::remove_file(w.phone_folder.join("blobs").join(&name)).unwrap();
        send_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), &BTreeMap::new(), DUE + 30, false, TEST);
        assert!(!w.server.join("blobs").join(&name).exists());
    }

    /// "Send everything again" after the server lost this device's files:
    /// each one goes back, said; a second time, nothing goes, all found there.
    #[test]
    fn send_everything_again_after_the_server_lost_this_devices_files() {
        let w = World::new("again");
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        w.phone.write("health-state.toml", "[taken]\n\"levo@1800000000\" = 1800000040\n");
        w.phone.exchange(&w.phone_folder, DUE + 40);
        assert!(phone_sends(&w, DUE + 41, false).problem.is_none());
        let own: Vec<String> = walk(&w.phone_folder).into_keys().filter(|r| r.contains(&w.phone.id)).collect();
        assert!(own.len() >= 2, "{own:?}");
        // The server loses them (restored from a backup, a folder emptied by hand).
        for relative in &own {
            std::fs::remove_file(w.server.join(relative)).unwrap();
        }
        assert!(crate::devices::all(&w.server, &KEY).0.iter().all(|e| e.id != w.phone.id));
        // Nothing changed here: a quick send asks nothing, sends nothing.
        w.fake.forget_seen();
        assert_eq!(phone_sends(&w, DUE + 50, false).sent, 0);
        assert!(w.fake.seen().is_empty());
        // Sent again, whatever was sent before.
        let again = phone_sends(&w, DUE + 60, true);
        assert!(again.problem.is_none() && again.sent == own.len(), "{again:?}");
        for relative in &own {
            assert_eq!(std::fs::read(w.server.join(relative)).ok(), std::fs::read(w.phone_folder.join(relative)).ok(), "{relative}");
        }
        assert_eq!(Sending::load(&w.phone.memory).again, Again { at: DUE + 60, sent: own.len(), same: 0, said: String::new() });
        w.desk.exchange(&w.server, DUE + 70);
        assert!(w.desk.read("health-state.toml").contains("levo@1800000000"));
        assert!(crate::devices::all(&w.server, &KEY).0.iter().any(|e| e.id == w.phone.id), "its entry back");
        // Again: all there, nothing sent.
        w.fake.forget_seen();
        let twice = phone_sends(&w, DUE + 80, true);
        assert!(twice.problem.is_none() && twice.sent == 0 && twice.same == own.len(), "{twice:?}");
        assert!(w.fake.seen().iter().all(|l| !l.starts_with("PUT ")), "{:?}", w.fake.seen());
        // The server unreachable: said, nothing lost here.
        w.fake.fault(|_| Some(Fault::Status(503)));
        let failed = phone_sends(&w, DUE + 90, true);
        assert!(failed.problem.as_deref().is_some_and(|p| p.starts_with("server:")), "{failed:?}");
        assert!(Sending::load(&w.phone.memory).again.said.starts_with("server:"));
    }

    /// The doses' rule (docs/health.md, "Knowing") with the phone's own files
    /// sent by Sioul right after each exchange and by eDrive too, late, and
    /// now and then in the moment between a write and Sioul's send (eDrive
    /// bringing the older copy down over the phone's newer one, or refusing
    /// its own upload): what the desk takes as known is there, every dose
    /// comes, the phone's records there never shorter, no conflicted copy.
    #[test]
    fn doses_are_never_known_wrongly_with_edrive_sending_too() {
        let w = World::new("edrive-sends");
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        let mut edrive = EDrive::default();
        edrive.scan(&w.fake, &w.server, &w.phone_folder);
        let mut marked: Vec<(String, i64)> = Vec::new();
        let mut sizes = BTreeMap::new();
        for minute in 0..150 {
            let now = DUE + minute * 60;
            // Every ten minutes; and twice close together, the second where eDrive looks before Sioul sends.
            if (minute % 10 == 0 || [17, 19, 77, 79].contains(&minute)) && minute < 130 {
                marked.push((format!("dose@{minute}"), now));
                let record: String = marked.iter().map(|(d, at)| format!("\"{d}\" = {at}\n")).collect();
                w.phone.write("health-state.toml", &format!("[taken]\n{record}"));
            }
            w.phone.exchange(&w.phone_folder, now);
            let round = walk(&w.phone_folder).into_keys().filter(|r| r.starts_with(&w.phone.id) && r.ends_with(".jsonl")).max_by_key(|r| r.trim_end_matches(".jsonl").rsplit('-').next().unwrap().parse::<u32>().unwrap()).unwrap();
            match minute % 6 {
                // Between the write and Sioul's send: eDrive looks (asked by another app, its half hour come).
                1 => edrive.scan(&w.fake, &w.server, &w.phone_folder),
                // Its upload of the appended file at once (CLOSE_WRITE), before Sioul's.
                3 => edrive.closed(&w.fake, &w.server, &w.phone_folder, &round),
                _ => {}
            }
            let sent = phone_sends(&w, now + 1, false);
            assert!(sent.problem.is_none(), "minute {minute}: {sent:?}");
            // Then eDrive, asked to look after Sioul's send, or not at all for a while.
            if minute % 4 == 0 {
                edrive.scan(&w.fake, &w.server, &w.phone_folder);
            }
            never_shorter(&mut sizes, records_there(&w.server, &w.phone.id), &format!("minute {minute}"));
            let outcome = w.desk.exchange(&w.server, now + 20);
            assert!(outcome.problems.iter().all(|p| !p.starts_with("share-other-cut") && !p.starts_with("share-other-gap")), "minute {minute}: {:?}", outcome.problems);
            if let Some(entry) = crate::devices::all(&w.server, &KEY).0.into_iter().find(|e| e.id == w.phone.id)
                && let Some(wrote) = entry.wrote
                && crate::share::heard(&w.desk.memory, &w.desk.id).complete(&w.phone.id, wrote)
            {
                let record = w.desk.read("health-state.toml");
                for (dose, at) in marked.iter().filter(|(_, at)| *at <= entry.exported) {
                    assert!(record.contains(dose.as_str()), "minute {minute}: the desk takes {dose} ({at}) as known, its record lacks it:\n{record}");
                }
            }
        }
        let record = w.desk.read("health-state.toml");
        for (dose, _) in &marked {
            assert!(record.contains(dose.as_str()), "{dose} never came:\n{record}");
        }
        assert!(walk(&w.server).keys().all(|r| !r.contains("conflicted")));
        eprintln!("eDrive beside Sioul: {} uploads, {} refused, {} brought down over a newer copy", edrive.uploads, edrive.refusals, edrive.downloads_over_newer);
        assert!(edrive.downloads_over_newer > 0 && edrive.refusals > 0, "the races were run");
    }

    /// The same with the desk's folder carried by the Nextcloud client and
    /// the desk sending its own files too: the client looking between a write
    /// and Sioul's send makes a conflicted copy here and puts the older copy
    /// back; the desk starts a new round with all it holds; the phone never
    /// takes a dose as known wrongly, never reads a copy, gets every dose.
    #[test]
    fn doses_are_never_known_wrongly_with_the_nextcloud_client_sending_too() {
        let w = World::new("client-sends");
        let desk_folder = w.base.join("desk-folder").join("Sioul");
        copy_dir(&w.server, &desk_folder);
        State::choose(&w.desk.memory, |s| s.given = "Documents/Sioul".into()).unwrap();
        assert!(find_with(&w.desk.memory, &desk_folder, &[w.fake.login()], &[], DUE, TEST).confirmed_for(&desk_folder));
        let mut client = Client::default();
        client.sync(&w.fake, &w.server, &desk_folder);
        let phone_down = || {
            let _turn = w.fake.turn.lock().unwrap();
            for (relative, bytes) in walk(&w.server).into_iter().filter(|(r, _)| !r.contains(&w.phone.id)) {
                put_bytes(&w.phone_folder, &relative, &bytes);
            }
        };
        let phone_up = || {
            let _turn = w.fake.turn.lock().unwrap();
            for relative in walk(&w.phone_folder).into_keys().filter(|r| r.contains(&w.phone.id)) {
                sync_up(&w.phone_folder.join(&relative), &w.server.join(&relative));
            }
        };
        let mut marked: Vec<(String, i64)> = Vec::new();
        let mut sizes = BTreeMap::new();
        let mut cuts = 0;
        for minute in 0..150 {
            let now = DUE + minute * 60;
            // Every ten minutes; and right after, where the client looks before Sioul sends.
            if (minute % 10 == 0 || [21, 71].contains(&minute)) && minute < 130 {
                marked.push((format!("dose@{minute}"), now));
                let record: String = marked.iter().map(|(d, at)| format!("\"{d}\" = {at}\n")).collect();
                w.desk.write("health-state.toml", &format!("[taken]\n{record}"));
            }
            let outcome = w.desk.exchange(&desk_folder, now);
            cuts += outcome.problems.iter().filter(|p| *p == "share-own-cut").count();
            // Now and then the client looks before Sioul's send.
            if minute % 5 == 1 {
                client.sync(&w.fake, &w.server, &desk_folder);
            }
            let sent = send_with(&w.desk.memory, &desk_folder, &w.desk.id, &w.fake.login(), &BTreeMap::new(), now + 1, false, TEST);
            assert!(sent.problem.is_none(), "minute {minute}: {sent:?}");
            if minute % 3 == 0 {
                client.sync(&w.fake, &w.server, &desk_folder);
            }
            never_shorter(&mut sizes, records_there(&w.server, &w.desk.id), &format!("minute {minute}"));
            phone_down();
            let read = w.phone.exchange(&w.phone_folder, now + 30);
            assert!(read.problems.iter().all(|p| !p.starts_with("share-other-cut") && !p.starts_with("share-other-gap")), "minute {minute}: {:?}", read.problems);
            phone_up();
            if let Some(entry) = crate::devices::all(&w.phone_folder, &KEY).0.into_iter().find(|e| e.id == w.desk.id)
                && let Some(wrote) = entry.wrote
                && crate::share::heard(&w.phone.memory, &w.phone.id).complete(&w.desk.id, wrote)
            {
                let record = w.phone.read("health-state.toml");
                for (dose, at) in marked.iter().filter(|(_, at)| *at <= entry.exported) {
                    assert!(record.contains(dose.as_str()), "minute {minute}: the phone takes {dose} ({at}) as known, its record lacks it:\n{record}");
                }
            }
        }
        let record = w.phone.read("health-state.toml");
        for (dose, _) in &marked {
            assert!(record.contains(dose.as_str()), "{dose} never came:\n{record}");
        }
        assert!(walk(&w.server).keys().all(|r| !r.contains("conflicted")), "a conflicted copy never goes up");
        eprintln!("Nextcloud client beside Sioul: {} uploads, {} conflicted copies here, {} rounds started again", client.uploads, client.conflicts, cuts);
        assert!(client.conflicts > 0 && cuts > 0, "the races were run");
    }

    // ------------------------------------------------ a slow uplink, a text to send, the cost

    /// The desk beside its own sync app, sending its files: its folder apart
    /// from the server's, found there under the same seal.
    fn desk_beside(w: &World) -> PathBuf {
        let desk_folder = w.base.join("desk-folder").join("Sioul");
        copy_dir(&w.server, &desk_folder);
        State::choose(&w.desk.memory, |s| s.given = "Documents/Sioul".into()).unwrap();
        assert!(find_with(&w.desk.memory, &desk_folder, &[w.fake.login()], &[], DUE, TEST).confirmed_for(&desk_folder));
        desk_folder
    }

    /// A desk holding much (its records' opening far past a megabyte).
    fn a_desk_holding_much(w: &World, folder: &Path, at: i64) {
        let many: String = (0..8000).map(|n| format!("sender{n}@example.org\n")).collect();
        put(&w.desk.roots.config, "known-senders.txt", &many);
        w.desk.exchange(folder, at);
    }

    fn desk_records(folder: &Path, id: &str) -> Vec<(String, u64)> {
        let mut out: Vec<(String, u64)> = walk(folder).into_iter().filter(|(r, _)| r.starts_with(id) && r.ends_with(".jsonl")).map(|(r, b)| (r, b.len() as u64)).collect();
        out.sort_by_key(|(r, _)| r.trim_end_matches(".jsonl").rsplit('-').next().unwrap().parse::<u32>().unwrap());
        out
    }

    /// The owner's desk, 8 October 2026: a records file of 2.5 MB on a
    /// phone's hotspot (3G) never went, cut at a flat minute and tried again
    /// from zero every minute. Now a file is given the time its size asks
    /// (`FLOOR`), still going is not cut; a file too slow even so is said in
    /// detail and held back, never tried before its backoff.
    #[test]
    fn a_large_file_goes_through_a_slow_uplink() {
        let w = World::new("slow-uplink");
        let desk_folder = desk_beside(&w);
        a_desk_holding_much(&w, &desk_folder, DUE);
        // The first large one in order: records go in order, the next ones wait behind it.
        let (round, size) = desk_records(&desk_folder, &w.desk.id).into_iter().find(|(_, s)| *s > 1 << 20).unwrap();
        assert!(size > 1 << 20, "a large records file: {size}");
        // An uplink of 512 KiB a second; a flat second for a file, as a flat minute was on 3G.
        *w.fake.throttle.lock().unwrap() = Some(512 << 10);
        let flat = Limits { large: Duration::from_secs(1), floor: 1 << 30, ..TEST };
        let tried = send_with(&w.desk.memory, &desk_folder, &w.desk.id, &w.fake.login(), &BTreeMap::new(), DUE + 10, false, flat);
        let failure = tried.failure.clone().expect("said in detail");
        assert!(failure.kind == "timeout" && failure.file == "records" && failure.sent > 0 && failure.total == size && failure.seconds >= 1, "{failure:?}");
        assert!(tried.held == 1, "{tried:?}");
        let sending = Sending::load(&w.desk.memory);
        assert_eq!(sending.failure.as_ref().map(|f| f.kind.as_str()), Some("timeout"));
        assert!(sending.held.get(&round).is_some_and(|h| h.tries == 1 && h.until == DUE + 10 + backoff(1)), "{:?}", sending.held);
        assert!(sending.rate > 0, "its rate measured from what went");
        // Before its backoff: not tried again, not a byte spent.
        let spent = w.fake.received.load(std::sync::atomic::Ordering::Relaxed);
        let early = send_with(&w.desk.memory, &desk_folder, &w.desk.id, &w.fake.login(), &BTreeMap::new(), DUE + 40, false, flat);
        assert!(early.held == 0 && w.fake.received.load(std::sync::atomic::Ordering::Relaxed) - spent < size / 2, "{early:?}");
        assert!(std::fs::metadata(w.server.join(&round)).map_or(0, |m| m.len()) < size);
        // Given the time its size asks (a floor of 128 KiB a second here): it goes, slowly, whole.
        // A stall of seconds: a busy machine (macOS on CI) may pause the fake server longer than TEST's.
        let scaled = Limits { large: Duration::from_secs(1), floor: 128 << 10, stall: Duration::from_secs(3), ..TEST };
        let went = send_with(&w.desk.memory, &desk_folder, &w.desk.id, &w.fake.login(), &BTreeMap::new(), DUE + 10 + backoff(1), false, scaled);
        assert!(went.problem.is_none() && went.held == 0, "{went:?}");
        assert_eq!(std::fs::read(w.server.join(&round)).unwrap(), std::fs::read(desk_folder.join(&round)).unwrap());
        let sending = Sending::load(&w.desk.memory);
        assert!(sending.held.is_empty() && sending.failure.is_none() && sending.last == DUE + 10 + backoff(1), "{sending:?}");
    }

    /// The server unreachable, or refusing: nothing tried again before the backoff.
    #[test]
    fn a_failed_send_waits_for_its_backoff() {
        let w = World::new("backoff");
        let desk_folder = desk_beside(&w);
        w.desk.write("health-state.toml", "[taken]\n\"levo@1800000000\" = 1800000040\n");
        w.desk.exchange(&desk_folder, DUE + 40);
        w.fake.fault(|r| (r.method == "PUT").then_some(Fault::Status(503)));
        let failed = send_with(&w.desk.memory, &desk_folder, &w.desk.id, &w.fake.login(), &BTreeMap::new(), DUE + 41, false, TEST);
        assert!(failed.problem.as_deref().is_some_and(|p| p.starts_with("server:")), "{failed:?}");
        assert_eq!(Sending::load(&w.desk.memory).retry_at, DUE + 41 + backoff(1));
        w.fake.forget_seen();
        let early = send_with(&w.desk.memory, &desk_folder, &w.desk.id, &w.fake.login(), &BTreeMap::new(), DUE + 41 + backoff(1) - 1, false, TEST);
        assert!(early.problem.as_deref().is_some_and(|p| p.starts_with("waiting:")) && w.fake.seen().is_empty(), "{early:?} {:?}", w.fake.seen());
        // Failing again: two minutes, then five.
        let again = send_with(&w.desk.memory, &desk_folder, &w.desk.id, &w.fake.login(), &BTreeMap::new(), DUE + 41 + backoff(1), false, TEST);
        assert!(again.problem.is_some());
        assert_eq!(Sending::load(&w.desk.memory).retry_at, DUE + 41 + backoff(1) + backoff(2));
        assert_eq!((backoff(1), backoff(2), backoff(3), backoff(9)), (60, 120, 300, 3600));
        // The server back: it goes, and the count starts again.
        w.fake.clear_faults();
        let at = DUE + 41 + backoff(1) + backoff(2);
        assert!(send_with(&w.desk.memory, &desk_folder, &w.desk.id, &w.fake.login(), &BTreeMap::new(), at, false, TEST).problem.is_none());
        let sending = Sending::load(&w.desk.memory);
        assert!(sending.tries == 0 && sending.retry_at == 0 && sending.failure.is_none());
    }

    /// A text written on the desk reaches the phone within a minute while a
    /// large records file is still crawling up: its small file of its own
    /// goes first and alone (`send_urgent`), the phone's pull brings it.
    #[test]
    fn a_text_to_send_reaches_the_phone_while_the_records_crawl() {
        let w = World::new("texts-lane");
        let desk_folder = desk_beside(&w);
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        a_desk_holding_much(&w, &desk_folder, DUE);
        // An uplink of 256 KiB a second: the records take seconds to go, given the time.
        *w.fake.throttle.lock().unwrap() = Some(256 << 10);
        let slow = Limits { large: Duration::from_secs(2), floor: 64 << 10, stall: Duration::from_secs(5), pull: Duration::from_secs(120), ..TEST };
        let crawling = {
            let (memory, folder, id, login) = (w.desk.memory.clone(), desk_folder.clone(), w.desk.id.clone(), w.fake.login());
            std::thread::spawn(move || send_with(&memory, &folder, &id, &login, &BTreeMap::new(), DUE + 10, false, slow))
        };
        std::thread::sleep(Duration::from_millis(500));
        // A text written now: its lines sealed already, in the desk's own file of the part "texts".
        let source = w.base.join("desk-texts-send.jsonl");
        std::fs::write(&source, "a sealed request line\n").unwrap();
        let written = Instant::now();
        assert!(place_texts(&desk_folder, &w.desk.id, &source).unwrap());
        let urgent = send_urgent_with(&w.desk.memory, &desk_folder, &w.desk.id, &w.fake.login(), DUE + 11, slow);
        assert!(urgent.problem.is_none() && urgent.sent == 1, "{urgent:?}");
        // The phone's next pull brings it; the records still on their way.
        let pulled = pull_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), DUE + 20, TEST);
        assert!(pulled.problem.is_none(), "{pulled:?}");
        assert_eq!(std::fs::read(texts_file(&cache_of(&w.phone.memory), &w.desk.id)).unwrap(), b"a sealed request line\n");
        assert!(!crawling.is_finished(), "the records still going up");
        assert!(written.elapsed() < Duration::from_secs(10), "{:?}", written.elapsed());
        let crawled = crawling.join().unwrap();
        assert!(crawled.problem.is_none(), "{crawled:?}");
        // Never sent twice by the main lane; a change goes again; none here, none there.
        assert!(!own_plain(&desk_folder, &w.desk.id).iter().any(|r| r.starts_with("texts/")));
        assert!(!place_texts(&desk_folder, &w.desk.id, &source).unwrap(), "unchanged: nothing to place");
        std::fs::remove_file(&source).unwrap();
        assert!(place_texts(&desk_folder, &w.desk.id, &source).unwrap() && !texts_file(&desk_folder, &w.desk.id).exists());
    }

    /// A reply written on the desk goes on the lane of the texts to send, in a
    /// small file of its own beside them, and the phone's next pull brings
    /// it; never by the main lane; none here, none there.
    #[test]
    fn a_reply_to_send_goes_on_the_texts_lane() {
        let w = World::new("replies-lane");
        let desk_folder = desk_beside(&w);
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        let (texts, asks) = (w.base.join("desk-texts-send.jsonl"), w.base.join("desk-replies-ask.jsonl"));
        std::fs::write(&texts, "a sealed request line\n").unwrap();
        std::fs::write(&asks, "r1:a sealed reply line\n").unwrap();
        assert!(place_texts(&desk_folder, &w.desk.id, &texts).unwrap());
        assert!(place_asks(&desk_folder, &w.desk.id, &asks).unwrap());
        assert_eq!(own_urgent(&desk_folder, &w.desk.id).len(), 2);
        let urgent = send_urgent_with(&w.desk.memory, &desk_folder, &w.desk.id, &w.fake.login(), DUE + 11, TEST);
        assert!(urgent.problem.is_none() && urgent.sent == 2, "{urgent:?}");
        let pulled = pull_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), DUE + 20, TEST);
        assert!(pulled.problem.is_none(), "{pulled:?}");
        assert_eq!(std::fs::read(asks_file(&cache_of(&w.phone.memory), &w.desk.id)).unwrap(), b"r1:a sealed reply line\n");
        assert!(!own_plain(&desk_folder, &w.desk.id).iter().any(|r| r.starts_with("phone-messages/")), "never by the main lane");
        assert_eq!(file_kind(&format!("phone-messages/ask/{}.jsonl", w.desk.id)), "replies");
        std::fs::remove_file(&asks).unwrap();
        assert!(place_asks(&desk_folder, &w.desk.id, &asks).unwrap() && !asks_file(&desk_folder, &w.desk.id).exists());
    }

    /// A multimedia message's media go up on the urgent lane before the
    /// request that names them, each asked by its own name (never the whole
    /// of `blobs/` listed); the lane keeps only the media it carries now. The
    /// phone, its sync app late, waits for them by name (`blobs::Wanted::media`):
    /// its own fetch brings them from the server.
    #[test]
    fn a_request_s_media_go_up_before_it_on_the_urgent_lane() {
        let w = World::new("texts-media-lane");
        let desk_folder = desk_beside(&w);
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        // A picture sealed into the desk's folder, as a computer writing a multimedia message seals it.
        let picture = w.base.join("picture.jpg");
        std::fs::write(&picture, b"\xFF\xD8\xFF a picture").unwrap();
        let (hash, _) = crate::blobs::hash_file(&picture).unwrap();
        let sealed = crate::blobs::put(&desk_folder, &KEY, &picture, &hash).unwrap().unwrap();
        let name = crate::blobs::name(&KEY, &hash);
        let source = w.base.join("desk-texts-send.jsonl");
        std::fs::write(&source, "a sealed request line naming it\n").unwrap();
        assert!(place_texts(&desk_folder, &w.desk.id, &source).unwrap());
        w.fake.forget_seen();
        let media = BTreeMap::from([(name.clone(), sealed)]);
        let urgent = send_urgent_media(&w.desk.memory, &desk_folder, &w.desk.id, &w.fake.login(), DUE + 11, &media, TEST);
        assert!(urgent.problem.is_none() && urgent.sent == 2, "{urgent:?}");
        let puts: Vec<String> = w.fake.seen().into_iter().filter(|line| line.starts_with("PUT ")).collect();
        let at = |what: &str| puts.iter().position(|line| line.contains(what));
        assert!(at(&format!("blobs/{name}")).is_some() && at(&format!("blobs/{name}")) < at("texts/send/"), "the medium first: {puts:?}");
        assert!(!w.fake.seen().iter().any(|line| line.starts_with("PROPFIND") && line.contains("/blobs")), "{:?}", w.fake.seen());
        // Sent again: nothing goes twice; given no more, forgotten by the lane.
        assert_eq!(send_urgent_media(&w.desk.memory, &desk_folder, &w.desk.id, &w.fake.login(), DUE + 12, &media, TEST).sent, 0);
        assert!(send_urgent_media(&w.desk.memory, &desk_folder, &w.desk.id, &w.fake.login(), DUE + 13, &BTreeMap::new(), TEST).problem.is_none());
        assert!(!Sending::load_lane(&w.desk.memory, Lane::Urgent).sent.keys().any(|relative| relative.starts_with("blobs/")));
        // The phone waits for it by name, its sync app late: its own fetch brings it.
        crate::blobs::Wanted::change(&w.phone.memory, |wanted| {
            wanted.media.insert(name.clone(), crate::blobs::Want { hash: hash.clone(), size: sealed, since: DUE, ..Default::default() });
        })
        .unwrap();
        assert!(wanted_due(&w.phone.memory, &w.phone_folder, DUE + 20));
        let fetched = fetch_wanted_with(&w.phone.memory, &w.phone_folder, &w.fake.login(), &KEY, DUE + 20, false, TEST);
        assert_eq!((fetched.fetched, fetched.problem.as_deref()), (1, None), "{fetched:?}");
        // Beside the synced folder, checked against its content, as `blobs::get` opens it.
        let copy = w.cache().join("blobs").join(&name);
        assert!(crate::blobs::check(&copy, &KEY, &hash).is_ok() && !w.phone_folder.join("blobs").join(&name).exists());
    }

    /// What a computer writing each minute costs, sent beside its sync app:
    /// a change a minute for an hour, its entry and its claim renewed each
    /// minute. Its records' file stays small (`share::SEGMENT`): measured here.
    #[test]
    fn bytes_an_hour_of_a_computer_writing_each_minute() {
        let w = World::new("an-hour");
        let desk_folder = desk_beside(&w);
        a_desk_holding_much(&w, &desk_folder, DUE);
        assert!(send_with(&w.desk.memory, &desk_folder, &w.desk.id, &w.fake.login(), &BTreeMap::new(), DUE + 1, false, TEST).problem.is_none());
        let start = w.fake.received.load(std::sync::atomic::Ordering::Relaxed);
        let mut minutes: String = String::new();
        for minute in 1..=60 {
            let now = DUE + minute * 60;
            minutes.push_str(&format!("\"dose@{minute}\" = {now}\n"));
            w.desk.write("health-state.toml", &format!("[taken]\n{minutes}"));
            w.desk.exchange(&desk_folder, now);
            crate::lease::renew(&desk_folder, &KEY, "health", &w.desk.id, now, now, false, crate::lease::Rule::FollowsYou, crate::share::written(&w.desk.memory, &w.desk.id)).unwrap();
            let sent = send_with(&w.desk.memory, &desk_folder, &w.desk.id, &w.fake.login(), &BTreeMap::new(), now + 1, false, TEST);
            assert!(sent.problem.is_none(), "minute {minute}: {sent:?}");
        }
        let hour = w.fake.received.load(std::sync::atomic::Ordering::Relaxed) - start;
        let largest = desk_records(&desk_folder, &w.desk.id).last().map_or(0, |(_, s)| *s);
        eprintln!("A computer writing each minute, sent beside its sync app: {hour} bytes in an hour; its current records' file {largest} bytes");
        assert!(hour < 3 << 20, "{hour} bytes an hour");
        assert!(largest < 64 << 10, "{largest}");
        // Every dose there for the others.
        w.phone.exchange(&w.server, DUE + 3_700);
        assert!(w.phone.read("health-state.toml").contains("dose@60"));
    }

    // ------------------------------------------------ sealed files waited for

    impl Device {
        /// An exchange of its notes too (`files`), kept in `notes`.
        fn exchange_notes(&self, folder: &Path, notes: &Path, now: i64) -> Outcome {
            let config = Config { notes_root: Some(notes.display().to_string()), ..Config::default() };
            let stores = crate::share::stores_of(&config, &self.roots, &|part| part == "notes" || crate::share::shared_by_default(part, &config));
            crate::share::exchange(&Sharing { folder, computer: &self.id, key: &KEY, memory: &self.memory, files: true, hurry: None }, &stores, now * 1000).unwrap()
        }
    }

    /// The desk and the phone sharing their notes, the backup found for the
    /// phone; the phone's sync app brings nothing down from now on (eDrive's
    /// half-hour, 10 October 2026). Their notes' folders.
    fn notes_world(name: &str) -> (World, PathBuf, PathBuf) {
        let w = World::new(name);
        let (desk_notes, phone_notes) = (w.base.join("desk-notes"), w.base.join("phone-notes"));
        for dir in [&desk_notes, &phone_notes] {
            std::fs::create_dir_all(dir).unwrap();
        }
        w.desk.exchange_notes(&w.server, &desk_notes, DUE + 10);
        w.phone.exchange_notes(&w.phone_folder, &phone_notes, DUE + 20);
        w.up();
        assert!(w.find(DUE + 30).confirmed_for(&w.phone_folder));
        (w, desk_notes, phone_notes)
    }

    /// A note written on the desk, its client carrying it to the server at once: its sealed file's name there.
    fn desk_writes(w: &World, desk_notes: &Path, file: &str, text: &str, now: i64) -> String {
        put(desk_notes, file, text);
        w.desk.exchange_notes(&w.server, desk_notes, now);
        let name = crate::blobs::name(&KEY, &crate::blobs::hash_file(&desk_notes.join(file)).unwrap().0);
        assert!(w.server.join("blobs").join(&name).exists());
        name
    }

    fn fetch(w: &World, now: i64, frugal: bool) -> Pulled {
        fetch_wanted_with(&w.phone.memory, &w.phone_folder, &w.fake.login(), &KEY, now, frugal, TEST)
    }

    fn blob_gets(w: &World) -> usize {
        w.fake.seen().iter().filter(|l| l.starts_with("GET ") && l.contains("/blobs/")).count()
    }

    /// A note written on the desk reaches a phone whose sync app brings no
    /// sealed file within one step: the pull brings the record, the exchange
    /// says the sealed file it waits for, the fetch brings that file alone,
    /// by its name, beside the synced folder, and the next exchange writes
    /// the note. Nothing listed in the server's `blobs/`, nothing sent; the
    /// copy fetched goes once the note is written.
    #[test]
    fn a_note_waited_for_is_fetched_by_its_name_and_written_within_one_step() {
        let (w, desk_notes, phone_notes) = notes_world("wanted");
        let name = desk_writes(&w, &desk_notes, "lease.md", "The lease, signed.\n", DUE + 60);
        w.fake.forget_seen();
        // The step: the pull, then the exchange.
        let pulled = w.pull(DUE + 70);
        assert!(pulled.problem.is_none(), "{pulled:?}");
        let first = w.phone.exchange_notes(&w.phone_folder, &phone_notes, DUE + 71);
        assert_eq!(first.waits.get("no-blob"), Some(&1), "{first:?}");
        assert_eq!((first.received, first.pending), (0, 1));
        assert!(!phone_notes.join("lease.md").exists());
        let wanted = crate::blobs::Wanted::load(&w.phone.memory);
        assert_eq!(wanted.blobs.keys().cloned().collect::<Vec<_>>(), [name.clone()]);
        assert!(wanted.blobs[&name].size == 19 && wanted.blobs[&name].since == DUE + 71, "{wanted:?}");
        assert!(wanted_due(&w.phone.memory, &w.phone_folder, DUE + 71));
        // Its sealed file fetched, then the exchange again.
        let fetched = fetch(&w, DUE + 72, false);
        assert_eq!((fetched.fetched, fetched.problem.as_deref()), (1, None), "{fetched:?}");
        assert!(w.cache().join("blobs").join(&name).exists());
        assert!(!w.phone_folder.join("blobs").join(&name).exists(), "never written into the synced folder");
        assert!(!wanted_due(&w.phone.memory, &w.phone_folder, DUE + 72), "fetched: no longer due");
        let second = w.phone.exchange_notes(&w.phone_folder, &phone_notes, DUE + 73);
        assert_eq!((second.received, second.pending), (1, 0), "{second:?}");
        assert!(second.waits.is_empty() && second.problems.is_empty(), "{second:?}");
        assert_eq!(std::fs::read_to_string(phone_notes.join("lease.md")).unwrap(), "The lease, signed.\n");
        assert!(!crate::blobs::Wanted::path(&w.phone.memory).exists(), "nothing waits");
        // By its name: one GET, no listing of `blobs/`, nothing sent.
        assert_eq!(blob_gets(&w), 1, "{:?}", w.fake.seen());
        for line in w.fake.seen() {
            assert!(!(line.starts_with("PROPFIND") && line.contains("/blobs")), "{line}");
            assert!(line.starts_with("PROPFIND ") || line.starts_with("GET "), "{line}");
        }
        // Nothing waits: no request.
        w.fake.forget_seen();
        assert_eq!(fetch(&w, DUE + 74, false), Pulled::default());
        assert!(w.fake.seen().is_empty());
        // Written: the copy fetched goes at the next tidying.
        tidy(&w.phone.memory, &w.phone_folder, &w.phone.id);
        assert!(!w.cache().join("blobs").join(&name).exists());
    }

    /// A copy fetched that does not open whole is never read: one damaged on
    /// this phone is taken out and fetched again; one damaged on the server
    /// is never kept, and asked again after a while; whole again there, it
    /// comes, and the note is written.
    #[test]
    fn a_damaged_copy_fetched_is_refused_and_fetched_again() {
        let (w, desk_notes, phone_notes) = notes_world("wanted-damaged");
        let name = desk_writes(&w, &desk_notes, "lease.md", "The lease, signed.\n", DUE + 60);
        assert!(w.pull(DUE + 70).problem.is_none());
        assert_eq!(w.phone.exchange_notes(&w.phone_folder, &phone_notes, DUE + 71).waits.get("no-blob"), Some(&1));
        // Damaged here, after it came: refused, taken out, waited for again.
        let whole = std::fs::read(w.server.join("blobs").join(&name)).unwrap();
        let mut damaged = whole.clone();
        let middle = damaged.len() / 2;
        damaged[middle] ^= 0x10;
        put_bytes(&w.cache(), &format!("blobs/{name}"), &damaged);
        let outcome = w.phone.exchange_notes(&w.phone_folder, &phone_notes, DUE + 72);
        assert_eq!(outcome.waits.get("no-blob"), Some(&1), "{outcome:?}");
        assert!(outcome.problems.is_empty(), "the copy fetched is not the folder's: nothing said damaged, {outcome:?}");
        assert!(!w.cache().join("blobs").join(&name).exists());
        assert!(!phone_notes.join("lease.md").exists());
        // Damaged on the server: fetched, refused, never kept; not asked again at once.
        std::fs::write(w.server.join("blobs").join(&name), &damaged).unwrap();
        let fetched = fetch(&w, DUE + 73, false);
        assert_eq!((fetched.fetched, fetched.held), (0, 1), "{fetched:?}");
        assert!(!w.cache().join("blobs").join(&name).exists());
        assert_eq!(crate::blobs::Wanted::load(&w.phone.memory).blobs[&name].again, DUE + 73 + 60);
        w.fake.forget_seen();
        assert_eq!(fetch(&w, DUE + 100, false).fetched, 0);
        assert_eq!(blob_gets(&w), 0, "within its wait: not asked");
        // Whole there again: it comes, the note is written.
        std::fs::write(w.server.join("blobs").join(&name), &whole).unwrap();
        assert_eq!(fetch(&w, DUE + 140, false).fetched, 1);
        let outcome = w.phone.exchange_notes(&w.phone_folder, &phone_notes, DUE + 141);
        assert_eq!(outcome.received, 1, "{outcome:?}");
        assert_eq!(std::fs::read_to_string(phone_notes.join("lease.md")).unwrap(), "The lease, signed.\n");
    }

    /// A sealed file the sync app is late with is not on the server yet
    /// either: asked again within minutes, never backed off for long; there,
    /// it comes at the next ask.
    #[test]
    fn a_sealed_file_not_on_the_server_yet_is_asked_again_within_minutes() {
        let (w, desk_notes, phone_notes) = notes_world("wanted-late");
        let name = desk_writes(&w, &desk_notes, "lease.md", "The lease, signed.\n", DUE + 60);
        let aside = w.base.join("aside-blob");
        std::fs::rename(w.server.join("blobs").join(&name), &aside).unwrap();
        assert!(w.pull(DUE + 70).problem.is_none());
        assert_eq!(w.phone.exchange_notes(&w.phone_folder, &phone_notes, DUE + 71).waits.get("no-blob"), Some(&1));
        let mut at = DUE + 72;
        for _ in 0..8 {
            let fetched = fetch(&w, at, false);
            assert!(fetched.fetched == 0 && fetched.problem.is_none(), "{fetched:?}");
            let again = crate::blobs::Wanted::load(&w.phone.memory).blobs[&name].again;
            assert!(again > at && again <= at + WANTED_AGAIN, "{again} after {at}");
            at = again;
        }
        std::fs::rename(&aside, w.server.join("blobs").join(&name)).unwrap();
        assert_eq!(fetch(&w, at, false).fetched, 1);
        assert_eq!(w.phone.exchange_notes(&w.phone_folder, &phone_notes, at + 1).received, 1);
    }

    /// A copy fetched, then the same brought by the sync app into the synced
    /// folder: the folder's is read, identical, and the copy fetched goes,
    /// even while the note still waits.
    #[test]
    fn a_sealed_file_fetched_then_brought_by_the_sync_app_is_kept_once() {
        let (w, desk_notes, phone_notes) = notes_world("wanted-brought");
        let name = desk_writes(&w, &desk_notes, "lease.md", "The lease, signed.\n", DUE + 60);
        assert!(w.pull(DUE + 70).problem.is_none());
        assert_eq!(w.phone.exchange_notes(&w.phone_folder, &phone_notes, DUE + 71).waits.get("no-blob"), Some(&1));
        assert_eq!(fetch(&w, DUE + 72, false).fetched, 1);
        // The sync app catches up before the next exchange.
        w.down();
        let (fetched, brought) = (std::fs::read(w.cache().join("blobs").join(&name)).unwrap(), std::fs::read(w.phone_folder.join("blobs").join(&name)).unwrap());
        assert_eq!(fetched, brought, "the same file");
        tidy(&w.phone.memory, &w.phone_folder, &w.phone.id);
        assert!(!w.cache().join("blobs").join(&name).exists(), "the synced folder holds it: the copy fetched goes");
        assert!(crate::blobs::Wanted::path(&w.phone.memory).exists(), "the note still waits");
        let outcome = w.phone.exchange_notes(&w.phone_folder, &phone_notes, DUE + 73);
        assert_eq!(outcome.received, 1, "{outcome:?}");
        assert!(!crate::blobs::Wanted::path(&w.phone.memory).exists());
    }

    /// What was fetched beside the folder never piles up: a copy no note
    /// waits for goes, one kept past a few days goes and is no longer waited
    /// for (an exchange that reads notes says it again if it still waits),
    /// all of them with the backup switched off.
    #[test]
    fn the_sealed_files_fetched_are_pruned() {
        let (w, desk_notes, phone_notes) = notes_world("wanted-pruned");
        let name = desk_writes(&w, &desk_notes, "lease.md", "The lease, signed.\n", DUE + 60);
        assert!(w.pull(DUE + 70).problem.is_none());
        assert_eq!(w.phone.exchange_notes(&w.phone_folder, &phone_notes, DUE + 71).waits.get("no-blob"), Some(&1));
        assert_eq!(fetch(&w, DUE + 72, false).fetched, 1);
        let blobs = w.cache().join("blobs");
        put(&blobs, "0123abcd", "a copy no note waits for");
        tidy(&w.phone.memory, &w.phone_folder, &w.phone.id);
        assert!(blobs.join(&name).exists(), "waited for: kept");
        assert!(!blobs.join("0123abcd").exists());
        set_mtime(&blobs.join(&name), SystemTime::now() - Duration::from_secs(4 * 86_400));
        tidy(&w.phone.memory, &w.phone_folder, &w.phone.id);
        assert!(!blobs.join(&name).exists(), "past a few days");
        assert!(!crate::blobs::Wanted::path(&w.phone.memory).exists(), "no longer waited for");
        w.fake.forget_seen();
        assert_eq!(fetch(&w, DUE + 80, false).fetched, 0);
        assert_eq!(blob_gets(&w), 0);
        // Still waiting, said again by the next exchange that reads notes: fetched again.
        assert_eq!(w.phone.exchange_notes(&w.phone_folder, &phone_notes, DUE + 81).waits.get("no-blob"), Some(&1));
        assert_eq!(fetch(&w, DUE + 82, false).fetched, 1);
        // The backup switched off: what was fetched goes.
        State::choose(&w.phone.memory, |s| s.on = Some(false)).unwrap();
        tidy(&w.phone.memory, &w.phone_folder, &w.phone.id);
        assert!(!blobs.join(&name).exists());
        assert_eq!(fetch(&w, DUE + 83, false).problem.as_deref(), Some("not-confirmed"));
    }

    /// Waited for: a step brings at most `WANTED_FILES` and `WANTED_BYTES`,
    /// the smallest first; on a metered or slow connection a note's sealed
    /// file comes at once, a large paper's at most every ten minutes.
    #[test]
    fn sealed_files_waited_for_come_bounded_and_paced() {
        let (w, _, _) = notes_world("wanted-paced");
        let made = |seed: u32, size: usize| {
            let mut x = seed.wrapping_mul(2_654_435_761) | 1;
            (0..size)
                .map(|_| {
                    x ^= x << 13;
                    x ^= x >> 17;
                    x ^= x << 5;
                    x as u8
                })
                .collect::<Vec<u8>>()
        };
        // Sealed on the server by hand, said waited for as an exchange says it.
        let sealed = |seed: u32, size: usize| {
            let source = w.base.join(format!("source-{seed}"));
            std::fs::write(&source, made(seed, size)).unwrap();
            let (hash, size) = crate::blobs::hash_file(&source).unwrap();
            crate::blobs::put(&w.server, &KEY, &source, &hash).unwrap();
            let name = crate::blobs::name(&KEY, &hash);
            crate::blobs::Wanted::change(&w.phone.memory, |wanted| {
                wanted.blobs.insert(name.clone(), crate::blobs::Want { hash, size, since: DUE, ..Default::default() });
            })
            .unwrap();
            name
        };
        let papers = [sealed(1, 1_500_000), sealed(2, 1_200_000)];
        let note = sealed(3, 3_000);
        // Metered: the note and one paper; the other paper waits ten minutes.
        let first = fetch(&w, DUE + 100, true);
        assert_eq!((first.fetched, first.paced), (2, 1), "{first:?}");
        let blobs = w.cache().join("blobs");
        assert!(blobs.join(&note).exists() && blobs.join(&papers[1]).exists() && !blobs.join(&papers[0]).exists());
        w.fake.forget_seen();
        assert_eq!((fetch(&w, DUE + 400, true).fetched, blob_gets(&w)), (0, 0), "paced: not asked");
        assert_eq!(fetch(&w, DUE + 100 + PACE, true).fetched, 1);
        assert!(blobs.join(&papers[0]).exists());
        // Many notes at once: `WANTED_FILES` a step, the rest at the next.
        let notes: Vec<String> = (10..10 + WANTED_FILES as u32 + 2).map(|seed| sealed(seed, 500)).collect();
        assert_eq!(fetch(&w, DUE + 2_000, true).fetched, WANTED_FILES);
        assert_eq!(fetch(&w, DUE + 2_001, true).fetched, 2);
        assert!(notes.iter().all(|n| blobs.join(n).exists()));
        // `WANTED_BYTES` a step, the first whatever its size: on an unmetered connection, all at once otherwise.
        let large: Vec<String> = (40..43).map(|seed| sealed(seed, 7 << 20)).collect();
        assert_eq!(fetch(&w, DUE + 3_000, false).fetched, 2, "14 MiB, then the third past 16");
        assert_eq!(fetch(&w, DUE + 3_001, false).fetched, 1);
        assert!(large.iter().all(|n| blobs.join(n).exists()));
    }

    // ------------------------------------------------ taken out there, whatever sent it again

    /// The phone's records' rounds there, by number.
    fn rounds_there(server: &Path, id: &str) -> BTreeSet<u32> {
        walk(server).into_keys().filter(|r| r.starts_with(id) && r.ends_with(".jsonl")).filter_map(|r| r.trim_end_matches(".jsonl").rsplit('-').next().and_then(|n| n.parse().ok())).collect()
    }

    /// Where the phone's rounds stand, as `share::rounds_past` reads it: its
    /// last round and its last full round in its memory, and how far the desk
    /// read it in the desk's notes, as its sync app brought them (at `at`).
    fn rounds_stand(w: &World, round: u32, full_round: u32, read: u32, at: i64) {
        let mut memory: serde_json::Value = serde_json::from_slice(&std::fs::read(&w.phone.memory).unwrap()).unwrap();
        memory["round"] = round.into();
        memory["full_round"] = full_round.into();
        std::fs::write(&w.phone.memory, serde_json::to_vec(&memory).unwrap()).unwrap();
        put(&w.phone_folder, &format!("{}.toml", w.desk.id), &format!("at = {at}\nround = 1\n\n[read]\n\"{}\" = {read}\n", w.phone.id));
    }

    /// eDrive sends again each file Sioul sent, the same bytes, and Nextcloud
    /// gives it a new ETag: a past round or a swept sealed file then met `412`
    /// and was forgotten, left on the server for good (a phone's past full
    /// rounds, 47 MB, 14 October 2026). Now looked at there and taken out over
    /// its ETag there when it is still what this device sent: of that size,
    /// and a sealed file dated as it was sent. A sealed file another device
    /// sent there again with a new time (it uses that content again), and a
    /// round grown there, stay; nothing of them is asked again.
    #[test]
    fn what_edrive_sent_again_is_taken_out_once_past() {
        let w = World::new("edrive-again");
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        let round = |n: u32| format!("{}-{n}.jsonl", w.phone.id);
        for n in 40..=43 {
            put(&w.phone_folder, &round(n), &format!("{{\"round\":{n}}}\n").repeat(n as usize));
        }
        let seal = |text: &str| {
            let source = w.base.join(format!("{}.md", text.len()));
            std::fs::write(&source, text.repeat(200)).unwrap();
            let (hash, _) = crate::blobs::hash_file(&source).unwrap();
            crate::blobs::put(&w.phone_folder, &KEY, &source, &hash).unwrap();
            let name = crate::blobs::name(&KEY, &hash);
            let size = std::fs::metadata(w.phone_folder.join("blobs").join(&name)).unwrap().len();
            (name, size)
        };
        let (mine, mine_size) = seal("a note of the phone's\n");
        let (used, used_size) = seal("a note the desk uses again\n");
        let sealed: BTreeMap<String, u64> = [(mine.clone(), mine_size), (used.clone(), used_size)].into();
        let sent = send_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), &sealed, DUE + 10, false, TEST);
        assert!(sent.problem.is_none() && sent.taken_out == 0, "{sent:?}");
        {
            let _turn = w.fake.turn.lock().unwrap();
            // eDrive sends them again, the same bytes, dated as on the phone: new ETags there.
            for relative in [round(40), round(41), format!("blobs/{mine}"), format!("blobs/{used}")] {
                sync_up(&w.phone_folder.join(&relative), &w.server.join(&relative));
            }
            // Round 41 longer there: eDrive carried a later copy than Sioul's last send.
            let grown = w.server.join(round(41));
            let mut bytes = std::fs::read(&grown).unwrap();
            bytes.extend_from_slice(b"{\"later\":1}\n");
            std::fs::write(&grown, bytes).unwrap();
            fake::bump(&grown);
            // The desk uses the second content again: made fresh, its sync app sends it with the new time.
            let again = w.server.join("blobs").join(&used);
            fake::bump(&again);
            set_mtime(&again, SystemTime::now() + Duration::from_secs(3600));
        }
        // Rounds 40 and 41 past their time here (every device read past them,
        // and 42 is the phone's last full round), both sealed files swept.
        for relative in [round(40), round(41), format!("blobs/{mine}"), format!("blobs/{used}")] {
            std::fs::remove_file(w.phone_folder.join(relative)).unwrap();
        }
        rounds_stand(&w, 43, 42, 43, DUE + 15);
        w.fake.forget_seen();
        let gone = send_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), &BTreeMap::new(), DUE + 20, false, TEST);
        assert!(gone.problem.is_none(), "{gone:?}");
        assert_eq!(gone.taken_out, 2, "{:?}", w.fake.seen());
        assert!(!w.server.join(round(40)).exists(), "the past round eDrive sent again: taken out");
        assert!(!w.server.join("blobs").join(&mine).exists(), "the swept sealed file eDrive sent again: taken out");
        assert!(w.server.join("blobs").join(&used).exists(), "sent again with a new time, by a device that uses it: left");
        assert!(w.server.join(round(41)).exists(), "longer there: left (a listing looks at it again)");
        assert!(w.server.join(round(42)).exists() && w.server.join(round(43)).exists(), "its last rounds stay");
        let deletes: Vec<String> = w.fake.seen().into_iter().filter(|l| l.starts_with("DELETE ")).collect();
        assert_eq!(deletes.len(), 6, "each refused once (412), two taken out over their ETag there: {deletes:?}");
        assert!(deletes.iter().all(|l| l.contains(&w.phone.id) || l.contains(&mine) || l.contains(&used)), "never another device's file: {deletes:?}");
        // Forgotten here: nothing asked again.
        w.fake.forget_seen();
        let quiet = send_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), &BTreeMap::new(), DUE + 30, false, TEST);
        assert!(quiet.problem.is_none() && quiet.taken_out == 0, "{quiet:?}");
        assert!(w.fake.seen().is_empty(), "{:?}", w.fake.seen());
    }

    /// The phone's rounds past their time that a sync app left on the server
    /// (eDrive passes no deletion on) or that an older Sioul forgot there go
    /// at the next listing, every six hours: below its last full round, read
    /// past by every device heard lately (a device that read less holds back
    /// the rest), only its own names, never another device's file, and
    /// nothing while none of its records is here.
    #[test]
    fn past_rounds_left_on_the_server_go_at_the_next_listing() {
        let w = World::new("past-rounds");
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        let mut edrive = EDrive::default();
        edrive.scan(&w.fake, &w.server, &w.phone_folder);
        let lines = |from: usize, count: usize| -> String { (from..from + count).map(|n| format!("phone-sender-{n:06}@example.org\n")).collect() };
        let mut list = String::new();
        let mut left_there: BTreeMap<String, Vec<u8>> = BTreeMap::new();
        let mut now = DUE;
        // The phone appends much: rounds, full rounds, its past ones taken out
        // here; eDrive sends each file again after Sioul.
        for step in 0..24 {
            list.push_str(&lines(step * 1_500, 1_500));
            put(&w.phone.roots.config, "known-senders.txt", &list);
            now += 600;
            w.phone.exchange(&w.phone_folder, now);
            let sent = phone_sends(&w, now + 1, false);
            assert!(sent.problem.is_none(), "step {step}: {sent:?}");
            edrive.scan(&w.fake, &w.server, &w.phone_folder);
            // What the server held of them, kept aside: as an older Sioul left them there.
            for (relative, bytes) in walk(&w.server).into_iter().filter(|(r, _)| r.starts_with(&w.phone.id) && r.ends_with(".jsonl")) {
                left_there.insert(relative, bytes);
            }
            w.desk.exchange(&w.server, now + 30);
            edrive.scan(&w.fake, &w.server, &w.phone_folder);
        }
        let past = crate::share::rounds_past(&w.phone_folder, &w.phone.memory, &w.phone.id, (now + 60) * 1000).unwrap();
        assert!(past > 3, "several rounds past their time: below {past}");
        // As they went past, eDrive's copies were taken out too.
        assert!(rounds_there(&w.server, &w.phone.id).iter().all(|r| *r >= past), "{:?}, below {past}", rounds_there(&w.server, &w.phone.id));
        assert!(rounds_there(&w.phone_folder, &w.phone.id).iter().all(|r| *r >= past));
        let put_back = |w: &World| {
            let _turn = w.fake.turn.lock().unwrap();
            for (relative, bytes) in &left_there {
                if !w.server.join(relative).exists() {
                    put_bytes(&w.server, relative, bytes);
                    fake::bump(&w.server.join(relative));
                }
            }
        };
        // Every past round back there, as an older Sioul left them; a stranger's past round beside.
        put_back(&w);
        let stranger = uuid::Uuid::new_v4().to_string();
        put(&w.server, &format!("{stranger}-1.jsonl"), "{\"n\":1}\n");
        let desks: BTreeMap<String, Vec<u8>> = walk(&w.server).into_iter().filter(|(r, _)| r.contains(&w.desk.id)).collect();
        let below: Vec<u32> = rounds_there(&w.server, &w.phone.id).into_iter().filter(|r| *r < past).collect();
        assert!(below.len() >= 3, "{below:?}");
        // Within six hours of the last listing: not looked for.
        w.fake.forget_seen();
        assert_eq!(phone_sends(&w, now + 120, false).taken_out, 0);
        assert!(w.fake.seen().iter().all(|l| !l.starts_with("DELETE ")));
        // A device that read the phone only to an earlier round holds back the rounds from there.
        let lagging = uuid::Uuid::new_v4().to_string();
        let held = below[below.len() / 2];
        let notes = |read: u32, at: i64| format!("at = {at}\nround = 1\n\n[read]\n\"{}\" = {read}\n", w.phone.id);
        put(&w.phone_folder, &format!("{lagging}.toml"), &notes(held, now + 100));
        let checked = phone_sends(&w, now + 6 * 3600 + 200, false);
        assert!(checked.problem.is_none(), "{checked:?}");
        assert_eq!(checked.taken_out, below.iter().filter(|r| **r < held).count(), "{checked:?}");
        assert_eq!(rounds_there(&w.server, &w.phone.id).into_iter().filter(|r| *r < past).collect::<Vec<_>>(), below.iter().copied().filter(|r| *r >= held).collect::<Vec<_>>(), "from round {held} on, held back");
        // It read on: the rest goes at the next listing.
        put(&w.phone_folder, &format!("{lagging}.toml"), &notes(past, now + 6 * 3600 + 300));
        assert!(phone_sends(&w, now + 12 * 3600 + 400, false).taken_out > 0);
        assert!(rounds_there(&w.server, &w.phone.id).iter().all(|r| *r >= past));
        // Nothing while none of its records is here.
        put_back(&w);
        let aside = w.base.join("rounds-aside");
        std::fs::create_dir_all(&aside).unwrap();
        let mine: Vec<String> = walk(&w.phone_folder).into_keys().filter(|r| r.starts_with(&w.phone.id) && r.ends_with(".jsonl")).collect();
        for relative in &mine {
            std::fs::rename(w.phone_folder.join(relative), aside.join(relative)).unwrap();
        }
        assert_eq!(phone_sends(&w, now + 18 * 3600 + 500, false).taken_out, 0, "none of its records here: nothing taken out");
        assert!(rounds_there(&w.server, &w.phone.id).iter().any(|r| *r < past));
        for relative in &mine {
            std::fs::rename(aside.join(relative), w.phone_folder.join(relative)).unwrap();
        }
        assert!(phone_sends(&w, now + 24 * 3600 + 600, false).taken_out > 0);
        assert!(rounds_there(&w.server, &w.phone.id).iter().all(|r| *r >= past));
        // Never another device's file.
        assert!(w.server.join(format!("{stranger}-1.jsonl")).exists());
        assert_eq!(walk(&w.server).into_iter().filter(|(r, _)| r.contains(&w.desk.id)).collect::<BTreeMap<_, _>>(), desks);
    }

    /// A refused delete (`412`) whose look at the server's copy then fails (a
    /// server's error on `PROPFIND`) leaves that file there and lets the send
    /// go on: the other files go, nothing is held back, no backoff; the next
    /// listing takes the round out (review of 15 October 2026, L1).
    #[test]
    fn a_failed_look_after_a_refused_delete_holds_nothing_back() {
        let w = World::new("look-fails");
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        let round = |n: u32| format!("{}-{n}.jsonl", w.phone.id);
        for n in 40..=42 {
            put(&w.phone_folder, &round(n), &format!("{{\"round\":{n}}}\n"));
        }
        assert!(send_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), &BTreeMap::new(), DUE + 10, false, TEST).problem.is_none());
        {
            let _turn = w.fake.turn.lock().unwrap();
            sync_up(&w.phone_folder.join(round(40)), &w.server.join(round(40)));
        }
        std::fs::remove_file(w.phone_folder.join(round(40))).unwrap();
        rounds_stand(&w, 42, 41, 42, DUE + 15);
        put(&w.phone_folder, &round(43), "{\"round\":43}\n");
        let looked = round(40);
        w.fake.fault(move |r| (r.method == "PROPFIND" && r.path.ends_with(&looked)).then_some(Fault::Status(500)));
        let sent = send_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), &BTreeMap::new(), DUE + 20, false, TEST);
        assert!(sent.problem.is_none() && sent.failure.is_none(), "the send goes on: {sent:?}");
        assert_eq!((sent.sent, sent.taken_out), (1, 0), "the new round went, the refused one stayed");
        let sending = Sending::load(&w.phone.memory);
        assert_eq!((sending.tries, sending.retry_at), (0, 0), "no backoff");
        assert!(w.server.join(round(40)).exists() && w.server.join(round(43)).exists());
        // Forgotten here: the next send asks nothing of it; the listing takes it out.
        w.fake.clear_faults();
        w.fake.forget_seen();
        send_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), &BTreeMap::new(), DUE + 30, false, TEST);
        assert!(w.fake.seen().iter().all(|l| !l.contains(&round(40))), "{:?}", w.fake.seen());
        let listed = send_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), &BTreeMap::new(), DUE + 10 + 6 * 3600, false, TEST);
        assert_eq!(listed.taken_out, 1, "{listed:?}");
        assert!(!w.server.join(round(40)).exists());
    }

    /// Any other answer to taking a file out there than taken out, gone or
    /// changed there (`423` while a sync app sends that very file again, a
    /// server's error, `403`) leaves it there and lets the send go on: the
    /// other files go, nothing is held back, no backoff. A past round is
    /// forgotten here and taken out at the next listing; a swept sealed file,
    /// which no listing looks for, is kept here, asked nothing at the next
    /// sends, and taken out at the next listing; so is one whose look after a
    /// `412` failed (final review of 15 October 2026, RES-1). Before, the
    /// first such answer failed the whole send and backed the next ones off.
    #[test]
    fn a_delete_answered_otherwise_holds_nothing_back() {
        for status in [423, 503, 403] {
            let w = World::new(&format!("delete-{status}"));
            assert!(w.find(DUE).confirmed_for(&w.phone_folder));
            let round = |n: u32| format!("{}-{n}.jsonl", w.phone.id);
            for n in 40..=42 {
                put(&w.phone_folder, &round(n), &format!("{{\"round\":{n}}}\n"));
            }
            let seal = |text: &str| {
                let source = w.base.join(format!("{}.md", text.len()));
                std::fs::write(&source, text.repeat(200)).unwrap();
                let (hash, _) = crate::blobs::hash_file(&source).unwrap();
                crate::blobs::put(&w.phone_folder, &KEY, &source, &hash).unwrap();
                let name = crate::blobs::name(&KEY, &hash);
                let size = std::fs::metadata(w.phone_folder.join("blobs").join(&name)).unwrap().len();
                (name, size)
            };
            let (refused, refused_size) = seal("a note of the phone's\n");
            let (looked, looked_size) = seal("another note of the phone's\n");
            let sealed: BTreeMap<String, u64> = [(refused.clone(), refused_size), (looked.clone(), looked_size)].into();
            assert!(send_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), &sealed, DUE + 10, false, TEST).problem.is_none());
            let blob = |name: &str| format!("blobs/{name}");
            {
                // eDrive sends the second sealed file again: a new ETag there.
                let _turn = w.fake.turn.lock().unwrap();
                sync_up(&w.phone_folder.join(blob(&looked)), &w.server.join(blob(&looked)));
            }
            // Round 40 past its time here, both sealed files swept; a new round to send.
            for relative in [round(40), blob(&refused), blob(&looked)] {
                std::fs::remove_file(w.phone_folder.join(relative)).unwrap();
            }
            rounds_stand(&w, 42, 41, 42, DUE + 15);
            put(&w.phone_folder, &round(43), "{\"round\":43}\n");
            let (deleted, stat) = ([round(40), refused.clone()], looked.clone());
            w.fake.fault(move |r| (r.method == "DELETE" && deleted.iter().any(|d| r.path.ends_with(d.as_str()))).then_some(Fault::Status(status)));
            w.fake.fault(move |r| (r.method == "PROPFIND" && r.path.ends_with(&stat)).then_some(Fault::Status(status)));
            let sent = send_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), &BTreeMap::new(), DUE + 20, false, TEST);
            assert!(sent.problem.is_none() && sent.failure.is_none(), "{status}: the send goes on: {sent:?}");
            assert_eq!((sent.sent, sent.taken_out), (1, 0), "{status}: the new round went, the others stayed there");
            let sending = Sending::load(&w.phone.memory);
            assert_eq!((sending.tries, sending.retry_at), (0, 0), "{status}: no backoff");
            assert!(!sending.sent.contains_key(&round(40)), "{status}: the round forgotten here");
            assert_eq!(sending.refused, [blob(&refused), blob(&looked)].into_iter().collect(), "{status}: the sealed files kept for the next listing");
            assert!([round(40), round(43), blob(&refused), blob(&looked)].iter().all(|r| w.server.join(r).exists()));
            // The next send asks nothing of them.
            w.fake.clear_faults();
            w.fake.forget_seen();
            let quiet = send_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), &BTreeMap::new(), DUE + 30, false, TEST);
            assert!(quiet.problem.is_none(), "{status}: {quiet:?}");
            assert!(w.fake.seen().iter().all(|l| !l.contains(&round(40)) && !l.contains(&refused) && !l.contains(&looked)), "{status}: {:?}", w.fake.seen());
            // The listing takes all three out, and forgets them here.
            let listed = send_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), &BTreeMap::new(), DUE + 10 + 6 * 3600, false, TEST);
            assert_eq!(listed.taken_out, 3, "{status}: {listed:?}");
            assert!([round(40), blob(&refused), blob(&looked)].iter().all(|r| !w.server.join(r).exists()));
            let sending = Sending::load(&w.phone.memory);
            assert!(sending.refused.is_empty() && !sending.sent.keys().any(|r| r.starts_with("blobs/")), "{status}: {sending:?}");
        }
    }

    /// A round of this device gone from the folder here but not past its time
    /// for every reader (a folder synced again in part, a backup put back) is
    /// not taken out there: only below the readers' floor (`share::rounds_past`),
    /// as `remove_old_rounds` judges it; then at the next send (review of
    /// 15 October 2026, L2).
    #[test]
    fn a_round_gone_here_goes_there_only_below_the_readers_floor() {
        let w = World::new("readers-floor");
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        let round = |n: u32| format!("{}-{n}.jsonl", w.phone.id);
        for n in 40..=43 {
            put(&w.phone_folder, &round(n), &format!("{{\"round\":{n}}}\n"));
        }
        assert!(send_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), &BTreeMap::new(), DUE + 10, false, TEST).problem.is_none());
        // The desk read the phone to round 41 only, and 40 is its last full round.
        rounds_stand(&w, 43, 40, 41, DUE + 15);
        std::fs::remove_file(w.phone_folder.join(round(41))).unwrap();
        let sent = send_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), &BTreeMap::new(), DUE + 20, false, TEST);
        assert!(sent.problem.is_none() && sent.taken_out == 0, "{sent:?}");
        assert!(w.server.join(round(41)).exists(), "below the latest round, not below the readers' floor: kept there");
        // Every reader read past it, and a later round is full: it goes.
        rounds_stand(&w, 43, 42, 43, DUE + 25);
        let sent = send_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), &BTreeMap::new(), DUE + 30, false, TEST);
        assert_eq!(sent.taken_out, 1, "{sent:?}");
        assert!(!w.server.join(round(41)).exists());
        assert!([40, 42, 43].iter().all(|n| w.server.join(round(*n)).exists()), "never one here");
    }

    // ------------------------------------------------ weeks of edits: what the server holds settles

    /// Bytes that do not compress, the same for the same seed: a recording, a scan.
    fn noise(length: usize, seed: u32) -> Vec<u8> {
        let mut x = seed.wrapping_mul(2_654_435_761).wrapping_add(1);
        (0..length)
            .map(|_| {
                x ^= x << 13;
                x ^= x >> 17;
                x ^= x << 5;
                x as u8
            })
            .collect()
    }

    /// A file's content by its sealed file's name.
    fn content_name(path: &Path) -> String {
        crate::blobs::name(&KEY, &crate::blobs::hash_file(path).unwrap().0)
    }

    /// Six weeks of a desk and a phone sharing through a Nextcloud, the phone
    /// under eDrive (it sends each file again, and never passes a deletion
    /// on) and sending its own files itself, as on 14 October 2026: 36 notes
    /// edited a day on the desk, a recording saved in three takes minutes
    /// apart every six days, a paper replaced every ten, a note of the
    /// phone's each day, the phone's texts growing as an archive (150 a
    /// day, from 3,000). What the server holds settles: every content
    /// replaced leaves it within two weeks and a day, whichever device
    /// sealed it; no device's records below its floor stay there; a
    /// recording's earlier takes never reach it. Past its current contents
    /// and records, the server holds at most what the last two weeks of edits
    /// replaced, the same in the sixth week as in the fourth. The daily
    /// figures are printed (`--nocapture`).
    #[test]
    fn six_weeks_of_edits_what_the_server_holds_settles() {
        crate::share::LARGE_SETTLE.with(|s| s.set(crate::share::LARGE_SETTLING));
        let w = World::new("six-weeks");
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        let (dn, pn) = (w.base.join("desk-notes"), w.base.join("phone-notes"));
        std::fs::create_dir_all(&dn).unwrap();
        std::fs::create_dir_all(&pn).unwrap();
        let texts = w.phone.roots.data.join(sioul_core::texts::FOLDER).join(sioul_core::texts::LOG).join(format!("{}.jsonl", w.phone.id));
        std::fs::create_dir_all(texts.parent().unwrap()).unwrap();
        let text_line = |n: usize| format!("{{\"n\":{n},\"padded\":\"{}\"}}\n", "x".repeat(230));
        std::fs::write(&texts, (0..3_000).map(text_line).collect::<String>()).unwrap();
        let mut texts_made = 3_000;
        // Sealed files dated long ago in real time, the same in every copy:
        // the sweeps then go by when each content was last used, in the
        // simulation's time, as on devices whose files age with the days.
        let long_ago = SystemTime::now() - Duration::from_secs(365 * 86_400);
        let age_sealed = |folder: &Path| {
            for entry in std::fs::read_dir(folder.join("blobs")).into_iter().flatten().filter_map(Result::ok) {
                if !entry.file_name().to_string_lossy().starts_with('.') && entry.metadata().and_then(|m| m.modified()).is_ok_and(|t| t > long_ago + Duration::from_secs(86_400)) {
                    set_mtime(&entry.path(), long_ago);
                }
            }
        };
        let mut edrive = EDrive::default();
        // Each content replaced, and when (seconds); the sizes sealed, as seen there.
        let mut replaced: BTreeMap<String, i64> = BTreeMap::new();
        let mut sizes: BTreeMap<String, u64> = BTreeMap::new();
        let mut takes: Vec<String> = Vec::new();
        let (mut last_song, mut last_paper): (Option<String>, Option<String>) = (None, None);
        let (mut phone_floor, mut desk_floor, mut taken_out) = (0u32, 0u32, 0usize);
        let mut overheads: Vec<u64> = Vec::new();
        let mut table: Vec<String> = Vec::new();
        let start = DUE + 3_600;
        let days = 42i64;
        for day in 0..days {
            for slot in 0..3i64 {
                let now = start + day * 86_400 + slot * 4 * 3_600;
                // The desk: twelve notes edited, each a content of its own.
                for i in 0..12usize {
                    let n = (day as usize * 36 + slot as usize * 12 + i) % 50;
                    let path = dn.join(format!("note-{n:02}.md"));
                    if path.is_file() {
                        replaced.insert(content_name(&path), now);
                    }
                    std::fs::write(&path, format!("note {n}, day {day}, edit {slot}-{i}\n").repeat(10 + (n * 7) % 90)).unwrap();
                }
                // A recording, three takes minutes apart: the last one settles.
                if day % 6 == 1 {
                    let song = dn.join("scenes").join("song.mp3");
                    std::fs::create_dir_all(song.parent().unwrap()).unwrap();
                    std::fs::write(&song, noise((1 << 20) + 100_000, (day * 10 + slot) as u32)).unwrap();
                    let name = content_name(&song);
                    if slot < 2 {
                        takes.push(name);
                    } else {
                        set_mtime(&song, SystemTime::now() - Duration::from_secs(11 * 60));
                        if let Some(old) = last_song.replace(name) {
                            replaced.insert(old, now);
                        }
                    }
                }
                // A paper replaced every ten days.
                if day % 10 == 2 && slot == 1 {
                    let paper = dn.join(sioul_core::papers::FOLDER).join("scan.pdf");
                    std::fs::create_dir_all(paper.parent().unwrap()).unwrap();
                    std::fs::write(&paper, noise(400_000, 1_000 + day as u32)).unwrap();
                    if let Some(old) = last_paper.replace(content_name(&paper)) {
                        replaced.insert(old, now);
                    }
                }
                w.desk.exchange_all_parts(&w.server, now, &dn);
                age_sealed(&w.server);
                // The phone: fifty texts, its own note once a day; its files sent, then eDrive's turn.
                {
                    let mut log = std::fs::OpenOptions::new().append(true).open(&texts).unwrap();
                    for _ in 0..50 {
                        log.write_all(text_line(texts_made).as_bytes()).unwrap();
                        texts_made += 1;
                    }
                }
                if slot == 1 {
                    let journal = pn.join("journal.md");
                    if journal.is_file() {
                        replaced.insert(content_name(&journal), now);
                    }
                    std::fs::write(&journal, format!("the phone's own note, day {day}\n").repeat(20)).unwrap();
                }
                w.phone.exchange_all_parts(&w.phone_folder, now + 60, &pn);
                age_sealed(&w.phone_folder);
                phone_floor = crate::share::rounds_past(&w.phone_folder, &w.phone.memory, &w.phone.id, (now + 60) * 1000).unwrap();
                let sent = send_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), &crate::share::own_sealed(&w.phone.memory, &w.phone.id), now + 61, false, TEST);
                assert!(sent.problem.is_none(), "day {day}: {sent:?}");
                taken_out += sent.taken_out;
                edrive.scan(&w.fake, &w.server, &w.phone_folder);
                w.desk.exchange_all_parts(&w.server, now + 120, &dn);
                age_sealed(&w.server);
                desk_floor = crate::share::rounds_past(&w.server, &w.desk.memory, &w.desk.id, (now + 120) * 1000).unwrap();
                edrive.scan(&w.fake, &w.server, &w.phone_folder);
            }
            // What the server holds at the end of the day.
            let end = start + day * 86_400 + 8 * 3_600 + 120;
            let there = walk(&w.server);
            let total: u64 = there.values().map(|b| b.len() as u64).sum();
            let blobs: BTreeMap<String, u64> = there.iter().filter_map(|(r, b)| r.strip_prefix("blobs/").map(|n| (n.to_string(), b.len() as u64))).collect();
            for (name, size) in &blobs {
                sizes.entry(name.clone()).or_insert(*size);
            }
            let current: BTreeSet<String> = [&dn, &pn].into_iter().flat_map(|dir| walk(dir).into_keys().map(move |r| content_name(&dir.join(r)))).collect();
            let mut overhead = 0;
            for (name, size) in blobs.iter().filter(|(n, _)| !current.contains(*n)) {
                let at = replaced.get(name).copied().unwrap_or_else(|| panic!("day {day}: a sealed file there that no edit replaced"));
                assert!(end - at <= 15 * 86_400, "day {day}: a content replaced {} days ago still there", (end - at) / 86_400);
                overhead += size;
            }
            assert!(takes.iter().all(|t| !blobs.contains_key(t)), "day {day}: a take saved minutes before the next reached the server");
            let (phone_rounds, desk_rounds) = (rounds_there(&w.server, &w.phone.id), rounds_there(&w.server, &w.desk.id));
            assert!(phone_rounds.iter().all(|r| *r >= phone_floor), "day {day}: the phone's rounds {phone_rounds:?}, below {phone_floor}");
            assert!(desk_rounds.iter().all(|r| *r >= desk_floor), "day {day}: the desk's rounds {desk_rounds:?}, below {desk_floor}");
            let bytes_of = |id: &str| -> u64 { there.iter().filter(|(r, _)| r.starts_with(id) && r.ends_with(".jsonl")).map(|(_, b)| b.len() as u64).sum() };
            let current_bytes: u64 = blobs.iter().filter(|(n, _)| current.contains(*n)).map(|(_, s)| s).sum();
            let replaced_bytes: u64 = replaced.keys().filter_map(|n| sizes.get(n)).sum();
            table.push(format!(
                "day {day:2}: {:>6} KB there; current sealed {:>6} KB; replaced, still there {:>5} KB ({:>3} files); phone's records {:>5} KB in {:>2} rounds ({:?}); desk's {:>4} KB in {} rounds; replaced since day 0 {:>6} KB",
                total / 1000,
                current_bytes / 1000,
                overhead / 1000,
                blobs.keys().filter(|n| !current.contains(*n)).count(),
                bytes_of(&w.phone.id) / 1000,
                phone_rounds.len(),
                phone_rounds.first().zip(phone_rounds.last()).map(|(a, b)| (*a, *b)).unwrap_or_default(),
                bytes_of(&w.desk.id) / 1000,
                desk_rounds.len(),
                replaced_bytes / 1000,
            ));
            overheads.push(overhead);
        }
        eprintln!("{}", table.join("\n"));
        eprintln!("eDrive: {} uploads, {} refused; the phone's sends took out {taken_out} files there", edrive.uploads, edrive.refusals);
        // The same in the sixth week as in the fourth: two weeks of edits, one recording more at most.
        let weeks = |from: usize, to: usize| overheads[from..to].iter().copied().max().unwrap_or(0);
        assert!(weeks(35, 42) <= weeks(21, 28) + (1 << 20) + 200_000, "settled: {} then {}", weeks(21, 28), weeks(35, 42));
        assert!(taken_out > 0 && edrive.uploads > 0, "eDrive sent the phone's files again, and Sioul took them out there");
        crate::share::LARGE_SETTLE.with(|s| s.set(0));
    }

    // ------------------------------------------------ joining through the server's sign-in

    /// What a device joining with nothing set up finds of the sharing folder
    /// on its server (`seek`): Sioul's own place first, then the top of the
    /// files, then each folder one level under Documents; a file that is no
    /// seal never taken for one; nothing written there.
    #[test]
    fn the_seal_is_found_at_documents_sioul_and_elsewhere() {
        use super::fake::USER;
        let base = scratch("seek");
        let files = base.join("cloud");
        std::fs::create_dir_all(files.join("Documents/Photos")).unwrap();
        let fake = Fake::start(&files);
        let login = crate::loginflow::Grant::of(&fake.base, USER, PASSWORD).login_for("cloud");
        let found = |login: &Login| seek_with(login, TEST).unwrap().found;
        assert_eq!(seek_with(&login, TEST).unwrap(), Sought { found: Vec::new(), complete: true }, "none yet, every place looked at");
        put(&files, "Documents/Sioul/seal.toml", SEAL);
        assert_eq!(found(&login), ["Documents/Sioul"]);
        std::fs::remove_dir_all(files.join("Documents/Sioul")).unwrap();
        put(&files, "Sioul/seal.toml", SEAL);
        put(&files, "Documents/Partagé/seal.toml", OTHER_SEAL);
        put(&files, "Documents/Notes/seal.toml", "not a seal");
        put(&files, "Documents/.hidden/seal.toml", SEAL);
        assert_eq!(seek_with(&login, TEST).unwrap(), Sought { found: vec!["Sioul".into(), "Documents/Partagé".into()], complete: true });
        // Only listings and seals asked; nothing written there.
        assert!(fake.seen().iter().all(|l| l.starts_with("PROPFIND ") || (l.starts_with("GET ") && l.contains("/seal.toml "))), "{:?}", fake.seen());
        // No Documents folder at all: the top still looked at.
        std::fs::remove_dir_all(files.join("Documents")).unwrap();
        assert_eq!(seek_with(&login, TEST).unwrap(), Sought { found: vec!["Sioul".into()], complete: true });
        // A refused login said, as `open` says it.
        let refused = Login { password: Some("wrong".into()), ..login };
        assert!(seek_with(&refused, TEST).unwrap_err().starts_with("login:"));
        // Which places the look goes through by itself (what "Add a device" may say is found by itself).
        assert!(sought("Documents/Sioul") && sought("/Sioul/") && sought("Documents/Partagé"));
        assert!(!sought("Documents/A/B") && !sought("Partage/Sioul") && !sought("Documents/.hidden") && !sought("Documents/"));
        let _ = std::fs::remove_dir_all(&base);
    }

    /// The look on a slow or failing server (the review of the join, M3):
    /// Sioul's own places are looked at first, before any listing; a listing of
    /// `Documents` that fails only ends the extra places; the time running out
    /// ends the look with what was found; a seal that cannot be read leaves the
    /// look incomplete, so that "none found" is never said, nor a new sharing
    /// offered, when the folder may be there.
    #[test]
    fn a_slow_or_failing_look_keeps_what_it_found_and_says_it_is_incomplete() {
        use super::fake::USER;
        let base = scratch("seek-slow");
        let files = base.join("cloud");
        for folder in 0..12 {
            std::fs::create_dir_all(files.join(format!("Documents/Dossier {folder:02}"))).unwrap();
        }
        put(&files, "Documents/Sioul/seal.toml", SEAL);
        let fake = Fake::start(&files);
        let login = crate::loginflow::Grant::of(&fake.base, USER, PASSWORD).login_for("cloud");
        // Documents/Sioul is read before Documents is listed.
        let _ = seek_with(&login, TEST).unwrap();
        let seen = fake.seen();
        let seal_at = seen.iter().position(|l| l.contains("/Documents/Sioul/seal.toml")).unwrap();
        let listed_at = seen.iter().position(|l| l.starts_with("PROPFIND ") && l.ends_with("/Documents 207")).unwrap();
        assert!(seal_at < listed_at, "{seen:?}");
        // The listing of Documents fails: what was found stays, the look incomplete.
        fake.fault(|r| (r.method == "PROPFIND" && r.path.ends_with("/files/jane/Documents")).then_some(Fault::Status(500)));
        assert_eq!(seek_with(&login, TEST).unwrap(), Sought { found: vec!["Documents/Sioul".into()], complete: false });
        fake.clear_faults();
        // The time runs out among the extra places: what was found stays.
        let tight = Limits { pull: Duration::from_millis(800), ..TEST };
        fake.fault(|r| (r.method == "GET" && r.path.contains("/Dossier ")).then_some(Fault::Late(Duration::from_millis(300))));
        assert_eq!(seek_with(&login, tight).unwrap(), Sought { found: vec!["Documents/Sioul".into()], complete: false });
        fake.clear_faults();
        // Its own seal cannot be read (the server's error): nothing found, but never "none found".
        fake.fault(|r| (r.method == "GET" && r.path.ends_with("/Documents/Sioul/seal.toml")).then_some(Fault::Status(503)));
        assert_eq!(seek_with(&login, TEST).unwrap(), Sought { found: Vec::new(), complete: false });
        fake.clear_faults();
        let _ = std::fs::remove_dir_all(&base);
    }

    /// An exchange with the folder's own key (made from a passphrase), its entry written after.
    fn keyed_exchange(device: &Device, folder: &Path, key: &[u8; 32], now: i64) -> Outcome {
        let outcome = crate::share::exchange(&Sharing { folder, computer: &device.id, key, memory: &device.memory, files: false, hurry: None }, &device.stores(), now * 1000).unwrap();
        crate::devices::change(&crate::devices::own_path(&device.roots.state), Some((folder, key)), |e| {
            e.id = device.id.clone();
            e.kind = device.kind.into();
            if e.started == 0 {
                e.start(now);
            }
            e.exported(now * 1000, outcome.wrote, now);
        })
        .unwrap();
        outcome
    }

    /// A fresh device joins through its Nextcloud's sign-in alone
    /// (docs/database.md, "Joining through your Nextcloud's sign-in"): the
    /// desk shares through its sync app's folder, the server's; the phone has
    /// nothing set up, no sync app, no account, no configuration. Signed in in
    /// the browser, it finds the folder there, the passphrase is checked
    /// against the seal (a wrong one refused), and Sioul keeps its own copy in
    /// step with that login alone: the desk's settings and accounts arrive at
    /// its first exchange, and the desk hears of the phone.
    #[test]
    fn a_fresh_device_joins_through_the_sign_in_and_receives_the_others_settings() {
        use super::fake::USER;
        let base = scratch("join");
        let files = base.join("cloud");
        let server = files.join("Documents").join("Sioul");
        std::fs::create_dir_all(&server).unwrap();
        let fake = Fake::start(&files);
        // The desk: its folder the server's (its sync app keeps the two equal), sealed with its passphrase.
        let passphrase = "a few words you keep";
        let key = crate::share::key_for(&server, passphrase).unwrap();
        let desk = Device::new(&base, "desk", COMPUTER);
        put(&desk.roots.config, "config.toml", "language = \"fr\"\n\n[[account]]\nid = \"agenda\"\nkind = \"dav\"\naddress = \"jane@example.org\"\nhost = \"cloud.example.org\"\nurl = \"https://cloud.example.org/remote.php/dav/calendars/jane/\"\n");
        keyed_exchange(&desk, &server, &key, DUE - 600);
        // The phone signs in, in its browser.
        let address = crate::loginflow::address_of(&fake.base).unwrap();
        let flow = crate::loginflow::begin(&address, "Sioul (Android)").unwrap();
        fake.grant_flows();
        let grant = crate::loginflow::wait(&flow, &std::sync::atomic::AtomicBool::new(false), Duration::from_secs(10), Duration::from_millis(50)).unwrap();
        let login = grant.login_for("cloud-agenda");
        // The folder found at Sioul's own place, its seal brought into the phone's own copy.
        assert_eq!(seek_with(&login, TEST).unwrap().found, ["Documents/Sioul"]);
        let opened = open_with(&login, "Documents/Sioul", TEST).unwrap();
        let phone = Device::new(&base, "phone", PHONE);
        let mirror = mirror_of(&phone.memory);
        put_bytes(&mirror, "seal.toml", opened.seal.as_deref().expect("sealed there"));
        // A wrong passphrase refused; the one chosen on the desk opens the seal.
        assert_eq!(crate::share::key_for(&mirror, "not the one chosen there").unwrap_err(), crate::share::Refused::WrongPassphrase);
        assert_eq!(crate::share::key_for(&mirror, passphrase).unwrap(), key);
        begin_signed_in(&phone.memory, &mirror, &login, &opened, DUE - 500).unwrap();
        let state = State::load(&phone.memory);
        assert_eq!((state.user.as_str(), state.mode.as_str(), state.account.as_str()), (USER, MIRROR, "cloud-agenda"));
        assert!(!std::fs::read_to_string(state_path(&phone.memory)).unwrap().contains(grant.password()), "never the app password");
        // Its first exchange: the server looked through, the others' files read, its own sent.
        let pulled = step_with(&phone.memory, &mirror, &phone.id, &login, DUE - 400, true, TEST);
        assert!(pulled.problem.is_none() && pulled.fetched > 0, "{pulled:?}");
        let outcome = keyed_exchange(&phone, &mirror, &key, DUE - 400);
        assert!(outcome.received > 0, "{outcome:?}");
        let pushed = step_with(&phone.memory, &mirror, &phone.id, &login, DUE - 399, false, TEST);
        assert!(pushed.problem.is_none() && pushed.sent > 0, "{pushed:?}");
        let config = std::fs::read_to_string(phone.roots.config.join("config.toml")).unwrap_or_default();
        assert!(config.contains("language = \"fr\"") && config.contains("id = \"agenda\""), "the desk's settings and accounts: {config}");
        // The desk, at its next exchange, hears of the phone: its records and its entry, on the server.
        keyed_exchange(&desk, &server, &key, DUE - 300);
        assert!(crate::devices::all(&server, &key).0.iter().any(|e| e.id == phone.id && e.kind == PHONE));
        // The app password, the only secret, went to that server alone, and is in no file of the phone's.
        for (relative, bytes) in walk(&phone.roots.state).into_iter().chain(walk(&phone.roots.config)) {
            assert!(!String::from_utf8_lossy(&bytes).contains(grant.password()), "{relative}");
        }
        let _ = std::fs::remove_dir_all(&base);
    }

    /// A first look cut short (the time out among the desk's records) is
    /// never taken for a whole one (the review of the join, M2): its state
    /// says an error and no whole look since the join, so that the window
    /// decides nothing about the contacts and calendars on it (`join.rs`);
    /// the next look goes through, says so, and the exchange then brings the
    /// desk's account, which the window then uses rather than make a second.
    #[test]
    fn a_first_look_cut_short_is_never_taken_for_a_whole_one() {
        use super::fake::USER;
        let base = scratch("join-late");
        let files = base.join("cloud");
        let server = files.join("Documents").join("Sioul");
        std::fs::create_dir_all(&server).unwrap();
        let fake = Fake::start(&files);
        let passphrase = "a few words you keep";
        let key = crate::share::key_for(&server, passphrase).unwrap();
        let desk = Device::new(&base, "desk", COMPUTER);
        put(&desk.roots.config, "config.toml", "[[account]]\nid = \"murena\"\nkind = \"dav\"\naddress = \"jane\"\nhost = \"cloud.example.org\"\nurl = \"https://cloud.example.org/remote.php/dav/calendars/jane/\"\n");
        keyed_exchange(&desk, &server, &key, DUE - 600);
        let grant = crate::loginflow::Grant::of(&fake.base, USER, PASSWORD);
        let login = grant.login_for("cloud-agenda");
        let opened = open_with(&login, "Documents/Sioul", TEST).unwrap();
        let phone = Device::new(&base, "phone", PHONE);
        let mirror = mirror_of(&phone.memory);
        put_bytes(&mirror, "seal.toml", opened.seal.as_deref().unwrap());
        assert_eq!(crate::share::key_for(&mirror, passphrase).unwrap(), key);
        begin_signed_in(&phone.memory, &mirror, &login, &opened, DUE - 500).unwrap();
        // The desk's records slow to come: the look's time runs out.
        let id = desk.id.clone();
        fake.fault(move |r| (r.method == "GET" && r.path.contains(&id) && r.path.ends_with(".jsonl")).then_some(Fault::Late(Duration::from_millis(900))));
        let tight = Limits { pull: Duration::from_millis(600), ..TEST };
        let cut = step_with(&phone.memory, &mirror, &phone.id, &login, DUE - 400, true, tight);
        assert!(cut.problem.is_some(), "{cut:?}");
        let state = State::load(&phone.memory);
        assert!(!state.said.is_empty() && state.last < DUE - 500, "no whole look since the join: {state:?}");
        keyed_exchange(&phone, &mirror, &key, DUE - 400);
        assert!(!std::fs::read_to_string(phone.roots.config.join("config.toml")).unwrap_or_default().contains("id = \"murena\""), "the desk's account not here yet");
        // The next look goes through: said so, and the desk's account comes.
        fake.clear_faults();
        let whole = step_with(&phone.memory, &mirror, &phone.id, &login, DUE - 300, true, TEST);
        assert!(whole.problem.is_none(), "{whole:?}");
        let state = State::load(&phone.memory);
        assert!(state.said.is_empty() && state.last >= DUE - 300 && state.left.is_empty(), "{state:?}");
        keyed_exchange(&phone, &mirror, &key, DUE - 300);
        let config = std::fs::read_to_string(phone.roots.config.join("config.toml")).unwrap_or_default();
        assert!(config.contains("id = \"murena\""), "{config}");
        let _ = std::fs::remove_dir_all(&base);
    }

    /// A device's memory as last saved: its last full round.
    fn full_round_of(d: &Device) -> u32 {
        std::fs::read(&d.memory).ok().and_then(|b| serde_json::from_slice::<serde_json::Value>(&b).ok()).and_then(|m| m["full_round"].as_u64()).unwrap_or(0) as u32
    }

    /// A sync app that never passes a deletion on (eDrive), for a device of
    /// its own folder: its own files up, the others' down.
    fn carried(w: &World, folder: &Path, id: &str) {
        let _turn = w.fake.turn.lock().unwrap();
        for (relative, bytes) in walk(folder).into_iter().filter(|(r, _)| r.contains(id)) {
            put_bytes(&w.server, &relative, &bytes);
        }
        for (relative, bytes) in walk(&w.server).into_iter().filter(|(r, _)| !r.contains(id)) {
            put_bytes(folder, &relative, &bytes);
        }
    }

    /// The senders an old phone keeps, a growing list (fiction).
    fn senders(step: usize) -> String {
        (0..(step + 1) * 1_500).map(|n| format!("old-sender-{n:06}@example.org\n")).collect()
    }

    /// Sealed files said swept here as a device's that no longer counts
    /// (`share::swept_theirs`), as an exchange says them, at `at` (seconds).
    fn swept_here(d: &Device, names: &[&str], at: i64) {
        let mut memory: serde_json::Value = serde_json::from_slice(&std::fs::read(&d.memory).unwrap()).unwrap();
        memory["taken"] = names.iter().map(|name| (name.to_string(), serde_json::Value::from(at * 1000))).collect::<serde_json::Map<_, _>>().into();
        std::fs::write(&d.memory, serde_json::to_vec(&memory).unwrap()).unwrap();
    }

    /// A phone dead for good, under a sync app that never passes a deletion
    /// on: its past rounds, taken out of its own folder before it died, were
    /// left on the server (the owner's, 16 October 2026: 47 MB). Forgotten on
    /// the phone that sends its own files, they go there at a listing: below
    /// the dead one's last full round only, once every device that counts read
    /// it past them, each over its ETag as listed; never fetched again
    /// meanwhile. One another device took out first (`404`), one a sync app
    /// sent again (`412`): left, the send going on; the next listing takes the
    /// rest. Only those names, never another device's file. A sealed file this
    /// phone swept as the dead one's goes there too when still as old there,
    /// never one another device made fresh there since.
    #[test]
    fn a_dead_phone_s_past_rounds_go_from_the_server_too() {
        let w = World::new("departed-rounds");
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        let old = Device::new(&w.base, "old-state", PHONE);
        let folder = w.base.join("old").join("storage").join("Documents").join("Sioul");
        put(&folder, "seal.toml", SEAL);
        old.session(&folder, |e| e.start(DUE - 6_000));
        let mut now = DUE;
        let mut step = 0;
        while full_round_of(&old) <= 1 {
            put(&old.roots.config, "known-senders.txt", &senders(step));
            now += 600;
            carried(&w, &folder, &old.id);
            old.exchange(&folder, now);
            carried(&w, &folder, &old.id);
            w.desk.exchange(&w.server, now + 10);
            w.down();
            w.phone.exchange(&w.phone_folder, now + 20);
            w.up();
            step += 1;
        }
        let full = full_round_of(&old);
        // A round continuing it; everyone reads to its end; then it dies.
        put(&old.roots.config, "known-senders.txt", &senders(step));
        carried(&w, &folder, &old.id);
        old.exchange(&folder, now + 300);
        carried(&w, &folder, &old.id);
        w.desk.exchange(&w.server, now + 310);
        w.down();
        w.phone.exchange(&w.phone_folder, now + 320);
        w.up();
        let all = rounds_there(&w.server, &old.id);
        let kept: BTreeSet<u32> = all.iter().copied().filter(|r| *r >= full).collect();
        let past: Vec<String> = all.iter().filter(|r| **r < full).map(|r| format!("{}-{r}.jsonl", old.id)).collect();
        assert!(past.len() >= 3 && kept.len() >= 2, "{all:?}, full {full}");
        assert!(rounds_there(&folder, &old.id).len() < all.len(), "it took its own out of its folder, never of the server");
        // Forgotten on the phone: taken out of its folder, still on the server.
        crate::share::forget_device(&w.phone_folder, &KEY, &w.phone.memory, &w.phone.id, &old.id).unwrap();
        w.phone.exchange(&w.phone_folder, now + 400);
        w.up();
        assert_eq!(rounds_there(&w.phone_folder, &old.id), kept);
        assert_eq!(rounds_there(&w.server, &old.id), all);
        assert_eq!(crate::share::departed_past(&w.phone.memory, &w.phone.id).get(&old.id), Some(&full));
        // Its pull never brings them again.
        w.fake.forget_seen();
        let pulled = w.pull(now + 410);
        assert!(pulled.problem.is_none(), "{pulled:?}");
        assert!(w.fake.seen().iter().any(|l| l.starts_with("PROPFIND ")), "listed there");
        assert!(w.fake.seen().iter().all(|l| !(l.starts_with("GET ") && past.iter().any(|r| l.contains(r.as_str())))), "never fetched again: {:?}", w.fake.seen());
        assert!(past.iter().all(|r| !w.cache().join(r).exists()));
        // Two sealed files swept here as the dead one's: one still as old there, one made fresh there since.
        let (stale, fresh) = ("a".repeat(64), "b".repeat(64));
        for (name, at) in [(&stale, SystemTime::now() - Duration::from_secs(100 * 86_400)), (&fresh, std::time::UNIX_EPOCH + Duration::from_secs(now as u64))] {
            put(&w.server, &format!("blobs/{name}"), "sealed\n");
            set_mtime(&w.server.join("blobs").join(name), at);
        }
        swept_here(&w.phone, &[&stale, &fresh], now + 400);
        // A listing: one sent again meanwhile (412), one another device took out first (404).
        let (refused, gone) = (past[0].clone(), past[1].clone());
        let r = refused.clone();
        w.fake.fault(once(move |q| q.method == "DELETE" && q.path.ends_with(&r), Fault::Status(412)));
        let (g, server) = (gone.clone(), w.server.clone());
        w.fake.fault(move |q| {
            (q.method == "DELETE" && q.path.ends_with(&g)).then(|| {
                let _ = std::fs::remove_file(server.join(&g));
                Fault::Status(404)
            })
        });
        w.fake.forget_seen();
        let sent = phone_sends(&w, now + 420, true);
        assert!(sent.problem.is_none(), "the send goes on: {sent:?}");
        assert_eq!(sent.taken_out, past.len() - 2 + 1, "every past round but two, and the stale sealed file: {:?}", w.fake.seen());
        let left: BTreeSet<u32> = kept.iter().copied().chain(remote_round(&refused)).collect();
        assert_eq!(rounds_there(&w.server, &old.id), left, "the refused one left, the one gone already gone");
        assert!(!w.server.join("blobs").join(&stale).exists(), "still as old there: taken out");
        assert!(w.server.join("blobs").join(&fresh).exists(), "made fresh there since: another device's use, left");
        let deletes: Vec<String> = w.fake.seen().into_iter().filter(|l| l.starts_with("DELETE ")).collect();
        assert!(deletes.iter().all(|l| past.iter().any(|r| l.contains(r.as_str())) || l.contains(&stale)), "only those names: {deletes:?}");
        // The next listing takes the refused one out; its last full round and the one after stay, ever.
        w.fake.clear_faults();
        let later = phone_sends(&w, now + 420 + CHECK_AGAIN, false);
        assert!(later.problem.is_none() && later.taken_out == 1, "{later:?}");
        assert_eq!(rounds_there(&w.server, &old.id), kept);
        let quiet = phone_sends(&w, now + 420 + 2 * CHECK_AGAIN, false);
        assert!(quiet.problem.is_none() && quiet.taken_out == 0, "{quiet:?}");
        assert_eq!(rounds_there(&w.server, &old.id), kept);
    }

    /// A round's number, from its file's name.
    fn remote_round(relative: &str) -> Option<u32> {
        round_of(relative)
    }

    /// The same, Sioul keeping the folders itself, no sync app anywhere: the
    /// desk takes a dead phone's past rounds out of its own copy, never
    /// fetches them again, and takes them out there at its next step; the
    /// phone, which still counts it, lets them go from its copy once the
    /// server no longer has them. A sealed file the desk swept as the dead
    /// one's goes there too, when still as old there, never fetched again.
    #[test]
    fn a_dead_phone_s_past_rounds_go_from_the_server_in_the_mirror_too() {
        let p = Pair::new("departed-mirror");
        let login = p.fake.login();
        let old = Device::new(&p.base, "old", PHONE);
        let old_folder = mirror_of(&old.memory);
        let joined = open_with(&login, "Documents/Sioul", TEST).unwrap();
        put_bytes(&old_folder, "seal.toml", joined.seal.as_deref().unwrap());
        begin(&old.memory, &old_folder, &login, &joined, DUE - 7_000).unwrap();
        old.session(&old_folder, |e| e.start(DUE - 6_900));
        let old_turn = |now: i64| {
            let before = step_with(&old.memory, &old_folder, &old.id, &login, now, true, TEST);
            assert!(before.problem.is_none(), "{before:?}");
            old.exchange(&old_folder, now);
            let after = step_with(&old.memory, &old_folder, &old.id, &login, now, false, TEST);
            assert!(after.problem.is_none(), "{after:?}");
        };
        old_turn(DUE - 6_800);
        p.turn(true, DUE - 6_700);
        p.turn(false, DUE - 6_600);
        // The old phone past a full round and one continuing it, alone; then it dies.
        let mut now = DUE;
        let mut step = 0;
        while full_round_of(&old) <= 1 {
            put(&old.roots.config, "known-senders.txt", &senders(step));
            now += 600;
            old_turn(now);
            step += 1;
        }
        let full = full_round_of(&old);
        put(&old.roots.config, "known-senders.txt", &senders(step));
        old_turn(now + 300);
        let there = || rounds_there(&p.fake.files.join("Documents").join("Sioul"), &old.id);
        let all = there();
        let kept: BTreeSet<u32> = all.iter().copied().filter(|r| *r >= full).collect();
        let past: Vec<String> = all.iter().filter(|r| **r < full).map(|r| format!("{}-{r}.jsonl", old.id)).collect();
        assert!(past.len() >= 3 && kept.len() >= 2, "{all:?}, full {full}");
        // The desk and the phone read it to its end.
        p.turn(true, now + 400);
        p.turn(false, now + 500);
        p.turn(true, now + 600);
        assert!(past.iter().all(|r| p.desk_folder.join(r).exists() && p.phone_folder.join(r).exists()));
        // Forgotten on the desk: out of its copy at once; a sealed file it swept as the dead one's.
        crate::share::forget_device(&p.desk_folder, &KEY, &p.desk.memory, &p.desk.id, &old.id).unwrap();
        p.turn(true, now + 700);
        assert!(past.iter().all(|r| !p.desk_folder.join(r).exists()), "taken out of the desk's copy");
        assert_eq!(there(), all, "still there until the desk's next step");
        let (stale, fresh) = ("c".repeat(64), "d".repeat(64));
        let blobs = p.fake.files.join("Documents").join("Sioul").join("blobs");
        for (name, at) in [(&stale, SystemTime::now() - Duration::from_secs(100 * 86_400)), (&fresh, std::time::UNIX_EPOCH + Duration::from_secs(now as u64))] {
            put(&blobs, name, "sealed\n");
            set_mtime(&blobs.join(name), at);
        }
        swept_here(&p.desk, &[&stale, &fresh], now + 700);
        // Its next step: listed, never fetched again, taken out there.
        p.fake.forget_seen();
        let step = p.step(true, now + 800, true);
        assert!(step.problem.is_none(), "{step:?}");
        let seen = p.fake.seen();
        assert!(seen.iter().all(|l| !(l.starts_with("GET ") && (past.iter().any(|r| l.contains(r.as_str())) || l.contains(&stale) || l.contains(&fresh)))), "never fetched again: {seen:?}");
        assert_eq!(there(), kept);
        assert!(!blobs.join(&stale).exists() && blobs.join(&fresh).exists(), "the stale one taken out, the fresh one left");
        assert!(!p.desk_folder.join("blobs").join(&fresh).exists(), "never fetched");
        let deletes: Vec<String> = seen.into_iter().filter(|l| l.starts_with("DELETE ")).collect();
        assert_eq!(deletes.len(), past.len() + 1, "{deletes:?}");
        // The phone still counts it: its copy lets them go once the server has them no more.
        p.turn(false, now + 900);
        assert!(past.iter().all(|r| !p.phone_folder.join(r).exists()));
        assert!(kept.iter().all(|r| p.phone_folder.join(format!("{}-{r}.jsonl", old.id)).exists() && p.desk_folder.join(format!("{}-{r}.jsonl", old.id)).exists()));
    }

    /// "Remove its files" on a device keeping the folder itself: a dead
    /// phone's rounds, every one, and its claim go from the server at the
    /// desk's next step, never fetched again; its entry and its note stay
    /// (forgotten here only, it may still count on the phone); the phone
    /// lets its rounds go from its copy. Back in use, what it writes since
    /// comes as any device's: its last round written on, its claim renewed,
    /// and it counts again.
    #[test]
    fn a_removed_device_s_files_go_from_the_server_in_the_mirror() {
        let p = Pair::new("removed-mirror");
        let login = p.fake.login();
        let old = Device::new(&p.base, "old", PHONE);
        let old_folder = mirror_of(&old.memory);
        let joined = open_with(&login, "Documents/Sioul", TEST).unwrap();
        put_bytes(&old_folder, "seal.toml", joined.seal.as_deref().unwrap());
        begin(&old.memory, &old_folder, &login, &joined, DUE - 7_000).unwrap();
        old.session(&old_folder, |e| e.start(DUE - 6_900));
        let old_turn = |now: i64| {
            let before = step_with(&old.memory, &old_folder, &old.id, &login, now, true, TEST);
            assert!(before.problem.is_none(), "{before:?}");
            old.exchange(&old_folder, now);
            let after = step_with(&old.memory, &old_folder, &old.id, &login, now, false, TEST);
            assert!(after.problem.is_none(), "{after:?}");
        };
        old_turn(DUE - 6_800);
        p.turn(true, DUE - 6_700);
        p.turn(false, DUE - 6_600);
        // A few rounds of its own and a claim; everyone reads them; then it dies.
        let mut now = DUE;
        for step in 0..3 {
            put(&old.roots.config, "known-senders.txt", &senders(step));
            crate::lease::renew(&old_folder, &KEY, "health", &old.id, now, now, false, crate::lease::Rule::FollowsYou, None).unwrap();
            now += 600;
            old_turn(now);
        }
        // Its last change a small one, alone in its last round (the round before is past 32 KiB).
        put(&old.roots.config, "safe-senders.txt", "one@example.org\n");
        old_turn(now + 50);
        p.turn(true, now + 100);
        p.turn(false, now + 200);
        p.turn(true, now + 300);
        let server = p.fake.files.join("Documents").join("Sioul");
        let all = rounds_there(&server, &old.id);
        let claim = format!("leases/health/{}.lease", old.id);
        let (entry, notes) = (format!("devices/{}.device", old.id), format!("{}.toml", old.id));
        assert!(all.len() >= 2 && server.join(&claim).exists() && p.desk_folder.join(&claim).exists(), "{all:?}");
        assert_eq!(rounds_there(&p.desk_folder, &old.id), all);
        // Forgotten on the desk, its files removed.
        crate::share::forget_device(&p.desk_folder, &KEY, &p.desk.memory, &p.desk.id, &old.id).unwrap();
        let removed = crate::share::remove_device_files(&p.desk_folder, &KEY, &p.desk.memory, &p.desk.id, &p.desk.stores(), &old.id, (now + 400) * 1000).unwrap();
        assert_eq!(removed.rounds, all.len(), "{removed:?}");
        assert!(rounds_there(&p.desk_folder, &old.id).is_empty() && !p.desk_folder.join(&claim).exists());
        assert!(p.desk_folder.join(&entry).exists() && p.desk_folder.join(&notes).exists(), "forgotten here only: its entry and its note stay");
        // The desk's next step: taken out there, never fetched again.
        p.fake.forget_seen();
        let step = p.step(true, now + 500, true);
        assert!(step.problem.is_none(), "{step:?}");
        let seen = p.fake.seen();
        assert!(seen.iter().all(|l| !(l.starts_with("GET ") && l.contains(&old.id))), "never fetched again: {seen:?}");
        assert!(rounds_there(&server, &old.id).is_empty(), "every round, its last too: {:?}", rounds_there(&server, &old.id));
        assert!(!server.join(&claim).exists());
        assert!(server.join(&entry).exists() && server.join(&notes).exists());
        // Steps and exchanges on: nothing of it comes back.
        p.turn(true, now + 600);
        p.turn(true, now + 610);
        assert!(rounds_there(&p.desk_folder, &old.id).is_empty() && !p.desk_folder.join(&claim).exists());
        // The phone, which still counts it, lets its rounds go from its copy.
        p.turn(false, now + 700);
        assert!(rounds_there(&p.phone_folder, &old.id).is_empty(), "{:?}", rounds_there(&p.phone_folder, &old.id));
        // Back in use: its last round written on (longer than it was), its claim renewed, its entry said again: they come.
        crate::lease::renew(&old_folder, &KEY, "health", &old.id, now + 800, now + 800, false, crate::lease::Rule::FollowsYou, None).unwrap();
        put(&old.roots.config, "safe-senders.txt", "one@example.org\ntwo@example.org\n");
        old.session(&old_folder, |e| e.start(now + 790));
        old_turn(now + 800);
        // (Its own copy keeps every round of its: those gone there go up again, and stay out until it counts again here.)
        assert!(rounds_there(&server, &old.id).contains(all.iter().max().unwrap()), "its last round, longer, there again");
        assert!(server.join(&claim).exists());
        p.turn(true, now + 900);
        assert!(std::fs::read_to_string(p.desk.roots.config.join("safe-senders.txt")).unwrap_or_default().contains("two@example.org"), "its last round written on, fetched at once");
        put(&old.roots.config, "known-senders.txt", &senders(9));
        old_turn(now + 905);
        p.turn(true, now + 910);
        assert!(!rounds_there(&p.desk_folder, &old.id).is_empty(), "what it wrote since comes");
        assert!(p.desk_folder.join(&claim).exists(), "its claim renewed: fetched");
        assert!(crate::share::removed_devices(&p.desk.memory, &p.desk.id).is_empty(), "it counts again: no longer removed");
        let senders_here = std::fs::read_to_string(p.desk.roots.config.join("known-senders.txt")).unwrap_or_default();
        assert!(senders_here.contains("old-sender-014999@example.org"), "its last change read");
    }

    /// Sioul keeping the folder itself: its own rounds past their time left
    /// on the server (a delete refused, "Send everything again" forgetting
    /// what it sent; the owner's new phone, 17 October 2026) go at its next
    /// step, whatever it remembers sending, and are never brought back into
    /// its copy (`restore`).
    #[test]
    fn own_past_rounds_left_on_the_server_go_in_the_mirror_too() {
        let p = Pair::new("own-past-mirror");
        let server = p.fake.files.join("Documents").join("Sioul");
        let mut left_there: BTreeMap<String, Vec<u8>> = BTreeMap::new();
        let mut now = DUE;
        let mut step = 0;
        // The phone past a full round, the desk reading along.
        while full_round_of(&p.phone) <= 1 {
            put(&p.phone.roots.config, "known-senders.txt", &senders(step));
            now += 600;
            p.turn(false, now);
            for (relative, bytes) in walk(&server).into_iter().filter(|(r, _)| r.starts_with(&p.phone.id) && r.ends_with(".jsonl")) {
                left_there.insert(relative, bytes);
            }
            p.turn(true, now + 30);
            step += 1;
        }
        p.turn(false, now + 60);
        p.turn(false, now + 70);
        let past = crate::share::rounds_past(&p.phone_folder, &p.phone.memory, &p.phone.id, (now + 80) * 1000).unwrap();
        assert!(past > 1, "below {past}");
        assert!(rounds_there(&server, &p.phone.id).iter().all(|r| *r >= past), "{:?}", rounds_there(&server, &p.phone.id));
        // Back there as an older Sioul left them; what it sent forgotten.
        {
            let _turn = p.fake.turn.lock().unwrap();
            for (relative, bytes) in &left_there {
                if !server.join(relative).exists() {
                    put_bytes(&server, relative, bytes);
                    fake::bump(&server.join(relative));
                }
            }
        }
        let below: Vec<u32> = rounds_there(&server, &p.phone.id).into_iter().filter(|r| *r < past).collect();
        assert!(!below.is_empty());
        again_mirror_with(&p.phone.memory, &p.phone_folder, &p.phone.id, &p.fake.login(), now + 90, TEST);
        // Its next step takes them out there, never brings them back here.
        p.fake.forget_seen();
        let pulled = p.step(false, now + 100, true);
        assert!(pulled.problem.is_none(), "{pulled:?}");
        let seen = p.fake.seen();
        assert!(seen.iter().all(|l| !(l.starts_with("GET ") && below.iter().any(|r| l.ends_with(&format!("{}-{r}.jsonl", p.phone.id))))), "never brought back: {seen:?}");
        assert!(rounds_there(&p.phone_folder, &p.phone.id).iter().all(|r| *r >= past));
        assert!(rounds_there(&server, &p.phone.id).iter().all(|r| *r >= past), "{:?}, below {past}", rounds_there(&server, &p.phone.id));
        // Its records go on as before: the desk reads what it writes next.
        put(&p.phone.roots.config, "known-senders.txt", &senders(step + 1));
        p.turn(false, now + 200);
        p.turn(true, now + 230);
        assert!(std::fs::read_to_string(p.desk.roots.config.join("known-senders.txt")).unwrap_or_default().contains(&format!("old-sender-{:06}@example.org", (step + 2) * 1_500 - 1)));
    }

    /// Both devices keeping the folder themselves, notes shared: the desk
    /// writes x, the phone gets it; the desk deletes x, the phone keeps it as
    /// a copy among its earlier versions; once the phone read past the
    /// take-out, the desk frees x's content and takes it off the server.
    /// The time each turn is at, and the content's name.
    fn held_out_of_the_server(p: &Pair, dn: &Path, pn: &Path) -> (String, i64) {
        let turn = |desk: bool, now: i64| {
            let (device, folder) = p.device(desk);
            let before = p.step(desk, now, true);
            assert!(before.problem.is_none(), "{before:?}");
            device.exchange_all_parts(folder, now, if desk { dn } else { pn });
            let after = p.step(desk, now, false);
            assert!(after.problem.is_none(), "{after:?}");
            if p.sealed(desk, now).fetched > 0 {
                device.exchange_all_parts(folder, now, if desk { dn } else { pn });
                let _ = p.step(desk, now, false);
            }
        };
        put(dn, "x.md", "# x, a note put back later\n");
        put(dn, "y.md", "# y, a note that stays\n");
        turn(true, DUE);
        turn(false, DUE + 10);
        turn(false, DUE + 20);
        assert_eq!(std::fs::read_to_string(pn.join("x.md")).unwrap(), "# x, a note put back later\n", "fetched by name, written");
        let x = {
            let path = p.base.join("x-content");
            std::fs::write(&path, "# x, a note put back later\n").unwrap();
            crate::blobs::name(&KEY, &crate::blobs::hash_file(&path).unwrap().0)
        };
        let server = p.fake.files.join("Documents").join("Sioul");
        for copy in [p.desk_folder.join("blobs").join(&x), server.join("blobs").join(&x)] {
            set_mtime(&copy, SystemTime::now() - Duration::from_secs(100 * 86_400));
        }
        std::fs::remove_file(dn.join("x.md")).unwrap();
        turn(true, DUE + 100);
        turn(true, DUE + 800);
        turn(false, DUE + 900);
        assert!(!pn.join("x.md").exists(), "taken out on the phone, kept among its earlier versions");
        // The desk's records go on in a later round, which the phone reads.
        put(&p.desk.roots.config, "known-senders.txt", &senders(1));
        turn(true, DUE + 1000);
        put(&p.desk.roots.config, "known-senders.txt", &senders(2));
        turn(true, DUE + 1100);
        turn(false, DUE + 1200);
        turn(true, DUE + 1300);
        assert!(!server.join("blobs").join(&x).exists(), "freed, off the server");
        assert!(p.phone_folder.join("blobs").join(&x).exists(), "still in the phone's copy, as fetched");
        (x, DUE + 1300)
    }

    /// The desk gets x back once the phone put it back.
    fn the_desk_gets_x_back(p: &Pair, dn: &Path, pn: &Path, mut now: i64) {
        for _ in 0..3 {
            now += 100;
            let _ = p.step(true, now, true);
            p.desk.exchange_all_parts(&p.desk_folder, now, dn);
            let _ = p.step(true, now, false);
            if p.sealed(true, now).fetched > 0 {
                p.desk.exchange_all_parts(&p.desk_folder, now, dn);
                let _ = p.step(true, now, false);
            }
        }
        let _ = pn;
        assert_eq!(std::fs::read_to_string(dn.join("x.md")).unwrap_or_default(), "# x, a note put back later\n", "put back on the phone: back on the desk");
    }

    /// H1 (review of 17 October 2026): a note put back on a device keeping
    /// the folder itself, after its content left the server, reaches the
    /// others. Its copy lets go of the others' sealed files the server no
    /// longer lists (but those it still needs), so that the put back seals
    /// the content again as its own and sends it.
    #[test]
    fn a_note_put_back_in_the_mirror_reaches_the_others_once_its_content_left() {
        let p = Pair::new("mirror-put-back");
        let (dn, pn) = (p.base.join("desk-notes"), p.base.join("phone-notes"));
        let (x, now) = held_out_of_the_server(&p, &dn, &pn);
        // An hour on, the phone's listing of `blobs/` (its ETag changed): x let go, a needed one kept.
        let needed = "e".repeat(64);
        put(&p.phone_folder, &format!("blobs/{needed}"), "a stale copy this device still needs\n");
        {
            let mut state = State::load(&p.phone.memory);
            state.files.insert(format!("blobs/{needed}"), Fetched { etag: String::new(), size: 38 });
            state.save(&p.phone.memory).unwrap();
            let files = p.phone.memory.with_file_name("files.json");
            let mut said: serde_json::Value = serde_json::from_slice(&std::fs::read(&files).unwrap()).unwrap();
            said["needed"].as_array_mut().expect("said by each exchange of this Sioul").push(serde_json::json!(needed));
            std::fs::write(&files, serde_json::to_vec(&said).unwrap()).unwrap();
        }
        let later = now + BLOBS_AGAIN + 100;
        let stepped = p.step(false, later, true);
        assert!(stepped.problem.is_none() && stepped.let_go == 0, "never in a step: {stepped:?}");
        let sealed = p.sealed(false, later);
        assert!(sealed.problem.is_none() && sealed.let_go >= 1 && sealed.freed > 0 && sealed.listed_bytes > 0, "{sealed:?}");
        assert!(!p.phone_folder.join("blobs").join(&x).exists(), "the server no longer has it: let go");
        assert!(p.phone_folder.join("blobs").join(&needed).exists(), "still needed here: kept");
        // The phone puts x back from its earlier versions: sealed again as its own, sent.
        put(&pn, "x.md", "# x, a note put back later\n");
        p.phone.exchange_all_parts(&p.phone_folder, later + 10, &pn);
        let pushed = p.step(false, later + 10, false);
        assert!(pushed.problem.is_none() && pushed.sent > 0, "{pushed:?}");
        let server = p.fake.files.join("Documents").join("Sioul");
        assert!(server.join("blobs").join(&x).exists(), "sent again");
        the_desk_gets_x_back(&p, &dn, &pn, later + 20);
    }

    /// The same, put back before the phone's next listing, its stale copy
    /// still there: the content its own change names is its own now, and its
    /// push sends it where the server no longer has it.
    #[test]
    fn a_note_put_back_in_the_mirror_before_its_listing_reaches_the_others() {
        let p = Pair::new("mirror-put-back-early");
        let (dn, pn) = (p.base.join("desk-notes"), p.base.join("phone-notes"));
        let (x, now) = held_out_of_the_server(&p, &dn, &pn);
        put(&pn, "x.md", "# x, a note put back later\n");
        p.phone.exchange_all_parts(&p.phone_folder, now + 10, &pn);
        let pushed = p.step(false, now + 10, false);
        assert!(pushed.problem.is_none(), "{pushed:?}");
        let server = p.fake.files.join("Documents").join("Sioul");
        assert!(server.join("blobs").join(&x).exists(), "its own now: sent where the server lacked it");
        assert!(crate::share::own_sealed(&p.phone.memory, &p.phone.id).contains_key(&x));
        the_desk_gets_x_back(&p, &dn, &pn, now + 20);
    }

    /// M4 (review of 17 October 2026): `blobs/` read a response at a time,
    /// whatever its size (11,000 names, past the old 4 MiB cap); never in a
    /// step; listed after one only once its ETag changed, an hour at most
    /// after the last listing; its failure fails nothing, and waits its
    /// backoff; what is waited for comes by name meanwhile, whole; the bytes
    /// listed are counted. A listing that ends before its end is no listing.
    #[test]
    fn blobs_are_listed_seldom_whatever_their_number_and_come_by_name() {
        let p = Pair::new("blobs-many");
        let server = p.fake.files.join("Documents").join("Sioul");
        // The stand-in hashes every file below a folder for its ETag before it
        // answers: with 11,000 sealed files, slow on Windows' disks (CI run
        // 39058463904); a real server keeps each folder's ETag.
        let login = p.fake.login();
        let step = |now: i64| step_with(&p.phone.memory, &p.phone_folder, &p.phone.id, &login, now, true, SLOW_STAND_IN);
        let sealed_step = |now: i64| sealed_step_with(&p.phone.memory, &p.phone_folder, &p.phone.id, &login, &KEY, now, false, SLOW_STAND_IN);
        {
            let _turn = p.fake.turn.lock().unwrap();
            for n in 0..11_000 {
                put(&server, &format!("blobs/{n:064x}"), "s");
            }
        }
        let lists = |seen: &[String]| seen.iter().filter(|l| l.starts_with("PROPFIND ") && l.split(' ').nth(1).is_some_and(|path| path.ends_with("/blobs"))).count();
        // A whole step: never a listing of blobs/; the sealed step after it lists it in full, fetches nothing (nothing waits).
        p.fake.forget_seen();
        let stepped = step(DUE + 100_000);
        assert!(stepped.problem.is_none() && lists(&p.fake.seen()) == 0, "never in a step: {stepped:?}");
        let sealed = sealed_step(DUE + 100_000);
        assert!(sealed.problem.is_none() && !sealed.listing_failed, "{sealed:?}");
        assert!(sealed.listed >= 11_000 && sealed.listed_bytes > 4 << 20, "past the old cap: {sealed:?}");
        assert_eq!(sealed.fetched, 0, "none waited for: none fetched");
        assert_eq!(lists(&p.fake.seen()), 1);
        // A new sealed file there: not listed again within the hour; fetched by its name once waited for.
        let source = p.base.join("medium.bin");
        std::fs::write(&source, "a medium\n".repeat(100)).unwrap();
        let (hash, _) = crate::blobs::hash_file(&source).unwrap();
        let elsewhere = p.base.join("elsewhere");
        crate::blobs::put(&elsewhere, &KEY, &source, &hash).unwrap();
        let name = crate::blobs::name(&KEY, &hash);
        let sealed_bytes = std::fs::read(elsewhere.join("blobs").join(&name)).unwrap();
        put_bytes(&server, &format!("blobs/{name}"), &sealed_bytes);
        crate::blobs::Wanted::change(&p.phone.memory, |w| {
            w.media.insert(name.clone(), crate::blobs::Want { hash: hash.clone(), size: sealed_bytes.len() as u64, since: DUE, ..Default::default() });
        })
        .unwrap();
        p.fake.forget_seen();
        let _ = step(DUE + 100_600);
        let sealed = sealed_step(DUE + 100_600);
        assert!(sealed.problem.is_none(), "{sealed:?}");
        assert_eq!(lists(&p.fake.seen()), 0, "within the hour: not listed again");
        assert!(p.phone_folder.join("blobs").join(&name).exists() && sealed.fetched == 1, "fetched by its name: {sealed:?}");
        assert!(State::load(&p.phone.memory).files.contains_key(&format!("blobs/{name}")), "as fetched: never sent as its own");
        // One that does not open whole is never kept.
        let other = "f".repeat(64);
        put(&server, &format!("blobs/{other}"), "not what it should be");
        crate::blobs::Wanted::change(&p.phone.memory, |w| {
            w.media.insert(other.clone(), crate::blobs::Want { hash: hash.clone(), size: 21, since: DUE, ..Default::default() });
        })
        .unwrap();
        let sealed = sealed_step(DUE + 100_700);
        assert!(sealed.held == 1 && !p.phone_folder.join("blobs").join(&other).exists(), "{sealed:?}");
        // An hour on, its ETag changed: listed again; the listing fails: nothing else fails, tried again after its backoff.
        p.fake.fault(move |r| (r.method == "PROPFIND" && r.path.ends_with("/blobs")).then_some(Fault::Status(500)));
        let _ = step(DUE + 100_000 + BLOBS_AGAIN + 10);
        let sealed = sealed_step(DUE + 100_000 + BLOBS_AGAIN + 10);
        assert!(sealed.listing_failed && sealed.let_go == 0, "{sealed:?}");
        p.fake.forget_seen();
        let sealed = sealed_step(DUE + 100_000 + BLOBS_AGAIN + 70);
        assert!(!sealed.listing_failed && lists(&p.fake.seen()) == 0, "its backoff: not asked again: {sealed:?}");
        p.fake.clear_faults();
        let _ = step(DUE + 100_000 + 3 * BLOBS_AGAIN);
        let sealed = sealed_step(DUE + 100_000 + 3 * BLOBS_AGAIN);
        assert!(sealed.problem.is_none() && !sealed.listing_failed && sealed.listed >= 11_002, "{sealed:?}");
        assert!(p.phone_folder.join("blobs").join(&name).exists(), "still listed there: kept");
    }

    /// A note written here with the same bytes as another device's note,
    /// whose sealed file this copy fetched: that content is this device's own
    /// now, and goes up only where the server no longer has it: one look
    /// (`Depth: 0`), never sent while it is there, nor looked at again
    /// (review of 17 October 2026, H1).
    #[test]
    fn a_content_fetched_and_named_here_is_sent_only_where_the_server_lacks_it() {
        let p = Pair::new("mirror-same-bytes");
        let (dn, pn) = (p.base.join("desk-notes"), p.base.join("phone-notes"));
        let turn = |desk: bool, now: i64| {
            let (device, folder) = p.device(desk);
            let notes = if desk { &dn } else { &pn };
            assert!(p.step(desk, now, true).problem.is_none());
            device.exchange_all_parts(folder, now, notes);
            assert!(p.step(desk, now, false).problem.is_none());
            if p.sealed(desk, now).fetched > 0 {
                device.exchange_all_parts(folder, now, notes);
                let _ = p.step(desk, now, false);
            }
        };
        put(&dn, "y.md", "# the same bytes in two notes\n");
        turn(true, DUE);
        turn(false, DUE + 10);
        turn(false, DUE + 20);
        assert_eq!(std::fs::read_to_string(pn.join("y.md")).unwrap_or_default(), "# the same bytes in two notes\n");
        put(&pn, "z.md", "# the same bytes in two notes\n");
        p.phone.exchange_all_parts(&p.phone_folder, DUE + 30, &pn);
        p.fake.forget_seen();
        let pushed = p.step(false, DUE + 30, false);
        assert!(pushed.problem.is_none(), "{pushed:?}");
        let seen = p.fake.seen();
        assert!(seen.iter().all(|l| !(l.starts_with("PUT ") && l.contains("/blobs/"))), "there already: never sent: {seen:?}");
        assert!(seen.iter().any(|l| l.starts_with("PROPFIND ") && l.contains("/blobs/")), "looked at, once: {seen:?}");
        p.fake.forget_seen();
        let _ = p.step(false, DUE + 40, false);
        assert!(p.fake.seen().iter().all(|l| !l.contains("/blobs/")), "{:?}", p.fake.seen());
    }

    /// This device's own sealed file lost on the server (taken out by hand,
    /// a backup restored there): the next listing of `blobs/` finds it gone
    /// there, and the push after it sends it again.
    #[test]
    fn an_own_sealed_file_lost_on_the_server_goes_up_again() {
        let p = Pair::new("own-lost");
        let source = p.base.join("note.md");
        std::fs::write(&source, "a note\n".repeat(100)).unwrap();
        let (hash, _) = crate::blobs::hash_file(&source).unwrap();
        crate::blobs::put(&p.desk_folder, &KEY, &source, &hash).unwrap();
        let name = crate::blobs::name(&KEY, &hash);
        let there = p.fake.files.join("Documents/Sioul/blobs").join(&name);
        p.turn(true, DUE + 10);
        p.turn(true, DUE + 20);
        assert!(there.exists(), "sent");
        std::fs::remove_file(&there).unwrap();
        // Within the hour: not listed again; nothing known lost.
        p.turn(true, DUE + 30);
        assert!(!there.exists());
        // An hour on, its ETag changed: listed, found gone there; the next push sends it again.
        p.turn(true, DUE + 30 + BLOBS_AGAIN);
        p.turn(true, DUE + 40 + BLOBS_AGAIN);
        assert!(there.exists(), "sent again");
    }

    /// A listing whose answer ends before its end is no listing: an error,
    /// never a part taken for the whole.
    #[test]
    fn a_listing_cut_short_is_no_listing() {
        let entry = |href: &str, kind: &str| format!("<d:response><d:href>{href}</d:href><d:propstat><d:prop>{kind}<d:getetag>&quot;e&quot;</d:getetag></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat></d:response>");
        let whole = fake::multistatus(&format!("{}{}", entry("/dav/blobs/", "<d:resourcetype><d:collection/></d:resourcetype>"), entry("/dav/blobs/a", "<d:resourcetype/>")));
        let (listing, bytes) = read_listing(&whole[..], "https://example.org/dav/blobs/").unwrap();
        assert!(listing.items.contains_key("a") && bytes == whole.len() as u64);
        let cut = &whole[..whole.len() - "</d:multistatus>".len()];
        assert!(read_listing(cut, "https://example.org/dav/blobs/").is_err());
        // End tags may carry spaces before their `>`, as XML allows: read as any (review of 18 October 2026, L-6).
        let spaced = String::from_utf8(whole.clone()).unwrap().replace("</d:response>", "</d:response >").replace("</d:multistatus>", "</d:multistatus\r\n>");
        let (listing, _) = read_listing(spaced.as_bytes(), "https://example.org/dav/blobs/").unwrap();
        assert!(listing.items.contains_key("a"), "{listing:?}");
        // The folder's own answer missing: what it holds cannot be told whole (L-1).
        let without = fake::multistatus(&entry("/dav/blobs/a", "<d:resourcetype/>"));
        assert!(read_listing(&without[..], "https://example.org/dav/blobs/").is_err());
    }

    /// L-1 (review of 18 October 2026): a listing of `blobs/` that leaves
    /// files out (a server restored from an older backup) never makes the
    /// phone let go of a content its current records name, those of the
    /// notes it holds after deleting them many at once among them: its "Put
    /// them back" still works.
    #[test]
    fn a_listing_that_leaves_files_out_never_takes_what_records_name() {
        let p = Pair::new("mirror-short-listing");
        let (dn, pn) = (p.base.join("desk-notes"), p.base.join("phone-notes"));
        let turn = |desk: bool, now: i64| {
            let (device, folder) = p.device(desk);
            let notes = if desk { &dn } else { &pn };
            assert!(p.step(desk, now, true).problem.is_none());
            device.exchange_all_parts(folder, now, notes);
            assert!(p.step(desk, now, false).problem.is_none());
            if p.sealed(desk, now).fetched > 0 {
                device.exchange_all_parts(folder, now, notes);
                let _ = p.step(desk, now, false);
            }
        };
        put(&dn, "today.md", "# today\n");
        for n in 0..12 {
            put(&dn, &format!("trip/{n}.md"), &format!("# day {n} of the trip\n"));
        }
        turn(true, DUE);
        turn(false, DUE + 10);
        assert_eq!(walk(&pn).len(), 13, "all here");
        // Deleted many at once on the phone: held there.
        std::fs::remove_dir_all(pn.join("trip")).unwrap();
        let held = p.phone.exchange_all_parts(&p.phone_folder, DUE + 20, &pn);
        assert!(held.withheld.as_ref().is_some_and(|w| w.iter().any(|w| w.count == 12)), "{held:?}");
        // An hour on, the server lists none of those sealed files (an older backup put back there).
        let server_blobs = p.fake.files.join("Documents").join("Sioul").join("blobs");
        let aside = p.base.join("blobs-aside");
        std::fs::rename(&server_blobs, &aside).unwrap();
        put(&server_blobs, &"0".repeat(64), "another device's");
        let now = DUE + 30 + BLOBS_AGAIN;
        assert!(p.step(false, now, true).problem.is_none());
        let sealed = p.sealed(false, now);
        assert!(sealed.listed > 0 && sealed.let_go == 0, "every content a record names kept: {sealed:?}");
        let back = crate::share::put_back_withheld(&p.phone_folder, &KEY, &p.phone.memory, &p.phone.id, &p.phone.all_parts(&pn), "files/notes/");
        assert_eq!(back, Ok(crate::share::PutBack { back: 12, held: 12 }));
        std::fs::remove_dir_all(&server_blobs).unwrap();
        std::fs::rename(&aside, &server_blobs).unwrap();
    }

    /// L-2 (review of 18 October 2026): a phone keeping the folder itself,
    /// whose background reads no notes (`files: false`), asks for the
    /// others' new notes' contents all the same; its sealed step brings
    /// them; the window, opened offline, writes them.
    #[test]
    fn the_background_asks_for_new_notes_and_the_window_writes_them_offline() {
        let p = Pair::new("mirror-background");
        let (dn, pn) = (p.base.join("desk-notes"), p.base.join("phone-notes"));
        let desk_turn = |now: i64| {
            assert!(p.step(true, now, true).problem.is_none());
            p.desk.exchange_all_parts(&p.desk_folder, now, &dn);
            assert!(p.step(true, now, false).problem.is_none());
        };
        put(&dn, "a.md", "# a\n");
        desk_turn(DUE);
        // The phone's window reads them once.
        assert!(p.step(false, DUE + 10, true).problem.is_none());
        p.phone.exchange_all_parts(&p.phone_folder, DUE + 10, &pn);
        let _ = p.sealed(false, DUE + 10);
        p.phone.exchange_all_parts(&p.phone_folder, DUE + 10, &pn);
        assert_eq!(std::fs::read_to_string(pn.join("a.md")).unwrap_or_default(), "# a\n");
        // The desk writes a note; the phone's background step: its records, a quick exchange, its sealed step.
        put(&dn, "b.md", "# b, written while the phone was put away\n");
        desk_turn(DUE + 100);
        assert!(p.step(false, DUE + 200, true).problem.is_none());
        let quick = p.phone.exchange_parts(&p.phone_folder, DUE + 200, &pn, false);
        assert!(quick.waits.contains_key("not-read") && !pn.join("b.md").exists(), "{quick:?}");
        let sealed = p.sealed(false, DUE + 200);
        assert_eq!(sealed.fetched, 1, "asked for, and brought: {sealed:?}");
        // The window opened offline: nothing asked of the server; its exchange writes it.
        p.fake.fault(|_| Some(Fault::Drop));
        p.phone.exchange_all_parts(&p.phone_folder, DUE + 300, &pn);
        assert_eq!(std::fs::read_to_string(pn.join("b.md")).unwrap_or_default(), "# b, written while the phone was put away\n");
    }

    /// L-4 (review of 18 October 2026): sealed files that came are put in
    /// place together, the state written once for them; never over a file
    /// there.
    #[test]
    fn sealed_files_that_came_are_placed_together_never_over_one_there() {
        let p = Pair::new("mirror-place");
        let blobs = p.phone_folder.join("blobs");
        std::fs::create_dir_all(&blobs).unwrap();
        let ready: Vec<(String, PathBuf, u64)> = (0..3)
            .map(|n| {
                let came = blobs.join(format!(".came-{n}"));
                std::fs::write(&came, format!("sealed {n}")).unwrap();
                (format!("blobs/{n:064x}"), came, 8)
            })
            .collect();
        put(&p.phone_folder, &format!("blobs/{:064x}", 1), "sealed here meanwhile");
        assert_eq!(place_fetched(&p.phone.memory, &p.phone_folder, &p.fake.login().account, &ready), vec![true, false, true]);
        let state = State::load(&p.phone.memory);
        assert!(state.files.contains_key(&ready[0].0) && !state.files.contains_key(&ready[1].0) && state.files.contains_key(&ready[2].0));
        assert_eq!(std::fs::read_to_string(blobs.join(format!("{:064x}", 1))).unwrap(), "sealed here meanwhile");
    }

    /// L-7 (review of 18 October 2026): "Send everything again" while
    /// `blobs/` cannot be listed asks each of this device's sealed files of
    /// the server itself, and sends again the one it lost.
    #[test]
    fn send_everything_again_finds_a_sealed_file_lost_while_blobs_cannot_be_listed() {
        let w = World::new("again-unlisted");
        assert!(w.find(DUE).confirmed_for(&w.phone_folder));
        let source = w.base.join("note.md");
        std::fs::write(&source, "a note\n".repeat(50)).unwrap();
        let (hash, _) = crate::blobs::hash_file(&source).unwrap();
        crate::blobs::put(&w.phone_folder, &KEY, &source, &hash).unwrap();
        let name = crate::blobs::name(&KEY, &hash);
        let size = std::fs::metadata(w.phone_folder.join("blobs").join(&name)).unwrap().len();
        let whole: BTreeMap<String, u64> = [(name.clone(), size)].into();
        assert!(send_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), &whole, DUE + 10, false, TEST).problem.is_none());
        let there = w.server.join("blobs").join(&name);
        assert!(there.exists());
        std::fs::remove_file(&there).unwrap();
        w.fake.fault(|r| (r.method == "PROPFIND" && r.path.ends_with("/blobs")).then_some(Fault::Status(500)));
        let again = send_with(&w.phone.memory, &w.phone_folder, &w.phone.id, &w.fake.login(), &whole, DUE + 20, true, TEST);
        assert!(again.listing_failed && there.exists(), "asked of the server itself, sent again: {again:?}");
    }

    /// On a metered or slow connection, the mirror's sealed files of a
    /// megabyte or more come one at a time, ten minutes apart, as the
    /// sending paces them (review of 18 October 2026, L-2's battery).
    #[test]
    fn large_sealed_files_are_paced_on_a_frugal_connection() {
        let p = Pair::new("mirror-frugal");
        crate::blobs::Wanted::change(&p.phone.memory, |w| {
            for n in 0..2 {
                w.blobs.insert(format!("{n:064x}"), crate::blobs::Want { hash: "h".into(), size: 2 << 20, since: DUE, ..Default::default() });
            }
        })
        .unwrap();
        let gets = |p: &Pair| p.fake.seen().iter().filter(|l| l.starts_with("GET ") && l.contains("/blobs/")).count();
        let login = p.fake.login();
        p.fake.forget_seen();
        let frugal = sealed_step_with(&p.phone.memory, &p.phone_folder, &p.phone.id, &login, &KEY, DUE + 10, true, TEST);
        assert!(gets(&p) == 1 && frugal.paced == 1, "one large at a time: {frugal:?}");
        p.fake.forget_seen();
        let _ = sealed_step_with(&p.phone.memory, &p.phone_folder, &p.phone.id, &login, &KEY, DUE + 20, true, TEST);
        assert_eq!(gets(&p), 0, "the next within ten minutes waits");
        let _ = sealed_step_with(&p.phone.memory, &p.phone_folder, &p.phone.id, &login, &KEY, DUE + 20 + PACE, true, TEST);
        assert!(gets(&p) >= 1, "ten minutes on, the next");
    }

    /// L-8 (review of 18 October 2026): a text's medium asked for in vain is
    /// asked within five minutes in its first hour, then less often, and no
    /// more after three days, until the texts' page asks for it again.
    #[test]
    fn a_medium_never_there_is_asked_three_days_then_left() {
        let p = Pair::new("mirror-media");
        let name = "e".repeat(64);
        crate::blobs::Wanted::change(&p.phone.memory, |w| {
            w.media.insert(name.clone(), crate::blobs::Want { hash: "h".into(), size: 10, since: DUE, ..Default::default() });
        })
        .unwrap();
        let asked = |p: &Pair| p.fake.seen().iter().filter(|l| l.starts_with("GET ") && l.contains(name.as_str())).count();
        p.fake.forget_seen();
        let _ = p.sealed(false, DUE + 10);
        let _ = p.sealed(false, DUE + 10 + WANTED_AGAIN);
        assert_eq!(asked(&p), 2, "twice in its first five minutes");
        // A day on, an hour of sealed steps a minute apart: its backoff grows past five minutes.
        p.fake.forget_seen();
        for minute in 0..60 {
            let _ = p.sealed(false, DUE + 86_400 + minute * 60);
        }
        assert!(asked(&p) <= 4, "less often than every five minutes: {}", asked(&p));
        // Three days on: asked no more.
        p.fake.forget_seen();
        for at in [DUE + 3 * 86_400 + 10, DUE + 3 * 86_400 + 4_000, DUE + 4 * 86_400] {
            let _ = p.sealed(false, at);
        }
        assert_eq!(asked(&p), 0, "left");
        // The page asks for it again (`texts::ask_media_again`): asked again.
        crate::blobs::Wanted::change(&p.phone.memory, |w| {
            if let Some(want) = w.media.get_mut(&name) {
                (want.since, want.again, want.tries) = (DUE + 4 * 86_400 + 60, 0, 0);
            }
        })
        .unwrap();
        let _ = p.sealed(false, DUE + 4 * 86_400 + 120);
        assert_eq!(asked(&p), 1, "asked again");
    }
}