sioul_sync/

share.rs

// SPDX-License-Identifier: GPL-3.0-or-later
// Copyright © 2026 Aurélien Pierre

//! What only this computer keeps, shared with your other computers through a
//! folder your sync already carries: Nextcloud, Dropbox, Syncthing
//! (docs/database.md, "The log").
//!
//! Mail, contacts, the agenda and tasks travel by their servers; projects and
//! notes by the folder that holds them. The rest lives in small files here:
//! settings, who may write to you, ties, time, drafts, health, lists kept
//! on this computer. Each computer has a name, a UUID made once,
//! and appends each change it finds in them, as one sealed record, to its own
//! file in the folder (`<computer>-<round>.jsonl`): one writer per file, so
//! the sync never makes conflicted copies.
//!
//! Files stay the truth: Sioul reads and writes them as before. A change is
//! found by comparing them with what they held at the last look; a record from
//! another computer is written into them. For each entry (a setting, a line of
//! a list, a session, a whole file) the record with the later clock wins: a
//! hybrid logical clock, the time made strictly increasing here and never
//! behind a record already read. A change is dated by its file's time, so a
//! change made here before another computer's, but found after, still loses.
//!
//! Sealed: each record is encrypted here (XChaCha20-Poly1305) with a key made
//! from a passphrase (Argon2id) and kept in each computer's keyring. The
//! folder and its server see which computer wrote, when and how much, never
//! what.
//!
//! What is shared comes in parts (`PARTS`: settings, senders, the spam
//! filter's table and label logs, health, time, drafts, projects, lists,
//! notes, papers), each switched on or off on each device. Notes and papers travel
//! one file at a time, each sealed apart in the folder (`blobs`), their
//! records saying which content each file holds; two devices changing one
//! file keep both versions. The spam filter's table is sealed apart too: one
//! file of a few megabytes, read in every exchange (`SPAM_TABLE`). Before another
//! device's change is written into a file here, the file as it was is kept on
//! this device (`history`), to be put back.

use base64::Engine;
use base64::engine::general_purpose::STANDARD as B64;
use chacha20poly1305::aead::rand_core::RngCore;
use chacha20poly1305::aead::{Aead, AeadCore, KeyInit, OsRng, Payload};
use chacha20poly1305::{XChaCha20Poly1305, XNonce};
use serde::{Deserialize, Serialize};
use sioul_core::config::Config;
use std::collections::{BTreeMap, BTreeSet};
use std::io::Write;
use std::path::{Path, PathBuf};

/// The keyring's name for the key made from the passphrase.
pub const KEY_NAME: &str = "Sharing key";

/// Between the parts of a setting's name.
const SEP: char = '\u{1f}';
/// Before an element's identity, in a list split by elements.
const MARK: char = '\u{1e}';
/// Files larger than this stay here.
const LARGEST: u64 = 16 << 20;
/// What a computer appends past its last full round before it opens a new
/// one, restating every entry it holds (`new_round`): old rounds can then go.
const ROUND_SIZE: u64 = 1 << 20;
/// A computer's file past this size is continued in a new round of its own,
/// nothing restated (docs/database.md, "The log"): a server sent the file whole
/// at each change (WebDAV has no append) is sent a small one, never the opening
/// of a full round (on a computer, a megabyte or two) again and again.
const SEGMENT: u64 = 32 << 10;
/// While the connection is metered, or measured slow (`set_frugal`), a full
/// round, a megabyte or two sent at once, waits, as long as this computer
/// appended less than this since the last one.
const FRUGAL_ROUND_SIZE: u64 = 4 << 20;

/// The sharings (by their memory) whose connection is metered or slow: full
/// rounds wait there (`FRUGAL_ROUND_SIZE`).
static FRUGAL: std::sync::Mutex<BTreeSet<PathBuf>> = std::sync::Mutex::new(BTreeSet::new());

/// Said by the window before its exchanges: the connection is metered, or
/// measured slow (`remote::Sending::slow`); a full round, sent whole, then
/// waits for a better one, within `FRUGAL_ROUND_SIZE`. `memory`: the sharing's.
pub fn set_frugal(memory: &Path, on: bool) {
    if let Ok(mut frugal) = FRUGAL.lock() {
        if on {
            frugal.insert(memory.to_path_buf());
        } else {
            frugal.remove(memory);
        }
    }
}

fn frugal(memory: &Path) -> bool {
    FRUGAL.lock().is_ok_and(|f| f.contains(memory))
}

/// While a bulk import goes on (`set_importing`), full rounds wait until this
/// device appended this much since the last one: the import's records go out
/// once, in the rounds that continue the last full one, and a single full
/// round follows the import, not one every few megabytes of it.
const IMPORT_ROUND_SIZE: u64 = 64 << 20;

/// The sharings (by their memory) whose device imports in bulk now (`set_importing`).
static IMPORTING: std::sync::Mutex<BTreeSet<PathBuf>> = std::sync::Mutex::new(BTreeSet::new());

/// Said before each exchange, by the background step and the window alike:
/// a bulk import goes on here (a phone's first import of its texts, or one
/// it fell behind in), so that no full round restating every record starts
/// meanwhile (`IMPORT_ROUND_SIZE`). On 8 October 2026 a first import of
/// 10 MB of texts made six full rounds, 63 MB in all, each sent twice.
pub fn set_importing(memory: &Path, on: bool) {
    if let Ok(mut importing) = IMPORTING.lock() {
        if on {
            importing.insert(memory.to_path_buf());
        } else {
            importing.remove(memory);
        }
    }
}

fn importing(memory: &Path) -> bool {
    IMPORTING.lock().is_ok_and(|i| i.contains(memory))
}
/// A device finding its own file ahead of its memory twice within this
/// (milliseconds) shares its name with another device (`share-twin`).
const TWIN_WITHIN: i64 = 6 * 60 * 60_000;
/// Entries taken out are remembered this long, so an old copy does not bring
/// them back, and each full round restates them (`new_round`): as long as a
/// device may be away and still count (`SILENT_DAYS`). A device you forgot,
/// or one another replaces, no longer holds the others' rounds back; back
/// within that time, it counts again and reads from a full round, which
/// must still say what was taken out meanwhile (but the lines of the logs
/// every device ages out by itself: `AGED_TOMBSTONE_DAYS`). Until 17 October
/// 2026 it was 90 days, and such a device back after more than 90 days kept
/// for good what the others had taken out (review of 17 October 2026, M1).
const TOMBSTONE_DAYS: i64 = SILENT_DAYS;
const _: () = assert!(TOMBSTONE_DAYS >= SILENT_DAYS);
/// The lines of the logs every device ages out by itself (`ages_out`) taken
/// out are remembered this long, past the longest one of them keeps a line
/// anywhere (its writer `KEPT_DAYS`, the others `LATE_DAYS` more): a line
/// older than that is never shown and goes by itself on a device back after
/// longer. They are many, a line for each call and for each message of the
/// phone's, each a few hundred bytes (a message's padded), its whole line its
/// name, and each full round restates them: 90 days, as before 17 October 2026.
const AGED_TOMBSTONE_DAYS: i64 = 90;
const _: () = assert!(
    AGED_TOMBSTONE_DAYS > sioul_core::calls::KEPT_DAYS + sioul_core::calls::LATE_DAYS
        && AGED_TOMBSTONE_DAYS > sioul_core::phonemsgs::KEPT_DAYS + sioul_core::phonemsgs::LATE_DAYS
        && AGED_TOMBSTONE_DAYS > sioul_core::texts::KEPT_DAYS + sioul_core::texts::LATE_DAYS
);
/// A computer silent this long no longer holds back the removal of old rounds.
const SILENT_DAYS: i64 = 180;
/// How long a file must stay empty, or gone, before its entries count as taken
/// out: one being written, a full disk or a crash never takes everything out
/// everywhere at once.
const EMPTIED_WAIT: i64 = 10 * 60_000;
/// Notes or papers gone many at once from a folder still there (deleted in
/// bulk, a folder moved within the notes): held this long from when they
/// went (`Sealed::gone`), said on the Porch with "Put them back" and "Take
/// them out now" (`withheld`), then taken out everywhere by themselves,
/// unless they came back. Nothing has to be pressed (until 17 October 2026,
/// they waited for "Take them out everywhere", however long that took). Two
/// weeks, as replaced contents stay (`blobs::UNUSED_DAYS`).
const GONE_GRACE: i64 = GONE_GRACE_DAYS * DAY;
/// The same in days, for the window to say.
pub const GONE_GRACE_DAYS: i64 = crate::blobs::UNUSED_DAYS;

/// How long a round waits for the end of the round before (`Turn`), which a
/// sync app may bring late, before that end is taken for lost: an hour
/// (milliseconds) of exchanges, time asleep left out (`AWAIT_STEP`). Then the
/// gap is said, the doses doubt what that computer marked until its next
/// full round, and its later records are read.
const AWAITED: i64 = 60 * 60_000;

/// The most one exchange counts of the wait (`AWAITED`): the time since the
/// one before, five minutes at most (milliseconds). A device asleep, or
/// closed, counts none of that time: woken, its sync app may not have
/// brought the round's end yet, and passing the round over then would ask
/// for a full round for nothing (on a phone, megabytes of its texts: review
/// of 10 October 2026, third pass).
const AWAIT_STEP: i64 = 5 * 60_000;

/// The longest a full round owed or asked for (`Memory::owed`) waits for a
/// connection not metered: six hours of exchanges, counted as `AWAITED` is
/// (milliseconds). A phone always on mobile data, which marks most doses,
/// would otherwise leave the others saying "check" on its doses for days
/// after one damaged line, until 4 MiB of growth.
const OWED_METERED: i64 = 6 * 60 * 60_000;
/// A line of a computer's records longer than this is none (the longest, a
/// file whole of 16 MiB sealed in a line, is about 30 MiB): skipped as broken.
const LONGEST_LINE: usize = 32 << 20;
/// Records are read this much at a time, never a whole file.
const READ_CHUNK: usize = 8 << 20;
/// More files sealed apart than this gone from a folder at once (or three and
/// more, past a fifth of it) are held, said, until you say to take them out.
const MASS: usize = 10;
const MINUTE: i64 = 60_000;
const HOUR: i64 = 60 * MINUTE;
const DAY: i64 = 24 * HOUR;

/// The beginning of the names of folders whose files are sealed apart (`Shape::Files`).
const FILES: &str = "files/";

/// How a file divides into entries.
#[derive(Debug, Clone, Copy)]
pub enum Shape {
    /// The file whole: a draft, an invoice.
    Whole,
    /// One entry per line: the sender lists.
    Lines,
    /// One entry per setting of a TOML file.
    Toml(&'static Rules),
    /// The file whole, sealed apart in the folder (`blobs`), its record saying
    /// which content it holds: notes, papers, their pictures and PDFs; the
    /// spam filter's table, a single file (`SPAM_TABLE`).
    Files,
}

/// How a TOML file divides, beyond one entry per setting.
#[derive(Debug)]
pub struct Rules {
    /// Lists whose elements are entries.
    pub keyed: &'static [Keyed],
    /// Tables shared whole, their fields together; `*` stands for any name.
    pub whole: &'static [&'static str],
    /// Settings that stay on each computer.
    pub local: &'static [&'static str],
    /// How the file divides in format 2 (`FORMAT`), when it differs: its
    /// lists named by ids, lists shared whole until then divided element by
    /// element. A device writes it once every device in the sharing reads it
    /// (`format_open`); until then, these rules (format 1), which an older
    /// Sioul reads.
    pub next: Option<&'static Rules>,
}

impl Rules {
    /// The rules of a file in a format: format 2's from 2 on, when they differ.
    pub fn at(&'static self, format: u32) -> &'static Rules {
        match self.next {
            Some(next) if format >= 2 => next,
            _ => self,
        }
    }
}

/// A list whose elements are entries, each named by some of its fields (none:
/// the element itself), less the fields that stay on each computer.
#[derive(Debug)]
pub struct Keyed {
    /// Its name; within tables, its path, `*` standing for any name
    /// (`words.*.*.add`: each list's words you added).
    pub list: &'static str,
    pub by: &'static [&'static str],
    pub local: &'static [&'static str],
    /// Other names the list may have in a file, its entries the same: the
    /// records always say `list`, and a file keeps the name it has. A file
    /// with neither, of another name than its record's, takes the first.
    pub also: &'static [&'static str],
    /// Format 2: each element named by its own `id`, given when it is made
    /// (`sioul_core::ids`), so that it stays one element whatever changes in
    /// it; an element without one (made by an older Sioul, or by hand) by an
    /// id derived from what it holds, the same on every device (`names`).
    /// `by` then says how format 1 named them, to read its records.
    pub ids: bool,
}

/// A keyed list as format 1 names its elements: by `by`, or by themselves.
const fn keyed(list: &'static str, by: &'static [&'static str]) -> Keyed {
    Keyed { list, by, local: &[], also: &[], ids: false }
}

/// A keyed list whose elements are named by their ids (format 2); `by`: as format 1 named them.
const fn with_ids(list: &'static str, by: &'static [&'static str]) -> Keyed {
    Keyed { list, by, local: &[], also: &[], ids: true }
}

/// Where things are on this computer, and how text reads on its screen.
const CONFIG_LOCAL: &[&str] = &["case_store", "known_senders", "blocked_senders", "reading", "history_weeks", "letters.inbox", "dnd.background"];
static CONFIG_RULES: Rules = Rules { keyed: &[Keyed { list: "account", by: &["id"], local: &["maildir", "history_weeks"], also: &[], ids: false }], whole: &[], local: CONFIG_LOCAL, next: Some(&CONFIG_RULES_2) };
/// Format 2: pinned sites, routines and task kinds one each, by their ids;
/// days off one each; the words you added to a list and those you took
/// away, one each (docs/words.md). Until then each of these lists travels
/// whole, and two devices adding to one in the same exchange keep only the
/// later list.
static CONFIG_RULES_2: Rules = Rules {
    keyed: &[
        Keyed { list: "account", by: &["id"], local: &["maildir", "history_weeks"], also: &[], ids: false },
        with_ids("site", &["id"]),
        with_ids("routine", &["id"]),
        with_ids("tasks.kind", &["id"]),
        with_ids("time_off", &[]),
        keyed("words.*.*.add", &[]),
        keyed("words.*.*.remove", &[]),
        // A named list's names and their words: `add = { "Ma Banque" = ["mabanque.example"] }`.
        keyed("words.*.*.add.*", &[]),
    ],
    whole: &[],
    local: CONFIG_LOCAL,
    next: None,
};
static HEALTH_RULES: Rules = Rules {
    keyed: &[keyed("prescription", &["id"]), keyed("medicine", &["id"])],
    whole: &[],
    // An older Sioul's folder of a watch's files (until 8 October 2026), a
    // path on its own computer: never carried, as before.
    local: &["watch_folder"],
    next: None,
};
static LINKS_RULES: Rules = Rules { keyed: &[keyed("link", &[])], whole: &[], local: &[], next: None };
static PORCH_RULES: Rules = Rules { keyed: &[], whole: &["done.*"], local: &[], next: None };
static MONEY_RULES: Rules = Rules { keyed: &[keyed("ignored", &[])], whole: &[], local: &[], next: None };
static TODAY_RULES: Rules = Rules { keyed: &[keyed("aside", &[])], whole: &[], local: &[], next: None };
static TIME_RULES: Rules = Rules { keyed: &[keyed("session", &["start", "task", "project"])], whole: &[], local: &[], next: Some(&TIME_RULES_2) };
/// Format 2: each session by its id, so that one changed on two devices stays
/// one; a session without one by its start, task and project, as before.
static TIME_RULES_2: Rules = Rules { keyed: &[with_ids("session", &["start", "task", "project"])], whole: &[], local: &[], next: None };
/// The hours' overrides and the two pauses (`sioul_core::quiet`); format 2:
/// the lighter days one each, by their date.
static QUIET_RULES: Rules = Rules { keyed: &[], whole: &[], local: &[], next: Some(&QUIET_RULES_2) };
static QUIET_RULES_2: Rules = Rules { keyed: &[keyed("lighter", &[])], whole: &[], local: &[], next: None };
/// How each day went (`sioul_core::reviews`): a date's review at the end of
/// work and the one before sleep travel whole, so that two devices answering
/// the same one keep the later answer, never a mix of both; the weather field by field.
static REVIEWS_RULES: Rules = Rules { keyed: &[], whole: &["*.work", "*.night"], local: &[], next: None };
static PLAIN_RULES: Rules = Rules { keyed: &[], whole: &[], local: &[], next: None };
/// Do-not-disturb's switch (docs/do-not-disturb.md): a table per device, each
/// written by its own device alone, shared whole.
static DND_RULES: Rules = Rules { keyed: &[], whole: &["device.*"], local: &[], next: None };
/// Who may reach you during do-not-disturb: one person each, by its id.
static DND_PEOPLE_RULES: Rules = Rules { keyed: &[keyed("person", &["id"])], whole: &[], local: &[], next: None };
/// Each dose that fell due (`sioul_core::doses`): one entry per field, each
/// device's opening apart, and each device's answer whole, so that two
/// devices never write one entry and an answer never travels in halves.
static DOSES_RULES: Rules = Rules { keyed: &[], whole: &["dose.*.answer.*"], local: &[], next: None };
/// What each device did to remind each dose (`sioul_core::dose_reminders`):
/// each device's entry for a dose written by it alone, and travelling whole,
/// so that a notice said sent and a promise of quiet never travel apart.
static REMINDERS_RULES: Rules = Rules { keyed: &[], whole: &["dose.*.*"], local: &[], next: None };
// Projects and budgets, at the notes folder's root, when they travel here (`share_projects`).
// The projects' records keep their first names, `notes/sioul-cases.toml` and
// `case`, which every version reads; a file renamed `sioul-projects.toml`, its
// tables `[[project]]`, reads and is written under them (`sioul_core::projects`).
static PROJECTS_RULES: Rules = Rules { keyed: &[Keyed { list: "case", by: &["id"], local: &[], also: &["project"], ids: false }], whole: &[], local: &[], next: None };
// The bank's movements: each account by its id, each movement by its account and the bank's own id.
static BANK_RULES: Rules = Rules { keyed: &[keyed("account", &["id"]), keyed("movement", &["account", "id"])], whole: &[], local: &[], next: None };
static LEDGER_RULES: Rules = Rules {
    keyed: &[
        keyed("budget", &["id"]),
        keyed("preset", &["id"]),
        keyed("reserve", &["id"]),
        keyed("bank_account", &["id"]),
        keyed("assign", &["account", "movement"]),
        // No name of their own: each one is itself, so two devices adding some keep both.
        keyed("line", &[]),
        keyed("cover", &[]),
        keyed("mail_rule", &[]),
        keyed("split", &[]),
    ],
    whole: &[],
    local: &[],
    next: Some(&LEDGER_RULES_2),
};
/// Format 2: lines, covers, mail rules, splits and presets each by its id, so
/// that two the same stay two and one changed on two devices stays one; one
/// without an id (made by an older Sioul, or by hand) by an id derived from
/// what it holds.
static LEDGER_RULES_2: Rules = Rules {
    keyed: &[
        keyed("budget", &["id"]),
        with_ids("preset", &["id"]),
        keyed("reserve", &["id"]),
        keyed("bank_account", &["id"]),
        keyed("assign", &["account", "movement"]),
        with_ids("line", &[]),
        with_ids("cover", &[]),
        with_ids("mail_rule", &[]),
        with_ids("split", &[]),
    ],
    whole: &[],
    local: &[],
    next: None,
};
static CONTRACTS_RULES: Rules = Rules { keyed: &[keyed("contract", &["id"])], whole: &[], local: &[], next: None };
static PAPERS_RULES: Rules = Rules { keyed: &[keyed("paper", &["id"])], whole: &[], local: &[], next: None };
/// In the notes folder, what the other parts carry: projects, budgets, the
/// bank, contracts (projects), the papers' wallet and its folder (papers).
const NOT_NOTES: &[&str] = &[
    sioul_core::projects::FILE,
    sioul_core::projects::OLD_FILE,
    sioul_core::projects::BEFORE_RENAME,
    sioul_core::budget::LEDGER,
    sioul_core::bank::MANIFEST,
    sioul_core::contracts::MANIFEST,
    sioul_core::papers::MANIFEST,
    sioul_core::papers::FOLDER,
];

/// The parts of what is shared, each switched on or off on each device
/// (docs/database.md, "Parts"): settings and accounts, senders, the calls
/// your phones screened, the messages from your phones' notifications, the
/// spam filter's table and label logs, health, time, drafts and invoices,
/// projects and money, lists kept here, notes, papers.
/// (texts: the part "texts", SMS phase b, after the phone's messages.)
pub const PARTS: [&str; 13] = ["settings", "senders", "calls", sioul_core::phonemsgs::PART, sioul_core::texts::PART, "spam", "health", "time", "drafts", "projects", "lists", "notes", "papers"];

/// Stores an older Sioul shared and this one no longer has: a Garmin
/// watch's days and the memory of its offers, taken out on 8 October 2026
/// (docs/health.md, "Your watch"). A device on an older version may still
/// send their changes: they are left aside, neither written nor kept
/// waiting, and the rest of the exchange goes on. The files stay where they
/// are on every device. texts: the first build of the texts, never
/// released, kept them in the state folder (`state/texts/`).
const RETIRED: &[&str] = &["data/watch/", "state/watch-offers.json", "state/texts/"];

/// Whether a record's key names a store that left (`RETIRED`).
fn retired(key: &str) -> bool {
    let file = file_of(key);
    RETIRED.iter().any(|store| if store.ends_with('/') { file.starts_with(store) } else { file == *store })
}

/// The phones' logs of the calls they screened (`sioul_core::calls`): each
/// phone writes its own file, a line per call, taken out after a month by
/// that phone alone; every device reads them all, so that a computer's Porch
/// lists what your phones declined. Never a blocked caller's call.
pub const CALLS_LOG: &str = "state/calls/log/";
/// The calls marked Seen, each device's own file, a line per press: seen on
/// one device, gone from the Porch of every device.
pub const CALLS_SEEN: &str = "state/calls/seen/";
/// Where the calls' part keeps its files in the records: remembered beside
/// the notes (`files.json`, not `memory.json`), never kept as an earlier
/// version nor copied aside when sharing starts, so that a call leaves every
/// device after its month (`calls_store`).
const CALLS: &str = "state/calls/";

/// The phones' logs of the messages their notifications brought
/// (`sioul_core::phonemsgs`), for the apps you switched on there: each phone
/// writes its own file, a line per message, padded, taken out after a week
/// by that phone alone; every device reads them all, so that a computer's
/// Porch says what came. Never a code, never a blocked sender's.
pub const PHONE_MESSAGES_LOG: &str = "state/phone-messages/log/";
/// The messages marked Seen, each device's own file: seen on one device,
/// gone from the Porch of every device.
pub const PHONE_MESSAGES_SEEN: &str = "state/phone-messages/seen/";
/// What each relayed notification offers a reply from a computer, each
/// phone's own file (`sioul_core::replies::Live`): a Reply, a Mark as read,
/// or that it went; no words, no names. Taken out with the log.
pub const PHONE_MESSAGES_LIVE: &str = "state/phone-messages/live/";
/// Each computer's replies to send to the phones' notifications, its own
/// file, each line padded and sealed at rest by its writer
/// (`sioul_core::replies::Ask`); also sent on the lane of the texts to send
/// (`remote::place_asks`). A week, then gone.
pub const PHONE_MESSAGES_ASK: &str = "state/phone-messages/ask/";
/// Each phone's word on each reply it was asked to send
/// (`sioul_core::replies::Outcome`): never the words. A week, then gone.
pub const PHONE_MESSAGES_OUTCOME: &str = "state/phone-messages/outcome/";
/// Where the phones' messages keep their files in the records: as the
/// calls', remembered beside the notes, never kept as an earlier version nor
/// copied aside when sharing starts (`calls_store`).
const PHONE_MESSAGES: &str = "state/phone-messages/";

// texts: SMS phase (b) (docs/texts.md, docs/database.md "Texts"). Each
// store a folder of lines in the data folder (an archive), one writer per
// file, every line sealed at rest by its writer (`textseal`) and again in
// the folder; media travel as blobs, outside the records.
/// Each phone's texts, the whole history (`sioul_core::texts::Text`).
pub const TEXTS_LOG: &str = "data/texts/log/";
/// Each computer's texts to send, a random key each.
pub const TEXTS_SEND: &str = "data/texts/send/";
/// Each phone's word on each text it was asked to send.
pub const TEXTS_OUTCOME: &str = "data/texts/outcome/";
/// Each device's marks on conversations: read, hidden (deleted in Sioul).
pub const TEXTS_MARKS: &str = "data/texts/marks/";
/// Where the texts keep their files in the records: as the calls', remembered
/// beside the notes, never kept as an earlier version nor copied aside (`calls_store`).
const TEXTS: &str = "data/texts/";

/// A store, a file or an entry of the calls' part, or of the phones'
/// messages, by its name in the records: logs of lines that leave every
/// device after their time.
fn calls_store(name: &str) -> bool {
    // texts: their stores too.
    name.starts_with(CALLS) || name.starts_with(PHONE_MESSAGES) || name.starts_with(TEXTS)
}

/// Whether an entry is a line of a log every device ages out by itself
/// (`AGED_TOMBSTONE_DAYS`): the calls' logs, the phone's messages' logs, the
/// texts' requests and outcomes; never the texts themselves, whose log only grows.
fn ages_out(key: &str) -> bool {
    key.starts_with(CALLS) || key.starts_with(PHONE_MESSAGES) || key.starts_with(TEXTS_SEND) || key.starts_with(TEXTS_OUTCOME)
}

/// The spam filter's table (`sioul_core::spam::table`), made by a training
/// on a computer, read by every device. Sealed apart, as its content's hash:
/// a new table is sent once, and the records stay small (whole in a record,
/// its two megabytes would go again in every round its computer starts). A
/// single file of Sioul's own, in its private folders: read in every
/// exchange, a phone's background step's too. Never the language model nor
/// the corpus beside it: they stay on the computer that made them.
pub const SPAM_TABLE: &str = "files/spam/table.bin";

/// The spam filter's label logs (`sioul_core::spam::labels`): each device
/// writes its own file, a line per act, never rewritten; every device reads
/// them all, so that a message you said is not spam on one is never flagged
/// again on another, and the training on your computer learns from what you
/// said on your phone. Small, read in every exchange.
pub const SPAM_LABELS: &str = "state/spam/labels/";
/// What your own spam filter moved into a Junk folder, each device's own
/// file: no word of yours; the Porch's lane of its catches reads it, and the
/// training, which learns from it until you say otherwise.
pub const SPAM_MOVED: &str = "state/spam/moved/";
/// What your own spam filter flagged where it is, each device's own file:
/// the training's, which learns from it until you say otherwise.
pub const SPAM_FLAGGED: &str = "state/spam/flagged/";

/// Whether a device that never chose shares a part: what was shared before
/// parts had switches, everything but notes and papers, and projects as the
/// setting all devices followed then said (`share_projects`); the spam
/// filter's table, which every device reads. Never the phones' messages,
/// newer than the switches: each device shares them once you turn them on there.
pub fn shared_by_default(part: &str, config: &Config) -> bool {
    match part {
        "projects" => config.share_projects,
        "notes" | "papers" => false,
        // A notification's words leave the phone only once you say so, on each device.
        sioul_core::phonemsgs::PART => false,
        // texts: read and sent through your phone, once you say so on each device.
        sioul_core::texts::PART => false,
        _ => true,
    }
}

/// A file, or a folder of files, that is shared.
#[derive(Debug, Clone)]
pub struct Store {
    /// Its name in the records, the same on every computer: "config/config.toml", "data/drafts/".
    pub name: String,
    pub path: PathBuf,
    /// A folder: each file in it, and below, on its own.
    pub folder: bool,
    pub shape: Shape,
    /// In a folder: names left out (of files sealed apart, at its top only).
    pub skip: &'static [&'static str],
    /// The part it belongs to (`PARTS`).
    pub part: &'static str,
}

/// The folders Sioul keeps its files in.
pub struct Roots {
    pub config: PathBuf,
    pub data: PathBuf,
    pub state: PathBuf,
}

impl Roots {
    pub fn here() -> Roots {
        Roots { config: sioul_core::config::config_dir(), data: sioul_core::config::data_dir(), state: sioul_core::config::state_dir() }
    }
}

/// What is shared, each part as a device that never chose shares it (`shared_by_default`).
pub fn stores(config: &Config, roots: &Roots) -> Vec<Store> {
    stores_of(config, roots, &|part| shared_by_default(part, config))
}

/// The format of what travels, as this Sioul reads and writes it
/// (docs/database.md, "The format of what travels"). 1: as Sioul 0.0.4 and
/// every earlier one wrote it. 2: money lines, covers, mail rules, splits,
/// presets and time sessions each named by its own id (`Keyed::ids`);
/// pinned sites, routines, task kinds, days off, the words you added or took
/// away and the lighter days one each, where they travelled whole. Each
/// device says it in its entry (`devices::Entry::format`), and writes format
/// 2 once every device in the sharing says it (`format_open`): an older
/// Sioul, which reads format 1 only, is never sent what it cannot read.
pub const FORMAT: u32 = 2;

/// The format each part is written in at `FORMAT`: 2 for the parts whose
/// records changed (settings, time, projects and money), 1 for the others.
/// Each record says its part's format when it is not 1 (`Change::f`).
pub fn part_format(part: &str) -> u32 {
    match part {
        "settings" | "time" | "projects" => 2,
        _ => 1,
    }
}

/// What is shared of the parts `shares` keeps. Not shared: caches, how far
/// each sync got, how pages are shown on this screen, the site notices of this
/// computer's browser, your own PGP keys (secret keys never leave the computer
/// they were made on).
pub fn stores_of(config: &Config, roots: &Roots, shares: &dyn Fn(&str) -> bool) -> Vec<Store> {
    let (c, d, s) = (&roots.config, &roots.data, &roots.state);
    let file = |part: &'static str, name: &str, path: PathBuf, shape: Shape| Store { name: name.into(), path, folder: false, shape, skip: &[], part };
    let folder = |part: &'static str, name: &str, path: PathBuf, shape: Shape, skip: &'static [&'static str]| Store { name: name.into(), path, folder: true, shape, skip, part };
    let senders = |chosen: &Option<String>, name: &str| chosen.as_deref().map_or_else(|| c.join(name), sioul_core::config::expand_home);
    let local = sioul_core::vdir::LOCAL;
    let mut stores = vec![
        file("settings", "config/config.toml", c.join("config.toml"), Shape::Toml(&CONFIG_RULES)),
        file("senders", "config/known-senders.txt", senders(&config.known_senders, "known-senders.txt"), Shape::Lines),
        file("senders", "config/blocked-senders.txt", senders(&config.blocked_senders, "blocked-senders.txt"), Shape::Lines),
        file("senders", "config/safe-senders.txt", c.join("safe-senders.txt"), Shape::Lines),
        file("senders", "config/neutral-senders.txt", c.join("neutral-senders.txt"), Shape::Lines),
        file("senders", "config/restricted-senders.txt", c.join("restricted-senders.txt"), Shape::Lines),
        // Who may reach you during do-not-disturb, beside the mail lists (docs/do-not-disturb.md).
        file("senders", "config/dnd-people.toml", c.join(sioul_core::everywhere::PEOPLE_FILE), Shape::Toml(&DND_PEOPLE_RULES)),
        file("settings", "data/links.toml", d.join("links.toml"), Shape::Toml(&LINKS_RULES)),
        file("health", "data/health.toml", d.join("health.toml"), Shape::Toml(&HEALTH_RULES)),
        // Each day's own meals, naps and nights: one entry per field of a block of a day.
        file("health", "data/health-days.toml", d.join("health-days.toml"), Shape::Toml(&PLAIN_RULES)),
        file("time", "data/time/running.toml", d.join("time").join("running.toml"), Shape::Whole),
        folder("time", "data/time/", d.join("time"), Shape::Toml(&TIME_RULES), &["running.toml"]),
        // How each day went, with the plan it is the outcome of (today.toml, quiet.toml, the sessions):
        // every device that plans learns the same (docs/reviews.md).
        folder("time", "data/reviews/", d.join("reviews"), Shape::Toml(&REVIEWS_RULES), &[]),
        folder("drafts", "data/drafts/", d.join("drafts"), Shape::Whole, &[]),
        folder("drafts", "data/invoices/", d.join("invoices"), Shape::Whole, &[]),
        folder("senders", "data/pgp/others/", d.join("pgp").join("others"), Shape::Whole, &[]),
        // Your security keys as a computer of yours read them, their certificates with them (public
        // parts only: `securitykey::shared_cards`), so that every device encrypts to you, hands your
        // key by Autocrypt and says what waits for the key. A store an older Sioul leaves alone.
        folder("settings", "data/pgp/cards/", d.join("pgp").join(sioul_core::securitykey::SHARED_CARDS), Shape::Whole, &[]),
        folder("lists", "data/calendars/local/", d.join("calendars").join(local), Shape::Whole, &[]),
        folder("lists", "data/contacts/local/", d.join("contacts").join(local), Shape::Whole, &[]),
        file("settings", "state/porch.toml", s.join("porch.toml"), Shape::Toml(&PORCH_RULES)),
        file("settings", "state/money.toml", s.join("money.toml"), Shape::Toml(&MONEY_RULES)),
        // Do-not-disturb's switch, pressed on any device (docs/do-not-disturb.md).
        file("settings", "state/do-not-disturb.toml", s.join(sioul_core::everywhere::SWITCH_FILE), Shape::Toml(&DND_RULES)),
        file("time", "state/today.toml", s.join("today.toml"), Shape::Toml(&TODAY_RULES)),
        file("time", "state/quiet.toml", s.join("quiet.toml"), Shape::Toml(&QUIET_RULES)),
        file("time", "state/stopped.toml", s.join("stopped.toml"), Shape::Toml(&PLAIN_RULES)),
        file("health", "state/health-state.toml", s.join("health-state.toml"), Shape::Toml(&PLAIN_RULES)),
        // Each dose that fell due and the answers your devices captured (docs/health.md,
        // "Doses as records"): a file of its own, which an older Sioul leaves alone.
        file("health", "state/health-doses.toml", s.join(sioul_core::doses::FILE), Shape::Toml(&DOSES_RULES)),
        // What each device did to remind each dose (docs/health.md, "What became of a
        // reminder"): a file of its own too, which an older Sioul leaves alone.
        file("health", "state/health-reminders.toml", s.join(sioul_core::dose_reminders::FILE), Shape::Toml(&REMINDERS_RULES)),
        folder("senders", "state/shield/", s.join("shield"), Shape::Whole, &[]),
        folder("lists", "state/dav/local/", s.join("dav").join(local), Shape::Whole, &[]),
        // The spam filter's table alone: its language model and its corpus, beside it, stay here.
        file("spam", SPAM_TABLE, d.join("spam").join("table.bin"), Shape::Files),
        // What you said is spam or not, what your own filter moved and what it
        // flagged: each device's own log (`<device>.jsonl`), a line each,
        // every device's read.
        folder("spam", SPAM_LABELS, s.join("spam").join(sioul_core::spam::labels::FOLDER), Shape::Lines, &[]),
        folder("spam", SPAM_MOVED, s.join("spam").join(sioul_core::spam::labels::MOVED), Shape::Lines, &[]),
        folder("spam", SPAM_FLAGGED, s.join("spam").join(sioul_core::spam::labels::FLAGGED), Shape::Lines, &[]),
        // The calls each phone screened, and those each device marked Seen:
        // each device's own file (`<device>.jsonl`), a line each, every device's read.
        folder("calls", CALLS_LOG, s.join(sioul_core::calls::FOLDER).join(sioul_core::calls::LOG), Shape::Lines, &[]),
        folder("calls", CALLS_SEEN, s.join(sioul_core::calls::FOLDER).join(sioul_core::calls::SEEN_LOG), Shape::Lines, &[]),
        // The messages each phone's notifications brought, and those each device
        // marked Seen: each device's own file, a line each, every device's read.
        folder(sioul_core::phonemsgs::PART, PHONE_MESSAGES_LOG, s.join(sioul_core::phonemsgs::FOLDER).join(sioul_core::phonemsgs::LOG), Shape::Lines, &[]),
        folder(sioul_core::phonemsgs::PART, PHONE_MESSAGES_SEEN, s.join(sioul_core::phonemsgs::FOLDER).join(sioul_core::phonemsgs::SEEN_LOG), Shape::Lines, &[]),
        // What each relayed notification offers a reply from your computers, each phone's own file.
        folder(sioul_core::phonemsgs::PART, PHONE_MESSAGES_LIVE, s.join(sioul_core::phonemsgs::FOLDER).join(sioul_core::replies::LIVE), Shape::Lines, &[]),
        // Each computer's replies to send, sealed lines, and each phone's word on them.
        folder(sioul_core::phonemsgs::PART, PHONE_MESSAGES_ASK, s.join(sioul_core::phonemsgs::FOLDER).join(sioul_core::replies::ASK), Shape::Lines, &[]),
        folder(sioul_core::phonemsgs::PART, PHONE_MESSAGES_OUTCOME, s.join(sioul_core::phonemsgs::FOLDER).join(sioul_core::replies::OUTCOME), Shape::Lines, &[]),
        // texts: each phone's texts and outcomes, each computer's requests, sealed lines, in the data folder.
        folder(sioul_core::texts::PART, TEXTS_LOG, d.join(sioul_core::texts::FOLDER).join(sioul_core::texts::LOG), Shape::Lines, &[]),
        folder(sioul_core::texts::PART, TEXTS_SEND, d.join(sioul_core::texts::FOLDER).join(sioul_core::texts::SEND), Shape::Lines, &[]),
        folder(sioul_core::texts::PART, TEXTS_OUTCOME, d.join(sioul_core::texts::FOLDER).join(sioul_core::texts::OUTCOME), Shape::Lines, &[]),
        folder(sioul_core::texts::PART, TEXTS_MARKS, d.join(sioul_core::texts::FOLDER).join(sioul_core::texts::MARKS), Shape::Lines, &[]),
    ];
    // From the notes folder each device keeps where it likes: projects,
    // budgets, the bank's movements and contracts; the papers' wallet and its
    // files; the notes themselves, each file sealed apart.
    if let Some(notes) = config.notes_root_path() {
        stores.push(file("projects", "notes/sioul-cases.toml", sioul_core::projects::file_in(&notes), Shape::Toml(&PROJECTS_RULES)));
        stores.push(file("projects", "notes/sioul-budgets.toml", notes.join(sioul_core::budget::LEDGER), Shape::Toml(&LEDGER_RULES)));
        stores.push(file("projects", "notes/sioul-bank.toml", notes.join(sioul_core::bank::MANIFEST), Shape::Toml(&BANK_RULES)));
        stores.push(file("projects", "notes/sioul-contracts.toml", notes.join(sioul_core::contracts::MANIFEST), Shape::Toml(&CONTRACTS_RULES)));
        stores.push(file("papers", "notes/sioul-papers.toml", notes.join(sioul_core::papers::MANIFEST), Shape::Toml(&PAPERS_RULES)));
        stores.push(folder("papers", "files/papers/", notes.join(sioul_core::papers::FOLDER), Shape::Files, &[]));
        stores.push(folder("notes", "files/notes/", notes, Shape::Files, NOT_NOTES));
    }
    stores.retain(|store| shares(store.part));
    stores
}

/// The stores as a format divides their files (`Rules::at`): format 2's
/// rules from 2 on, where they differ.
pub fn shaped(stores: &[Store], format: u32) -> Vec<Store> {
    stores
        .iter()
        .map(|store| Store {
            shape: match store.shape {
                Shape::Toml(rules) => Shape::Toml(rules.at(format)),
                other => other,
            },
            ..store.clone()
        })
        .collect()
}

/// What notes or papers would send from here, before their part is switched
/// on: how many files, how many bytes, and how many stay (too big). Listed as
/// an exchange lists them, nothing read through, nothing removed.
pub fn estimate(stores: &[Store]) -> (usize, u64, usize) {
    let (mut found, mut files, known, confirmed) = (Found::default(), Vec::new(), BTreeMap::new(), BTreeSet::new());
    for store in stores.iter().filter(|s| matches!(s.shape, Shape::Files) && s.path.is_dir()) {
        Listing { store: &store.name, root: &store.path, skip: store.skip, known: &known, confirmed: &confirmed, files: &mut files, found: &mut found, sweep: false }.list(&store.path);
    }
    files.iter().filter_map(|(_, path)| std::fs::metadata(path).ok()).fold((0, 0, 0), |(count, bytes, big), meta| if meta.len() > crate::blobs::LARGEST { (count, bytes, big + 1) } else { (count + 1, bytes + meta.len(), big) })
}

/// The part a file of the records belongs to, whether this device shares it
/// or not; none for a store this version does not know (its changes wait for
/// a version that knows it).
fn known_part(file: &str) -> Option<&'static str> {
    static KNOWN: std::sync::OnceLock<Vec<(String, bool, &'static str)>> = std::sync::OnceLock::new();
    let known = KNOWN.get_or_init(|| {
        let roots = Roots { config: PathBuf::from("config"), data: PathBuf::from("data"), state: PathBuf::from("state") };
        let config = Config { notes_root: Some("notes".into()), ..Config::default() };
        stores_of(&config, &roots, &|_| true).into_iter().map(|store| (store.name, store.folder, store.part)).collect()
    });
    #[cfg(test)]
    if tests::OLDER.with(|older| older.borrow().iter().any(|store| file.starts_with(store.as_str()))) {
        return None;
    }
    known.iter().find(|(name, folder, _)| !folder && name == file).or_else(|| known.iter().filter(|(name, folder, _)| *folder && file.starts_with(name.as_str())).max_by_key(|(name, _, _)| name.len())).map(|(_, _, part)| *part)
}

/// A file's name in the records, as shown: without the folder Sioul keeps it in
/// ("config/config.toml" → "config.toml", "files/notes/admin/lease.md" → "admin/lease.md").
pub fn shown(file: &str) -> &str {
    ["files/notes/", "files/", "config/", "data/", "state/", "notes/"].iter().find_map(|root| file.strip_prefix(root)).unwrap_or(file)
}

// ---------------------------------------------------------------- entries

/// What the files hold now, entry by entry.
#[derive(Debug, Default)]
struct Found {
    /// Each entry's value, hashed: `<store><file>#<entry>` → its hash.
    hashes: BTreeMap<String, String>,
    /// The values of the entries in files read this time; the others' files did not change.
    values: BTreeMap<String, String>,
    /// When each file last changed, in milliseconds: dates the changes found in it.
    changed: BTreeMap<String, i64>,
    /// Files that could not be read (a TOML file half written, a folder not
    /// there): their entries are neither taken out nor written to.
    unknown: BTreeSet<String>,
    /// Each file's size, time and entries: a file unchanged is not read again.
    files: BTreeMap<String, Stat>,
    /// Files sealed apart left here, too big to travel (`blobs::LARGEST`): said.
    too_big: Vec<String>,
    /// Folders of files sealed apart that list empty while they held files at
    /// the last look, with how many they held: unknown, said.
    emptied: Vec<(String, usize)>,
    /// What else the look has to say (names that are not text).
    said: Vec<String>,
    /// Large notes and papers found changed since they were last read, not
    /// read yet: since when (`Sealed::changing`).
    changing: BTreeMap<String, i64>,
}

/// A file as last read: its size, when it changed (nanoseconds), its entries'
/// hashes, and when it was read (milliseconds, this computer's clock).
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
struct Stat {
    size: u64,
    modified: u64,
    entries: Vec<(String, String)>,
    /// A file read within `settling_ms` of its change may have changed again
    /// since at the same size and time (a coarse clock: a FAT card's 2 s): read again.
    #[serde(default, skip_serializing_if = "is_zero")]
    seen: i64,
}

fn is_zero(n: &i64) -> bool {
    *n == 0
}

impl Found {
    fn is_unknown(&self, key: &str) -> bool {
        let file = file_of(key);
        self.unknown.iter().any(|u| file == u || (u.ends_with('/') && file.starts_with(u.as_str())))
    }
}

/// Folders whose files travel whole (`Shape::Whole`, `Shape::Files`): their
/// keys are the file's name and an empty entry, `#`, and a name may hold `#`
/// itself ("Facture #123.pdf").
const WHOLE_FOLDERS: &[&str] = &["data/drafts/", "data/invoices/", "data/pgp/others/", "data/calendars/local/", "data/contacts/local/", "state/shield/", "state/dav/local/", FILES];

/// The drafts' folder. A draft taken out on one device (sent, or thrown away)
/// while another changed it, each unaware of the other, stays taken out on
/// every device, whichever came later; the change made meanwhile is kept
/// among that device's earlier versions (review of 5 October 2026, F22: a
/// draft sent could come back, and be sent twice). Each record of a draft
/// names the version it replaced (`Change::b`), and each device keeps every
/// version of a draft it met (`Memory::drafts`): a change of a change of the
/// version sent loses too (`sent_meanwhile`). An older Sioul's records name
/// none: the later word wins, as before.
const DRAFTS: &str = "data/drafts/";

/// How a record of a draft is decided (`DRAFTS`): Some(true) it wins, Some(false)
/// it loses, whichever came later; None, the later word wins, as ever. `here`:
/// the draft here, or what came for it earlier in this reading (taken out, its
/// version, the version it replaced); `met`: every version of it met here.
fn sent_meanwhile(met: Option<&BTreeSet<String>>, here: Option<(bool, &str, &str)>, removal: bool, base: &str) -> Option<bool> {
    let (gone, version, replaced) = here?;
    let known = |v: &str| !v.is_empty() && (v == version || v == replaced || met.is_some_and(|met| met.contains(v)));
    match (removal, gone) {
        // A change of a version that was taken out: it was sent.
        (false, true) if known(base) => Some(false),
        // Taken out where this draft came from: sent, whatever was changed here since.
        (true, false) if known(base) => Some(true),
        _ => None,
    }
}

/// `<store><file>`: the part of a key before its entry.
fn file_of(key: &str) -> &str {
    if WHOLE_FOLDERS.iter().any(|folder| key.starts_with(folder))
        && let Some(file) = key.strip_suffix('#')
    {
        return file;
    }
    key.split_once('#').map_or(key, |(file, _)| file)
}

/// The entry a key names in its file.
fn entry_of(key: &str) -> &str {
    key.get(file_of(key).len() + 1..).unwrap_or("")
}

pub(crate) fn modified_ns(meta: &std::fs::Metadata) -> u64 {
    meta.modified().ok().and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok()).map_or(0, |d| d.as_nanos() as u64)
}

/// How a look goes: which stores it reads, whether it must hurry, which
/// folders' emptying you confirmed, this computer's clock (milliseconds).
struct Look<'a> {
    /// Stores read this time; the others are left as last read.
    reads: &'a dyn Fn(&Store) -> bool,
    /// Files sealed apart are not read through while a hurried exchange waits.
    hurry: &'a dyn Fn() -> bool,
    confirmed: &'a BTreeSet<String>,
    clock: i64,
    /// Large notes and papers found changed since they were last read, and since when (`Sealed::changing`).
    changing: &'a BTreeMap<String, i64>,
}

/// This computer's clock, in milliseconds.
fn clock_ms() -> i64 {
    std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_millis() as i64)
}

#[cfg(test)]
thread_local! {
    /// How long a file sealed apart settles before it is read, in this test's thread: not at all, unless a test says.
    static SETTLE: std::cell::Cell<i64> = const { std::cell::Cell::new(0) };
}

/// A file sealed apart changed this recently may still be being written (an
/// editor writing it in place): read at the next look.
fn settling_ms() -> i64 {
    #[cfg(test)]
    return SETTLE.with(std::cell::Cell::get);
    #[cfg(not(test))]
    2_000
}

/// A note or a paper this large (bytes) is sealed only once it has settled
/// (`large_settling_ms`): a recording or a scan saved again within minutes
/// goes once, its last save, not each one. On 14 October 2026 four earlier
/// takes of the owner's recordings, 15.7 MB, were sealed 13, 16, 25 and 1
/// minute before the next save, and each stayed in the folder as long as
/// replaced contents stay: ten minutes would have kept only the last of them
/// (3.5 MB) off it. Smaller notes go as before.
const LARGE_SETTLES: u64 = 1 << 20;

#[cfg(test)]
thread_local! {
    /// How long a large note or paper settles, in this test's thread: not at all, unless a test says.
    pub(crate) static LARGE_SETTLE: std::cell::Cell<i64> = const { std::cell::Cell::new(0) };
}

/// How long a note or a paper of `LARGE_SETTLES` or more stays unchanged
/// before it is read and sealed. One that never stops changing still goes an
/// hour after it was first found changed (`read_file`, `Sealed::changing`).
pub(crate) const LARGE_SETTLING: i64 = 10 * MINUTE;

fn large_settling_ms() -> i64 {
    #[cfg(test)]
    return LARGE_SETTLE.with(std::cell::Cell::get);
    #[cfg(not(test))]
    LARGE_SETTLING
}

/// What the stores hold; a file whose size and time did not change since
/// `known` is taken from there, not read. What could not be read is unknown,
/// its last look kept: nothing of it is taken out elsewhere.
fn gather(stores: &[Store], known: &BTreeMap<String, Stat>, look: &Look) -> Found {
    let mut found = Found::default();
    for store in stores {
        if !(look.reads)(store) {
            // Not read this time (notes and papers in a hurried exchange).
            found.unknown.insert(store.name.clone());
            continue;
        }
        if store.folder {
            if !store.path.is_dir() {
                // Notes or papers that held files and are gone (a disk not
                // mounted, a folder moved): unknown, said. A folder that never
                // held any is a new one, filled.
                let held = known.range(store.name.clone()..).take_while(|(file, _)| file.starts_with(&store.name)).count();
                if matches!(store.shape, Shape::Files) && held == 0 {
                    continue;
                }
                if matches!(store.shape, Shape::Files) && !look.confirmed.iter().any(|said| confirms(said, &store.name)) {
                    found.emptied.push((store.name.clone(), held));
                }
                found.unknown.insert(store.name.clone());
                continue;
            }
            let mut files = Vec::new();
            if matches!(store.shape, Shape::Files) {
                let mut listing = Listing { store: &store.name, root: &store.path, skip: store.skip, known, confirmed: look.confirmed, files: &mut files, found: &mut found, sweep: true };
                listing.list(&store.path);
            } else {
                list_files(&store.path, &store.path, store.skip, &mut files);
            }
            for (relative, path) in files {
                read_file(store, &format!("{}{relative}", store.name), &path, known, look, &mut found);
            }
        } else if store.path.is_file() {
            read_file(store, &store.name, &store.path, known, look, &mut found);
        } else if !matches!(store.shape, Shape::Whole | Shape::Files) {
            // A settings file not there is not a file emptied; a file whole or
            // sealed apart not there is none yet (the spam filter's table before a training).
            found.unknown.insert(store.name.clone());
        }
    }
    // What is unknown keeps its last look: next time, a folder that held files is still known to have held them.
    let carried: Vec<(String, Stat)> = known.iter().filter(|(file, _)| !found.files.contains_key(*file) && found.is_unknown(file)).map(|(file, stat)| (file.clone(), stat.clone())).collect();
    found.files.extend(carried);
    // The logs of lines kept (`LINES`) that are no longer there, forgotten.
    if let Ok(mut all) = LINES.lock() {
        all.retain(|path, _| path.exists() || !stores.iter().any(|s| matches!(s.shape, Shape::Lines) && path.starts_with(&s.path)));
    }
    found
}

/// Every file below a folder, by its path from it with `/`; temporary and hidden files left out.
fn list_files(root: &Path, dir: &Path, skip: &[&str], out: &mut Vec<(String, PathBuf)>) {
    let Ok(entries) = std::fs::read_dir(dir) else { return };
    for entry in entries.filter_map(Result::ok) {
        let name = entry.file_name().to_string_lossy().to_string();
        if name.starts_with('.') || name.ends_with(".new") || name.ends_with(".tmp") || name.ends_with('~') || skip.contains(&name.as_str()) {
            continue;
        }
        let path = entry.path();
        if path.is_dir() {
            list_files(root, &path, skip, out);
        } else if let Ok(relative) = path.strip_prefix(root) {
            out.push((relative.components().map(|c| c.as_os_str().to_string_lossy()).collect::<Vec<_>>().join("/"), path));
        }
    }
}

/// A listing of a folder of files sealed apart (notes, papers).
struct Listing<'a> {
    store: &'a str,
    root: &'a Path,
    skip: &'a [&'a str],
    known: &'a BTreeMap<String, Stat>,
    /// The folders you said to take out what went from (`Sealed::confirmed`):
    /// one of them, or a folder below one, listing empty is emptied.
    confirmed: &'a BTreeSet<String>,
    files: &'a mut Vec<(String, PathBuf)>,
    found: &'a mut Found,
    /// Whether what a crash left half written goes once an hour old: in an
    /// exchange, under its lock; never in a look from outside it
    /// (`estimate`), which removes nothing (review of 18 October 2026, I-2).
    sweep: bool,
}

impl Listing<'_> {
    /// Every file below `dir`, by its path from the root with `/`; how many.
    /// Left out: what sync apps, editors and systems make (`made_by_tools`),
    /// `skip` at the top (whatever its case), tools' own folders, a folder
    /// shared through (it holds a seal), links, names that are not text (said).
    /// A folder that cannot be read whole (one name that errs is enough), or
    /// that lists empty while it held files at the last look (a disk not
    /// mounted, access withdrawn), is unknown: nothing in it is taken out
    /// elsewhere, nothing is written into it.
    fn list(&mut self, dir: &Path) -> usize {
        let relative = dir.strip_prefix(self.root).map(|r| r.components().map(|c| c.as_os_str().to_string_lossy()).collect::<Vec<_>>().join("/")).unwrap_or_default();
        let within = if relative.is_empty() { String::new() } else { format!("{relative}/") };
        let prefix = format!("{}{within}", self.store);
        let mut whole = true;
        let mut count = 0;
        match std::fs::read_dir(dir) {
            Err(_) => whole = false,
            Ok(entries) => {
                for entry in entries {
                    let Ok(entry) = entry else {
                        whole = false;
                        continue;
                    };
                    let Ok(kind) = entry.file_type() else {
                        whole = false;
                        continue;
                    };
                    let name = entry.file_name();
                    let Some(name) = name.to_str() else {
                        self.found.said.push(format!("share-not-text:{prefix}{}", name.to_string_lossy()));
                        continue;
                    };
                    let path = entry.path();
                    if is_leftover(name) {
                        if self.sweep {
                            remove_if_old(&path);
                        }
                        continue;
                    }
                    if kind.is_symlink() {
                        // A folder or a file put back as a link (moved out of
                        // the notes, and linked back): links are never
                        // followed, and what was there is unknown, said as a
                        // folder gone, never taken for deleted (review of 17
                        // October 2026, L4).
                        let place = format!("{prefix}{name}");
                        let below = format!("{place}/");
                        let held = self.known.range(place.clone()..).take_while(|(file, _)| file.starts_with(&place)).filter(|(file, _)| **file == place || file.starts_with(&below)).count();
                        if held > 0 && !self.confirmed.iter().any(|said| confirms(said, &below)) {
                            // Said as what it stands for: a note ("…/single.md"), or a folder ("…/archive/").
                            let one = self.known.contains_key(&place);
                            self.found.emptied.push((if one { place.clone() } else { below.clone() }, held));
                            self.found.unknown.insert(place);
                            self.found.unknown.insert(below);
                        }
                        continue;
                    }
                    if made_by_tools(name) || (dir == self.root && self.skip.iter().any(|skip| skip.eq_ignore_ascii_case(name))) {
                        continue;
                    }
                    if kind.is_dir() {
                        if !matches!(name, "node_modules" | "target") && !path.join("seal.toml").is_file() {
                            count += self.list(&path);
                        }
                    } else if kind.is_file() {
                        self.files.push((format!("{within}{name}"), path));
                        count += 1;
                    }
                }
            }
        }
        let held = self.known.range(prefix.clone()..).take_while(|(file, _)| file.starts_with(&prefix)).count();
        let confirmed = self.confirmed.iter().any(|said| confirms(said, &prefix));
        if !whole || (count == 0 && held > 0 && !confirmed) {
            if whole {
                self.found.emptied.push((prefix.clone(), held));
            }
            self.found.unknown.insert(prefix);
        }
        count
    }
}

/// Whether what you said to take out everywhere (`Sealed::confirmed`: a
/// folder by its place, "files/notes/disk/", or one note replaced by a
/// link, "files/notes/single.md") covers `file` (a file's or a folder's
/// place): what is below that folder, or that note; never a name beside it.
fn confirms(said: &str, file: &str) -> bool {
    if said.ends_with('/') { file.starts_with(said) } else { file == said || file.strip_prefix(said).is_some_and(|rest| rest.starts_with('/')) }
}

/// What a crash left half written by Sioul: its hidden names ending so, and
/// those its replacements write beside a file (`filelock::Prepared`,
/// `filelock::replace`: `.<name>.<process>-<number>.new`).
fn is_leftover(name: &str) -> bool {
    let replacement = name.strip_suffix(".new").and_then(|rest| rest.rsplit_once('.')).is_some_and(|(_, tail)| tail.split_once('-').is_some_and(|(process, number)| !process.is_empty() && !number.is_empty() && process.bytes().all(|b| b.is_ascii_digit()) && number.bytes().all(|b| b.is_ascii_digit())));
    name.starts_with('.') && ([TEMPORARY, ".shared.tmp", ".conflict.tmp"].iter().any(|end| name.ends_with(end)) || replacement)
}

/// [`clean_leftovers`] in `dir` and its folders, a few deep: the folders whose
/// files travel whole (drafts, calendars and address books kept here), where
/// a crash in a receive, a Put back or a copy's replacement leaves a hidden
/// file that nothing else ever sweeps (review of 19 October 2026, F17).
fn clean_leftovers_below(dir: &Path, depth: usize) {
    clean_leftovers(dir);
    if depth == 0 {
        return;
    }
    for entry in std::fs::read_dir(dir).into_iter().flatten().filter_map(Result::ok) {
        if entry.file_type().is_ok_and(|t| t.is_dir()) {
            clean_leftovers_below(&entry.path(), depth - 1);
        }
    }
}

/// A file left half written, removed once an hour old: never one still being written.
fn remove_if_old(path: &Path) {
    if std::fs::metadata(path).ok().and_then(|m| m.modified().ok()).and_then(|t| t.elapsed().ok()).is_some_and(|age| age.as_secs() > 3600) {
        let _ = std::fs::remove_file(path);
    }
}

/// What a crash left half written in a folder (the sealed files, the history), removed after an hour.
pub(crate) fn clean_leftovers(dir: &Path) {
    for entry in std::fs::read_dir(dir).into_iter().flatten().filter_map(Result::ok) {
        if entry.file_name().to_str().is_some_and(is_leftover) {
            remove_if_old(&entry.path());
        }
    }
}

/// Names that sync apps, editors and systems make beside your files: hidden
/// ones, temporary and backup copies, conflicted copies, locks. Sioul's own
/// copies of a file two devices changed ("lease (conflict …).md") are none of them.
fn made_by_tools(name: &str) -> bool {
    let lower = name.to_lowercase();
    name.starts_with('.')
        || name.starts_with('~')
        || name.ends_with('~')
        || (name.starts_with('#') && name.ends_with('#'))
        || [".tmp", ".temp", ".part", ".partial", ".crdownload", ".download", ".swp", ".swx", ".new"].iter().any(|end| lower.ends_with(end))
        || ["conflicted copy", ".sync-conflict-", "_conflict-", "sfconflict"].iter().any(|word| lower.contains(word))
        || matches!(lower.as_str(), "thumbs.db" | "desktop.ini" | "4913")
}

/// A file sealed apart, as its record says it: its content's hash, its size, when it changed (milliseconds).
#[derive(Debug, Serialize, Deserialize)]
struct Reference {
    h: String,
    s: u64,
    t: i64,
}

fn reference(h: &str, size: u64, modified_ns: u64) -> String {
    serde_json::to_string(&Reference { h: h.to_string(), s: size, t: (modified_ns / 1_000_000) as i64 }).unwrap_or_default()
}

/// What an entry's value is known by: a file sealed apart by its content's hash, anything else by its value's.
fn value_hash(key: &str, value: &str) -> String {
    if key.starts_with(FILES) { serde_json::from_str::<Reference>(value).map(|r| r.h).unwrap_or_default() } else { hash(value) }
}

fn read_file(store: &Store, file: &str, path: &Path, known: &BTreeMap<String, Stat>, look: &Look, found: &mut Found) {
    let Ok(meta) = std::fs::metadata(path) else {
        found.unknown.insert(file.to_string());
        return;
    };
    let sealed_apart = matches!(store.shape, Shape::Files);
    if meta.len() > if sealed_apart { crate::blobs::LARGEST } else { LARGEST } {
        found.unknown.insert(file.to_string());
        if sealed_apart {
            found.too_big.push(file.to_string());
        }
        return;
    }
    let modified = modified_ns(&meta);
    found.changed.insert(file.to_string(), (modified / 1_000_000) as i64);
    // As last read: the same size and time, read well after it changed. Not
    // a log of lines (calls, texts, labels): what it holds is not kept twice
    // in the memory (its lines are its entries' names), it is read again.
    let lines = matches!(store.shape, Shape::Lines);
    if let Some(stat) = known.get(file).filter(|s| !lines && s.size == meta.len() && s.modified == modified && (s.seen == 0 || (s.modified / 1_000_000) as i64 + settling_ms() < s.seen)) {
        for (entry, h) in &stat.entries {
            found.hashes.insert(format!("{file}#{entry}"), h.clone());
            // A file sealed apart: its record made from what was kept, the file not read again.
            if sealed_apart {
                found.values.insert(format!("{file}#{entry}"), reference(h, stat.size, stat.modified));
            }
        }
        found.files.insert(file.to_string(), stat.clone());
        return;
    }
    if sealed_apart {
        // Changed a moment ago (maybe still being written), or a hurried
        // exchange waits: read at the next look. A large note or paper, until
        // it has not changed for ten minutes (`LARGE_SETTLES`), or an hour
        // after it was first found changed, whichever comes first: one that
        // never stops changing still goes, a new one too; one saved again
        // after a quiet hour waits as well. Unknown meanwhile, as a file
        // being written is: the others' changes to it wait, nothing of it is
        // taken out. Read through for its hash, never held whole; one that
        // changed while read is read next time.
        let large = meta.len() >= LARGE_SETTLES && matches!(store.part, "notes" | "papers");
        // Changed since it was last read (else taken as it was, above): since
        // when it was first found so, kept until it is read (`Sealed::changing`).
        let since = look.changing.get(file).copied().unwrap_or(look.clock);
        let settling = if large && look.clock - since < HOUR { large_settling_ms().max(settling_ms()) } else { settling_ms() };
        let fresh = look.clock - ((modified / 1_000_000) as i64) < settling;
        let read = (!fresh && !(look.hurry)()).then(|| crate::blobs::hash_file(path).ok()).flatten().filter(|(_, size)| *size == meta.len());
        let Some((h, _)) = read else {
            found.unknown.insert(file.to_string());
            if large {
                found.changing.insert(file.to_string(), since);
            }
            return;
        };
        let key = format!("{file}#");
        found.hashes.insert(key.clone(), h.clone());
        found.values.insert(key, reference(&h, meta.len(), modified));
        found.files.insert(file.to_string(), Stat { size: meta.len(), modified, entries: vec![(String::new(), h)], seen: look.clock });
        return;
    }
    if lines {
        // A log of lines: its lines as this process last read them, while the
        // file is that one (`LINES`), else read now and kept.
        let Some(lines) = lines_of(path, &meta, look.clock) else {
            found.unknown.insert(file.to_string());
            return;
        };
        let h = hash("");
        for line in lines.iter() {
            let key = format!("{file}#{line}");
            found.hashes.insert(key.clone(), h.clone());
            found.values.insert(key, String::new());
        }
        // When it was read is not kept (the memory would change at each).
        found.files.insert(file.to_string(), Stat { size: meta.len(), modified, entries: Vec::new(), seen: 0 });
        return;
    }
    // Read whole, as one version held it (`filelock::read_whole_with`): never
    // a file replaced while it was read, whose old bytes may be zeros by the
    // end (a copy beside a draft encrypted again, `draftcopies`, which takes
    // its place under the exchange lock this exchange holds, so this is a
    // last guard). What is recorded, the size, the time and each entry's
    // hash, is that version's own, from the descriptor that read it: what
    // goes out is always bytes read whole from a file that had its name.
    let Some((entries, held)) = sioul_core::filelock::read_whole_with(path).ok().and_then(|(bytes, held)| Some((entries_of(store, &bytes)?, held))) else {
        found.unknown.insert(file.to_string());
        return;
    };
    let mut stat = Stat { size: held.len(), modified: modified_ns(&held), entries: Vec::with_capacity(entries.len()), seen: look.clock };
    for (entry, value) in entries {
        let key = format!("{file}#{entry}");
        let h = hash(&value);
        stat.entries.push((entry, h.clone()));
        found.hashes.insert(key.clone(), h);
        found.values.insert(key, value);
    }
    found.files.insert(file.to_string(), stat);
}

/// Each log of lines (`Shape::Lines`) as this process last read it, by its
/// path: the file's stamp then, when it was read (milliseconds), its lines.
/// Read again only once the file changed, or when it was read within
/// `settling_ms` of its change (a coarse clock: it may have changed again at
/// the same size and time). The texts' log alone is megabytes of sealed lines,
/// once read at every exchange of a phone's background step.
type Lines = BTreeMap<PathBuf, (FileStamp, i64, std::sync::Arc<Vec<String>>)>;
static LINES: std::sync::Mutex<Lines> = std::sync::Mutex::new(BTreeMap::new());

/// A log's lines, as `entries_of` reads them: from `LINES` while the file is
/// the one read there, else read now (`clock`: this computer's, milliseconds) and kept.
fn lines_of(path: &Path, meta: &std::fs::Metadata, clock: i64) -> Option<std::sync::Arc<Vec<String>>> {
    let stamp = file_stamp(meta);
    let settled = |read: i64| (stamp.modified / 1_000_000) as i64 + settling_ms() < read;
    if let Some((_, _, lines)) = keeping().then(|| LINES.lock().ok().and_then(|all| all.get(path).filter(|(was, read, _)| *was == stamp && settled(*read)).cloned())).flatten() {
        return Some(lines);
    }
    let bytes = std::fs::read(path).ok()?;
    #[cfg(test)]
    LINES_READ.with(|n| n.set(n.get() + 1));
    // Not text (a list kept by another tool in another encoding): unknown, left as it is.
    let lines: std::sync::Arc<Vec<String>> = std::sync::Arc::new(std::str::from_utf8(&bytes).ok()?.lines().map(str::trim).filter(|l| !l.is_empty() && !l.starts_with('#')).map(str::to_string).collect());
    // Kept, read whole only if it did not change meanwhile: else read again next time.
    if keeping()
        && bytes.len() as u64 == stamp.size
        && let Ok(mut all) = LINES.lock()
    {
        all.insert(path.to_path_buf(), (stamp, clock, std::sync::Arc::clone(&lines)));
    }
    Some(lines)
}

/// A file's entries and their values; none when it cannot be read as its
/// shape says. Files sealed apart are read through, never whole (`read_file`).
/// A list or a settings file that is not text (saved by another tool in
/// another encoding, damaged) is none: never decoded lossily, which would
/// send its replaced characters and, written back, take its other lines out
/// everywhere (review of 5 October 2026, F25).
fn entries_of(store: &Store, bytes: &[u8]) -> Option<Vec<(String, String)>> {
    match store.shape {
        Shape::Whole => Some(vec![(String::new(), B64.encode(bytes))]),
        Shape::Lines => Some(std::str::from_utf8(bytes).ok()?.lines().map(str::trim).filter(|l| !l.is_empty() && !l.starts_with('#')).map(|l| (l.to_string(), String::new())).collect()),
        Shape::Toml(rules) => toml_entries(std::str::from_utf8(bytes).ok()?, rules).ok(),
        Shape::Files => None,
    }
}

/// A list's or a settings file's text, to write entries into: none there yet
/// is an empty one; one that cannot be read, or is not text, is an error, and
/// what came for it waits (never the incoming entries alone written in its place).
fn text_to_write(path: &Path) -> Result<String, String> {
    match std::fs::read(path) {
        Ok(bytes) => String::from_utf8(bytes).map_err(|_| format!("share-unreadable:{}", path.display())),
        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(String::new()),
        Err(e) => Err(format!("share-unreadable:{}: {e}", path.display())),
    }
}

/// An entry's value, read from its file now.
fn value_of(stores: &[Store], key: &str) -> Option<String> {
    let (file, entry) = (file_of(key), entry_of(key));
    let (store, path) = locate(stores, file)?;
    if matches!(store.shape, Shape::Files) {
        let meta = std::fs::metadata(&path).ok()?;
        let (h, size) = crate::blobs::hash_file(&path).ok()?;
        return entry.is_empty().then(|| reference(&h, size, modified_ns(&meta)));
    }
    let bytes = sioul_core::filelock::read_whole(&path).ok()?;
    entries_of(store, &bytes)?.into_iter().find(|(e, _)| e == entry).map(|(_, value)| value)
}

/// A value as TOML text, `v = …`: one form for one value, whatever the file's layout.
fn leaf_text(value: &toml::Value) -> String {
    let mut table = toml::Table::new();
    table.insert("v".into(), value.clone());
    toml::to_string(&table).unwrap_or_default()
}

fn leaf_value(text: &str) -> Result<toml::Value, String> {
    let mut table: toml::Table = text.parse().map_err(|e: toml::de::Error| e.to_string())?;
    table.remove("v").ok_or_else(|| "no value".to_string())
}

fn matches_rule(path: &[String], rule: &str) -> bool {
    let parts: Vec<&str> = rule.split('.').collect();
    parts.len() == path.len() && parts.iter().zip(path).all(|(r, p)| *r == "*" || r == p)
}

/// An element's name in its list: its naming fields, or the element itself.
fn identity(element: &toml::Value, by: &[&str]) -> String {
    if by.is_empty() {
        return leaf_text(element);
    }
    by.iter()
        .map(|field| match element.get(field) {
            Some(toml::Value::String(s)) => s.clone(),
            Some(other) => other.to_string(),
            None => String::new(),
        })
        .collect::<Vec<_>>()
        .join("\u{1d}")
}

fn strip_local(element: &mut toml::Value, local: &[&str]) {
    if let toml::Value::Table(table) = element {
        for field in local {
            table.remove(*field);
        }
    }
}

/// The keyed list at `path` in a file: by its name at the top (or one of its
/// other names, `Keyed::also`), by its pattern within tables.
fn keyed_at<'r>(rules: &'r Rules, path: &[String]) -> Option<&'r Keyed> {
    rules.keyed.iter().find(|k| match path {
        [name] => k.list == name || k.also.contains(&name.as_str()),
        _ => k.list.contains('.') && matches_rule(path, k.list),
    })
}

/// The keyed list a record's entry names (`<list>␟␞<element>`, `<table>␟…␟<list>␟␞<element>` within tables).
fn keyed_named<'r>(rules: &'r Rules, list: &[&str]) -> Option<&'r Keyed> {
    let path: Vec<String> = list.iter().map(|part| (*part).to_string()).collect();
    rules.keyed.iter().find(|k| match list {
        [name] => k.list == *name,
        _ => k.list.contains('.') && matches_rule(&path, k.list),
    })
}

/// An element's own id, when it has one.
fn own_id(element: &toml::Value) -> Option<&str> {
    element.get("id").and_then(toml::Value::as_str).filter(|id| !id.is_empty())
}

/// The id format 2 gives an element without one: from its list and `what`,
/// the stable key format 1 named it by (`identity`: a session's start, task
/// and project; a money line itself), the same on every device. Written into
/// the element once, when the device takes format 2 (`switch_format`); until
/// then, and for an element made without one since (by hand), its name.
/// Shaped as a UUID (version 8: made here, by name).
pub(crate) fn derived(list: &str, what: &str) -> String {
    use sha2::Digest;
    let mut hasher = sha2::Sha256::new();
    hasher.update(b"sioul-id\x1f");
    hasher.update(list.as_bytes());
    hasher.update(b"\x1f");
    hasher.update(what.as_bytes());
    let digest = hasher.finalize();
    let mut bytes = [0u8; 16];
    bytes.copy_from_slice(&digest[..16]);
    bytes[6] = (bytes[6] & 0x0f) | 0x80;
    bytes[8] = (bytes[8] & 0x3f) | 0x80;
    uuid::Uuid::from_bytes(bytes).to_string()
}

/// The names of a keyed list's elements (their local fields taken out), in
/// their order. Format 1: as `by` says, or the element itself. Format 2
/// (`Keyed::ids`): each element's own `id`; one without (made by hand), or
/// whose id another element of the list holds too, by the id derived from
/// the key format 1 named it by (`derived`): a stable key, which changing
/// what the element holds does not change for a session (its start, task
/// and project), and the same on every device. Elements format 1 named
/// alike are one entry, as they were in format 1.
fn names(elements: &[toml::Value], keyed: &Keyed) -> Vec<String> {
    if !keyed.ids {
        return elements.iter().map(|e| identity(e, keyed.by)).collect();
    }
    let mut ids: BTreeMap<&str, usize> = BTreeMap::new();
    for id in elements.iter().filter_map(own_id) {
        *ids.entry(id).or_default() += 1;
    }
    elements
        .iter()
        .map(|element| match own_id(element) {
            Some(id) if ids.get(id) == Some(&1) => id.to_string(),
            _ => derived(keyed.list, &identity(element, keyed.by)),
        })
        .collect()
}

/// A TOML file's entries: one per setting, one per element of a keyed list,
/// one per table kept whole; the settings that stay here left out.
fn toml_entries(text: &str, rules: &Rules) -> Result<Vec<(String, String)>, String> {
    let table: toml::Table = text.parse().map_err(|e: toml::de::Error| e.to_string())?;
    let mut out = Vec::new();
    for (name, value) in &table {
        flatten(vec![name.clone()], value, rules, &mut out);
    }
    Ok(out)
}

/// The record's name of a keyed list at `path`: its own at the top, its path within tables.
fn list_name(keyed: &Keyed, path: &[String]) -> String {
    if path.len() == 1 { keyed.list.to_string() } else { path.join(&SEP.to_string()) }
}

fn flatten(path: Vec<String>, value: &toml::Value, rules: &Rules, out: &mut Vec<(String, String)>) {
    if rules.local.iter().any(|rule| matches_rule(&path, rule)) {
        return;
    }
    if let toml::Value::Array(elements) = value
        && let Some(keyed) = keyed_at(rules, &path)
    {
        let list = list_name(keyed, &path);
        let elements: Vec<toml::Value> = elements
            .iter()
            .map(|element| {
                let mut element = element.clone();
                strip_local(&mut element, keyed.local);
                element
            })
            .collect();
        for (element, name) in elements.iter().zip(names(&elements, keyed)) {
            out.push((format!("{list}{SEP}{MARK}{name}"), leaf_text(element)));
        }
        return;
    }
    match value {
        toml::Value::Table(table) if !rules.whole.iter().any(|rule| matches_rule(&path, rule)) => {
            for (name, value) in table {
                let mut deeper = path.clone();
                deeper.push(name.clone());
                flatten(deeper, value, rules, out);
            }
        }
        _ => out.push((path.join(&SEP.to_string()), leaf_text(value))),
    }
}

// ---------------------------------------------------------------- writing entries

/// Writes entries into one file: each `(entry, value)`, `None` taking it out;
/// under the file's lock, as the window writes some of these files too
/// (the doses' record: `sioul_core::filelock`). Before the file changes, or
/// goes, `keep` keeps it as it was (`history`).
fn write_entries(store: &Store, path: &Path, changes: &[(&str, Option<&str>)], keep: impl FnOnce() -> Result<(), String>) -> Result<BTreeMap<String, String>, String> {
    sioul_core::filelock::with_lock(path, || {
        let new = rewritten(store, path, changes)?;
        // What the file holds once written, entry by entry, by hash: what the next look compares with.
        let written: BTreeMap<String, String> = new.as_deref().and_then(|bytes| entries_of(store, bytes)).unwrap_or_default().into_iter().map(|(entry, value)| (entry, hash(&value))).collect();
        let old = std::fs::read(path).ok();
        if old == new {
            return Ok(written);
        }
        // A doses' record not here that would hold no entry (only removals
        // came): nothing written. Written empty, with its witness, it would
        // read as lost and be repaired again and again.
        if old.is_none() && of_the_doses(store) && written.is_empty() {
            return Ok(written);
        }
        if old.is_some() {
            keep()?;
        }
        match new {
            // The doses' records as the window writes them (`write_witnessed`):
            // their bytes on the disk before they take the name, and their
            // witnesses made, so that a power cut after a mark received here
            // leaves a record lost, said, never a sound empty one (review of
            // 10 October 2026, R6).
            Some(bytes) if of_the_doses(store) => sioul_core::health::write_witnessed(path, &bytes)?,
            Some(bytes) => write_atomically(path, &bytes)?,
            None => match std::fs::remove_file(path) {
                Err(e) if e.kind() != std::io::ErrorKind::NotFound => return Err(format!("{}: {e}", path.display())),
                _ => {}
            },
        }
        Ok(written)
    })
}

/// The doses' records: the marks (`health-state.toml`), each dose's record
/// (`health-doses.toml`), and what each device did to remind it
/// (`health-reminders.toml`).
fn of_the_doses(store: &Store) -> bool {
    matches!(store.name.as_str(), "state/health-state.toml" | "state/health-doses.toml" | "state/health-reminders.toml")
}

/// What a file holds once entries are written into it; none when it goes.
fn rewritten(store: &Store, path: &Path, changes: &[(&str, Option<&str>)]) -> Result<Option<Vec<u8>>, String> {
    match store.shape {
        Shape::Whole => {
            let (_, value) = changes.last().ok_or("nothing")?;
            value.map(|value| B64.decode(value).map_err(|e| e.to_string())).transpose()
        }
        Shape::Files => Err(format!("{}: sealed apart", path.display())),
        Shape::Lines => {
            let text = text_to_write(path)?;
            let mut lines: Vec<String> = text.lines().map(str::to_string).collect();
            for (entry, value) in changes {
                let at = lines.iter().position(|l| l.trim() == *entry);
                match (value, at) {
                    (Some(_), None) => lines.push(entry.to_string()),
                    (None, Some(at)) => {
                        lines.remove(at);
                    }
                    _ => {}
                }
            }
            let mut text = lines.join("\n");
            if !text.is_empty() {
                text.push('\n');
            }
            Ok(Some(text.into_bytes()))
        }
        Shape::Toml(rules) => {
            let text = text_to_write(path)?;
            // A file here under another name than its record's (the projects'
            // file renamed): a list new to it takes its other name.
            let renamed = path.file_name() != Path::new(&store.name).file_name();
            Ok(Some(toml_write(&text, rules, changes, renamed)?.into_bytes()))
        }
    }
}

/// A file written whole beside its place under a hidden name, yours alone
/// (`new_private`), then renamed over it: never half a file, and its folders
/// made yours alone (`private_dirs`).
pub fn write_atomically(path: &Path, bytes: &[u8]) -> Result<(), String> {
    write_then_rename(path, bytes, false)
}

/// The same, the bytes on the disk before the name changes: a file whose loss
/// costs more than a minute's work (this computer's name and sharing, its memory).
pub(crate) fn write_synced(path: &Path, bytes: &[u8]) -> Result<(), String> {
    write_then_rename(path, bytes, true)
}

fn write_then_rename(path: &Path, bytes: &[u8], synced: bool) -> Result<(), String> {
    let fail = |e: std::io::Error| format!("{}: {e}", path.display());
    if let Some(parent) = path.parent() {
        private_dirs(parent).map_err(fail)?;
    }
    // A name starting with a dot: sync apps leave it alone (eDrive skips them,
    // Nextcloud's client by default), so a half-written file never travels.
    // Yours alone (`new_private`): the file it replaces takes its mode too.
    let temporary = temporary(path);
    let written = (|| {
        let mut file = new_private(&temporary)?;
        file.write_all(bytes)?;
        if synced {
            file.sync_all()?;
        }
        std::fs::rename(&temporary, path)
    })();
    if written.is_err() {
        let _ = std::fs::remove_file(&temporary);
    }
    written.map_err(fail)
}

/// A small file of the folder (a computer's notes, the seal, a claim), never
/// read past `SMALL_FILE`: one larger is no such file (whoever wrote it).
pub(crate) fn read_small(path: &Path) -> Option<String> {
    use std::io::Read;
    let mut text = String::new();
    std::fs::File::open(path).ok()?.take(SMALL_FILE + 1).read_to_string(&mut text).ok()?;
    (text.len() as u64 <= SMALL_FILE).then_some(text)
}

/// Small files of the folder are never read past this.
pub(crate) const SMALL_FILE: u64 = 64 << 10;

/// A hidden name beside `path` for a file being written, never another's:
/// two exchanges, two Sioul running, never write into one (".lease.md.4211-7.sioul.tmp").
pub(crate) fn temporary(path: &Path) -> PathBuf {
    static NEXT: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
    let name = path.file_name().map_or_else(|| "file".into(), |n| n.to_string_lossy().to_string());
    let n = NEXT.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
    path.with_file_name(format!(".{name}.{}-{n}{TEMPORARY}", std::process::id()))
}

/// How the names of files being written end: what is left of them after a
/// crash is cleaned after an hour (`clean_leftovers`).
pub(crate) const TEMPORARY: &str = ".sioul.tmp";

/// A file's last change set to `when`, through a handle that cannot write it.
/// On Windows, a handle on its attributes alone (`FILE_WRITE_ATTRIBUTES`):
/// closing a handle that could write the file has the antivirus read it
/// whole before the close returns, a quarter of a second and more for a
/// note of 24 MB, under the exchanges' lock when a put back dates it there
/// (CI's Windows job, 19 October 2026); an attribute's handle is not
/// scanned. Elsewhere a read handle: the owner sets its times
/// (`futimens`); where a file system asks for write access to set them, a
/// write handle after all.
pub(crate) fn set_time(path: &Path, when: std::time::SystemTime) -> std::io::Result<()> {
    #[cfg(windows)]
    {
        use std::os::windows::fs::OpenOptionsExt;
        const FILE_WRITE_ATTRIBUTES: u32 = 0x0100;
        const SYNCHRONIZE: u32 = 0x0010_0000;
        std::fs::OpenOptions::new().access_mode(FILE_WRITE_ATTRIBUTES | SYNCHRONIZE).open(path)?.set_modified(when)
    }
    #[cfg(not(windows))]
    {
        match std::fs::File::open(path)?.set_modified(when) {
            Err(e) if e.kind() == std::io::ErrorKind::PermissionDenied => std::fs::File::options().write(true).open(path)?.set_modified(when),
            done => done,
        }
    }
}

// ---------------------------------------------------------------- yours alone

/// What the sharing writes is yours alone on Unix, as the calls' logs are
/// (`sioul_core::calls::append_private`): its files 0600, the folders it
/// makes 0700, whatever the umask would let others read (the records, sealed
/// files, the files it brings in from your other devices, the copies it
/// keeps). A file there already with a wider mode is made yours alone the
/// next time the sharing writes it: written beside then renamed, it takes the
/// new file's mode; appended to or copied, its mode is set. Never by a sweep
/// of your folders. Where modes mean nothing (a phone's shared storage,
/// Windows), nothing is asked and nothing said. These folders made, with
/// their parents, each 0700; folders there already keep their mode.
pub fn private_dirs(dir: &Path) -> std::io::Result<()> {
    let mut builder = std::fs::DirBuilder::new();
    builder.recursive(true);
    #[cfg(unix)]
    std::os::unix::fs::DirBuilderExt::mode(&mut builder, 0o700);
    builder.create(dir)
}

/// A new file to write, yours alone (0600 on Unix); an error when one is there (`create_new`).
pub(crate) fn new_private(path: &Path) -> std::io::Result<std::fs::File> {
    let mut options = std::fs::OpenOptions::new();
    options.write(true).create_new(true);
    #[cfg(unix)]
    std::os::unix::fs::OpenOptionsExt::mode(&mut options, 0o600);
    options.open(path)
}

/// A file the sharing copied (a copy takes its source's mode) or appends to,
/// made yours alone (0600) when others could read it. Never through a link.
pub(crate) fn make_private(path: &Path) {
    #[cfg(unix)]
    {
        use std::os::unix::fs::PermissionsExt;
        if let Ok(metadata) = std::fs::symlink_metadata(path)
            && metadata.is_file()
            && metadata.permissions().mode() & 0o077 != 0
        {
            let _ = std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o600));
        }
    }
    #[cfg(not(unix))]
    let _ = path;
}

/// `from` copied to `to`, yours alone (`make_private`), as one version of it
/// held it whole (`filelock::copy_whole`: never a file replaced while it was
/// copied, whose old bytes may be zeros by the end).
pub(crate) fn copy_private(from: &Path, to: &Path) -> std::io::Result<()> {
    sioul_core::filelock::copy_whole(from, to)?;
    make_private(to);
    Ok(())
}

/// How far a rewritten file's size climbs before it starts again from the smallest.
const PAD_LIMIT: u64 = 4096;

/// A file written again in place must change size. The sharing asks little of
/// the sync app that carries the folder (docs/database.md, "What the sync app
/// must do"): new files and files that grow, copied some day, in any order.
/// Some sync apps tell a change by its size alone: eDrive (Murena's, on /e/OS)
/// downloads a file changed elsewhere only when its size differs from the copy
/// it holds (its `FileDiffUtils.getActionForFileDiff`), and others compare size
/// and time. So each rewrite is padded one step past the size of the file there
/// now, up to `PAD_LIMIT`, then from the smallest again: a copy held elsewhere
/// matches the newest only when a whole turn of rewrites (several hundred)
/// went by unseen, and the next rewrite mends it. `size(pad)` is the file's
/// size with `pad` characters of padding.
pub(crate) fn pad_for(path: &Path, size: impl Fn(usize) -> u64) -> usize {
    let base = size(0);
    let Ok(before) = std::fs::metadata(path).map(|m| m.len()) else { return 0 };
    if before < base + PAD_LIMIT {
        // One step past it: the padding grows a character at a time from about the right length.
        let mut pad = usize::try_from(before.saturating_sub(base) * 3 / 4).unwrap_or(0);
        while size(pad) <= before {
            pad += 1;
        }
        if size(pad) <= base + PAD_LIMIT {
            return pad;
        }
    }
    // A whole turn: the smallest again, never the size there now.
    (0..).find(|&pad| size(pad) != before).unwrap_or(0)
}

/// A TOML value as toml_edit holds it: a table stays a table, a list of tables a list of tables.
fn edit_item(text: &str) -> Result<toml_edit::Item, String> {
    let doc: toml_edit::DocumentMut = text.parse().map_err(|e: toml_edit::TomlError| e.to_string())?;
    let mut item = doc.as_table().get("v").cloned().ok_or("no value")?;
    match &mut item {
        toml_edit::Item::Value(value) => value.decor_mut().clear(),
        toml_edit::Item::Table(table) => table.decor_mut().clear(),
        _ => {}
    }
    Ok(item)
}

/// Sets or takes out entries in a TOML file's text, keeping the rest as
/// written; `renamed`: the file has another name than its record's (`Keyed::also`).
fn toml_write(text: &str, rules: &Rules, changes: &[(&str, Option<&str>)], renamed: bool) -> Result<String, String> {
    let mut doc: toml_edit::DocumentMut = text.parse().map_err(|e: toml_edit::TomlError| e.to_string())?;
    // The elements of keyed lists, list by list, named as the file holds them before any of them changes.
    let mut lists: Vec<(Vec<&str>, Vec<(&str, Option<&str>)>)> = Vec::new();
    for (entry, value) in changes {
        let path: Vec<&str> = entry.split(SEP).collect();
        if let Some((element, list)) = path.split_last()
            && let Some(id) = element.strip_prefix(MARK)
            && !list.is_empty()
        {
            match lists.iter_mut().find(|(known, _)| known.as_slice() == list) {
                Some((_, elements)) => elements.push((id, *value)),
                None => lists.push((list.to_vec(), vec![(id, *value)])),
            }
        } else {
            let item = value.map(edit_item).transpose()?;
            set_path(doc.as_table_mut(), &path, item.as_ref())?;
        }
    }
    for (list, elements) in lists {
        let keyed = keyed_named(rules, &list).ok_or_else(|| format!("{}: not a list", list.join(".")))?;
        let Some((name, within)) = list.split_last() else { continue };
        let Some(table) = table_at(doc.as_table_mut(), within, elements.iter().any(|(_, value)| value.is_some()))? else { continue };
        write_elements(table, keyed, name, &elements, renamed && within.is_empty())?;
    }
    Ok(doc.to_string())
}

/// The table at `path` below `table`: made when `make` (implicit, as a
/// file's own tables are), else none when it is not there. A table written
/// inline becomes a table of its own.
fn table_at<'t>(table: &'t mut toml_edit::Table, path: &[&str], make: bool) -> Result<Option<&'t mut toml_edit::Table>, String> {
    let Some((first, rest)) = path.split_first() else { return Ok(Some(table)) };
    if !make && !table.contains_key(first) {
        return Ok(None);
    }
    let item = table.entry(first).or_insert_with(|| {
        let mut new = toml_edit::Table::new();
        new.set_implicit(true);
        toml_edit::Item::Table(new)
    });
    if let Some(inline) = item.as_inline_table().cloned() {
        *item = toml_edit::Item::Table(inline.into_table());
    }
    let inner = item.as_table_mut().ok_or_else(|| format!("{first}: not a table"))?;
    table_at(inner, rest, make)
}

/// The names of a list's elements as read (local fields out); none for one that does not read.
fn names_read(elements: &[Option<toml::Value>], keyed: &Keyed) -> Vec<Option<String>> {
    let read: Vec<toml::Value> = elements.iter().flatten().cloned().collect();
    let mut named = names(&read, keyed).into_iter();
    elements.iter().map(|element| element.as_ref().and_then(|_| named.next())).collect()
}

fn set_path(table: &mut toml_edit::Table, path: &[&str], value: Option<&toml_edit::Item>) -> Result<(), String> {
    match path {
        [] => Ok(()),
        [last] => {
            match value {
                // A value replaced keeps its comments and spacing.
                Some(toml_edit::Item::Value(new)) if table.get(last).is_some_and(toml_edit::Item::is_value) => {
                    if let Some(old) = table.get_mut(last).and_then(toml_edit::Item::as_value_mut) {
                        let decor = old.decor().clone();
                        *old = new.clone();
                        *old.decor_mut() = decor;
                    }
                }
                Some(item) => {
                    table.insert(last, item.clone());
                }
                None => {
                    table.remove(last);
                }
            }
            Ok(())
        }
        [first, rest @ ..] => {
            if value.is_none() && !table.contains_key(first) {
                return Ok(());
            }
            let item = table.entry(first).or_insert_with(|| {
                let mut new = toml_edit::Table::new();
                new.set_implicit(true);
                toml_edit::Item::Table(new)
            });
            if let Some(inline) = item.as_inline_table().cloned() {
                *item = toml_edit::Item::Table(inline.into_table());
            }
            let inner = item.as_table_mut().ok_or_else(|| format!("{first}: not a table"))?;
            set_path(inner, rest, value)
        }
    }
}

/// Where a store is read, as the memory keeps it (`Memory::places`): its
/// path, the projects' file under its first name whichever it has, so that
/// renaming it (`sioul_core::projects::rename_file`) is no move: a move
/// rebuilds the file from the records, and a change made since would go.
fn place_of(store: &Store) -> String {
    let renamed = !store.folder && store.path.file_name().is_some_and(|name| name == sioul_core::projects::FILE);
    let path = if renamed { store.path.with_file_name(sioul_core::projects::OLD_FILE) } else { store.path.clone() };
    path.display().to_string()
}

/// A table read from an entry's text, placed in a file: written where it
/// stands, its own tables under it. toml_edit writes a file's tables in the
/// order of the positions they were read at; those read from the entry's
/// text would put them out of place (a project's routes under the project
/// after it). So its tables keep none, and it takes `at`, the position of
/// the one it replaces.
fn placed(mut table: toml_edit::Table, at: Option<isize>) -> toml_edit::Table {
    fn clear(table: &mut toml_edit::Table) {
        table.set_position(None);
        for (_, item) in table.iter_mut() {
            match item {
                toml_edit::Item::Table(inner) => clear(inner),
                toml_edit::Item::ArrayOfTables(list) => list.iter_mut().for_each(clear),
                _ => {}
            }
        }
    }
    clear(&mut table);
    table.set_position(at);
    table
}

/// The elements named so of a keyed list in `table` (`changes`: each name
/// and its value, none to take it out), all named as the list holds them
/// before any of them changes: replaced (their local fields kept), added, or
/// taken out. `list`:
/// its name in the records; at the top, the list keeps the name it has in
/// the file (`Keyed::also`).
fn write_elements(table: &mut toml_edit::Table, keyed: &Keyed, list: &str, changes: &[(&str, Option<&str>)], renamed: bool) -> Result<(), String> {
    let normal = |text: String| -> Option<toml::Value> {
        let mut element = leaf_value(&text).ok()?;
        strip_local(&mut element, keyed.local);
        Some(element)
    };
    let news: Vec<(&str, Option<toml_edit::Item>)> = changes.iter().map(|(id, value)| Ok((*id, value.map(edit_item).transpose()?))).collect::<Result<_, String>>()?;
    let others: &[&str] = if keyed.list == list { keyed.also } else { &[] };
    let name = std::iter::once(list).chain(others.iter().copied()).find(|n| table.contains_key(n)).unwrap_or(match others.first() {
        Some(other) if renamed => other,
        _ => list,
    });
    if !table.contains_key(name) {
        match news.iter().find_map(|(_, new)| new.as_ref()) {
            Some(toml_edit::Item::Table(_)) => {
                table.insert(name, toml_edit::Item::ArrayOfTables(toml_edit::ArrayOfTables::new()));
            }
            Some(_) => {
                table.insert(name, toml_edit::value(toml_edit::Array::new()));
            }
            None => return Ok(()),
        }
    }
    let mut gone: Vec<usize> = Vec::new();
    match table.get_mut(name) {
        Some(toml_edit::Item::ArrayOfTables(elements)) => {
            let named = names_read(&elements.iter().map(|t| normal(format!("[v]\n{t}"))).collect::<Vec<_>>(), keyed);
            let mut added: Vec<toml_edit::Table> = Vec::new();
            for (id, new) in news {
                let at = named.iter().position(|n| n.as_deref() == Some(id));
                match (new, at) {
                    (Some(toml_edit::Item::Table(mut element)), Some(at)) => {
                        if let Some(old) = elements.get(at) {
                            for field in keyed.local {
                                if let Some(kept) = old.get(field) {
                                    element.insert(field, kept.clone());
                                }
                            }
                            // Its id never stripped by a value written without one (a
                            // version from before the switch put back, an older
                            // Sioul's): it names this element.
                            if keyed.ids
                                && !element.contains_key("id")
                                && let Some(id) = old.get("id")
                            {
                                element.insert("id", id.clone());
                            }
                        }
                        if let Some(place) = elements.get_mut(at) {
                            let position = place.position();
                            *place = placed(element, position);
                        }
                    }
                    (Some(toml_edit::Item::Table(element)), None) => added.push(element),
                    (None, Some(at)) => gone.push(at),
                    _ => {}
                }
            }
            for element in added {
                elements.push(placed(element, None));
            }
            gone.sort_unstable();
            for at in gone.into_iter().rev() {
                elements.remove(at);
            }
        }
        Some(toml_edit::Item::Value(toml_edit::Value::Array(elements))) => {
            let named = names_read(&elements.iter().map(|v| normal(format!("v = {v}"))).collect::<Vec<_>>(), keyed);
            let mut added: Vec<toml_edit::Value> = Vec::new();
            for (id, new) in news {
                let at = named.iter().position(|n| n.as_deref() == Some(id));
                match (new, at) {
                    (Some(toml_edit::Item::Value(element)), Some(at)) => {
                        elements.replace(at, element);
                    }
                    (Some(toml_edit::Item::Value(element)), None) => added.push(element),
                    (None, Some(at)) => gone.push(at),
                    _ => {}
                }
            }
            for element in added {
                elements.push(element);
            }
            gone.sort_unstable();
            for at in gone.into_iter().rev() {
                elements.remove(at);
            }
            elements.fmt();
        }
        _ => return Err(format!("{name}: not a list")),
    }
    Ok(())
}

// ---------------------------------------------------------------- the seal

/// The folder's seal: how the key is made from the passphrase, and a value to
/// check it with. The same on every computer; the passphrase never written.
#[derive(Debug, Serialize, Deserialize)]
struct SealFile {
    version: u32,
    salt: String,
    memory_kib: u32,
    passes: u32,
    check: String,
}

const CHECK: &[u8] = b"sioul: the passphrase is right";

/// Why sharing cannot start.
#[derive(Debug, PartialEq, Eq)]
pub enum Refused {
    /// Not the passphrase chosen on the first computer.
    WrongPassphrase,
    Other(String),
}

fn derive(passphrase: &str, salt: &[u8], memory_kib: u32, passes: u32) -> Result<[u8; 32], String> {
    let params = argon2::Params::new(memory_kib, passes, 1, Some(32)).map_err(|e| e.to_string())?;
    let mut key = [0u8; 32];
    argon2::Argon2::new(argon2::Algorithm::Argon2id, argon2::Version::V0x13, params).hash_password_into(passphrase.as_bytes(), salt, &mut key).map_err(|e| e.to_string())?;
    Ok(key)
}

/// Whether `bytes` are a seal of Sioul's (a folder's `seal.toml`): a few
/// lines that read as one, with a salt and a check. Says nothing of the
/// passphrase (`key_for` does): for finding the folder on a server
/// (`remote::seek`).
pub fn is_seal(bytes: &[u8]) -> bool {
    bytes.len() <= 4096 && std::str::from_utf8(bytes).ok().and_then(|text| toml::from_str::<SealFile>(text).ok()).is_some_and(|seal| !seal.salt.is_empty() && !seal.check.is_empty())
}

/// The key for a folder: made from the passphrase and the folder's seal, which
/// the first computer writes (64 MiB, 3 passes: half a second, once per computer).
pub fn key_for(folder: &Path, passphrase: &str) -> Result<[u8; 32], Refused> {
    key_with(folder, passphrase, 64 * 1024, 3)
}

fn key_with(folder: &Path, passphrase: &str, memory_kib: u32, passes: u32) -> Result<[u8; 32], Refused> {
    let path = folder.join("seal.toml");
    if path.exists() {
        // Written by Sioul in a few lines: one larger is no seal of its.
        let text = read_small(&path).ok_or_else(|| Refused::Other(format!("{}: not a seal", path.display())))?;
        let seal: SealFile = toml::from_str(&text).map_err(|e| Refused::Other(format!("{}: {e}", path.display())))?;
        // The folder passes through others' servers: a seal asking far more than
        // Sioul writes (64 MiB, 3 passes) would only exhaust this computer.
        if seal.memory_kib > 1 << 20 || seal.passes > 16 {
            return Err(Refused::Other(format!("{}: {} KiB, {} passes", path.display(), seal.memory_kib, seal.passes)));
        }
        let salt = B64.decode(&seal.salt).map_err(|e| Refused::Other(e.to_string()))?;
        let key = derive(passphrase, &salt, seal.memory_kib, seal.passes).map_err(Refused::Other)?;
        return match open(&key, "check", &seal.check) {
            Some(plain) if plain == CHECK => Ok(key),
            _ => Err(Refused::WrongPassphrase),
        };
    }
    let mut salt = [0u8; 16];
    OsRng.fill_bytes(&mut salt);
    let key = derive(passphrase, &salt, memory_kib, passes).map_err(Refused::Other)?;
    let seal = SealFile { version: 1, salt: B64.encode(salt), memory_kib, passes, check: seal(&key, "check", CHECK) };
    let text = format!("# Sioul: how your devices' shared records are sealed (docs/database.md).\n{}", toml::to_string(&seal).map_err(|e| Refused::Other(e.to_string()))?);
    private_dirs(folder).map_err(|e| Refused::Other(format!("{}: {e}", folder.display())))?;
    write_atomically(&path, text.as_bytes()).map_err(Refused::Other)?;
    Ok(key)
}

/// The sharing folder as each exchange finds it first (review of 5 October
/// 2026, F5 and F20). Gone (a disk not mounted, a sync app's folder moved):
/// an error, and nothing is made, read or written (`share-no-seal`), never a
/// new empty folder whose files would later meet the real ones as conflicted
/// copies. Else its seal: none (a seal that does not read, an empty
/// placeholder of one, is none), or whether it opens with this device's key,
/// and its salt (which sharing it is).
/// Gone, or not opening, where this device saw it open before
/// (`Memory::seal_seen`: a folder made again by a sync app, another device's
/// seal put in its place), nothing is written either, said (`share-no-seal`,
/// `share-sealed-otherwise`): never under a key the others lack; sharing set
/// up again with the passphrase the folder's seal holds mends it.
fn sealed_for(folder: &Path, key: &[u8; 32]) -> Result<Option<(bool, String)>, ()> {
    if !folder.is_dir() {
        return Err(());
    }
    let Some(seal) = read_small(&folder.join("seal.toml")).and_then(|text| toml::from_str::<SealFile>(&text).ok()) else { return Ok(None) };
    Ok(Some((open(key, "check", &seal.check).is_some_and(|plain| plain == CHECK), seal.salt)))
}

pub(crate) fn seal(key: &[u8; 32], bound: &str, plain: &[u8]) -> String {
    let cipher = XChaCha20Poly1305::new(key.into());
    let nonce = XChaCha20Poly1305::generate_nonce(&mut OsRng);
    let sealed = cipher.encrypt(&nonce, Payload { msg: plain, aad: bound.as_bytes() }).unwrap_or_default();
    B64.encode([nonce.as_slice(), &sealed].concat())
}

pub(crate) fn open(key: &[u8; 32], bound: &str, text: &str) -> Option<Vec<u8>> {
    let bytes = B64.decode(text).ok()?;
    if bytes.len() < 24 {
        return None;
    }
    let (nonce, sealed) = bytes.split_at(24);
    XChaCha20Poly1305::new(key.into()).decrypt(XNonce::from_slice(nonce), Payload { msg: sealed, aad: bound.as_bytes() }).ok()
}

// ---------------------------------------------------------------- this computer

/// This computer, as sharing knows it: its name, the machine it was made on
/// (a copied configuration on another machine gets a name of its own), the
/// folder it shares through.
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
pub struct Here {
    #[serde(default)]
    pub id: String,
    #[serde(default)]
    pub machine: String,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub folder: Option<String>,
    /// The parts this device shares or not, as chosen here (`PARTS`): never
    /// shared, each device chooses its own.
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    pub parts: BTreeMap<String, bool>,
    /// Whether a sync app carries this device's notes folder, as you said on
    /// a phone, where Sioul cannot read the sync apps' settings; none: guessed
    /// (the app's `notes_carried`). Never shared.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub notes_carried: Option<bool>,
    /// The notes folder that answer was given for: it counts for that folder
    /// alone; the notes moved (into a folder a sync app carries, or out of
    /// one), it is asked again, guessed meanwhile (review of 10 October 2026,
    /// R12). None: an answer given before, taken for the notes folder of
    /// then (the app writes it in at its next start).
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub notes_carried_for: Option<String>,
}

impl Here {
    /// Whether this device shares a part: as chosen here, else as before parts had switches.
    pub fn shares(&self, part: &str, config: &Config) -> bool {
        self.parts.get(part).copied().unwrap_or_else(|| shared_by_default(part, config))
    }

    pub fn path(state: &Path) -> PathBuf {
        state.join("share").join("here.toml")
    }

    /// This computer's name, made once.
    pub fn load(state: &Path) -> Here {
        let path = Here::path(state);
        let mut here: Here = std::fs::read_to_string(&path).ok().and_then(|t| toml::from_str(&t).ok()).unwrap_or_default();
        let machine = machine();
        if here.id.is_empty() || (!machine.is_empty() && here.machine != machine) {
            here.id = uuid::Uuid::new_v4().to_string();
            here.machine = machine;
            let _ = here.save(state);
        }
        here
    }

    /// Its bytes on the disk before its name changes: lost, this computer would take another name.
    pub fn save(&self, state: &Path) -> Result<(), String> {
        write_synced(&Here::path(state), toml::to_string(self).map_err(|e| e.to_string())?.as_bytes())
    }

    /// The folder shared through, `~` expanded.
    pub fn folder_path(&self) -> Option<PathBuf> {
        self.folder.as_deref().filter(|f| !f.is_empty()).map(sioul_core::config::expand_home)
    }

    /// What you said of the notes folder `notes` (`notes_carried`), when you
    /// said it of that folder.
    pub fn notes_said(&self, notes: &Path) -> Option<bool> {
        self.notes_carried.filter(|_| self.notes_carried_for.as_deref().is_none_or(|said| Path::new(said) == notes))
    }
}

/// A hash of the machine's own id (`/etc/machine-id`), else of its name.
fn machine() -> String {
    let id = ["/etc/machine-id", "/var/lib/dbus/machine-id"].iter().find_map(|p| std::fs::read_to_string(p).ok()).or_else(|| std::env::var("COMPUTERNAME").ok()).or_else(|| std::fs::read_to_string("/etc/hostname").ok()).unwrap_or_default();
    let id = id.trim();
    if id.is_empty() { String::new() } else { format!("{:016x}", fnv(id.as_bytes())) }
}

fn fnv(bytes: &[u8]) -> u64 {
    bytes.iter().fold(0xcbf2_9ce4_8422_2325u64, |hash, b| (hash ^ u64::from(*b)).wrapping_mul(0x0100_0000_01b3))
}

pub(crate) fn hash(value: &str) -> String {
    format!("{:016x}", fnv(value.as_bytes()))
}

// ---------------------------------------------------------------- memory

/// What this computer remembers between two exchanges (`memory.json`);
/// what it remembers of files sealed apart aside (`files.json`, `Sealed`): a
/// big notes folder makes that long, and what the doses and claims ask
/// (`heard`, `written`, `traffic`) reads the rest alone.
#[derive(Debug, Default, Serialize, Deserialize)]
struct Memory {
    #[serde(default)]
    computer: String,
    /// The last clock given or read.
    #[serde(default)]
    clock: u64,
    /// This computer's round (its file) and the records in it.
    #[serde(default)]
    round: u32,
    #[serde(default)]
    seq: u64,
    /// The size of this computer's file after its last writing: shorter, a sync
    /// app put back an older copy of it, and a new one starts (`exchange`).
    #[serde(default)]
    own_size: u64,
    /// The size of this computer's file when its round began: a new round once
    /// it grew `ROUND_SIZE` past it (a round opening on more than that does not
    /// start another one each minute).
    #[serde(default)]
    round_base: u64,
    /// The last round that opens on every entry this computer holds (a full
    /// round, `new_round`); the rounds after it continue it, `SEGMENT` each at
    /// most. 0: kept by an older Sioul, whose every round was full.
    #[serde(default)]
    full_round: u32,
    /// What this computer appended since its last full round (bytes).
    #[serde(default)]
    grown: u64,
    /// The size of its last full round's file once it opened (bytes): the
    /// next one waits until as much was appended since (`full_round_after`).
    /// 0: not known yet (a memory from before 15 October 2026), read from
    /// that round's file in the folder.
    #[serde(default, skip_serializing_if = "is_zero_u64")]
    full_size: u64,
    /// The number of the last line of the round before, when this round
    /// continues it (`SEGMENT`): said on its first line (`Turn::p`). 0 for a
    /// full round.
    #[serde(default, skip_serializing_if = "is_zero_u64")]
    continues: u64,
    /// A full round is owed: the last round after lost lines of this
    /// computer's (its file cut short) could not restate all it holds (a file
    /// not readable then), and a reader that had not read those lines waits
    /// for a full round; or another device asks for one (`Seen::full`).
    /// Written as soon as all reads again (`new_round`).
    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
    owed: bool,
    /// How long the full round owed waited for a connection not metered,
    /// exchanges running (milliseconds, as `Awaited::waited`), and the last
    /// exchange that counted it: past `OWED_METERED`, it goes all the same.
    #[serde(default, skip_serializing_if = "is_zero_i64")]
    owed_waited: i64,
    #[serde(default, skip_serializing_if = "is_zero_i64")]
    owed_last: i64,
    /// This memory enters a round only once the one before was read to its
    /// end (`Turn`). One kept before (10 October 2026) may have moved past
    /// the end of a round not read whole: every other computer's kept rounds
    /// are read again once, what was known already changing nothing.
    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
    turns: bool,
    /// The folder's seal was seen here, opening with this device's key: gone
    /// from it later, nothing is written there until it is back (`sealed_for`).
    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
    seal_seen: bool,
    /// The salt of that seal: which sharing this memory is of. Another one
    /// met (another folder set up with this memory kept): started anew.
    #[serde(default, skip_serializing_if = "String::is_empty")]
    seal_salt: String,
    /// When this device last found its own records in the folder ahead of
    /// its memory (milliseconds): again soon after, another device writes
    /// under its name (`share-twin`).
    #[serde(default, skip_serializing_if = "is_zero")]
    ahead_at: i64,
    /// Every version of each draft met here, by its key: made here, received,
    /// or passed over (`DRAFTS`, `sent_meanwhile`). Forgotten with the draft's entry.
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    drafts: BTreeMap<String, BTreeSet<String>>,
    /// When this computer's sealed files were last looked for, and the
    /// history and leftovers last tidied (milliseconds).
    #[serde(default)]
    checked: i64,
    #[serde(default)]
    tidied: i64,
    /// When what a crash left half written among the folder's sealed files
    /// was last cleaned (milliseconds): once a day, since listing `blobs/`
    /// reads thousands of names (on a phone, through its storage's slow layer).
    #[serde(default, skip_serializing_if = "is_zero")]
    cleaned: i64,
    /// Others' records already read in: done once, when sharing starts.
    #[serde(default)]
    joined: bool,
    /// How far each other computer's records were read: its round and the bytes read in it.
    #[serde(default)]
    read: BTreeMap<String, (u32, u64)>,
    /// The last record read from each other computer: its round and number.
    /// Its claims say how far it wrote (`lease::Claim::wrote`): read that far,
    /// everything it said until then is known here (docs/health.md, "Knowing").
    #[serde(default)]
    read_n: BTreeMap<String, (u32, u64)>,
    /// The last line of each other computer met here, read or found damaged
    /// (its number then inferred: the one after the line met before): its
    /// round and number. A round continuing the one before is entered once
    /// that one was met to its last line (`Turn`), whatever was lost in it,
    /// which `read_n` keeps said for the doses. Missing (a memory kept before
    /// 10 October 2026): as `read_n`.
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    met: BTreeMap<String, (u32, u64)>,
    /// Each other computer's round waiting here for the end of the one
    /// before (`Turn`), and how long it waited, exchanges running: passed
    /// over as lost past `AWAITED`. (`awaited`, which counted the clock's
    /// time, is left aside.)
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    waiting_for: BTreeMap<String, Awaited>,
    /// When a line of another computer's could not be read here (Unix seconds): what it said is lost.
    #[serde(default)]
    broken: BTreeMap<String, i64>,
    /// Files whose entries are read again from every computer's records, this
    /// one's too, at the next exchange (`rebuild`): a record lost here comes back.
    #[serde(default)]
    rebuild: BTreeSet<String>,
    /// Of those, the files rebuilt without being set aside (`rebuild`): what
    /// they hold may be what was there before, so at that exchange they join
    /// as a store new here does, read from the records first, only what the
    /// records lack going out. Not those set aside in the same step
    /// (`rebuild_then`): what they hold was written after the repair, and goes
    /// out as changes made here (review of 15 October 2026, RF-J).
    #[serde(default, skip_serializing_if = "BTreeSet::is_empty")]
    rejoin: BTreeSet<String>,
    /// Others' changes not written yet (their file could not be read, or is
    /// one this version does not know): tried again at each exchange.
    #[serde(default)]
    pending: BTreeMap<String, (Option<String>, u64, String)>,
    /// Each entry's last change: its clock, the computer that made it, its value's hash ("" once taken out).
    #[serde(default)]
    entries: BTreeMap<String, Known>,
    /// Where each store was read (its path): a store new here, or moved (another
    /// notes folder), joins as a new computer would (`exchange`).
    #[serde(default)]
    places: BTreeMap<String, String>,
    /// Files found empty or gone after holding entries, since when (milliseconds):
    /// their entries count as taken out only once that has lasted (`EMPTIED_WAIT`).
    #[serde(default)]
    emptied: BTreeMap<String, i64>,
    /// The files as last read.
    #[serde(default)]
    files: BTreeMap<String, Stat>,
    /// When each part last sent a change, and last received one here (Unix seconds).
    #[serde(default)]
    traffic: BTreeMap<String, (i64, i64)>,
    /// The format this device writes (`FORMAT`): 0 (an older Sioul's memory)
    /// or 1 until every device in the sharing reads format 2 (`format_open`),
    /// then 2, once and for all (`switch_format`).
    #[serde(default)]
    format: u32,
    /// A record in format 2 met while this device still wrote format 1:
    /// another device writes it already; this one does from its next exchange.
    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
    switch: bool,
    /// Each format-1 entry format 2 renamed: what format 1 last said under it
    /// here, by a hash of its name (`Floor`, `floor_key`): read again, format
    /// 1 at or below it is passed over (`translate`).
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    floors: BTreeMap<String, Floor>,
    /// Others' changes in a format this device does not write yet (format 2,
    /// before its switch) or does not know (a newer Sioul's): their value,
    /// clock, computer and format, written once it can.
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    waiting: BTreeMap<String, (Option<String>, u64, String, u32)>,
    /// Parts met in a format newer than this Sioul knows (`Newer`). Nothing of
    /// them is sent from here, nor written here, until this Sioul is updated,
    /// or their writers no longer count (`release_newer`) (`share-newer`).
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    newer: BTreeMap<String, Newer>,
    /// Parts no longer held for writers that no longer count: their records
    /// in that newer format up to this clock, read again, are passed over.
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    released: BTreeMap<String, u64>,
    /// Changes found here while their part was held (`newer`): when they were
    /// found (a clock) and what they held (a hash; "" taken out). Once the part
    /// is no longer held they go out at that time, not later: a newer
    /// device's later change still wins over them.
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    held: BTreeMap<String, (u64, String)>,
    /// When each other device was last heard of here, from its records read
    /// (milliseconds, its clock): what tells a device still there from one
    /// gone, with its sealed entry, never its plain notes (`present`).
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    heard_at: BTreeMap<String, i64>,
    /// Devices you said are gone (`forget_device`): when they were last heard
    /// of then (milliseconds). They count again once heard of later.
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    forgotten: BTreeMap<String, i64>,
    /// Each other device's latest sealed entry seen here (`note_entries`): an
    /// older copy put back in the folder never lowers what is known of it.
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    seen: BTreeMap<String, crate::devices::Entry>,
    /// The devices known here by records read before (`read_n`) of which no
    /// clock is known at all (their rounds gone from the folder, read by a
    /// memory from before `heard_at` was kept, none of their changes the last
    /// word here), with when this device first found them so (milliseconds,
    /// its clock): what ages them (`present`), so that one gone for good
    /// stops counting 180 days later.
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    unclocked: BTreeMap<String, i64>,
    /// The other devices that count, as the last exchange found them by
    /// sealed facts (`counted`), and those sealed facts say no longer count
    /// (they left, you forgot them, another replaces them, silent
    /// `SILENT_DAYS`): who holds this device's rounds back, as the sending
    /// reads it without the key (`rounds_past`). None in a memory saved
    /// before 16 October 2026: the rule as it was, until the next exchange.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    counting: Option<BTreeSet<String>>,
    #[serde(default, skip_serializing_if = "BTreeSet::is_empty")]
    uncounted: BTreeSet<String>,
    /// Each device that no longer counts by a sealed fact and has rounds
    /// here: the round below which they are past their time (`departed_rounds`),
    /// taken out of the folder here, never fetched again, taken out of the
    /// server by the sending (`departed_past`).
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    departed: BTreeMap<String, u32>,
    /// Sealed files swept here as written by a device that no longer counts
    /// (`sweep_theirs`), and when (milliseconds): the sending takes each out
    /// of the server too (`swept_theirs`); forgotten after `UNUSED_DAYS`, or
    /// once one is back in the folder (a device uses that content again).
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    taken: BTreeMap<String, i64>,
    /// Notes and papers gone many at once from this device, held until they
    /// leave by themselves (`GONE_GRACE`), summed up for the Porch and
    /// Settings (`withheld`): as the last exchange found them.
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    withheld: Vec<Withheld>,
    /// Devices whose files you removed from the folder here ("Remove its
    /// files", `remove_device_files`), and what went (`RemovedDevice`). What
    /// they had written then is never fetched again, and the sending takes
    /// what is still on the server out; what such a device writes after
    /// (still in use, it sends everything again) comes as any device's, and
    /// it counts again.
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    removed_devices: BTreeMap<String, RemovedDevice>,
    /// What the whole lists of format 1 seen here held (lists format 2
    /// divides), by format 2's names: each list record read, at its clock, in
    /// whatever order (`note_whole_record`), and, while this device writes
    /// format 1, the file between exchanges (`note_whole_lists`); what a later
    /// list took out is passed over at or below that clock (`below_whole_floor`)
    /// and kept with the list's floor at the switch (`Floor::removed`).
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    lists: BTreeMap<String, WholeList>,
    /// What it remembers of files sealed apart, in `files.json` beside.
    #[serde(skip)]
    sealed: Sealed,
    /// `memory.json` as `save` last wrote it, kept with the memory in this
    /// process (`Memory::keep`); never written itself.
    #[serde(skip)]
    saved: Vec<u8>,
}

/// What this computer remembers of files sealed apart (notes, papers), beside
/// its memory (`files.json`). Their entries, their files as last read and the
/// changes waiting for them are kept here too, out of `memory.json`.
#[derive(Debug, Default, Serialize, Deserialize)]
struct Sealed {
    #[serde(default)]
    computer: String,
    #[serde(default)]
    entries: BTreeMap<String, Known>,
    #[serde(default)]
    files: BTreeMap<String, Stat>,
    #[serde(default)]
    pending: BTreeMap<String, (Option<String>, u64, String)>,
    /// For each change waiting, the content it replaces where it was made: its base.
    #[serde(default)]
    bases: BTreeMap<String, String>,
    /// For each change waiting, every content the others' records named for
    /// its file so far, versions and bases (`receive`).
    #[serde(default)]
    named: BTreeMap<String, BTreeSet<String>>,
    /// The sealed files this computer put in the folder (`blobs`): when a
    /// record last pointed to each (milliseconds), and the size it sealed.
    #[serde(default)]
    mine: BTreeMap<String, (i64, u64)>,
    /// Sealed files the others' records named lately, by name: when this
    /// device first read such a record (milliseconds); never from its own
    /// records, nor from a record read again. None is taken out within the
    /// time sealed files stay (`unused_days`: two weeks, or 90 days) of that.
    #[serde(default)]
    named_at: BTreeMap<String, i64>,
    /// Sealed files of the others' notes and papers that stopped being
    /// current here (replaced, taken out, or passed by a later change read in
    /// the same exchange), by name: the device whose record named it, and its
    /// last use here (milliseconds). Its writer sweeps it (`blobs::sweep`);
    /// forgotten here once it left the folder. A writer that no longer counts
    /// by a sealed fact never will (a phone dead for good): swept here then,
    /// `unused_days` after that last use (`sweep_theirs`). Empty in an older
    /// Sioul's memory, which passes it over.
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    theirs: BTreeMap<String, (String, i64)>,
    /// Sealed files of notes and papers this device sealed (`mine`) whose
    /// file was taken out, by name: the device whose record took it out, and
    /// that record's round. Each goes as soon as every device that counts
    /// read past that round, with `blobs::sweep`'s care, rather than two weeks
    /// on (`removed_due`): a device that takes such a file out keeps it
    /// among its earlier versions as a copy (`history::keep_moved`), and
    /// nothing else needs it. Empty in an older Sioul's memory, which passes
    /// it over.
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    removed: BTreeMap<String, (String, u32)>,
    /// Sealed files found damaged, as they were then (`blobs::fingerprint`):
    /// not opened again until another copy comes.
    #[serde(default)]
    damaged: BTreeMap<String, (u64, u64, u64)>,
    /// Changes waiting for their sealed file, since when (milliseconds): said after a day.
    #[serde(default)]
    missing: BTreeMap<String, i64>,
    /// Changes that could not be written here (a full disk, a name a folder
    /// takes here): their sealed file, when to try again, how many times so far.
    #[serde(default)]
    failing: BTreeMap<String, (String, i64, u32)>,
    /// Files gone here, since when (milliseconds): taken out elsewhere once
    /// gone a while (`EMPTIED_WAIT`).
    #[serde(default)]
    gone: BTreeMap<String, i64>,
    /// Folders whose files gone at once you said to take out everywhere
    /// (`confirm_gone`), by their place in the records ("files/notes/disk/"):
    /// a folder that lists empty, or a whole store; a folder below one
    /// confirmed is confirmed too, never one beside it.
    #[serde(default)]
    confirmed: BTreeSet<String>,
    /// Files held after going many at once that you said to take out now
    /// ("Take them out now", `confirm_withheld`): those alone, never a
    /// folder that lists empty beside them (review of 17 October 2026, M1).
    #[serde(default, skip_serializing_if = "BTreeSet::is_empty")]
    confirmed_files: BTreeSet<String>,
    /// Files held as gone many at once (`GONE_GRACE`): held so until their
    /// own grace ends, whatever goes or comes back beside them, so that a
    /// bulk's remainder never leaves days early (review of 17 October 2026, L3).
    #[serde(default, skip_serializing_if = "BTreeSet::is_empty")]
    bulk: BTreeSet<String>,
    /// Sealed files whose content a change of a note or paper replaced, made
    /// here or read in another device's records (its base), by name, and
    /// when (milliseconds), for `history::SEALED_DAYS` and a day: a device
    /// that received such a change may keep that content by reference among
    /// its earlier versions. None of them leaves early (`removed_due`), and a
    /// copy of the folder kept by Sioul itself keeps them (`needed`)
    /// (review of 17 October 2026, M2).
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    replaced: BTreeMap<String, i64>,
    /// Sioul keeping the folder itself: the sealed files its copy keeps
    /// though the server may no longer list them, by name, for the pull,
    /// which has no key (`needed_sealed`): the contents of the current notes
    /// and papers of the parts shared here, the files held after going many
    /// at once among them (a listing that leaves files out never takes what
    /// a record names: review of 18 October 2026, L-1), those changes waiting
    /// here name, and those a change replaced lately (`replaced`: an earlier
    /// version kept here by reference opens from that copy). Kept here, out
    /// of `memory.json`, which is written at every exchange. None in an older
    /// Sioul's files, until this one's first exchange says it: the pull lets
    /// go of nothing meanwhile.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    needed: Option<BTreeSet<String>>,
    /// When this computer's sealed files were last looked for, and the
    /// history and leftovers last tidied (milliseconds): kept in `memory.json`
    /// now (`Memory::checked`, `tidied`), so that this file, large with many
    /// notes or texts, is written only when what it holds changes. Read once,
    /// from an older Sioul's.
    #[serde(default, skip_serializing)]
    checked: i64,
    #[serde(default, skip_serializing)]
    tidied: i64,
    /// The spam filter's tables this computer sealed in the folder, by name,
    /// oldest first: past the newest `KEPT_TABLES`, the older go from the
    /// folder at once rather than 90 days on (`prune_tables`). This device's
    /// own memory, never shared; empty in an older Sioul's, whose tables go
    /// as before.
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    tables: Vec<String>,
    /// Large notes and papers found changed since they were last read, and
    /// since when (milliseconds, this computer's clock): each is read and
    /// sealed once it has not changed for ten minutes, or an hour after that
    /// time (`LARGE_SETTLES`). Kept here rather than in each file's last look
    /// (`Stat::seen`, when it was last read), which cannot tell a file quiet
    /// for an hour, then saved again, from one changing for an hour, and
    /// which a new file has none of (review of 15 October 2026, M2).
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    changing: BTreeMap<String, i64>,
}

/// The spam filter's tables a computer keeps in the folder: the one in use
/// and the one before it, for a device that has not read the newest record
/// yet. Each training that does no worse seals a new one, about two
/// megabytes, once a week at most (docs/spam-filter.md); kept 90 days each,
/// they would be a dozen, and a phone whose sync app never deletes a file
/// (eDrive) would keep every one it brought.
const KEPT_TABLES: usize = 2;

/// This computer's own spam filter's tables past the newest `KEPT_TABLES`
/// taken out of the folder now, unless a record of this computer's names
/// one again (`used`: a table put back): that one goes by the usual rule.
/// Never another device's file: only those this computer sealed (`mine`).
/// A device that reads only the newest record, as every Sioul does, never
/// asks for them; an earlier version of the table kept by reference on
/// another device can no longer be put back from the folder.
fn prune_tables(folder: &Path, sealed: &mut Sealed, used: &BTreeSet<String>) {
    sealed.tables.retain(|name| sealed.mine.contains_key(name));
    while sealed.tables.len() > KEPT_TABLES {
        let old = sealed.tables.remove(0);
        if used.contains(&old) {
            continue;
        }
        let _ = std::fs::remove_file(folder.join("blobs").join(&old));
        sealed.mine.remove(&old);
    }
}

/// A change read in as the winner of its entry. The content of a file sealed
/// apart that another device's change named, and that this one passes,
/// noted as theirs (`theirs_now`, `Sealed::theirs`).
fn win(winners: &mut BTreeMap<String, (Option<String>, u64, String)>, theirs_now: &mut Vec<(String, String)>, computer: &str, key: String, change: (Option<String>, u64, String)) {
    let files = key.starts_with(FILES).then(|| key.clone());
    if let Some((Some(value), _, writer)) = winners.insert(key, change)
        && writer != computer
        && let Some(key) = files
    {
        let h = value_hash(&key, &value);
        if !h.is_empty() {
            theirs_now.push((h, writer));
        }
    }
}

/// The contents of notes and papers this device sealed whose file was taken
/// out (`removed_now`: by this device, or read in another device's record),
/// each with that record's writer and round (`Sealed::removed`); each is due
/// once every device that counts read past that round (`readers`: a reader
/// without notes in the folder read none, and holds it): its last use then
/// counts as `days` ago, and `blobs::sweep_after` takes it out at once, with
/// its care all the same: never a content used again or named lately, never
/// one made fresh within `days` (on a phone under eDrive, which keeps every
/// sealed file it brought, a content used again past that is made fresh, and
/// sent there again). Nothing else needs it: a device taking such a file out
/// keeps it as a copy among its earlier versions (`history::keep_moved`), and
/// a device joining, or back after long, reads that it was taken out. Only
/// when `early`: every device that counts says it keeps such a file so
/// (`blobs::KEEPING_MOVED`); an earlier Sioul keeps it by reference, its
/// content needed in the folder for `history::SEALED_DAYS`. Until 17 October
/// 2026 such a content stayed two weeks more (90 days while an older Sioul
/// counts, as it still does: `days`), as it does when not `early`. Forgotten
/// once swept, or once current again.
#[allow(clippy::too_many_arguments)]
fn removed_due(folder: &Path, key: &[u8; 32], sealed: &mut Sealed, removed_now: Vec<(String, String, u32)>, current: &BTreeSet<String>, reading: &BTreeSet<String>, last: &mut BTreeMap<String, i64>, days: i64, early: bool, now_ms: i64) {
    for (h, writer, round) in removed_now.into_iter().filter(|(h, _, _)| !current.contains(h)) {
        let name = crate::blobs::name(key, &h);
        if sealed.mine.contains_key(&name) {
            sealed.removed.insert(name, (writer, round));
        }
    }
    let current: BTreeSet<String> = current.iter().map(|h| crate::blobs::name(key, h)).collect();
    sealed.removed.retain(|name, _| sealed.mine.contains_key(name) && !current.contains(name));
    if !early {
        return;
    }
    let read_past = |writer: &str, round: u32| reading.iter().filter(|r| r.as_str() != writer).all(|r| read_seen(folder, r).and_then(|s| s.read.get(writer).copied()).unwrap_or(0) > round);
    // Never one a change replaced lately (`Sealed::replaced`): the same bytes
    // may be another note's earlier version, kept by reference (review of 17
    // October 2026, M2); it goes in its time.
    for (name, (writer, round)) in &sealed.removed {
        if read_past(writer, *round)
            && !sealed.replaced.contains_key(name)
            && let Some(at) = last.get_mut(name)
        {
            *at = (*at).min(now_ms - days * DAY);
        }
    }
}

/// The parts whose files are sealed apart (`Shape::Files`): what one of their
/// records names is a sealed file of the folder, the same bytes the same
/// file whatever the part (`blobs::name`): a note and a paper alike.
const FILE_PARTS: [&str; 3] = ["spam", "papers", "notes"];

/// The others' contents of notes and papers that stopped being current in
/// this exchange (`theirs_now`: replaced, taken out, or passed by a later
/// change read in it), noted (`Sealed::theirs`); and those whose writer no
/// longer counts by a sealed fact (`Counted::departed`: it left, you forgot
/// it, another replaces it) swept, since that writer never sweeps them again
/// (a phone dead for good), with the care `blobs::sweep` takes of this
/// device's own (`blobs::sweep_after`): unused `unused_days` since their last
/// use here, never fresh in the folder (another device uses that content
/// again, `blobs::put`), never one a current record names (a note's, a change
/// waiting, one the others named lately, one this device sealed itself, the
/// texts' media: `texts_media`), and nothing at all while the texts' media
/// are not known here, nor while a part whose files are sealed apart is not
/// shared here (`FILE_PARTS`): the records of a part a device does not share
/// are passed over, and a current paper with the same bytes as a departed
/// device's replaced note would go (review of 17 October 2026, L1). Each
/// one swept is said for the server (`Memory::taken`).
/// A device that counts sweeps them, each its own folder; two at once find
/// it gone, and their sending a file gone (`404`) or changed (`412`).
fn sweep_theirs(sharing: &Sharing, stores: &[Store], memory: &mut Memory, counted: &[(String, Counted)], theirs_now: Vec<(String, String)>, current_before: &BTreeSet<String>, now_ms: i64) {
    let blobs = sharing.folder.join("blobs");
    memory.taken.retain(|name, at| now_ms - *at < crate::blobs::UNUSED_DAYS * DAY && !blobs.join(name).exists());
    let current: BTreeSet<String> = memory.entries.iter().filter(|(key, known)| key.starts_with(FILES) && !known.h.is_empty()).map(|(_, known)| known.h.clone()).collect();
    for (h, writer) in theirs_now.into_iter().filter(|(h, _)| !current.contains(h)) {
        memory.sealed.theirs.insert(crate::blobs::name(sharing.key, &h), (writer, now_ms));
    }
    if memory.sealed.theirs.is_empty() {
        return;
    }
    let days = unused_days(sharing, memory, now_ms);
    let departed: BTreeSet<&str> = counted.iter().filter(|(_, counted)| counted.departed()).map(|(id, _)| id.as_str()).collect();
    // A writer that counts sweeps its own: forgotten here once it left the folder.
    memory.sealed.theirs.retain(|name, (writer, at)| departed.contains(writer.as_str()) || now_ms - *at < days * DAY || blobs.join(name).exists());
    let mut last: BTreeMap<String, i64> = memory.sealed.theirs.iter().filter(|(_, (writer, _))| departed.contains(writer.as_str())).map(|(name, (_, at))| (name.clone(), *at)).collect();
    if last.is_empty() {
        return;
    }
    // The last words of a device whose files you removed (`remove_device_files`)
    // that no other current record names: no record in the folder names them
    // any more, and they go as its replaced contents do.
    let removed: BTreeSet<&str> = memory.removed_devices.keys().map(String::as_str).collect();
    let orphaned: BTreeSet<&String> = if removed.is_empty() {
        BTreeSet::new()
    } else {
        let files = memory.entries.iter().filter(|(key, known)| key.starts_with(FILES) && !known.h.is_empty());
        let named: BTreeSet<&String> = files.clone().filter(|(_, known)| !removed.contains(known.w.as_str())).map(|(_, known)| &known.h).collect();
        files.filter(|(_, known)| removed.contains(known.w.as_str()) && !named.contains(&known.h)).map(|(_, known)| &known.h).collect()
    };
    let used: BTreeSet<String> = current
        .iter()
        .chain(current_before)
        .filter(|h| !orphaned.contains(h))
        .cloned()
        .chain(memory.pending.iter().filter(|(key, _)| key.starts_with(FILES)).filter_map(|(key, (value, _, _))| value.as_deref().map(|v| value_hash(key, v))))
        .map(|h| crate::blobs::name(sharing.key, &h))
        .chain(memory.sealed.named_at.keys().cloned())
        .chain(memory.sealed.mine.keys().cloned())
        .collect();
    let unused = days * DAY;
    let fresh = |name: &str| std::fs::metadata(blobs.join(name)).ok().and_then(|m| m.modified().ok()).and_then(|t| t.elapsed().ok()).is_some_and(|age| (age.as_millis() as i64) < unused);
    let due = last.iter().any(|(name, at)| !used.contains(name) && now_ms - *at >= unused && !fresh(name));
    let every_part = FILE_PARTS.iter().all(|part| stores.iter().any(|s| s.part == *part && matches!(s.shape, Shape::Files)));
    if due && every_part && let Some(media) = texts_media(sharing, stores, memory, counted) {
        let used: BTreeSet<String> = used.into_iter().chain(media).collect();
        let before: Vec<String> = last.keys().cloned().collect();
        crate::blobs::sweep_after(sharing.folder, &mut last, &used, now_ms, days);
        for name in before.into_iter().filter(|name| !last.contains_key(name)) {
            memory.sealed.theirs.remove(&name);
            memory.taken.insert(name, now_ms);
        }
    } else {
        // Used again: its use now (once a day at most, as `blobs::sweep_after` does).
        for (_, at) in last.iter_mut().filter(|(name, _)| used.contains(*name)) {
            if now_ms - *at >= DAY {
                *at = now_ms;
            }
        }
    }
    for (name, at) in last {
        if let Some(theirs) = memory.sealed.theirs.get_mut(&name) {
            theirs.1 = at;
        }
    }
}

/// The sealed files the texts name, by name (`blobs::name`): each part of
/// every text in each phone's log as this device holds it (`TEXTS_LOG`, each
/// line sealed at rest, `textseal`), the texts taken out included. None when
/// they are not known here: the texts not shared on this device, or a whole
/// line of their log that does not open or read (a last line still being
/// written, with no line break yet, is passed over: its medium went into the
/// folder before it, and is fresh there); then no other device's sealed
/// file is swept here (`sweep_theirs`). A sharing where no phone was ever
/// seen (every other device known here by its entry, none a phone, nor this
/// one) holds none: only a phone brings the texts' media.
fn texts_media(sharing: &Sharing, stores: &[Store], memory: &Memory, counted: &[(String, Counted)]) -> Option<BTreeSet<String>> {
    if let Some(store) = stores.iter().find(|s| s.name == TEXTS_LOG) {
        use sioul_core::texts::Sealer;
        #[derive(Deserialize)]
        struct Text {
            #[serde(default)]
            parts: Vec<Part>,
        }
        #[derive(Deserialize)]
        struct Part {
            #[serde(default)]
            hash: String,
        }
        let seal = crate::textseal::TextSeal::new(sharing.key);
        let mut out = BTreeSet::new();
        for entry in std::fs::read_dir(&store.path).into_iter().flatten().filter_map(Result::ok) {
            let path = entry.path();
            if !path.is_file() || path.extension().is_none_or(|e| e != "jsonl") || entry.file_name().to_string_lossy().starts_with('.') {
                continue;
            }
            let text = std::fs::read_to_string(&path).ok()?;
            for line in text.split_inclusive('\n') {
                // A last line still being written (no line break yet) names nothing yet: its medium went first, and is fresh.
                let opened = seal.open(line.trim()).and_then(|plain| serde_json::from_str::<Text>(&plain).ok());
                let Some(text) = opened else {
                    if line.trim().is_empty() || !line.ends_with('\n') {
                        continue;
                    }
                    return None;
                };
                out.extend(text.parts.into_iter().filter(|part| !part.hash.is_empty()).map(|part| crate::blobs::name(sharing.key, &part.hash)));
            }
        }
        return Some(out);
    }
    let phone = |entry: Option<&crate::devices::Entry>| entry.is_none_or(|e| e.kind == crate::devices::PHONE);
    let phones = crate::devices::own(&sharing.memory.with_file_name("device.toml")).kind == crate::devices::PHONE || counted.iter().any(|(id, _)| phone(memory.seen.get(id)));
    (!phones).then(BTreeSet::new)
}

#[derive(Debug, Clone, Serialize, Deserialize)]
struct Known {
    c: u64,
    w: String,
    h: String,
    /// For a file sealed apart changed here: the content it replaced, said again in a new round.
    #[serde(default, skip_serializing_if = "String::is_empty")]
    b: String,
}

impl Memory {
    /// `memory.json` alone: what the doses and claims ask.
    fn load(path: &Path, computer: &str) -> Memory {
        let memory: Memory = std::fs::read_to_string(path).ok().and_then(|t| serde_json::from_str(&t).ok()).unwrap_or_default();
        if memory.computer == computer { memory } else { Memory { computer: computer.to_string(), round: 1, ..Memory::default() } }
    }

    /// The whole memory, files sealed apart too (`files.json`), their entries
    /// and changes among the others while an exchange runs: as the last
    /// exchange in this process left it while both files are as it wrote
    /// them (`Kept`), else read from them.
    fn load_all(path: &Path, computer: &str) -> Memory {
        if let Some(kept) = Memory::kept(path, computer) {
            return kept;
        }
        let mut memory = Memory::load(path, computer);
        match std::fs::read_to_string(sealed_path(path)).ok().and_then(|t| serde_json::from_str::<Sealed>(&t).ok()).filter(|s| s.computer == computer) {
            Some(sealed) => {
                // An older Sioul's times, kept in this file then.
                memory.checked = memory.checked.max(sealed.checked);
                memory.tidied = memory.tidied.max(sealed.tidied);
                memory.sealed = sealed;
            }
            // Lost, or not readable: notes and papers, and the calls, join
            // again as a new device's would (their files read again from the
            // records first), rather than each going out as new.
            None => memory.places.retain(|store, _| !store.starts_with(FILES) && !calls_store(store)),
        }
        memory.entries.append(&mut memory.sealed.entries);
        memory.files.append(&mut memory.sealed.files);
        memory.pending.append(&mut memory.sealed.pending);
        memory
    }

    /// Both files written, each when it changed only (a phone's storage
    /// wears), its bytes on the disk before its name changes. The calls'
    /// entries go beside the notes': a log of lines names each entry by its
    /// line, and `memory.json`, written at every exchange and read by the
    /// doses' knowing, stays small.
    fn save(&mut self, path: &Path) -> Result<(), String> {
        self.prepare_save(path)?.commit()
    }

    /// What `save` writes, written ahead under hidden names, synced and
    /// closed (on Windows, the antivirus reads a file written whole at its
    /// close), each file only when it changed: put in place by renames alone
    /// (`SavePrepared::commit`), which is all "Remove its files" does under
    /// the exchanges' lock, however large the memory (review of part 3, R-6;
    /// CI's Windows job of 20 October 2026: 0.79 s under the lock).
    fn prepare_save(&mut self, path: &Path) -> Result<SavePrepared, String> {
        let apart = |key: &String| key.starts_with(FILES) || calls_store(key);
        let (sealed, kept): (BTreeMap<_, _>, BTreeMap<_, _>) = std::mem::take(&mut self.entries).into_iter().partition(|(key, _)| apart(key));
        (self.sealed.entries, self.entries) = (sealed, kept);
        let (sealed, kept): (BTreeMap<_, _>, BTreeMap<_, _>) = std::mem::take(&mut self.files).into_iter().partition(|(file, _)| apart(file));
        (self.sealed.files, self.files) = (sealed, kept);
        let (sealed, kept): (BTreeMap<_, _>, BTreeMap<_, _>) = std::mem::take(&mut self.pending).into_iter().partition(|(key, _)| apart(key));
        (self.sealed.pending, self.pending) = (sealed, kept);
        self.sealed.computer = self.computer.clone();
        let mut prepared = SavePrepared { renames: Vec::new() };
        let mut write = |target: PathBuf, text: &[u8]| -> Result<(), String> {
            if std::fs::read(&target).is_ok_and(|old| old == text) {
                return Ok(());
            }
            let fail = |e: std::io::Error| format!("{}: {e}", target.display());
            if let Some(parent) = target.parent() {
                private_dirs(parent).map_err(fail)?;
            }
            let temporary = temporary(&target);
            let written = (|| {
                let mut file = new_private(&temporary)?;
                file.write_all(text)?;
                file.sync_all()
            })();
            if let Err(e) = written {
                let _ = std::fs::remove_file(&temporary);
                return Err(fail(e));
            }
            slow_memory_write();
            prepared.renames.push((temporary, target));
            Ok(())
        };
        write(sealed_path(path), serde_json::to_string(&self.sealed).map_err(|e| e.to_string())?.as_bytes())?;
        let text = serde_json::to_string(self).map_err(|e| e.to_string())?;
        write(path.to_path_buf(), text.as_bytes())?;
        self.saved = text.into_bytes();
        Ok(prepared)
    }

    /// Kept in this process once saved, for the next exchange or send to take
    /// rather than read both files again (`Kept`).
    fn keep(mut self, path: &Path) {
        let text = std::mem::take(&mut self.saved);
        if text.is_empty() {
            return;
        }
        let sealed = stamp_at(&sealed_path(path));
        if let Ok(mut mine) = MINE.lock() {
            mine.insert(path.to_path_buf(), (sealed, self.computer.clone(), self.sealed.mine.iter().map(|(name, (_, size))| (name.clone(), *size)).collect()));
        }
        if !keeping() {
            return;
        }
        self.entries.append(&mut self.sealed.entries);
        self.files.append(&mut self.sealed.files);
        self.pending.append(&mut self.sealed.pending);
        let kept = Kept { own: stamp_at(path), sealed, text, memory: self };
        if let Ok(mut all) = KEPT.lock() {
            all.insert(path.to_path_buf(), kept);
        }
    }

    /// The memory kept in this process (`keep`), taken, when it is this
    /// computer's and both its files are still as it wrote them: `memory.json`
    /// the same bytes, `files.json` the same file (its inode, size and time).
    fn kept(path: &Path, computer: &str) -> Option<Memory> {
        if !keeping() {
            return None;
        }
        let kept = KEPT.lock().ok()?.remove(path)?;
        let same = kept.memory.computer == computer && kept.own.is_some() && stamp_at(path) == kept.own && stamp_at(&sealed_path(path)) == kept.sealed && std::fs::read(path).is_ok_and(|text| text == kept.text);
        same.then_some(kept.memory)
    }

    /// A new clock: after every clock given or read, and not before `physical` (milliseconds).
    fn tick(&mut self, physical: i64) -> u64 {
        self.clock = (self.clock + 1).max((physical.max(0) as u64) << 16);
        self.clock
    }
}

/// Where what this computer remembers of files sealed apart is kept: `files.json`, beside its memory.
fn sealed_path(memory: &Path) -> PathBuf {
    memory.with_file_name("files.json")
}

/// A file as it stands: its inode (on Unix; a file written anew and renamed
/// into place is another), its size and its time (nanoseconds).
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
struct FileStamp {
    ino: u64,
    size: u64,
    modified: u64,
}

fn file_stamp(meta: &std::fs::Metadata) -> FileStamp {
    #[cfg(unix)]
    let ino = std::os::unix::fs::MetadataExt::ino(meta);
    #[cfg(not(unix))]
    let ino = 0;
    FileStamp { ino, size: meta.len(), modified: modified_ns(meta) }
}

fn stamp_at(path: &Path) -> Option<FileStamp> {
    std::fs::metadata(path).ok().map(|meta| file_stamp(&meta))
}

/// The memory as the last exchange in this process saved it (`Memory::keep`),
/// with `memory.json` as written and both files' stamps: the next exchange,
/// or a send asking what this device sealed (`own_sealed`), takes it while
/// neither file changed, rather than reading them again. A phone's background
/// service exchanges every few minutes, and its `files.json` holds tens of
/// thousands of entries (the texts' lines): megabytes read at each.
struct Kept {
    memory: Memory,
    text: Vec<u8>,
    own: Option<FileStamp>,
    sealed: Option<FileStamp>,
}

#[cfg(test)]
thread_local! {
    /// Tests only: how long each file of the memory written takes more on
    /// this thread, as the antivirus' read at its close on Windows. Never in a build.
    pub(crate) static SLOW_MEMORY_WRITE: std::cell::Cell<std::time::Duration> = const { std::cell::Cell::new(std::time::Duration::ZERO) };
}

fn slow_memory_write() {
    #[cfg(test)]
    std::thread::sleep(SLOW_MEMORY_WRITE.with(std::cell::Cell::get));
}

/// The memory's files written ahead (`Memory::prepare_save`): hidden, synced
/// and closed, each beside the file it replaces; taken away unless put in
/// place.
struct SavePrepared {
    renames: Vec<(PathBuf, PathBuf)>,
}

impl SavePrepared {
    /// Each put in place, `files.json` first, by a rename alone.
    fn commit(mut self) -> Result<(), String> {
        for (temporary, target) in std::mem::take(&mut self.renames) {
            if let Err(e) = std::fs::rename(&temporary, &target) {
                let _ = std::fs::remove_file(&temporary);
                return Err(format!("{}: {e}", target.display()));
            }
        }
        Ok(())
    }
}

impl Drop for SavePrepared {
    fn drop(&mut self) {
        for (temporary, _) in &self.renames {
            let _ = std::fs::remove_file(temporary);
        }
    }
}

/// The memories kept in this process, by the path of their `memory.json`.
static KEPT: std::sync::Mutex<BTreeMap<PathBuf, Kept>> = std::sync::Mutex::new(BTreeMap::new());

/// Whether this process keeps the memory and the logs of lines between its
/// exchanges (`set_keeping`); always in tests, which run the sharing through it.
static KEEPING: std::sync::atomic::AtomicBool = std::sync::atomic::AtomicBool::new(cfg!(test));

/// Said once by a process that exchanges every few minutes for a long time
/// (a phone's background service): the memory and the logs of lines are kept
/// between its exchanges (`Kept`, `LINES`), rather than read again at each.
/// They weigh some tens of megabytes with many texts shared (about 30 MB for
/// 10 MB of texts): a window's process, which holds little between its
/// minutes, reads them again at each (docs/android.md, "In the background").
pub fn set_keeping(on: bool) {
    KEEPING.store(on, std::sync::atomic::Ordering::Relaxed);
    if !on {
        KEPT.lock().map(|mut all| all.clear()).ok();
        LINES.lock().map(|mut all| all.clear()).ok();
    }
}

fn keeping() -> bool {
    KEEPING.load(std::sync::atomic::Ordering::Relaxed)
}

/// What this device sealed in the folder (`Sealed::mine`, by name, the size
/// sealed), as `files.json` said it when last written or read in this process
/// (its stamp, and whose it is): what each send asks first (`own_sealed`), a few names.
type Mine = BTreeMap<PathBuf, (Option<FileStamp>, String, BTreeMap<String, u64>)>;
static MINE: std::sync::Mutex<Mine> = std::sync::Mutex::new(BTreeMap::new());

/// One line of a computer's file: its number in the round, its clock, the sealed change.
#[derive(Debug, Serialize, Deserialize)]
struct Line {
    n: u64,
    c: u64,
    s: String,
}

/// A change, sealed in a line: the entry and its new value, none once taken out.
#[derive(Debug, Serialize, Deserialize)]
struct Change {
    k: String,
    v: Option<String>,
    /// For a file sealed apart: the content it replaces where it was made, by
    /// its hash ("" for a file new there). Another device holding something
    /// else changed it too: both are kept.
    #[serde(default, skip_serializing_if = "String::is_empty")]
    b: String,
    /// The build that wrote it (`sioul_core::build::DESCRIBED`), on the first
    /// line of each batch this computer appends, a new round's first line
    /// among them: the lines after it, until the next that says one, are that
    /// build's. Sealed with the change: the server never learns it. An older
    /// Sioul passes over it.
    #[serde(default, skip_serializing_if = "String::is_empty")]
    build: String,
    /// The format its part is written in (`part_format`), when not 1: a
    /// device that does not know it keeps the change waiting and says so
    /// (`share-newer`); one that does not write it yet writes it from its
    /// next exchange (`Memory::switch`). Sealed with the change. An older
    /// Sioul passes over it, and its changes say none: format 1.
    #[serde(default, skip_serializing_if = "first_format")]
    f: u32,
}

fn first_format(f: &u32) -> bool {
    *f <= 1
}

/// What the first line of a round says of where it stands, sealed with its
/// change: a full round (`new_round`, a computer's first), which restates all
/// its writer holds, or one continuing the round before (`SEGMENT`), with the
/// number of that round's last line. A reader enters a continuing round only
/// once it has read the one before to that line: a sync app may bring a
/// round before the end of the one before, and that end, a dose marked taken
/// among it, would never be read (docs/database.md, "The log"). An older
/// Sioul's lines say neither, and are read as before; an older Sioul passes
/// over both fields.
#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
struct Turn {
    /// The round before's last number, on the first line of a round continuing it.
    #[serde(default, skip_serializing_if = "is_zero_u64")]
    p: u64,
    /// On the first line of a full round.
    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
    full: bool,
}

fn is_zero_i64(n: &i64) -> bool {
    *n == 0
}

fn is_zero_u64(n: &u64) -> bool {
    *n == 0
}

/// A round waiting for the end of the round before (`Memory::waiting_for`).
#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
struct Awaited {
    /// The round waiting.
    round: u32,
    /// How long it waited, the exchanges' time counted (`AWAIT_STEP`), in milliseconds.
    waited: i64,
    /// The last exchange that counted it (milliseconds).
    last: i64,
}

/// The turn of a round that does not know where the round before it ended
/// (`Turn::p`): one that could not restate all (`new_round`) after a round
/// of its own found without a line. No reader ever met that line: it waits
/// for the round before as for a lost one (`AWAITED`), then reads on with
/// the gap said, the doses in doubt until a full round, never as an older
/// Sioul's round, which would take all before it as read.
const UNKNOWN_TURN: u64 = u64::MAX;

/// A sealed line's change and its round's turn (`Turn`), read in one pass.
#[derive(Deserialize)]
struct Opened {
    k: String,
    v: Option<String>,
    #[serde(default)]
    b: String,
    #[serde(default)]
    build: String,
    #[serde(default)]
    f: u32,
    #[serde(default)]
    p: u64,
    #[serde(default)]
    full: bool,
}

impl Opened {
    fn parts(self) -> (Change, Turn) {
        (Change { k: self.k, v: self.v, b: self.b, build: self.build, f: self.f }, Turn { p: self.p, full: self.full })
    }
}

/// A change as it is sealed in a line: the change, and on a round's first
/// line, its turn (`Turn`).
#[derive(Serialize)]
struct Sealing<'a> {
    #[serde(flatten)]
    change: &'a Change,
    #[serde(flatten)]
    turn: Turn,
}

/// A computer's own notes in the folder: when it last exchanged, its round, how far it read the others.
#[derive(Debug, Default, Serialize, Deserialize)]
struct Seen {
    #[serde(default)]
    at: i64,
    #[serde(default)]
    round: u32,
    #[serde(default)]
    read: BTreeMap<String, u32>,
    /// The computers it asks for a full round, each with the latest round of
    /// theirs it met: some of their records were lost here (a damaged line,
    /// a round taken for lost), so what they wrote is not all known here,
    /// the doses in doubt, until a full round of theirs after that one. An
    /// older Sioul passes it over (review of 10 October 2026).
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    full: BTreeMap<String, u32>,
    /// Its size changed at each writing (`pad_for`): read by nobody.
    #[serde(default, skip_serializing_if = "String::is_empty")]
    pad: String,
}

fn bound(computer: &str, round: u32, n: u64, clock: u64) -> String {
    format!("{computer}:{round}:{n}:{clock}")
}

fn round_file(folder: &Path, computer: &str, round: u32) -> PathBuf {
    folder.join(format!("{computer}-{round}.jsonl"))
}

/// Every computer sharing through the folder: those that wrote records, and
/// those that only read so far (their notes); in the copy fetched from the
/// server too (`remote::overlay`).
fn computers(folder: &Path) -> BTreeSet<String> {
    let mut out: BTreeSet<String> = rounds_with(folder).into_keys().collect();
    for dir in std::iter::once(folder.to_path_buf()).chain(crate::remote::overlay(folder)) {
        for entry in std::fs::read_dir(&dir).into_iter().flatten().filter_map(Result::ok) {
            let name = entry.file_name().to_string_lossy().to_string();
            if let Some(id) = name.strip_suffix(".toml").filter(|id| id.len() == 36 && uuid::Uuid::parse_str(id).is_ok()) {
                out.insert(id.to_string());
            }
        }
    }
    out
}

/// The computers' files in the folder and in the copy fetched from the
/// server (`remote::overlay`): computer → its rounds, those of either.
fn rounds_with(folder: &Path) -> BTreeMap<String, Vec<u32>> {
    let mut all = rounds(folder);
    if let Some(fetched) = crate::remote::overlay(folder) {
        for (computer, theirs) in rounds(&fetched) {
            let list = all.entry(computer).or_default();
            list.extend(theirs);
            list.sort_unstable();
            list.dedup();
        }
    }
    all
}

/// Another computer's round, from the longer of its two copies: the folder's,
/// and the one fetched from the server (`remote::overlay`). Records only
/// grow: the longer holds all the shorter does, and where each line starts
/// is the same in both.
fn open_round(folder: &Path, computer: &str, round: u32) -> std::io::Result<std::fs::File> {
    let here = round_file(folder, computer, round);
    let Some(fetched) = crate::remote::overlay(folder).map(|f| round_file(&f, computer, round)) else { return std::fs::File::open(here) };
    let size = |path: &Path| std::fs::metadata(path).map(|m| m.len()).ok();
    match (size(&here), size(&fetched)) {
        (Some(a), Some(b)) if b > a => std::fs::File::open(fetched),
        (None, Some(_)) => std::fs::File::open(fetched),
        _ => std::fs::File::open(here),
    }
}

/// The computers' files in the folder: computer → its rounds.
fn rounds(folder: &Path) -> BTreeMap<String, Vec<u32>> {
    let mut out: BTreeMap<String, Vec<u32>> = BTreeMap::new();
    for entry in std::fs::read_dir(folder).into_iter().flatten().filter_map(Result::ok) {
        let name = entry.file_name().to_string_lossy().to_string();
        let Some(stem) = name.strip_suffix(".jsonl") else { continue };
        // "<uuid>-<round>": a UUID is 36 characters; a conflicted copy's name is longer.
        let Some((computer, round)) = stem.rsplit_once('-') else { continue };
        if computer.len() != 36 || uuid::Uuid::parse_str(computer).is_err() {
            continue;
        }
        if let Ok(round) = round.parse::<u32>() {
            out.entry(computer.to_string()).or_default().push(round);
        }
    }
    for list in out.values_mut() {
        list.sort_unstable();
    }
    out
}

// ---------------------------------------------------------------- formats

/// A change kept waiting (`Memory::waiting`): the later of two for one entry.
fn wait(waiting: &mut BTreeMap<String, (Option<String>, u64, String, u32)>, key: String, change: (Option<String>, u64, String, u32)) {
    if waiting.get(&key).is_none_or(|(_, c, w, _)| (change.1, change.2.as_str()) > (*c, w.as_str())) {
        waiting.insert(key, change);
    }
}

/// A part met in a format newer than this Sioul knows (`Memory::newer`).
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
struct Newer {
    /// The newest format met.
    format: u32,
    /// The build that wrote it, as its batch says.
    #[serde(default)]
    build: String,
    /// The devices that wrote it: while none of them is still in the
    /// sharing (gone, forgotten, silent 180 days: a test build tried once),
    /// the part is no longer held (`release_newer`).
    #[serde(default)]
    writers: BTreeSet<String>,
}

/// What a format-1 entry renamed by format 2 last said, kept once this device
/// writes format 2 (`Memory::floors`): a record of format 1 under that entry
/// read again (a store joining, a record rebuilt, an older copy of a round
/// put back) at or below it is passed over, so that nothing format 1 already
/// said comes back.
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
struct Floor {
    c: u64,
    w: String,
    /// For a list format 1 sends whole: the names, in format 2, of the
    /// elements it held then. A later whole list takes out only those of
    /// them it no longer holds, never an element added since in format 2.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    held: Option<BTreeSet<String>>,
    /// For a list format 1 sends whole: the elements a whole list took out
    /// here, with the clock of the list that did (`Memory::lists`). A record
    /// of one at or below that clock is passed over (`below_whole_floor`).
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    removed: BTreeMap<String, u64>,
}

/// A list format 1 sends whole, as the whole lists seen here said it, each
/// at its clock (`Memory::lists`), in whatever order they came: for each
/// element one of them held, the latest clock of a list that held it, and
/// the latest of one that did not. An element is taken out when a list
/// without it came after the last one with it (`removed`). An element no
/// list held is not in it: a list that did not know it did not take it out.
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
struct WholeList {
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    held_at: BTreeMap<String, u64>,
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    lacked_at: BTreeMap<String, u64>,
    /// The latest clock of any list seen.
    #[serde(default)]
    top: u64,
}

impl WholeList {
    /// A whole list seen, at clock `c`, holding `names`: a record read (in one
    /// exchange, a later list may come first), or the file between exchanges.
    fn saw(&mut self, c: u64, names: &BTreeSet<String>) {
        for name in self.held_at.keys().filter(|name| !names.contains(*name)) {
            let lacked = self.lacked_at.entry(name.clone()).or_default();
            *lacked = (*lacked).max(c);
        }
        for name in names {
            // Every list seen before did not hold it.
            if !self.held_at.contains_key(name) && self.top > 0 {
                self.lacked_at.insert(name.clone(), self.top);
            }
            let held = self.held_at.entry(name.clone()).or_default();
            *held = (*held).max(c);
        }
        self.top = self.top.max(c);
    }

    /// When an element was taken out: the clock of the latest list without
    /// it, when that came after the latest list with it.
    fn removed_at(&self, name: &str) -> Option<u64> {
        let held = self.held_at.get(name)?;
        self.lacked_at.get(name).copied().filter(|lacked| lacked > held)
    }

    fn removed(&self) -> BTreeMap<String, u64> {
        self.held_at.keys().filter_map(|name| self.removed_at(name).map(|at| (name.clone(), at))).collect()
    }
}

/// A record of a list format 1 sends whole (format 2 dividing it), as
/// `WholeList::saw` takes it: the names, in format 2, of what it holds. Any
/// other record: nothing.
fn note_whole_record(stores: &[Store], memory: &mut Memory, key: &str, value: Option<&str>, c: u64) {
    let (file, entry) = (file_of(key), entry_of(key));
    let Some((store, _)) = locate(stores, file) else { return };
    let Shape::Toml(rules) = store.shape else { return };
    if rules.next.is_none() {
        return;
    }
    let Renamed::Whole(keyed) = renamed(rules, rules.at(2), entry) else { return };
    let elements: Vec<toml::Value> = value
        .and_then(|v| leaf_value(v).ok())
        .and_then(|v| v.as_array().cloned())
        .unwrap_or_default()
        .into_iter()
        .map(|mut element| {
            strip_local(&mut element, keyed.local);
            element
        })
        .collect();
    let held: BTreeSet<String> = names(&elements, keyed).into_iter().collect();
    memory.lists.entry(key.to_string()).or_default().saw(c, &held);
}

/// What each list format 1 sends whole holds now in the files format 2
/// divides otherwise, by format 2's names (`Memory::lists`): an element a
/// list no longer holds is noted as taken out at the clock of the list's
/// last word here (this device's or another's), until a list holds it again.
/// While this device writes format 1, after each exchange and before the
/// switch renames its memory.
fn note_whole_lists(stores: &[Store], memory: &mut Memory) {
    for (file, path, store) in divided(stores) {
        let Shape::Toml(rules) = store.shape else { continue };
        let next = rules.at(2);
        let Ok(text) = std::fs::read_to_string(&path) else { continue };
        if text.parse::<toml::Table>().is_err() {
            continue;
        }
        let mut now: BTreeMap<String, BTreeSet<String>> = BTreeMap::new();
        for (before, after, _) in aligned(&text, rules, next) {
            if matches!(renamed(rules, next, &before), Renamed::Whole(_)) && !after.is_empty() {
                now.entry(format!("{file}#{before}")).or_default().insert(element_name(&after).to_string());
            }
        }
        let keys: BTreeSet<String> = memory.lists.keys().filter(|key| file_of(key) == file).cloned().chain(now.keys().cloned()).collect();
        for key in keys {
            let held = now.remove(&key).unwrap_or_default();
            let clock = memory.entries.get(&key).map_or(memory.clock, |known| known.c);
            memory.lists.entry(key).or_default().saw(clock, &held);
        }
    }
}

/// The name a floor is kept under: a hash of the format-1 entry (whose name may be a whole money line).
fn floor_key(key: &str) -> String {
    derived("floor", key)
}

/// Whether a record of an element of a list format 1 sent whole (pinned
/// sites, words, days off, routines, task kinds, lighter days) comes at or
/// below the clock of a whole list that took that element out here
/// (`Floor::removed`), the list not holding it since. Passed over, so that
/// an element taken out before the switch never comes back, as when a
/// device restates its old entries in a new round (`share-own-cut`). An
/// element no whole list here ever held (added in format 2 elsewhere, its
/// record waiting here) is never passed over: a list that did not know it
/// did not take it out.
fn below_whole_floor(memory: &Memory, key: &str, c: u64) -> bool {
    let (file, entry) = (file_of(key), entry_of(key));
    let Some((list, element)) = entry.rsplit_once(SEP) else { return false };
    let Some(name) = element.strip_prefix(MARK) else { return false };
    let whole = format!("{file}#{list}");
    let by_floor = memory.floors.get(&floor_key(&whole)).is_some_and(|floor| floor.held.as_ref().is_some_and(|held| !held.contains(name)) && floor.removed.get(name).is_some_and(|at| c <= *at));
    // The whole lists' records read here, in any order, in any format this device wrote (T7b: a device joining reads a list with it and a later one without in one exchange).
    by_floor || memory.lists.get(&whole).and_then(|list| list.removed_at(name)).is_some_and(|at| c <= at)
}

/// Why a device holds back format 2 (`format_holders`).
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum Holds {
    /// Its Sioul does not read format 2, or does not say: an older one, or a
    /// device known by its records alone.
    Older,
    /// Its entry does not read here (its seal not arrived, damaged, taken away).
    Unread,
    /// It reads format 2, but what it wrote before is not all read here yet.
    Unheard,
}

/// When an entry was written, as far as its own times tell (each writing
/// sets one of them to its device's clock then, and none goes back).
fn entry_stamp(entry: &crate::devices::Entry) -> i64 {
    entry.started.max(entry.imported).max(entry.closed).max(entry.exported)
}

/// What this device has seen of each other's sealed entry, kept
/// (`Memory::seen`): the latest by its own times. An older copy put back in
/// the folder (a replay by a hostile server) never lowers it.
fn note_entries(folder: &Path, key: &[u8; 32], memory: &mut Memory) {
    for entry in crate::devices::all(folder, key).0 {
        if memory.seen.get(&entry.id).is_none_or(|seen| entry_stamp(&entry) >= entry_stamp(seen)) {
            memory.seen.insert(entry.id.clone(), entry);
        }
    }
}

/// The clock of each other device's last record in the folder, opened (sealed,
/// bound to its device, round, number and clock), for the devices this
/// memory has not heard of yet (`Memory::heard_at`): a memory from before it
/// was kept learns when each device it read last wrote.
///
/// A device read here whose rounds are gone from the folder takes the latest
/// clock of its changes this memory still holds (each the clock of a record
/// read here, sealed); one with none at all is noted as found without a
/// clock (`Memory::unclocked`), at `now_ms`, once.
fn fill_heard_at(folder: &Path, key: &[u8; 32], computer: &str, memory: &mut Memory, now_ms: i64) {
    for (other, their_rounds) in rounds_with(folder) {
        if other == computer || memory.heard_at.contains_key(&other) {
            continue;
        }
        let Some(&round) = their_rounds.last() else { continue };
        if let Some(clock) = last_record_clock(folder, key, &other, round) {
            memory.heard_at.insert(other, (clock >> 16) as i64);
        }
    }
    let read: Vec<String> = memory.read_n.keys().filter(|id| *id != computer && !memory.heard_at.contains_key(*id)).cloned().collect();
    for other in read {
        let held = memory.entries.values().filter(|k| k.w == other).map(|k| k.c).chain(memory.floors.values().filter(|f| f.w == other).map(|f| f.c)).max();
        match held {
            Some(clock) => {
                memory.heard_at.insert(other.clone(), (clock >> 16) as i64);
                memory.unclocked.remove(&other);
            }
            None => {
                memory.unclocked.entry(other).or_insert(now_ms);
            }
        }
    }
    let heard: Vec<String> = memory.unclocked.keys().filter(|id| memory.heard_at.contains_key(*id)).cloned().collect();
    for id in heard {
        memory.unclocked.remove(&id);
    }
}

/// The clock of the last record of a round that opens with the key, read from its end.
fn last_record_clock(folder: &Path, key: &[u8; 32], computer: &str, round: u32) -> Option<u64> {
    use std::io::{Read, Seek};
    let mut file = open_round(folder, computer, round).ok()?;
    let size = file.metadata().ok()?.len();
    let from = size.saturating_sub(256 * 1024);
    let mut tail = Vec::new();
    file.seek(std::io::SeekFrom::Start(from)).ok()?;
    file.read_to_end(&mut tail).ok()?;
    tail.split(|b| *b == b'\n').rev().find_map(|line| {
        let record = std::str::from_utf8(line).ok().and_then(|t| serde_json::from_str::<Line>(t).ok())?;
        open(key, &bound(computer, round, record.n, record.c), &record.s).map(|_| record.c)
    })
}

/// When another device was last heard of, from sealed facts only: its entry's
/// times (sealed, bound to it) and the clock of its last record read here
/// (`Memory::heard_at`), in milliseconds; 0 when nothing is known. Never its
/// notes in the folder, which are plain and could be forged.
fn last_heard(entry: Option<&crate::devices::Entry>, memory: &Memory, id: &str) -> i64 {
    let entry = entry.map_or(0, |e| entry_stamp(e) * 1000);
    entry.max(memory.heard_at.get(id).copied().unwrap_or(0))
}

/// The other devices of the sharing that count, and what each says of
/// itself (its latest sealed entry seen here, `Memory::seen`, a replayed
/// older copy never lowering it): every device known here by a sealed fact
/// (its readable entry, its records in the folder, or its records read here
/// before, `read_n`, `heard_at`, whatever the folder shows now: a hostile
/// folder hiding a device's files never makes it go), but those that left
/// (their entry says so), those you forgot until they say anything newer
/// (`forget_device`), those another device's entry says it replaces, until
/// they say anything newer than it says (`devices::Entry::replaces`), and
/// those not heard of for `SILENT_DAYS` (one of which no clock is known at
/// all, from when this device first found it so, `Memory::unclocked`). A
/// file alone (plain notes, an entry that does not read) with no record is a
/// stray file, not a device. The same devices as `counted` says count.
fn present(folder: &Path, key: &[u8; 32], computer: &str, memory: &Memory, now_ms: i64) -> Vec<(String, Option<crate::devices::Entry>, bool)> {
    counted(folder, key, computer, memory, now_ms)
        .into_iter()
        .filter_map(|(id, counted)| match counted {
            Counted::Yes(entry, unread) => Some((id, entry, unread)),
            _ => None,
        })
        .collect()
}

/// Where another device of the sharing stands, by sealed facts (`counted`):
/// what `present` keeps, and why it leaves a device out.
#[derive(Debug, Clone, PartialEq, Eq)]
enum Counted {
    /// It counts: its latest sealed entry seen here (none: known by its
    /// records alone), and whether its entry does not read here.
    Yes(Option<crate::devices::Entry>, bool),
    /// Its entry says it stopped sharing.
    Left,
    /// You said it is gone (`forget_device`), and it said nothing newer since.
    Forgotten,
    /// Another device's entry says it replaces it (`devices::Entry::replaces`),
    /// and it said nothing newer since.
    Replaced,
    /// Not heard of for `SILENT_DAYS`, by sealed facts.
    Silent,
    /// A file alone (plain notes, an entry that does not read) with no
    /// record: a stray file, not a device; a device whose entry has not come yet.
    Stray,
}

impl Counted {
    /// Gone by a sealed fact that a device of its own never undoes by
    /// silence: it left, you forgot it, another device replaces it. Its past
    /// rounds and the sealed files it wrote that no record names any more are
    /// the others' to take out (`departed_rounds`, `sweep_theirs`).
    fn departed(&self) -> bool {
        matches!(self, Counted::Left | Counted::Forgotten | Counted::Replaced)
    }
}

/// Every other device known here, and where it stands (`Counted`): every
/// device known by a sealed fact, as `present` says, and the stray files of
/// the folder (notes alone). A stray file you forgot, or that a replacement
/// names, is said so.
fn counted(folder: &Path, key: &[u8; 32], computer: &str, memory: &Memory, now_ms: i64) -> Vec<(String, Counted)> {
    let (entries, unread) = crate::devices::all(folder, key);
    // Every replacement said: by the entries read now and the latest seen
    // here (an older copy put back never takes one away), this device's own among them.
    let replaced: Vec<crate::devices::Replaced> = entries.iter().chain(memory.seen.values()).flat_map(|e| e.replaces.iter().cloned()).collect();
    let recorded: BTreeSet<String> = rounds_with(folder).into_keys().chain(memory.read_n.keys().cloned()).chain(memory.heard_at.keys().cloned()).collect();
    let mut ids = computers(folder);
    ids.extend(entries.iter().map(|e| e.id.clone()));
    ids.extend(unread.iter().cloned());
    ids.extend(recorded.iter().cloned());
    ids.into_iter()
        .filter(|id| id != computer)
        .map(|id| {
            let here = entries.iter().find(|e| e.id == id).cloned();
            let entry = match (here, memory.seen.get(&id)) {
                (Some(here), Some(seen)) if entry_stamp(seen) > entry_stamp(&here) => Some(seen.clone()),
                (None, Some(seen)) => Some(seen.clone()),
                (here, _) => here,
            };
            let last = last_heard(entry.as_ref(), memory, &id);
            let forgotten = memory.forgotten.get(&id).is_some_and(|mark| last <= *mark);
            let replaces = replaced.iter().any(|r| r.id == id && r.holds(entry.as_ref().map(|e| e.started), last));
            // Replaced before forgotten: every device reads a replacement
            // (sealed in another device's entry), a forget is this one's word
            // alone, and what goes with a removed device's files follows it
            // (`small_go`: forgotten here, then replaced, its entry goes too).
            let counted = if entry.is_none() && !recorded.contains(&id) {
                if replaces {
                    Counted::Replaced
                } else if forgotten {
                    Counted::Forgotten
                } else {
                    Counted::Stray
                }
            } else if entry.as_ref().is_some_and(|e| e.left) {
                Counted::Left
            } else if replaces {
                Counted::Replaced
            } else if forgotten {
                Counted::Forgotten
            } else {
                // No clock known at all: aged from when this device first found it so.
                let aged = if last > 0 { last } else { memory.unclocked.get(&id).copied().unwrap_or(0) };
                if aged > 0 && now_ms - aged > SILENT_DAYS * DAY {
                    Counted::Silent
                } else {
                    let unread = unread.contains(&id) && entries.iter().all(|e| e.id != id);
                    Counted::Yes(entry, unread)
                }
            };
            (id, counted)
        })
        .collect()
}

/// The devices whose reading holds back the removal of a device's rounds
/// (`past_below`): every device that counts (`counted`), whose notes say how
/// far it read (none in the folder: nothing read, everything held back; a
/// hostile folder hiding them never makes a round go), and a file of notes
/// alone whose notes say it read within `SILENT_DAYS` (a device whose entry
/// has not come yet: plain notes only ever hold more back). Never a device
/// that left, that you forgot, that another replaces, or silent for
/// `SILENT_DAYS` by sealed facts, whatever its notes say: until 16 October
/// 2026 every device whose plain notes were heard within 180 days held them
/// back, a phone dead for good among them, and nothing of the others' left
/// the folder for half a year.
fn readers(folder: &Path, counted: &[(String, Counted)], now_ms: i64) -> BTreeSet<String> {
    counted
        .iter()
        .filter(|(id, counted)| match counted {
            Counted::Yes(..) => true,
            Counted::Stray => read_seen(folder, id).is_some_and(|s| now_ms / 1000 - s.at < SILENT_DAYS * 86_400),
            _ => false,
        })
        .map(|(id, _)| id.clone())
        .collect()
}

/// The devices that hold back format 2 (`FORMAT`), and why: of the devices
/// that count (`present`), each must say in its sealed entry that it reads
/// format 2 (`devices::Entry::format`), and all it wrote up to that entry
/// (`wrote`) must be read here (`read_n`). A device whose entry does not read
/// here, or known by its records alone, holds it back: an older Sioul cannot
/// read format 2 and would double what it changes (an entry that no longer
/// reads is said as such, even when an older one was seen here). A hostile
/// folder can only hold it back longer, never open it.
fn format_holders(folder: &Path, key: &[u8; 32], computer: &str, memory: &Memory, now_ms: i64) -> Vec<(String, Holds)> {
    let heard = Heard { read: memory.read_n.clone(), broken: BTreeMap::new() };
    present(folder, key, computer, memory, now_ms)
        .into_iter()
        .filter_map(|(id, entry, unread)| match entry {
            Some(entry) if entry.format >= 2 => entry.wrote.is_some_and(|wrote| !heard.complete(&id, wrote)).then_some((id, Holds::Unheard)),
            _ if unread => Some((id, Holds::Unread)),
            _ => Some((id, Holds::Older)),
        })
        .collect()
}

/// How long this device keeps the sealed files no record points to any more
/// (days): two weeks (`blobs::UNUSED_DAYS`) once every other device that
/// counts (`present`) says in its sealed entry that it keeps them so too
/// (`devices::Entry::keeping`), else 90 days (`blobs::UNUSED_DAYS_BEFORE`), as
/// until 15 October 2026. An older Sioul makes a content it uses again fresh
/// only past 30 days (`blobs::put`): on a phone under eDrive, which keeps every
/// sealed file it brought, it could put back an earlier version whose
/// content left the server, and name it in a record no device could follow.
/// A device whose entry does not read, or known by its records alone, counts
/// as an older one; a hostile folder can only keep contents longer.
fn unused_days(sharing: &Sharing, memory: &Memory, now_ms: i64) -> i64 {
    let all = present(sharing.folder, sharing.key, sharing.computer, memory, now_ms).iter().all(|(_, entry, _)| entry.as_ref().is_some_and(|e| e.keeping >= crate::blobs::KEEPING_TWO_WEEKS));
    if all { crate::blobs::UNUSED_DAYS } else { crate::blobs::UNUSED_DAYS_BEFORE }
}

/// Whether this device may write format 2: another device at least counts
/// (`present`; alone, it writes format 1: a device joining later may run an
/// older Sioul), and none holds it back (`format_holders`). A device not
/// joined yet holds nothing format 1 could lose: every other device saying
/// it reads format 2 is enough, and it joins in format 2.
fn format_open(sharing: &Sharing, memory: &Memory, now_ms: i64) -> bool {
    !present(sharing.folder, sharing.key, sharing.computer, memory, now_ms).is_empty() && format_holders(sharing.folder, sharing.key, sharing.computer, memory, now_ms).iter().all(|(_, holds)| !memory.joined && *holds == Holds::Unheard)
}

/// When `device` was last heard of here, from sealed facts only (`last_heard`:
/// its latest entry read here, its records' last clock read), in
/// milliseconds; 0 when nothing is known. What a replacement says of it
/// (`devices::Replaced::heard`).
pub fn heard_of(folder: &Path, key: &[u8; 32], memory: &Path, computer: &str, device: &str) -> i64 {
    let state = Memory::load_all(memory, computer);
    let (entries, _) = crate::devices::all(folder, key);
    let here = entries.iter().find(|e| e.id == device);
    let entry = match (here, state.seen.get(device)) {
        (Some(here), Some(seen)) if entry_stamp(seen) > entry_stamp(here) => Some(seen),
        (None, Some(seen)) => Some(seen),
        (here, _) => here,
    };
    last_heard(entry, &state, device)
}

/// A device you said is gone (Settings ▸ Your folder and sharing ▸ Forget
/// this device), as the sharing sees it: it no longer holds format 2 back,
/// nor keeps a part held, until it says anything newer than now (an entry
/// written since, a record read here: `present`). Waits for an exchange running.
pub fn forget_device(folder: &Path, key: &[u8; 32], memory: &Path, computer: &str, device: &str) -> Result<(), String> {
    let _running = exchange_lock(memory, true)?;
    let mut state = Memory::load_all(memory, computer);
    let (entries, _) = crate::devices::all(folder, key);
    let mark = last_heard(entries.iter().find(|e| e.id == device), &state, device);
    state.forgotten.insert(device.to_string(), mark.max(1));
    state.save(memory)?;
    state.keep(memory);
    Ok(())
}

/// A device counted again (Count it again), whatever it said since.
pub fn count_device_again(memory: &Path, computer: &str, device: &str) -> Result<(), String> {
    let _running = exchange_lock(memory, true)?;
    let mut state = Memory::load_all(memory, computer);
    if state.forgotten.remove(device).is_some() {
        state.save(memory)?;
        state.keep(memory);
    }
    Ok(())
}

/// What this device knows of the sharing's formats, for the window
/// (Settings ▸ Your folder and sharing, the status line): the format it
/// writes, the parts met in a newer format than it knows (their format,
/// the build that wrote it), and, while it writes format 1, the devices that
/// hold format 2 back and why.
#[derive(Debug, Default, Clone)]
pub struct Formats {
    pub writes: u32,
    pub newer: Vec<(String, u32, String)>,
    pub holders: Vec<(String, Holds)>,
    /// The devices that count (`present`) whose entry says they read an
    /// older format than this one's: said once this device writes format 2.
    pub older: Vec<String>,
    /// When each device of `holders` and `older` was last heard of, from
    /// sealed facts (`last_heard`), in milliseconds; 0 when nothing says it.
    /// Settings lists each, with "Forget this device" for one not counted
    /// otherwise.
    pub heard: BTreeMap<String, i64>,
}

pub fn formats(folder: &Path, key: &[u8; 32], memory: &Path, computer: &str, now_ms: i64) -> Formats {
    let state = Memory::load(memory, computer);
    let holders = if state.format < 2 && state.joined { format_holders(folder, key, computer, &state, now_ms) } else { Vec::new() };
    let counting = present(folder, key, computer, &state, now_ms);
    let older = if state.format >= 2 { counting.iter().filter(|(_, entry, _)| entry.as_ref().is_some_and(|e| e.format < FORMAT)).map(|(id, _, _)| id.clone()).collect() } else { Vec::new() };
    let heard = counting.iter().filter(|(id, _, _)| holders.iter().any(|(holder, _)| holder == id) || older.contains(id)).map(|(id, entry, _)| (id.clone(), last_heard(entry.as_ref(), &state, id))).collect();
    Formats { writes: state.format.max(1), newer: state.newer.into_iter().map(|(part, newer)| (part, newer.format, newer.build)).collect(), holders, older, heard }
}

/// Whether this device holds a part met in a newer format than its Sioul
/// reads (`Memory::newer`), as its memory says on the disk: the same in every
/// process, after a restart too. For the doses: this device's entry then says
/// its doses are not known, and it never closes as if they were (docs/health.md).
pub fn holds(memory: &Path, part: &str) -> bool {
    // Only the parts held are kept from the reading: the rest of the memory is passed over, never built.
    #[derive(Deserialize)]
    struct Held {
        #[serde(default)]
        newer: BTreeMap<String, serde::de::IgnoredAny>,
    }
    std::fs::read_to_string(memory).ok().and_then(|t| serde_json::from_str::<Held>(&t).ok()).is_some_and(|held| held.newer.contains_key(part))
}

/// The format this device writes (`FORMAT`): 1 until every device reads format 2 (`format_open`), then 2.
pub fn writes(memory: &Path) -> u32 {
    format_of(memory).max(1)
}

/// The format this device writes, as its memory says (`Memory::format`), whichever computer's it is.
fn format_of(memory: &Path) -> u32 {
    std::fs::read_to_string(memory).ok().and_then(|t| serde_json::from_str::<serde_json::Value>(&t).ok()).and_then(|v| v.get("format").and_then(serde_json::Value::as_u64)).map_or(0, |f| f as u32)
}

/// Parts held for writers that no longer count (`present`: gone, forgotten,
/// silent 180 days: a test build tried once): no longer held. Their changes in that newer format, kept waiting,
/// are dropped; read again later, they are passed over (`Memory::released`).
fn release_newer(sharing: &Sharing, memory: &mut Memory, now_ms: i64) {
    if memory.newer.is_empty() {
        return;
    }
    // Only writers that no longer count, by sealed facts (`present`): never
    // an entry's format, which a record ahead of its new entry, or an older
    // copy put back, could say.
    let counting: BTreeSet<String> = present(sharing.folder, sharing.key, sharing.computer, memory, now_ms).into_iter().map(|(id, _, _)| id).collect();
    let gone: Vec<String> = memory.newer.iter().filter(|(_, newer)| newer.writers.iter().all(|w| !counting.contains(w))).map(|(part, _)| part.clone()).collect();
    for part in gone {
        memory.newer.remove(&part);
        let dropped: Vec<String> = memory.waiting.iter().filter(|(key, (_, _, _, f))| known_part(file_of(key)) == Some(part.as_str()) && *f > part_format(&part)).map(|(key, _)| key.clone()).collect();
        for key in dropped {
            if let Some((_, c, _, _)) = memory.waiting.remove(&key) {
                let released = memory.released.entry(part.clone()).or_default();
                *released = (*released).max(c);
            }
        }
    }
}

/// How format 2 names an entry format 1 named so (its path in its file).
enum Renamed<'r> {
    /// As format 1 does.
    Same,
    /// An element of a list whose elements format 2 names otherwise (`Keyed::ids`).
    Element(&'r Keyed),
    /// A list format 1 sends whole, divided element by element in format 2.
    Whole(&'r Keyed),
}

fn renamed<'r>(rules: &Rules, next: &'r Rules, entry: &str) -> Renamed<'r> {
    let path: Vec<&str> = entry.split(SEP).collect();
    match path.split_last() {
        Some((element, list)) if element.starts_with(MARK) && !list.is_empty() => match (keyed_named(rules, list), keyed_named(next, list)) {
            (Some(before), Some(after)) if before.ids == after.ids && before.by == after.by => Renamed::Same,
            (_, Some(after)) => Renamed::Element(after),
            _ => Renamed::Same,
        },
        _ => match (keyed_named(rules, &path), keyed_named(next, &path)) {
            (None, Some(after)) => Renamed::Whole(after),
            _ => Renamed::Same,
        },
    }
}

/// The elements of a file's keyed lists (format 2's), each with its entry
/// in format 1 (its own, or its whole list's when format 1 sends the list
/// whole), its entry in format 2, and its value.
fn aligned(text: &str, rules: &Rules, next: &Rules) -> Vec<(String, String, String)> {
    let Ok(table) = text.parse::<toml::Table>() else { return Vec::new() };
    let mut out = Vec::new();
    for (name, value) in &table {
        align(vec![name.clone()], value, rules, next, &mut out);
    }
    out
}

fn align(path: Vec<String>, value: &toml::Value, rules: &Rules, next: &Rules, out: &mut Vec<(String, String, String)>) {
    if next.local.iter().any(|rule| matches_rule(&path, rule)) {
        return;
    }
    if let toml::Value::Array(elements) = value
        && let Some(keyed) = keyed_at(next, &path)
    {
        let (before, after) = list_names(elements, &path, rules, keyed);
        let list = list_name(keyed, &path);
        for ((entry, name), element) in before.into_iter().zip(names(&after, keyed)).zip(&after) {
            out.push((entry, format!("{list}{SEP}{MARK}{name}"), leaf_text(element)));
        }
        return;
    }
    if let toml::Value::Table(table) = value
        && !next.whole.iter().any(|rule| matches_rule(&path, rule))
    {
        for (name, value) in table {
            let mut deeper = path.clone();
            deeper.push(name.clone());
            align(deeper, value, rules, next, out);
        }
    }
}

/// A keyed list's elements at `path`: their entries in format 1 (their own,
/// or the whole list's), and the elements as format 2 reads them (its local
/// fields out).
fn list_names(elements: &[toml::Value], path: &[String], rules: &Rules, keyed: &Keyed) -> (Vec<String>, Vec<toml::Value>) {
    let strip = |local: &[&str]| -> Vec<toml::Value> {
        elements
            .iter()
            .map(|element| {
                let mut element = element.clone();
                strip_local(&mut element, local);
                element
            })
            .collect()
    };
    let before: Vec<String> = match keyed_at(rules, path) {
        Some(before) => {
            let list = list_name(before, path);
            names(&strip(before.local), before).into_iter().map(|name| format!("{list}{SEP}{MARK}{name}")).collect()
        }
        None => vec![path.join(&SEP.to_string()); elements.len()],
    };
    (before, strip(keyed.local))
}

/// The name format 2 gives an element format 1 named `ident` when the file
/// here does not say otherwise: format 1 named it by itself (`by` empty),
/// and its own id, else the id derived from it, names it; by its id: that
/// id; by other fields (a session by its start, task and project): the id
/// derived from them, the one written into it when a device took format 2.
fn stateless(keyed: &Keyed, ident: &str) -> String {
    if keyed.by.is_empty()
        && let Some(id) = leaf_value(ident).ok().as_ref().and_then(own_id).map(str::to_string)
    {
        return id;
    }
    if keyed.by == ["id"] && !ident.is_empty() {
        return ident.to_string();
    }
    derived(keyed.list, ident)
}

/// The element's name (after `␞`) in an entry.
fn element_name(entry: &str) -> &str {
    entry.rsplit_once(MARK).map_or("", |(_, name)| name)
}

/// An element as text, its id left out: what two versions of one element compare by.
fn without_id(text: &str) -> String {
    match leaf_value(text) {
        Ok(toml::Value::Table(mut table)) => {
            table.remove("id");
            leaf_text(&toml::Value::Table(table))
        }
        Ok(other) => leaf_text(&other),
        Err(_) => text.to_string(),
    }
}

/// Format 1's changes (`older`: by entry, the later of each), for the files
/// format 2 divides otherwise, in format 2's names. Passed over: one at or
/// below what format 1 already said under that entry here (`Floor`). An
/// element's change takes the name format 2 gives it: its own id; for a
/// session (named by its start, task and project) without one, the id of
/// the session of that name here (a device on format 1 writes a session
/// without the id the switch gave it here: the id is kept), else the id
/// derived from that name; for a money line, its id, else the id derived
/// from it. A value without its id takes the id it goes under, written into
/// it: what the switch wrote stays. From an older Sioul (`modern`: the
/// writers whose sealed entry says they read format 2; the others), a line's
/// removal named by a version this device does not hold any more (a copy
/// changed since) is passed over; from a device that reads format 2 and
/// still writes format 1 for a few minutes, the later word wins. Several
/// entries for one element (an older Sioul changes a line by adding its new
/// version and taking the old one out) make one change: the latest version
/// held, at the latest clock; none held, taken out. A list sent whole sets
/// what it holds and takes out, of what the previous whole list held, what
/// it no longer holds, at its clock: never an element added since in format
/// 2. Returns the changes, and the names that differ from what a device
/// holding none of them would give (a session whose own id was kept here,
/// its value carrying none): sent again from here in format 2, so that every
/// device, one joining later too, holds it under one name.
fn translate(stores: &[Store], older: &BTreeMap<String, (Option<String>, u64, String)>, memory: &mut Memory, winners: &BTreeMap<String, (Option<String>, u64, String)>, modern: &BTreeSet<String>) -> (Vec<(String, Option<String>, u64, String)>, Vec<(String, String)>) {
    let mut versions: BTreeMap<String, Vec<(Option<String>, u64, String)>> = BTreeMap::new();
    let mut out = Vec::new();
    let mut again = Vec::new();
    let mut here: BTreeMap<String, Vec<(String, String, String)>> = BTreeMap::new();
    for (key, (value, c, w)) in older {
        let (file, entry) = (file_of(key), entry_of(key));
        let Some((store, path)) = locate(stores, file) else { continue };
        let Shape::Toml(rules) = store.shape else { continue };
        let next = rules.at(2);
        let renaming = renamed(rules, next, entry);
        if matches!(renaming, Renamed::Same) {
            out.push((key.clone(), value.clone(), *c, w.clone()));
            continue;
        }
        let floor = floor_key(key);
        let previous = memory.floors.get(&floor).cloned();
        if previous.as_ref().is_some_and(|f| (*c, w.as_str()) <= (f.c, f.w.as_str())) {
            continue;
        }
        let elements = here.entry(file.to_string()).or_insert_with(|| aligned(&std::fs::read_to_string(&path).unwrap_or_default(), rules, next));
        match renaming {
            Renamed::Same => {}
            Renamed::Element(keyed) => {
                let (list, ident) = entry.rsplit_once(SEP).map_or(("", ""), |(list, element)| (list, element.trim_start_matches(MARK)));
                let given = value.as_deref().and_then(|v| leaf_value(v).ok()).map(|mut element| {
                    strip_local(&mut element, keyed.local);
                    element
                });
                let fallback = stateless(keyed, ident);
                // The element format 1 names so here (a session by its start,
                // task and project), when none holds the id format 2 derives
                // from that name: one whose id was kept (an older Sioul wrote it
                // back without).
                let derived_here = elements.iter().any(|(_, after, _)| element_name(after) == fallback);
                let mine = (!keyed.by.is_empty() && !derived_here).then(|| elements.iter().find(|(before, _, _)| before == entry)).flatten();
                let mut value = value.clone();
                // The id kept from the session of that name here (an older Sioul wrote it back without).
                let mut kept = false;
                let name = match (&given, given.as_ref().and_then(own_id), mine) {
                    (Some(_), Some(id), _) => id.to_string(),
                    (Some(_), None, Some((_, after, text))) => {
                        kept = leaf_value(text).ok().as_ref().and_then(own_id).is_some();
                        element_name(after).to_string()
                    }
                    (None, _, Some((_, after, _))) => element_name(after).to_string(),
                    _ => fallback.clone(),
                };
                // An element's value without its id (format 1 named it otherwise) takes the id it
                // goes under, as the switch wrote it into the element: never written back without.
                if let Some(element) = given.as_ref().filter(|e| own_id(e).is_none() && e.is_table()) {
                    let mut element = element.clone();
                    if let toml::Value::Table(table) = &mut element {
                        table.insert("id".into(), toml::Value::String(name.clone()));
                    }
                    value = Some(leaf_text(&element));
                }
                // A line taken out as a version this device no longer holds under
                // that name, by an older Sioul (its sealed entry says no newer
                // format): passed over. From a device that reads format 2 (it
                // still writes format 1 for a few minutes), the later word wins,
                // as it will when that device takes format 2.
                if given.is_none() && keyed.by.is_empty() && !modern.contains(w) {
                    let key2 = format!("{file}#{list}{SEP}{MARK}{name}");
                    let current = winners.get(&key2).map(|(v, _, _)| v.clone()).unwrap_or_else(|| elements.iter().find(|(_, after, _)| *after == format!("{list}{SEP}{MARK}{name}")).map(|(_, _, text)| text.clone()));
                    if current.is_some_and(|text| without_id(&text) != without_id(ident)) {
                        memory.floors.insert(floor, Floor { c: *c, w: w.clone(), held: None, removed: BTreeMap::new() });
                        continue;
                    }
                }
                memory.floors.insert(floor, Floor { c: *c, w: w.clone(), held: None, removed: BTreeMap::new() });
                if kept && name != fallback {
                    again.push((format!("{file}#{list}{SEP}{MARK}{name}"), format!("{file}#{list}{SEP}{MARK}{fallback}")));
                }
                versions.entry(format!("{file}#{list}{SEP}{MARK}{name}")).or_default().push((value, *c, w.clone()));
            }
            Renamed::Whole(keyed) => {
                let path: Vec<String> = entry.split(SEP).map(str::to_string).collect();
                let prefix = format!("{file}#{}{SEP}{MARK}", list_name(keyed, &path));
                let elements: Vec<toml::Value> = value
                    .as_deref()
                    .and_then(|v| leaf_value(v).ok())
                    .and_then(|v| v.as_array().cloned())
                    .unwrap_or_default()
                    .into_iter()
                    .map(|mut element| {
                        strip_local(&mut element, keyed.local);
                        element
                    })
                    .collect();
                let listed: BTreeSet<String> = names(&elements, keyed).into_iter().collect();
                for (element, name) in elements.iter().zip(names(&elements, keyed)) {
                    versions.entry(format!("{prefix}{name}")).or_default().push((Some(leaf_text(element)), *c, w.clone()));
                }
                // Of what the previous whole list held, what this one no longer holds.
                let mut removed = previous.as_ref().map(|f| f.removed.clone()).unwrap_or_default();
                for gone in previous.and_then(|f| f.held).unwrap_or_default().difference(&listed) {
                    versions.entry(format!("{prefix}{gone}")).or_default().push((None, *c, w.clone()));
                    removed.insert(gone.clone(), *c);
                }
                removed.retain(|name, _| !listed.contains(name));
                memory.floors.insert(floor, Floor { c: *c, w: w.clone(), held: Some(listed), removed });
            }
        }
    }
    for (key, list) in versions {
        let Some(last) = list.iter().max_by(|a, b| (a.1, &a.2).cmp(&(b.1, &b.2))) else { continue };
        let held = list.iter().filter(|v| v.0.is_some()).max_by(|a, b| (a.1, &a.2).cmp(&(b.1, &b.2))).and_then(|v| v.0.clone());
        out.push((key, held, last.1, last.2.clone()));
    }
    (out, again)
}

/// The files of the stores format 2 divides otherwise: their names in the
/// records, where they are, their store.
fn divided<'s>(stores: &'s [Store]) -> Vec<(String, PathBuf, &'s Store)> {
    let mut out = Vec::new();
    for store in stores.iter().filter(|s| matches!(s.shape, Shape::Toml(rules) if rules.next.is_some())) {
        if store.folder {
            let mut files = Vec::new();
            list_files(&store.path, &store.path, store.skip, &mut files);
            out.extend(files.into_iter().map(|(relative, path)| (format!("{}{relative}", store.name), path, store)));
        } else if store.path.is_file() {
            out.push((store.name.clone(), store.path.clone(), store));
        }
    }
    out
}

/// This device takes format 2 (`FORMAT`), once and for all, before this
/// exchange goes on:
/// 1. every file format 2 divides otherwise must read whole: one that does
///    not (half written, broken by hand), or of no bytes while it held
///    entries, keeps this device on format 1 for now, said
///    (`share-format-wait`), and the switch is tried at the next exchange;
/// 2. what changed in them since the last look goes out first, in format 1
///    and as format 1 names it (`flush`): a removal, a corrected session
///    reach the devices that still read format 1;
/// 3. each element of a list format 2 names by ids is given its id in the
///    file, once, through the file's lock, the file as it was kept first
///    among the earlier versions (`give_ids`); from then on every element
///    carries an id of its own, which changing it never changes;
/// 4. the memory is said in format 2's names, each renamed entry's last
///    clock kept as its floor (`Floor`).
///
/// Returns whether it did. Stopped half way, the next exchange does it
/// again from where the files and the memory are: the ids already written
/// stay, what was sent is known.
fn switch_format(sharing: &Sharing, memory: &mut Memory, stores: &[Store], now_ms: i64, problems: &mut Vec<String>) -> Result<bool, String> {
    let files = divided(stores);
    for (name, path, _) in &files {
        let text = std::fs::read_to_string(path);
        let held = memory.entries.iter().any(|(key, known)| file_of(key) == name && !known.h.is_empty());
        let reads = match &text {
            Ok(text) if text.trim().is_empty() => !held,
            Ok(text) => text.parse::<toml::Table>().is_ok(),
            Err(_) => false,
        };
        if !reads {
            problems.push(format!("share-format-wait:{name}"));
            return Ok(false);
        }
    }
    if memory.joined {
        flush(sharing, memory, stores, now_ms)?;
    }
    // What each whole list holds after that, and what one took out: kept with its floor.
    note_whole_lists(stores, memory);
    // Ids written first, file by file; the memory renamed only once all are:
    // one that cannot be written (no room for the copy kept, a file being
    // written) keeps this device on format 1 for now, said; tried again at the
    // next exchange, the ids already written stay theirs.
    let history = crate::history::root(sharing.memory);
    let mut done = Vec::new();
    for (name, path, store) in &files {
        match give_ids(store, name, path, memory, &history, now_ms) {
            Ok(mut placed) => {
                placed.extend(whole_lists(store, name, path, memory));
                done.push((name, *store, placed));
            }
            Err(e) => {
                problems.push(e);
                problems.push(format!("share-format-wait:{name}"));
                return Ok(false);
            }
        }
    }
    for (name, store, placed) in done {
        rename_memory(memory, store, name, &placed);
    }
    let belongs = |file: &str| locate(stores, file).is_some_and(|(store, _)| matches!(store.shape, Shape::Toml(rules) if rules.next.is_some()));
    memory.files.retain(|file, _| !belongs(file));
    // Changes of these files waiting to be written: with the others' format-1 records, translated.
    let pending: Vec<String> = memory.pending.keys().filter(|key| belongs(file_of(key))).cloned().collect();
    for key in pending {
        if let Some((value, c, w)) = memory.pending.remove(&key) {
            wait(&mut memory.waiting, key, (value, c, w, 1));
        }
    }
    memory.format = 2;
    memory.switch = false;
    Ok(true)
}

/// What changed in the files format 2 divides otherwise since the last look,
/// sent in format 1 (this device still writes it), as an exchange sends it;
/// not for a store joining in this exchange, nor a part held under a newer format.
fn flush(sharing: &Sharing, memory: &mut Memory, stores: &[Store], now_ms: i64) -> Result<(), String> {
    // Not a store joining in this exchange (switched on, or moved: it joins as
    // a new device would, its file rebuilt from the records first), nor a part
    // held under a newer format (nothing of it goes out from here).
    let joining = |store: &Store| !memory.places.is_empty() && memory.places.get(&store.name) != Some(&place_of(store));
    let subset: Vec<Store> = stores.iter().filter(|s| matches!(s.shape, Shape::Toml(rules) if rules.next.is_some()) && !joining(s) && !memory.newer.contains_key(s.part)).cloned().collect();
    let confirmed = BTreeSet::new();
    let found = gather(&subset, &memory.files, &Look { reads: &|_| true, hurry: &|| false, confirmed: &confirmed, clock: clock_ms(), changing: &BTreeMap::new() });
    let mut out: Vec<(String, Option<String>, u64, String)> = Vec::new();
    for (key, h) in &found.hashes {
        if memory.entries.get(key).is_some_and(|k| k.h == *h) {
            continue;
        }
        let Some(value) = found.values.get(key).cloned().or_else(|| value_of(&subset, key)) else { continue };
        let clock = memory.tick(found.changed.get(file_of(key)).copied().unwrap_or(now_ms).min(now_ms));
        memory.entries.insert(key.clone(), Known { c: clock, w: sharing.computer.to_string(), h: h.clone(), b: String::new() });
        out.push((key.clone(), Some(value), clock, String::new()));
    }
    let gone: Vec<String> = memory.entries.iter().filter(|(key, known)| !known.h.is_empty() && !found.hashes.contains_key(*key) && !found.is_unknown(key) && locate(&subset, file_of(key)).is_some()).map(|(key, _)| key.clone()).collect();
    for key in gone {
        let clock = memory.tick(now_ms);
        memory.entries.insert(key.clone(), Known { c: clock, w: sharing.computer.to_string(), h: String::new(), b: String::new() });
        out.push((key, None, clock, String::new()));
    }
    if memory.round == 0 {
        memory.round = 1;
    }
    append(sharing, memory, &out)?;
    for (file, stat) in found.files {
        memory.files.insert(file, stat);
    }
    Ok(())
}

/// An element of a list format 2 names by ids, as `give_ids` left it: its
/// entry in format 1 before, its entry in format 2, its value, and whether it
/// stands for that format-1 entry (what format 1 last sent or received
/// under it: the other devices hold it under that name, and give it the same id).
struct Placed {
    before: String,
    after: String,
    text: String,
    stands: bool,
    /// It holds exactly what was last sent or received: else (changed
    /// meanwhile, or one of several named alike) it is sent again in format
    /// 2, under its id, for every device to hold it as it is here.
    exact: bool,
}

/// Each element of the lists of `path` that format 2 names by ids is given
/// one in the file, once: the element that stands for a format-1 entry
/// (what was last sent or received under it) the id derived from that entry
/// (`derived`), as every device holding it derives it; another (a second
/// session at one start, a second money line alike, a preset an older Sioul
/// never carried) an id of its own, drawn at random, since it was never
/// shared. Two elements holding one id (two devices changed one element
/// apart while they wrote format 1): the one holding the greatest text keeps
/// it, the other takes the id derived from its own format-1 entry. A
/// preset's id is put where splits and lines named it by its place
/// (`#3`). Written through the file's lock, the file as it was kept first
/// (`history`). Returns every element of those lists.
fn give_ids(store: &Store, file: &str, path: &Path, memory: &Memory, history: &Path, now_ms: i64) -> Result<Vec<Placed>, String> {
    let Shape::Toml(rules) = store.shape else { return Ok(Vec::new()) };
    let next = rules.at(2);
    sioul_core::filelock::with_lock(path, || {
        let text = std::fs::read_to_string(path).map_err(|e| format!("{}: {e}", path.display()))?;
        let mut doc: toml_edit::DocumentMut = text.parse().map_err(|e: toml_edit::TomlError| format!("{}: {e}", path.display()))?;
        let mut before: Vec<(Vec<String>, Vec<String>, Vec<(bool, bool)>)> = Vec::new();
        let mut presets: BTreeMap<String, String> = BTreeMap::new();
        let mut changed = false;
        each_id_list(doc.as_table_mut(), Vec::new(), next, &mut |path, keyed, list| {
            let normal = |t: &toml_edit::Table| leaf_value(&format!("[v]\n{t}")).ok();
            let read: Vec<toml::Value> = list.iter().map(|t| normal(t).unwrap_or_else(|| toml::Value::Table(toml::Table::new()))).collect();
            let (entries, _) = list_names(&read, path, rules, keyed);
            let whole = keyed_at(rules, path).is_none();
            // A whole list stands for its format-1 entry when the file holds what was last sent.
            let whole_stands = whole && memory.entries.get(&format!("{file}#{}", entries.first().cloned().unwrap_or_default())).is_some_and(|k| !k.h.is_empty() && toml_entries(&text, rules).is_ok_and(|all| all.iter().any(|(e, v)| entries.first() == Some(e) && hash(v) == k.h)));
            let texts: Vec<String> = read
                .iter()
                .map(|element| {
                    let mut element = element.clone();
                    strip_local(&mut element, keyed_at(rules, path).map_or(keyed.local, |b| b.local));
                    leaf_text(&element)
                })
                .collect();
            let mut ids: BTreeMap<String, Vec<usize>> = BTreeMap::new();
            for (i, element) in read.iter().enumerate() {
                if let Some(id) = own_id(element) {
                    ids.entry(id.to_string()).or_default().push(i);
                }
            }
            // The element each format-1 entry stands for: its one element; of
            // several format 1 named alike (two sessions an older Sioul noted
            // at one start), the first when that entry's last word came from
            // another device (format 1 wrote it there), the last when from
            // this one (format 1 sent that one).
            let mut alike: BTreeMap<&str, Vec<usize>> = BTreeMap::new();
            for (i, entry) in entries.iter().enumerate() {
                alike.entry(entry.as_str()).or_default().push(i);
            }
            let standing = |i: usize| -> (bool, bool) {
                if whole {
                    return (whole_stands, true);
                }
                let Some(known) = memory.entries.get(&format!("{file}#{}", entries[i])).filter(|k| !k.h.is_empty()) else { return (false, false) };
                let at = &alike[entries[i].as_str()];
                let chosen = if at.len() == 1 { at[0] } else if known.w == memory.computer { at[at.len() - 1] } else { at[0] };
                (chosen == i, known.h == hash(&texts[i]))
            };
            let mut claimed: BTreeSet<String> = BTreeSet::new();
            let mut stands = vec![(false, false); read.len()];
            for (i, element) in read.iter().enumerate() {
                let entry = &entries[i];
                let (shared, exact) = standing(i);
                let ident = element_name(entry).to_string();
                let new_id = match own_id(element) {
                    Some(id) if ids.get(id).is_some_and(|at| at.len() == 1) => {
                        stands[i] = (shared, exact);
                        None
                    }
                    Some(id) => {
                        let at = &ids[id];
                        let keeper = at.iter().copied().max_by(|a, b| texts[*a].cmp(&texts[*b]).then(b.cmp(a))).unwrap_or(i);
                        stands[i] = (shared, exact);
                        (keeper != i).then(|| derived(keyed.list, if whole { &texts[i] } else { &ident }))
                    }
                    None => {
                        let what = if whole { texts[i].clone() } else { ident.clone() };
                        if (shared || !memory.joined) && claimed.insert(what.clone()) {
                            stands[i] = (shared, exact);
                            Some(derived(keyed.list, &what))
                        } else {
                            Some(sioul_core::ids::new())
                        }
                    }
                };
                if let Some(id) = new_id {
                    if keyed.list == "preset" && path.len() == 1 {
                        presets.insert(format!("#{i}"), id.clone());
                    }
                    if let Some(table) = list.get_mut(i) {
                        table.insert("id", toml_edit::value(id));
                        changed = true;
                    }
                }
            }
            before.push((path.to_vec(), entries, stands));
        });
        // Splits, lines and mail rules that named a preset by its place name it
        // by its id. Format 1 carried one preset without an id only, so places
        // may name different presets on each device: each element so changed
        // goes out again (not exact), and one version wins everywhere.
        let mut repointed: BTreeSet<(String, usize)> = BTreeSet::new();
        if !presets.is_empty() {
            for list in ["split", "line", "mail_rule"] {
                if let Some(tables) = doc.get_mut(list).and_then(toml_edit::Item::as_array_of_tables_mut) {
                    for (at, table) in tables.iter_mut().enumerate() {
                        if let Some(id) = table.get("preset").and_then(toml_edit::Item::as_str).and_then(|place| presets.get(place)).cloned() {
                            table.insert("preset", toml_edit::value(id));
                            repointed.insert((list.to_string(), at));
                        }
                    }
                }
            }
        }
        let written = doc.to_string();
        if changed {
            crate::history::keep(history, store.part, file, path, now_ms)?;
            write_atomically(path, written.as_bytes())?;
        }
        // Every element as format 2 now reads it, beside its entry in format 1 before.
        let now: toml::Table = written.parse().map_err(|e: toml::de::Error| format!("{}: {e}", path.display()))?;
        let mut placed = Vec::new();
        for (list_path, entries, stands) in before {
            let Some(keyed) = keyed_at(next, &list_path) else { continue };
            let Some(elements) = array_at(&now, &list_path) else { continue };
            let (_, after) = list_names(elements, &list_path, rules, keyed);
            let list = list_name(keyed, &list_path);
            for (at, (((entry, (stands, exact)), name), element)) in entries.into_iter().zip(stands).zip(names(&after, keyed)).zip(&after).enumerate() {
                let exact = exact && !(list_path.len() == 1 && repointed.contains(&(list_path[0].clone(), at)));
                placed.push(Placed { before: entry, after: format!("{list}{SEP}{MARK}{name}"), text: leaf_text(element), stands, exact });
            }
        }
        Ok(placed)
    })
}

/// The array at `path` in a table.
fn array_at<'t>(table: &'t toml::Table, path: &[String]) -> Option<&'t Vec<toml::Value>> {
    let (last, within) = path.split_last()?;
    let mut at = table;
    for part in within {
        at = at.get(part)?.as_table()?;
    }
    at.get(last)?.as_array()
}

/// The elements of the lists of words and dates format 1 sends whole (format
/// 2 names them by themselves, no id to give): each stands for its whole
/// list's entry when the file holds what was last sent under it.
fn whole_lists(store: &Store, file: &str, path: &Path, memory: &Memory) -> Vec<Placed> {
    let Shape::Toml(rules) = store.shape else { return Vec::new() };
    let next = rules.at(2);
    let Ok(text) = std::fs::read_to_string(path) else { return Vec::new() };
    let sent: BTreeMap<String, String> = toml_entries(&text, rules).unwrap_or_default().into_iter().map(|(entry, value)| (entry, hash(&value))).collect();
    aligned(&text, rules, next)
        .into_iter()
        .filter(|(before, after, _)| matches!(renamed(rules, next, before), Renamed::Whole(keyed) if !keyed.ids) && !after.is_empty())
        .map(|(before, after, text)| {
            let stands = memory.entries.get(&format!("{file}#{before}")).is_some_and(|known| !known.h.is_empty() && sent.get(&before) == Some(&known.h));
            Placed { before, after, text, stands, exact: true }
        })
        .collect()
}

/// Each list of tables in `table` that format 2 names by ids (`Keyed::ids`), with its path.
fn each_id_list(table: &mut toml_edit::Table, path: Vec<String>, next: &Rules, f: &mut dyn FnMut(&[String], &Keyed, &mut toml_edit::ArrayOfTables)) {
    let keys: Vec<String> = table.iter().map(|(key, _)| key.to_string()).collect();
    for key in keys {
        let mut deeper = path.clone();
        deeper.push(key.clone());
        if next.local.iter().any(|rule| matches_rule(&deeper, rule)) {
            continue;
        }
        let Some(item) = table.get_mut(&key) else { continue };
        match item {
            toml_edit::Item::ArrayOfTables(list) => {
                if let Some(keyed) = keyed_at(next, &deeper).filter(|k| k.ids) {
                    f(&deeper, keyed, list);
                }
            }
            toml_edit::Item::Table(inner) if !next.whole.iter().any(|rule| matches_rule(&deeper, rule)) => each_id_list(inner, deeper, next, f),
            _ => {}
        }
    }
}

/// The memory of one file said in format 2's names, once its elements carry
/// their ids (`give_ids`): the entry each element stands for becomes its
/// entry in format 2 (its value now holding the id: its hash too), at the
/// same clock; a list format 1 sent whole becomes an entry per element, its
/// clock and what it held kept as its floor; an entry for an element no
/// longer here (taken out) is named as `stateless` names it. Several of
/// format 1's entries for one element (its versions) make one: the latest
/// clock, the version held. Each renamed entry keeps its clock as its floor.
fn rename_memory(memory: &mut Memory, store: &Store, file: &str, placed: &[Placed]) {
    let Shape::Toml(rules) = store.shape else { return };
    let next = rules.at(2);
    let mut grouped: BTreeMap<String, Vec<Known>> = BTreeMap::new();
    let mut wholes: BTreeMap<String, BTreeSet<String>> = BTreeMap::new();
    for element in placed {
        let before = format!("{file}#{}", element.before);
        if let Renamed::Whole(_) = renamed(rules, next, &element.before) {
            wholes.entry(before.clone()).or_default().insert(element_name(&element.after).to_string());
        }
        if !element.stands {
            continue;
        }
        if let Some(known) = memory.entries.get(&before) {
            // Not exactly what was shared: a hash nothing holds, so that the next look sends it.
            let h = if element.exact { hash(&element.text) } else { "?".to_string() };
            grouped.entry(format!("{file}#{}", element.after)).or_default().push(Known { c: known.c, w: known.w.clone(), h, b: String::new() });
        }
    }
    let keys: Vec<String> = memory.entries.keys().filter(|key| file_of(key) == file).cloned().collect();
    for key in keys {
        let entry = entry_of(&key).to_string();
        let renaming = renamed(rules, next, &entry);
        if matches!(renaming, Renamed::Same) {
            continue;
        }
        let Some(known) = memory.entries.remove(&key) else { continue };
        match renaming {
            Renamed::Same => {}
            Renamed::Whole(_) => {
                let held = wholes.get(&key).cloned().filter(|_| !known.h.is_empty());
                let removed = memory.lists.get(&key).map(WholeList::removed).unwrap_or_default();
                memory.floors.insert(floor_key(&key), Floor { c: known.c, w: known.w.clone(), held: Some(held.unwrap_or_default()), removed });
            }
            Renamed::Element(keyed) => {
                memory.floors.insert(floor_key(&key), Floor { c: known.c, w: known.w.clone(), held: None, removed: BTreeMap::new() });
                if !placed.iter().any(|p| p.stands && format!("{file}#{}", p.before) == key) {
                    let (list, ident) = entry.rsplit_once(SEP).map_or(("", ""), |(list, element)| (list, element.trim_start_matches(MARK)));
                    grouped.entry(format!("{file}#{list}{SEP}{MARK}{}", stateless(keyed, ident))).or_default().push(Known { h: String::new(), ..known });
                }
            }
        }
    }
    for (key, versions) in grouped {
        let Some(last) = versions.iter().max_by(|a, b| (a.c, &a.w).cmp(&(b.c, &b.w))).cloned() else { continue };
        let held = versions.iter().filter(|v| !v.h.is_empty()).max_by(|a, b| (a.c, &a.w).cmp(&(b.c, &b.w))).map(|v| v.h.clone()).unwrap_or_default();
        memory.entries.insert(key, Known { c: last.c, w: last.w, h: held, b: String::new() });
    }
}

// ---------------------------------------------------------------- exchange

/// Sharing as set up on this computer.
pub struct Sharing<'a> {
    pub folder: &'a Path,
    pub computer: &'a str,
    pub key: &'a [u8; 32],
    /// Where this computer keeps what it remembers: `<state>/share/memory.json`.
    pub memory: &'a Path,
    /// Notes and papers too (`Shape::Files`): not for an exchange that must be
    /// quick (a dose's alarm, a notification's button, Sioul closing), nor
    /// without the system's leave to read them all. A single file sealed apart
    /// (the spam filter's table) goes in every exchange.
    pub files: bool,
    /// Set while a hurried exchange waits for this one: its work on notes and
    /// papers stops where it is, and goes on at the next.
    pub hurry: Option<&'a std::sync::atomic::AtomicBool>,
}

/// What an exchange did.
#[derive(Debug, Default)]
pub struct Outcome {
    /// The stores written to, by name: what to read again.
    pub written: BTreeSet<String>,
    /// Why notes and papers received wait, by reason, counted (never named):
    /// "no-store" (not shared here), "not-read" (not this time: a quick
    /// exchange, or Android's leave to read them all not given), "hurried",
    /// "unknown" (their file here not readable as it stands), "backoff" (could
    /// not be written lately, tried again later), "no-blob" (their sealed file
    /// neither in the folder nor fetched beside it yet: waited for, `blobs::Wanted`),
    /// "later" (changed here since it was looked at: the next exchange sends that first),
    /// "copies" (a take-out past what an exchange copies into the history, `TAKE_OUT_COPIES`).
    pub waits: BTreeMap<String, usize>,
    /// Changes found here and sent.
    pub sent: usize,
    /// Changes from the others written here.
    pub received: usize,
    /// What went wrong, in a word each; the rest went on.
    pub problems: Vec<String>,
    /// The others' changes waiting to be written here (their file unreadable, or not shared here).
    pub pending: usize,
    /// When this computer's files were read for it (milliseconds, its clock):
    /// everything captured here before is in its records, up to `wrote`. 0
    /// when it did not run (`share-busy`).
    pub looked: i64,
    /// How far this computer's records went once it ended: round and number;
    /// none before sharing joined.
    pub wrote: Option<(u32, u64)>,
    /// Nothing it reads had changed since an exchange left everything
    /// settled: nothing was read nor written (`quiet`).
    pub quiet: bool,
    /// The notes and papers gone many at once here and held, as this exchange
    /// left them (`withheld`); none when it did not get that far (`share-busy`,
    /// a seal missing, nothing to do).
    pub withheld: Option<Vec<Withheld>>,
}

/// Before the first exchange, a copy of every shared file, in case. Not of
/// notes and papers, which may be large: each file is kept before anything
/// is written over it (`history`). Not of the calls' logs: nothing removes
/// these copies, and a call leaves every device after its month. A copy
/// there already is never written over: a first exchange tried again (one
/// that failed after writing the others' changes), or sharing stopped and
/// started again the same day, keeps the files as they were before sharing
/// (review of 5 October 2026, F22).
fn keep_copies(stores: &[Store], memory: &Path, today: &str) {
    let Some(base) = memory.parent() else { return };
    let aside = base.join(format!("before-sharing-{today}"));
    let keep = |from: &Path, to: &Path| {
        if to.exists() {
            return;
        }
        let _ = to.parent().map(private_dirs);
        let _ = copy_private(from, to);
    };
    for store in stores.iter().filter(|s| !matches!(s.shape, Shape::Files) && !calls_store(&s.name)) {
        let target = aside.join(store.name.trim_end_matches('/'));
        if store.folder {
            let mut files = Vec::new();
            list_files(&store.path, &store.path, store.skip, &mut files);
            for (relative, path) in files {
                keep(&path, &target.join(relative));
            }
        } else if store.path.is_file() {
            keep(&store.path, &target);
        }
    }
}

/// The copies beside drafts kept before sharing began (`keep_copies`:
/// `before-sharing-<day>/data/drafts/<id>.eml`, beside `memory`), which
/// nothing removes: until 19 October 2026 one could hold an encrypted
/// message's text in clear (`sioul_core::draftcopies::seal_versions`
/// encrypts those again).
pub fn draft_copies_kept_before_sharing(memory: &Path) -> Vec<PathBuf> {
    let Some(base) = memory.parent() else { return Vec::new() };
    let mut out = Vec::new();
    for aside in std::fs::read_dir(base).into_iter().flatten().filter_map(Result::ok) {
        if !aside.file_name().to_string_lossy().starts_with("before-sharing-") || !aside.file_type().is_ok_and(|t| t.is_dir()) {
            continue;
        }
        for copy in std::fs::read_dir(aside.path().join("data").join("drafts")).into_iter().flatten().filter_map(Result::ok) {
            if copy.file_type().is_ok_and(|t| t.is_file()) && copy.path().extension().is_some_and(|e| e == "eml") {
                out.push(copy.path());
            }
        }
    }
    out.sort();
    out
}

/// The exchange lock as `sioul_core::draftcopies::Hold` asks it, for the
/// copies beside drafts encrypted again: taken for each short batch of their
/// replacements, waiting for an exchange running, so that no exchange reads a
/// copy while it is replaced (nor seals and sends the zeros written over the
/// old one after). A device that has never shared (no `share/` folder beside
/// `memory`) runs no exchange: a guard that holds nothing, no folder made.
pub fn replacements_hold(memory: &Path) -> impl Fn() -> Option<Box<dyn sioul_core::draftcopies::Held>> + '_ {
    move || {
        if !memory.parent().is_some_and(Path::exists) {
            return sioul_core::draftcopies::unshared();
        }
        exchange_lock(memory, true).ok().flatten().map(|file| Box::new(HandedOff(memory.to_path_buf(), Some(file))) as Box<dyn sioul_core::draftcopies::Held>)
    }
}

/// The lock held for a batch of the copies beside drafts, handed to an
/// exchange waiting in this process when let go (`hand_off`), let go at once
/// when none waits here; it ends after its copy once one does (`waiting_here`).
struct HandedOff(PathBuf, Option<std::fs::File>);

impl sioul_core::draftcopies::Held for HandedOff {
    fn wanted(&self) -> bool {
        waiting_here(&self.0)
    }
}

impl Drop for HandedOff {
    fn drop(&mut self) {
        hand_off(&self.0, self.1.take(), std::time::Duration::ZERO);
    }
}

/// One exchange: the changes found here go out, the others' come in. One at a
/// time on this computer, whatever runs it (`exchange_lock`): another running,
/// a quick one waits for it; a whole one does nothing, and says so (`share-busy`).
pub fn exchange(sharing: &Sharing, stores: &[Store], now_ms: i64) -> Result<Outcome, String> {
    // The folder as it was set up, its seal opening with this device's key;
    // else nothing is read, written or made, and it is said (`sealed_for`).
    let (sealed, salt) = match sealed_for(sharing.folder, sharing.key) {
        Ok(Some((opens, salt))) => (Some(opens), salt),
        Ok(None) => (None, String::new()),
        Err(()) => return Ok(Outcome { problems: vec!["share-no-seal".into()], ..Outcome::default() }),
    };
    let Some(_running) = exchange_lock(sharing.memory, !sharing.files)? else { return Ok(Outcome { problems: vec!["share-busy".into()], ..Outcome::default() }) };
    // What was fetched from the server too, read beside the folder, the newer
    // copy of each other device's file (`remote`); none until a server's
    // folder is confirmed to be this one.
    crate::remote::attach(sharing.folder, sharing.memory);
    let mut outcome = Outcome::default();
    // Notes and papers only when asked (not for a dose's alarm, a button
    // pressed, Sioul closing), and while no hurried exchange waits for this
    // one: their work stops where it is, and goes on at the next.
    let hurried = || sharing.hurry.is_some_and(|hurry| hurry.load(std::sync::atomic::Ordering::Relaxed));
    // A single file sealed apart (the spam filter's table), in every exchange:
    // one file of Sioul's own, quick to read, never in a shared storage.
    let reads = |store: &Store| reads_now(sharing, store);
    // What it reads, as it stands before anything is read (`Standing`): as
    // when the last exchange in this process left everything settled, there
    // is nothing to do, and nothing is read (`quiet`). Not with notes and
    // papers: the window's exchanges read them through.
    // Its time taken first: whatever was written before it is in the stamps.
    let standing = (!sharing.files).then(|| {
        let taken = clock_ms();
        (Standing::now(sharing, stores, &reads), taken)
    });
    if let Some(outcome) = standing.as_ref().and_then(|(standing, taken)| quiet(sharing, standing, *taken, now_ms)) {
        return Ok(outcome);
    }
    let mut memory = Memory::load_all(sharing.memory, sharing.computer);
    // Another sharing than the one this memory knew (its seal made from
    // another salt): this device set up again with another folder while its
    // memory stayed (the keyring's key lost, the passphrase typed again with
    // another folder). How far it read there, and that it joined, mean nothing
    // here: it starts anew, as when sharing stops and starts again (review
    // of 5 October 2026, F22), its own records here read first if any.
    if sealed == Some(true) && !memory.seal_salt.is_empty() && memory.seal_salt != salt {
        // Its own records here, if any, were sealed under another key (two
        // devices that sealed the folder apart): a new round of its own, full,
        // which the others can open and read on from (`later_full`).
        let round = last_own(sharing.folder, sharing.computer).map_or(1, |(round, _, _)| round + 1);
        memory = Memory { computer: sharing.computer.to_string(), round, full_round: round, ..Memory::default() };
    }
    if sealed == Some(true) {
        memory.seal_salt = salt;
    }
    // Its seal gone from a folder this device saw sealed (a sync app that made
    // the folder again, empty, or brought an empty placeholder of it), or
    // there but no longer opening with this device's key (another device's
    // seal put in its place: two devices sealed the folder apart): nothing
    // written there until it is as it was, said (`sealed_for`).
    match (sealed, memory.seal_seen) {
        (None, true) => return Ok(Outcome { problems: vec!["share-no-seal".into()], ..Outcome::default() }),
        (Some(false), true) => return Ok(Outcome { problems: vec!["share-sealed-otherwise".into()], ..Outcome::default() }),
        (Some(true), false) => memory.seal_seen = true,
        _ => {}
    }
    // This computer's own records in the folder go further than its memory: the
    // memory was restored from a backup, lost, or started again ("Stop sharing",
    // then again). Its numbering goes on after the folder's last line (the
    // others never read a number twice, nor miss one), and every file is read
    // again from all the records, its own too: what it marked after its memory's
    // time comes back here.
    let mut restate = false;
    if let Some((round, n, size)) = last_own(sharing.folder, sharing.computer)
        && (round, n) > (memory.round, memory.seq)
    {
        outcome.problems.push("share-own-ahead".into());
        // Lines this device did not append (`appended`: its own last append,
        // noted before it was made, where a process stopped before saving its
        // memory left it) again within hours: another device writes under this
        // one's name (a disk or a state folder copied to it), each finding the
        // other's lines in its own file; a memory restored finds them once.
        // Said, for you to stop sharing on one of them and start it again
        // there, which gives it a name of its own (review of 5 October 2026,
        // F22). Meanwhile the others meet gaps in that name's records: the
        // doses say the doubt.
        if appended(sharing.memory, sharing.computer).is_none_or(|end| (round, n) > end) {
            if memory.ahead_at > 0 && now_ms - memory.ahead_at < TWIN_WITHIN {
                outcome.problems.push("share-twin".into());
            }
            memory.ahead_at = now_ms;
        }
        memory.round = round;
        memory.seq = n;
        memory.own_size = size;
        memory.round_base = 0;
        // Where its rounds stood is read from the folder, not from the memory
        // (`Turn`): a round found without a line (its first writing lost, a
        // placeholder) continues the round before as that round ends; with
        // none before it, a full round follows, restating all it holds.
        memory.continues = 0;
        if n == 0 && round > 1 {
            match last_line(sharing.folder, sharing.computer, round - 1) {
                Some(last) if last > 0 => memory.continues = last,
                _ => restate = true,
            }
        }
        // Which of its rounds was full is not known: none taken out until
        // the next full round (`remove_old_rounds` keeps every round from 1).
        // Nor how much that one restated: read again from the folder
        // (`full_round_after`), never the size this memory knew when it was
        // put away, which would hold the next full round back, and every
        // round meanwhile, for that many bytes (review of 15 October 2026, L3).
        memory.full_round = 1;
        memory.full_size = 0;
        memory.read.clear();
        memory.rebuild.insert("*".into());
    }
    // A memory kept before rounds said where they stand (`Turn`) may have
    // moved past the end of a round it had not read whole: every other
    // computer's kept rounds are read again, once; what was known already
    // changes nothing, what was passed over comes in.
    // Entries of stores that left (`RETIRED`) are forgotten: nothing reads or
    // writes them any more (review of 10 October 2026, S2-B).
    memory.entries.retain(|key, _| !retired(key));
    if !memory.turns {
        if memory.joined {
            memory.read.clear();
        }
        memory.turns = true;
    }
    if !memory.joined {
        let today = jiff::Timestamp::from_millisecond(now_ms).map(|t| t.strftime("%Y-%m-%d").to_string()).unwrap_or_default();
        keep_copies(stores, sharing.memory, &today);
    }
    // The format this device writes (`FORMAT`): format 2 once every device
    // in the sharing reads it (`format_open`), or once another device writes
    // it already (`Memory::switch`); its memory is then said in format 2's
    // names, once (`switch_format`). Its files are read and written as its
    // format divides them; an older format's records are translated
    // (`translate`).
    // Parts met in a newer format that this Sioul now reads (it was updated),
    // or whose writers no longer count: no longer held (`release_newer`).
    memory.newer.retain(|part, newer| newer.format > part_format(part));
    // What is known of the others, from sealed facts (`present`).
    note_entries(sharing.folder, sharing.key, &mut memory);
    fill_heard_at(sharing.folder, sharing.key, sharing.computer, &mut memory, now_ms);
    release_newer(sharing, &mut memory, now_ms);
    if memory.format < 2 && (memory.switch || format_open(sharing, &memory, now_ms)) {
        switch_format(sharing, &mut memory, stores, now_ms, &mut outcome.problems)?;
    }
    let originals = stores;
    let shaped_stores = shaped(stores, memory.format);
    let stores = shaped_stores.as_slice();
    // Parts met in a newer format: nothing of them goes out from here until this Sioul is updated.
    let held: BTreeSet<&'static str> = memory.newer.keys().filter_map(|part| PARTS.iter().find(|p| **p == part.as_str()).copied()).collect();
    let holds = |key: &str| known_part(file_of(key)).is_some_and(|part| held.contains(part));
    let clock = clock_ms();
    let confirmed = memory.sealed.confirmed.clone();
    let mut found = gather(stores, &memory.files, &Look { reads: &reads, hurry: &hurried, confirmed: &confirmed, clock, changing: &memory.sealed.changing });
    // Large notes and papers settling: those of the stores read now as this
    // look found them, the others' as they were (`Sealed::changing`).
    let mut changing = std::mem::take(&mut found.changing);
    changing.extend(memory.sealed.changing.iter().filter(|(file, _)| locate(stores, file).is_some_and(|(store, _)| !reads(store))).map(|(file, since)| (file.clone(), *since)));
    memory.sealed.changing = changing;
    outcome.problems.extend(found.too_big.iter().map(|file| format!("share-too-big:{file}")));
    outcome.problems.append(&mut found.said);
    outcome.problems.extend(found.emptied.iter().map(|(folder, held)| format!("share-vanished:{folder}:{held}")));
    let mut out: Vec<(String, Option<String>, u64, String)> = Vec::new();

    // Stores new here (projects shared from now on, a store a new version
    // adds) or moved (another notes folder): joined as a new computer joins.
    // Their files are rebuilt from all the records first, then only what they
    // alone hold goes out: an old copy here never beats the others' newer
    // values, an empty new folder is filled, and nothing is taken out
    // elsewhere. A memory from before places were kept takes every store where
    // it is. A store not read this time joins when it is.
    let place = place_of;
    if memory.joined && memory.places.is_empty() {
        memory.places = stores.iter().map(|s| (s.name.clone(), place(s))).collect();
    }
    let joining: BTreeSet<String> = if memory.joined { stores.iter().filter(|s| reads(s) && memory.places.get(&s.name) != Some(&place(s))).map(|s| s.name.clone()).collect() } else { BTreeSet::new() };
    let joins_store = |key: &str| locate(stores, file_of(key)).is_some_and(|(store, _)| joining.contains(&store.name));
    if !joining.is_empty() {
        memory.entries.retain(|key, _| !joins_store(key));
        memory.read.clear();
        memory.rebuild.extend(joining.iter().cloned());
    }
    // Files rebuilt without being set aside (`rebuild`, `Memory::rejoin`)
    // join as the stores joining do: read from the records first, then only
    // what the records lack goes out; what they hold may be what was there
    // before, and never goes out first, with a clock later than everything
    // read, over another device's newer word not read yet (a dose's mark the
    // phone had taken back came back on both devices: review of 15 October
    // 2026, RV-P2). Not the files set aside in the same step (`rebuild_then`,
    // the doses' repair): they hold only what was written after the repair,
    // a change made here that goes, never replaced by an older record of the
    // same entry (RF-J). Nor every file read again because this device's own
    // records go further than its memory (`share-own-ahead`): that memory
    // keeps its entries, and what changed here since them goes.
    let rebuilt_here: BTreeSet<String> = joining.iter().cloned().chain(std::mem::take(&mut memory.rejoin)).collect();
    let joins = |key: &str| {
        let file = file_of(key);
        rebuilt_here.contains(file) || rebuilt_here.iter().any(|r| r.ends_with('/') && file.starts_with(r.as_str()))
    };

    // A file sealed apart found empty that was not at the last look (an
    // editor writing it in place, a crash): held as it was, a while.
    let mut held_empty: BTreeSet<String> = BTreeSet::new();
    let emptied_now: Vec<String> = found.files.iter().filter(|(file, stat)| file.starts_with(FILES) && stat.size == 0 && memory.files.get(*file).is_some_and(|before| before.size > 0)).map(|(file, _)| file.clone()).collect();
    for file in emptied_now {
        let since = *memory.emptied.entry(file.clone()).or_insert(now_ms);
        if now_ms - since < EMPTIED_WAIT {
            found.hashes.remove(&format!("{file}#"));
            found.unknown.insert(file.clone());
            if let Some(before) = memory.files.get(&file) {
                found.files.insert(file.clone(), before.clone());
            }
            held_empty.insert(file);
        }
    }
    // Not read this time (a quick exchange): held as they were.
    let unread = |file: &str| locate(stores, file).is_some_and(|(store, _)| !reads(store));
    memory.emptied.retain(|file, _| !file.starts_with(FILES) || held_empty.contains(file) || unread(file));

    // Files sealed apart gone here: taken out elsewhere once gone a while
    // (`EMPTIED_WAIT`: a file being replaced, a disk away a moment); many at
    // once (a folder moved away, deleted in bulk) held until you say so
    // (`confirm_gone`) or for `GONE_GRACE`, then out by themselves unless
    // they came back (`withheld` says when). A folder missing, unmounted or
    // not readable whole is not a deletion: its files are unknown (`gather`),
    // never gone, and nothing of them leaves. Meanwhile another device's
    // change to one of them still comes, unless many went at once.
    let mut held_gone: BTreeSet<String> = BTreeSet::new();
    let mut gone_since: BTreeMap<String, i64> = memory.sealed.gone.iter().filter(|(file, _)| unread(file)).map(|(file, since)| (file.clone(), *since)).collect();
    // Those held as gone many at once, by store, for the Porch (`withheld`);
    // a store not read this time keeps what the last exchange said of it.
    let mut mass_held: BTreeMap<String, BTreeMap<String, i64>> = BTreeMap::new();
    let mut bulk_now: BTreeSet<String> = memory.sealed.bulk.iter().filter(|file| unread(file)).cloned().collect();
    let mut withheld: Vec<Withheld> = std::mem::take(&mut memory.withheld).into_iter().filter(|w| stores.iter().any(|s| s.name == w.store && !reads(s))).collect();
    if memory.joined {
        let mut by_store: BTreeMap<String, (usize, Vec<String>)> = BTreeMap::new();
        for key in memory.entries.iter().filter(|(key, known)| key.starts_with(FILES) && !known.h.is_empty()).map(|(key, _)| key) {
            let Some((store, _)) = locate(stores, file_of(key)) else { continue };
            if !reads(store) || joining.contains(&store.name) {
                continue;
            }
            let counted = by_store.entry(store.name.clone()).or_default();
            counted.0 += 1;
            if !found.hashes.contains_key(key) && !found.is_unknown(key) {
                counted.1.push(file_of(key).to_string());
            }
        }
        for (store, (held, gone)) in by_store.into_iter().filter(|(_, (_, gone))| !gone.is_empty()) {
            // You said to take them out: the folder they went from (its own
            // line, `confirm_gone`), or these files ("Take them out now",
            // `confirm_withheld`).
            let confirmed = |file: &String| memory.sealed.confirmed.iter().any(|said| confirms(said, file)) || memory.sealed.confirmed_files.contains(file);
            let mass = gone.len() > MASS || (gone.len() >= 3 && gone.len() * 5 > held);
            let since_of = |file: &String| memory.sealed.gone.get(file).copied().unwrap_or(now_ms);
            // Held as gone many at once: now, or before and until its own grace ends (`Sealed::bulk`).
            let bulk = |file: &String| mass || memory.sealed.bulk.contains(file);
            let held_now = gone.iter().any(|file| bulk(file) && !confirmed(file) && now_ms - since_of(file) < GONE_GRACE);
            if held_now {
                outcome.problems.push(format!("share-vanished:{store}:{}", gone.len()));
            }
            for file in gone {
                let since = since_of(&file);
                if bulk(&file) && !confirmed(&file) && now_ms - since < GONE_GRACE {
                    gone_since.insert(file.clone(), since);
                    mass_held.entry(store.clone()).or_default().insert(file.clone(), since);
                    bulk_now.insert(file.clone());
                    // Held as it was, its date too: put back, it is dated as it was (`put_back_withheld`).
                    if let Some(before) = memory.files.get(&file) {
                        found.files.insert(file.clone(), before.clone());
                    }
                    found.unknown.insert(file);
                } else if !bulk(&file) && !confirmed(&file) && now_ms - since < EMPTIED_WAIT {
                    gone_since.insert(file.clone(), since);
                    held_gone.insert(file);
                }
            }
        }
    }
    memory.sealed.gone = gone_since;
    memory.sealed.bulk = bulk_now;
    // What you said to take out that went, or came back, is forgotten.
    let gone_now = &memory.sealed.gone;
    memory.sealed.confirmed_files.retain(|file| gone_now.contains_key(file));
    withheld.extend(mass_held.iter().map(|(store, files)| withheld_of(store, files)));
    withheld.sort_by(|a, b| a.store.cmp(&b.store));
    memory.withheld = withheld;
    let value = |key: &str| found.values.get(key).cloned().or_else(|| value_of(stores, key));
    // The contents of the files sealed apart as this exchange finds them: used
    // in it, so that one replaced in it (here, or by another device's change
    // read now) is swept two weeks from now, not from its last use this device
    // noted, which may be days old after days away (`blobs::sweep_after`).
    let current_before: BTreeSet<String> = memory.entries.iter().filter(|(key, known)| key.starts_with(FILES) && !known.h.is_empty()).map(|(_, known)| known.h.clone()).collect();
    // Those of them the others' records named, by content, with whose record:
    // one no longer current at the end is noted as theirs (`Sealed::theirs`).
    // So are the others' contents passed by a later change in this reading.
    let mut theirs_now: Vec<(String, String)> = memory.entries.iter().filter(|(key, known)| key.starts_with(FILES) && !known.h.is_empty() && known.w != sharing.computer).map(|(_, known)| (known.h.clone(), known.w.clone())).collect();
    // The contents of the files sealed apart taken out in this exchange, with
    // the writer and round of the record that took each out (`removed_due`).
    let mut removed_now: Vec<(String, String, u32)> = Vec::new();
    // The contents of the files sealed apart that a change made or read in
    // this exchange replaced (its base): kept by reference somewhere, maybe
    // (`Sealed::replaced`).
    let mut replaced_now: Vec<String> = Vec::new();

    // Changes made here since the last look, dated by their file. When joining,
    // the others' records come first, and only what they do not hold goes out.
    let mut older: Vec<String> = Vec::new();
    if memory.joined {
        for (key, h) in &found.hashes {
            if memory.entries.get(key).is_some_and(|k| k.h == *h) || joins(key) {
                memory.held.remove(key);
                continue;
            }
            // Found while its part is held: when it was found is kept; it goes
            // once the part is no longer held, at that time (`Memory::held`).
            if holds(key) {
                if memory.held.get(key).is_none_or(|(_, held)| held != h) {
                    let at = memory.tick(found.changed.get(file_of(key)).copied().unwrap_or(now_ms).min(now_ms));
                    memory.held.insert(key.clone(), (at, h.clone()));
                }
                continue;
            }
            if key.starts_with(FILES) {
                // An older copy put back by hand (a backup's, its time before
                // the version last seen here): not sent; that version comes
                // back, the copy kept beside (`older`).
                let file = file_of(key);
                if memory.entries.get(key).is_some_and(|k| !k.h.is_empty()) && found.files.get(file).zip(memory.files.get(file)).is_some_and(|(now, before)| now.modified < before.modified) {
                    older.push(key.clone());
                    continue;
                }
                if hurried() {
                    continue;
                }
            }
            let Some(value) = value(key) else { continue };
            // A file sealed apart goes into the folder before its record.
            if !seal_apart(sharing, stores, key, &value, &mut memory.sealed, &mut outcome.problems, now_ms) {
                continue;
            }
            let base = base_of(&memory, key);
            let clock = match memory.held.remove(key) {
                Some((at, held)) if held == *h => at,
                _ => memory.tick(found.changed.get(file_of(key)).copied().unwrap_or(now_ms).min(now_ms)),
            };
            memory.entries.insert(key.clone(), Known { c: clock, w: sharing.computer.to_string(), h: h.clone(), b: base.clone() });
            met_draft(&mut memory, key, [&base, h]);
            out.push((key.clone(), Some(value), clock, base));
        }
        // A settings file (the settings, the doses' record…) that held entries
        // and is now gone or of no bytes at all: a crash, a full disk, a file
        // being written in place, rather than a choice. Held for a while
        // (`EMPTIED_WAIT`): never everything taken out, everywhere, at once. A
        // list emptied on purpose, or a file gone from a folder of files (a
        // draft sent), is taken out at once; a note or a paper after a while
        // (above). A store no longer shared here (a part switched off, a notes
        // folder unset) takes nothing out elsewhere.
        let settings = |file: &str| stores.iter().find(|s| !s.folder && s.name == file && matches!(s.shape, Shape::Toml(_)));
        let held: BTreeSet<String> = memory.entries.iter().filter(|(_, k)| !k.h.is_empty()).map(|(key, _)| file_of(key).to_string()).filter(|file| settings(file).is_some()).collect();
        let mut waiting: BTreeSet<String> = BTreeSet::new();
        for file in held {
            let nothing = settings(&file).is_some_and(|s| std::fs::metadata(&s.path).map_or(true, |m| m.len() == 0));
            if !nothing || found.hashes.keys().any(|k| file_of(k) == file) {
                memory.emptied.remove(&file);
            } else if now_ms - *memory.emptied.entry(file.clone()).or_insert(now_ms) < EMPTIED_WAIT {
                outcome.problems.push(format!("share-emptied:{file}"));
                waiting.insert(file);
            }
        }
        let gone: Vec<String> = memory
            .entries
            .iter()
            .filter(|(key, known)| !known.h.is_empty() && !found.hashes.contains_key(*key) && !found.is_unknown(key) && !held_gone.contains(file_of(key)))
            .filter(|(key, _)| locate(stores, file_of(key)).is_some_and(|(store, _)| reads(store)) && !waiting.contains(file_of(key)))
            .map(|(key, _)| key.clone())
            .collect();
        for key in gone {
            if holds(&key) {
                if memory.held.get(&key).is_none_or(|(_, held)| !held.is_empty()) {
                    let at = memory.tick(now_ms);
                    memory.held.insert(key.clone(), (at, String::new()));
                }
                continue;
            }
            let base = base_of(&memory, &key);
            let clock = match memory.held.remove(&key) {
                Some((at, held)) if held.is_empty() => at,
                _ => memory.tick(now_ms),
            };
            memory.entries.insert(key.clone(), Known { c: clock, w: sharing.computer.to_string(), h: String::new(), b: base.clone() });
            met_draft(&mut memory, &key, [&base, ""]);
            out.push((key, None, clock, base));
        }
    }

    // The others' records, from where each was left; those not written last
    // time first. A change for a part this device does not share is not kept
    // waiting: switched on, the part joins and reads it again.
    let newer = |c: u64, w: &str, than: Option<(u64, &str)>| than.is_none_or(|(tc, tw)| (c, w) > (tc, tw));
    // Nor one for a store that left (`RETIRED`), which an older device may still send.
    let off = |key: &str| retired(key) || (locate(stores, file_of(key)).is_none() && known_part(file_of(key)).is_some());
    let mut winners: BTreeMap<String, (Option<String>, u64, String)> = std::mem::take(&mut memory.pending)
        .into_iter()
        .filter(|(key, (_, c, w))| !off(key) && newer(*c, w, memory.entries.get(key).map(|k| (k.c, k.w.as_str()))))
        .collect();
    // Records of an older format (format 1: an older Sioul's, or this device's
    // own before it wrote format 2), for files format 2 divides otherwise: by
    // their entries, the later of each, translated once all are read (`translate`).
    let mut older_format: BTreeMap<String, (Option<String>, u64, String)> = BTreeMap::new();
    let divided_otherwise = |key: &str| locate(originals, file_of(key)).is_some_and(|(store, _)| matches!(store.shape, Shape::Toml(rules) if rules.next.is_some()));
    let later = |older_format: &mut BTreeMap<String, (Option<String>, u64, String)>, key: String, value: Option<String>, c: u64, w: &str| {
        if older_format.get(&key).is_none_or(|(_, tc, tw)| (c, w) > (*tc, tw.as_str())) {
            older_format.insert(key, (value, c, w.to_string()));
        }
    };
    // Changes that waited for this device to write format 2, or for this
    // Sioul to know their part's format: in, once it can.
    let ready: Vec<String> = memory.waiting.iter().filter(|(key, (_, _, _, f))| memory.format >= 2 && known_part(file_of(key)).is_some_and(|part| *f <= part_format(part))).map(|(key, _)| key.clone()).collect();
    for key in ready {
        let Some((value, c, w, f)) = memory.waiting.remove(&key) else { continue };
        if off(&key) {
            continue;
        }
        if f < 2 && divided_otherwise(&key) {
            later(&mut older_format, key, value, c, &w);
        } else if !below_whole_floor(&memory, &key, c) && newer(c, &w, memory.entries.get(&key).map(|k| (k.c, k.w.as_str()))) && newer(c, &w, winners.get(&key).map(|(_, c, w)| (*c, w.as_str()))) {
            winners.insert(key, (value, c, w));
        }
    }
    // The build each computer's lines were written by, as its batches say: for `share-newer`.
    let mut builds: BTreeMap<String, String> = BTreeMap::new();
    // For files sealed apart: the content each change replaces where it was
    // made (its base), and every content the others' records name for each
    // file, their versions and what those replaced: a file here among them is
    // an older version, not a change of its own (`receive`).
    let mut bases: BTreeMap<String, String> = std::mem::take(&mut memory.sealed.bases).into_iter().filter(|(key, _)| winners.contains_key(key)).collect();
    let mut named: BTreeMap<String, BTreeSet<String>> = std::mem::take(&mut memory.sealed.named).into_iter().filter(|(key, _)| winners.contains_key(key)).collect();
    for (key, (value, _, _)) in winners.iter().filter(|(key, _)| key.starts_with(FILES)) {
        named.entry(key.clone()).or_default().extend(value.as_deref().map(|v| value_hash(key, v)).into_iter().chain(bases.get(key).cloned()).filter(|h| !h.is_empty()));
    }
    let all = rounds_with(sharing.folder);
    // Rebuilding a file: this computer's own records are read again too, for its entries only.
    let rebuilding = std::mem::take(&mut memory.rebuild);
    let rebuilt = |file: &str| rebuilding.contains("*") || rebuilding.contains(file) || rebuilding.iter().any(|r| r.ends_with('/') && file.starts_with(r.as_str()));
    for (computer, their_rounds) in all.iter().filter(|(c, _)| *c != sharing.computer || !rebuilding.is_empty()) {
        let own = computer == sharing.computer;
        let (mut start, mut skip) = if own { (0, 0) } else { memory.read.get(computer).copied().unwrap_or((0, 0)) };
        if !their_rounds.contains(&start) {
            // Not begun, or that round was removed: the oldest kept starts with all that counts.
            (start, skip) = (their_rounds[0], 0);
        }
        // A round waiting for the end of the one before is passed over for a
        // later full round, which restates all its computer holds (`Turn`).
        let mut from_round = start;
        'rounds: for &round in their_rounds.iter().filter(|r| **r >= start) {
            if round < from_round {
                continue;
            }
            let mut offset = if round == start { skip } else { 0 };
            let opened = if own { std::fs::File::open(round_file(sharing.folder, computer, round)) } else { open_round(sharing.folder, computer, round) };
            let Ok(mut file) = opened else {
                if !own {
                    memory.read.insert(computer.clone(), (round, offset));
                }
                continue;
            };
            // Shorter than what was read of it: an older copy put back by a sync
            // app. What it held past that point is lost here, said; it is read
            // again from its start (lines already known change nothing).
            if !own && file.metadata().is_ok_and(|m| m.len() < offset) {
                outcome.problems.push(format!("share-other-cut:{computer}"));
                say_broken(&mut memory, computer, now_ms / 1000);
                offset = 0;
            }
            {
                use std::io::Seek;
                let _ = file.seek(std::io::SeekFrom::Start(offset));
            }
            // Only whole lines: one still arriving is read next time. Each line on
            // its own: one that is not text (a disk's damage), or longer than any
            // record, is one broken line, not the end of everything after it.
            let record_of = |line: &[u8]| std::str::from_utf8(line).ok().and_then(|text| serde_json::from_str::<Line>(text).ok());
            let opens = |record: &Line| {
                let plain = open(sharing.key, &bound(computer, round, record.n, record.c), &record.s)?;
                // The change and, on its round's first line, where the round stands
                // (`Turn`; an older Sioul says nothing): one reading.
                serde_json::from_slice::<Opened>(&plain).ok().map(Opened::parts)
            };
            // The last line of this round that opened in this reading: its number,
            // and its clock (none for where an earlier reading stopped).
            let mut good: Option<(u64, Option<u64>)> = memory.read_n.get(computer).filter(|(r, _)| *r == round && offset > 0).map(|(_, n)| (*n, None));
            let mut lines = LineReader::new(file);
            let mut next = lines.next();
            while let Some((line, length)) = next.take() {
                next = lines.next();
                let Some(record) = record_of(&line) else {
                    // Never passed over in silence: it may have been a dose marked taken.
                    offset += length;
                    if !own {
                        if let Some(at) = lost_line(memory.read_n.get(computer).copied(), round, good, next.as_ref().map(|(n, _)| n.as_slice()), now_ms) {
                            outcome.problems.push(format!("share-other-line:{computer}"));
                            say_broken(&mut memory, computer, at);
                        }
                        lost_here(&mut memory, computer, round, None);
                    }
                    continue;
                };
                let Some((change, turn)) = opens(&record) else {
                    outcome.problems.push(format!("share-other-seal:{computer}"));
                    // One line that does not open while the next does: a damaged line,
                    // lost and said. None opening: another key, or a seal not here
                    // yet (the sync app is slow): read again from there next time.
                    if !own && next.as_ref().and_then(|(next, _)| record_of(next)).is_some_and(|next| opens(&next).is_some()) {
                        offset += length;
                        if let Some(at) = lost_line(memory.read_n.get(computer).copied(), round, good, next.as_ref().map(|(n, _)| n.as_slice()), now_ms) {
                            say_broken(&mut memory, computer, at);
                        }
                        lost_here(&mut memory, computer, round, Some(record.n));
                        continue;
                    }
                    if !own {
                        // A later full round that opens (that device set up again
                        // with this folder's passphrase, its old lines under
                        // another): read on from there, what it holds restated.
                        if let Some(full) = later_full(sharing, computer, their_rounds, round) {
                            from_round = full;
                            continue 'rounds;
                        }
                        memory.read.insert(computer.clone(), (round, offset));
                    }
                    break 'rounds;
                };
                // The turn of a round (`Turn`): one continuing the round before is
                // entered only once that round was met here to its last line, read
                // or found damaged (`Memory::met`; a line lost on the way stays said
                // for the doses through `read_n` and `broken`). Its end, or the
                // whole round before, still on its way (each file travels on its
                // own, in any order), this round waits for it, unless a later full
                // round restates it all. Rounds go from the folder oldest first
                // (`remove_old_rounds`): the round before missing while an earlier
                // one is kept has not come yet; missing with every earlier one, it
                // was taken out, and what it held past here is lost: a gap, said below.
                // Waited for an hour of exchanges (`AWAITED`; a round truly lost: an older copy
                // kept for good, a file taken out of the server), it is passed over
                // as lost: the gap said, what that computer wrote not all known
                // here (`read_n` stays) until its next full round, which this device
                // asks for (`Seen::full`), and the rest of its records flow
                // meanwhile (review of 10 October 2026).
                if !own
                    && record.n == 1
                    && turn.p > 0
                    && let Some(before) = round.checked_sub(1)
                    && memory.met.get(computer).or_else(|| memory.read_n.get(computer)).is_some_and(|met| *met < (before, turn.p))
                {
                    if let Some(full) = later_full(sharing, computer, their_rounds, round) {
                        memory.waiting_for.remove(computer);
                        from_round = full;
                        continue 'rounds;
                    }
                    if their_rounds.iter().any(|r| *r <= before) {
                        let waiting = memory.waiting_for.entry(computer.clone()).or_default();
                        if waiting.round == round {
                            waiting.waited += (now_ms - waiting.last).clamp(0, AWAIT_STEP);
                        } else {
                            *waiting = Awaited { round, waited: 0, last: now_ms };
                        }
                        waiting.last = now_ms;
                        if waiting.waited < AWAITED {
                            break 'rounds;
                        }
                    }
                }
                if !own && record.n == 1 {
                    memory.waiting_for.remove(computer);
                }
                offset += length;
                good = Some((record.n, Some(record.c)));
                if !change.build.is_empty() {
                    builds.insert(computer.clone(), change.build.clone());
                }
                // Sealed files another device's record named lately are never
                // taken out from under it (`blobs::sweep`), `UNUSED_DAYS` from
                // when this device first read that record. Never from its own
                // records, nor from a record read before (a store rebuilt, or
                // a memory from before rounds said where they stand, reads
                // every kept round again): until 15 October 2026 each rebuild
                // restarted that time for every superseded content this
                // computer's kept rounds named, and those never aged while new
                // versions kept coming (`named_at` itself says the others' records).
                let first = memory.met.get(computer).or_else(|| memory.read_n.get(computer)).is_none_or(|met| (round, record.n) > *met);
                if !own
                    && first
                    && change.k.starts_with(FILES)
                    && let Some(value) = change.v.as_deref()
                {
                    memory.sealed.named_at.insert(crate::blobs::name(sharing.key, &value_hash(&change.k, value)), now_ms);
                }
                if own {
                    // Only the entries of the files rebuilt; the rest is this computer's as it is.
                    if rebuilt(file_of(&change.k)) && !off(&change.k) && memory.format < 2 && change.f >= 2 {
                        // Its own format 2, met while its memory says format 1 (a
                        // memory put back from before its switch): never written
                        // with format 1's rules; it takes format 2 again from its
                        // next exchange, and the record waits until then.
                        memory.switch = true;
                        wait(&mut memory.waiting, change.k, (change.v, record.c, computer.clone(), change.f));
                    } else if rebuilt(file_of(&change.k)) && !off(&change.k) && memory.format >= 2 && change.f < 2 && divided_otherwise(&change.k) {
                        later(&mut older_format, change.k, change.v, record.c, computer);
                    } else if rebuilt(file_of(&change.k)) && !off(&change.k) && !below_whole_floor(&memory, &change.k, record.c) && newer(record.c, computer, winners.get(&change.k).map(|(_, c, w)| (*c, w.as_str()))) && memory.entries.get(&change.k).is_none_or(|k| (record.c, computer.as_str()) > (k.c, k.w.as_str())) {
                        bases.insert(change.k.clone(), change.b);
                        win(&mut winners, &mut theirs_now, sharing.computer, change.k, (change.v, record.c, computer.clone()));
                    }
                    continue;
                }
                // The lines follow each other: after a gap (lines lost to a stale copy of
                // the file, or to a damaged one) what that computer marked is not known
                // here, said as a doubt, until a full round restates all it holds. A
                // round's first line follows when it opens a full round, or continues
                // the round before as read here to its last line (`Turn`); an older
                // Sioul's says neither, and follows as before. A device read here for
                // the first time, from a round continuing one gone, knows where it
                // stands at its computer's next full round, with nothing said.
                if memory.met.get(computer).is_none_or(|met| (round, record.n) > *met) {
                    memory.met.insert(computer.clone(), (round, record.n));
                }
                let last = memory.read_n.get(computer).copied();
                if last.is_none_or(|last| (round, record.n) > last) {
                    let follows = match last {
                        Some((r, n)) if r == round => record.n == n + 1,
                        _ if record.n != 1 => false,
                        _ if turn.full => true,
                        _ if turn.p > 0 => last.is_some() && last == round.checked_sub(1).map(|before| (before, turn.p)),
                        _ => true,
                    };
                    if follows {
                        memory.read_n.insert(computer.clone(), (round, record.n));
                    } else if last.is_some() {
                        if !outcome.problems.iter().any(|p| *p == format!("share-other-gap:{computer}")) {
                            outcome.problems.push(format!("share-other-gap:{computer}"));
                        }
                        // What was lost was written before this line: about then.
                        say_broken(&mut memory, computer, ((record.c >> 16) as i64 / 1000).min(now_ms / 1000));
                    }
                }
                memory.clock = memory.clock.max(record.c);
                // Heard of now, by a sealed record (`present`).
                let heard_at = (record.c >> 16) as i64;
                if memory.heard_at.get(computer).is_none_or(|at| *at < heard_at) {
                    memory.heard_at.insert(computer.clone(), heard_at);
                }
                if off(&change.k) {
                    continue;
                }
                // Its part in a format this Sioul does not know (a newer one's):
                // kept waiting, never written here, said once; nothing of that
                // part goes out from here until this Sioul is updated.
                let format = change.f.max(1);
                if let Some(part) = known_part(file_of(&change.k))
                    && format > part_format(part)
                {
                    // Of writers that no longer count, released: passed over.
                    if memory.released.get(part).is_some_and(|c| record.c <= *c) {
                        continue;
                    }
                    if !memory.newer.contains_key(part) {
                        outcome.problems.push(format!("share-newer:{part}"));
                    }
                    let newer = memory.newer.entry(part.to_string()).or_default();
                    newer.format = newer.format.max(format);
                    if let Some(build) = builds.get(computer) {
                        newer.build = build.clone();
                    }
                    newer.writers.insert(computer.clone());
                    wait(&mut memory.waiting, change.k, (change.v, record.c, computer.clone(), format));
                    continue;
                }
                // A whole list of format 1: what it holds, at its clock (`WholeList`),
                // whatever this device writes, before its record is applied or translated.
                if format < 2 {
                    note_whole_record(originals, &mut memory, &change.k, change.v.as_deref(), record.c);
                }
                // Format 2 while this device writes format 1: another device
                // writes it already; this one does from its next exchange, and
                // the change waits for it.
                if format >= 2 && memory.format < 2 {
                    memory.switch = true;
                    wait(&mut memory.waiting, change.k, (change.v, record.c, computer.clone(), format));
                    continue;
                }
                // Format 1 for a file format 2 divides otherwise: translated once all are read.
                if format < 2 && memory.format >= 2 && divided_otherwise(&change.k) {
                    later(&mut older_format, change.k, change.v, record.c, computer);
                    continue;
                }
                if change.k.starts_with(FILES) {
                    named.entry(change.k.clone()).or_default().extend(change.v.as_deref().map(|v| value_hash(&change.k, v)).into_iter().chain([change.b.clone()]).filter(|h| !h.is_empty()));
                    // Replaced by a new version, not taken out: a take-out is kept as a copy (`history::keep_moved`).
                    if change.v.is_some() && !change.b.is_empty() {
                        replaced_now.push(change.b.clone());
                    }
                }
                // A draft taken out while another device changed it: it was sent (`DRAFTS`).
                let sent = change.k.starts_with(DRAFTS).then(|| {
                    let here = match winners.get(&change.k) {
                        Some((value, _, _)) => Some((value.is_none(), value.as_deref().map(|v| value_hash(&change.k, v)).unwrap_or_default(), bases.get(&change.k).cloned().unwrap_or_default())),
                        None => memory.entries.get(&change.k).map(|k| (k.h.is_empty(), k.h.clone(), k.b.clone())),
                    };
                    let decided = sent_meanwhile(memory.drafts.get(&change.k), here.as_ref().map(|(gone, h, b)| (*gone, h.as_str(), b.as_str())), change.v.is_none(), &change.b);
                    let version = change.v.as_deref().map(|v| value_hash(&change.k, v)).unwrap_or_default();
                    met_draft(&mut memory, &change.k, [&change.b, &version]);
                    decided
                });
                let known = memory.entries.get(&change.k).map(|k| (k.c, k.w.as_str()));
                let pending = winners.get(&change.k).map(|(_, c, w)| (*c, w.as_str()));
                // An element a later whole list of format 1 took out, restated at its old clock: passed over.
                let wins = match sent.flatten() {
                    Some(wins) => wins,
                    None => newer(record.c, computer, known) && newer(record.c, computer, pending) && !below_whole_floor(&memory, &change.k, record.c),
                };
                if wins {
                    // A file sealed apart taken out by another device: what it held, and where that record is.
                    if change.v.is_none() && change.k.starts_with(FILES) {
                        let before = match winners.get(&change.k) {
                            Some((value, _, _)) => value.as_deref().map(|v| value_hash(&change.k, v)).unwrap_or_default(),
                            None => memory.entries.get(&change.k).map(|k| k.h.clone()).unwrap_or_default(),
                        };
                        if !before.is_empty() {
                            removed_now.push((before, computer.clone(), round));
                        }
                    }
                    bases.insert(change.k.clone(), change.b);
                    win(&mut winners, &mut theirs_now, sharing.computer, change.k, (change.v, record.c, computer.clone()));
                }
            }
            if !own {
                memory.read.insert(computer.clone(), (round, offset));
            }
        }
    }

    // An older format's changes, in format 2's names (`translate`), then as any other.
    let mut again: Vec<(String, String)> = Vec::new();
    if !older_format.is_empty() {
        // The writers whose sealed entry says they read format 2 (`translate`).
        let modern: BTreeSet<String> = memory.seen.values().filter(|e| e.format >= 2).map(|e| e.id.clone()).collect();
        let (translated, named_here) = translate(originals, &older_format, &mut memory, &winners, &modern);
        again = named_here;
        for (key, value, c, w) in translated {
            if newer(c, &w, memory.entries.get(&key).map(|k| (k.c, k.w.as_str()))) && newer(c, &w, winners.get(&key).map(|(_, c, w)| (*c, w.as_str()))) {
                bases.remove(&key);
                winners.insert(key, (value, c, w));
            }
        }
    }

    // The others' changes, written into the files: notes and papers taken out
    // first, so that a file renamed by its case comes in the same exchange.
    let mut by_file: BTreeMap<String, Vec<(String, Option<String>)>> = BTreeMap::new();
    for (key, (value, _, _)) in &winners {
        by_file.entry(file_of(key).to_string()).or_default().push((key.clone(), value.clone()));
    }
    let mut order: Vec<&String> = by_file.keys().collect();
    order.sort_by_key(|file| !(file.starts_with(FILES) && by_file[*file].first().is_some_and(|(_, value)| value.is_none())));
    let mut written_keys: BTreeSet<String> = BTreeSet::new();
    // What was written, by key: what the next look compares with, whatever happens to the file after.
    let mut written_hashes: BTreeMap<String, String> = BTreeMap::new();
    // Files written: as they are now (a note, a paper: read next time only if it changes), or to read again.
    let mut written_files: BTreeMap<String, Option<Stat>> = BTreeMap::new();
    // Files sealed apart already as the others' change says: known, nothing written.
    let mut settled: BTreeSet<String> = BTreeSet::new();
    let history = crate::history::root(sharing.memory);
    let mut kept = false;
    let mut names: Option<Names> = None;
    let receiving = Receiving { sharing, history: &history, now_ms, clock, copied: std::cell::Cell::new(0) };
    // Sealed files the others' changes name: not here yet (their content's hash and size), or here.
    let mut wanted: BTreeMap<String, (String, u64)> = BTreeMap::new();
    let mut there: BTreeSet<String> = BTreeSet::new();
    for file in order {
        let changes = &by_file[file];
        let Some((store, path)) = locate(stores, file) else {
            if file.starts_with(FILES) {
                *outcome.waits.entry("no-store".into()).or_default() += 1;
            }
            continue;
        };
        if matches!(store.shape, Shape::Files) {
            // Not read this time, too big here, in a folder that cannot be read
            // or emptied of a sudden, or a hurried exchange waits: left waiting.
            let Some((key, value)) = changes.first() else { continue };
            let why = if !reads(store) { "not-read" } else if hurried() { "hurried" } else if found.is_unknown(file) { "unknown" } else { "" };
            if !why.is_empty() {
                *outcome.waits.entry(why.into()).or_default() += 1;
                // Sioul keeping the folder itself, an exchange that leaves the
                // notes for later (a phone's background step, an alarm's): their
                // contents asked for all the same, nothing written, so that the
                // window writes them as soon as it opens, offline too (review of
                // 18 October 2026, L-2).
                if keeps_itself(sharing)
                    && let Some(reference) = value.as_deref().and_then(|v| serde_json::from_str::<Reference>(v).ok())
                {
                    let blob = crate::blobs::name(sharing.key, &reference.h);
                    if std::fs::metadata(sharing.folder.join("blobs").join(&blob)).is_ok_and(|m| m.len() > 0) {
                        there.insert(blob);
                    } else {
                        wanted.insert(blob, (reference.h.clone(), reference.s));
                    }
                }
                continue;
            }
            // Take-outs copied into the history: so many an exchange, the rest at the next (`TAKE_OUT_COPIES`).
            if value.is_none() && receiving.copied.get() >= take_out_copies() {
                *outcome.waits.entry("copies".into()).or_default() += 1;
                continue;
            }
            let reference = value.as_deref().and_then(|v| serde_json::from_str::<Reference>(v).ok());
            let blob = reference.as_ref().map(|r| crate::blobs::name(sharing.key, &r.h)).unwrap_or_default();
            // Could not be written lately (a full disk, a name a folder takes here): tried again after a while, not at every exchange.
            if memory.sealed.failing.get(key).is_some_and(|(failed, again, _)| *failed == blob && now_ms < *again) {
                *outcome.waits.entry("backoff".into()).or_default() += 1;
                continue;
            }
            if !writable(store, &path, sharing) {
                outcome.problems.push(format!("share-refused:{file}"));
                continue;
            }
            let names = names.get_or_insert_with(|| Names::new(&memory.entries, &found));
            if value.is_some() && names.clash(file) {
                outcome.problems.push(format!("share-name-clash:{file}"));
                continue;
            }
            let base = bases.get(key).map_or("", String::as_str);
            let seen = |h: &str| h == base || named.get(key).is_some_and(|n| n.contains(h));
            let back_off = |failing: &mut BTreeMap<String, (String, i64, u32)>| {
                let tried = failing.get(key).map_or(0, |(_, _, n)| *n);
                let wait = [MINUTE, 10 * MINUTE, HOUR, 6 * HOUR][(tried as usize).min(3)];
                failing.insert(key.clone(), (blob.clone(), now_ms + wait, tried + 1));
            };
            let came = receive(&receiving, store, file, &path, value.as_deref(), found.hashes.get(key).map(String::as_str), &seen, memory.entries.get(key), found.files.get(file), &mut memory.sealed.damaged);
            // Its sealed file neither in the folder nor fetched beside it: waited for (`note_wanted`); else no longer.
            match (&came, &reference) {
                (Err(crate::blobs::Fault::Missing), Some(reference)) => {
                    wanted.insert(blob.clone(), (reference.h.clone(), reference.s));
                }
                (_, Some(_)) => {
                    there.insert(blob.clone());
                }
                _ => {}
            }
            match came {
                Ok(Received::AlreadySo) => {
                    settled.insert(key.clone());
                    memory.sealed.missing.remove(key);
                    memory.sealed.failing.remove(key);
                }
                Ok(Received::Later) => *outcome.waits.entry("later".into()).or_default() += 1,
                Ok(Received::Written { stat, copy, kept: into_history }) => {
                    kept |= into_history;
                    outcome.written.insert(store.name.clone());
                    outcome.received += 1;
                    written_keys.insert(key.clone());
                    written_hashes.insert(key.clone(), stat.as_ref().and_then(|s| s.entries.first()).map(|(_, h)| h.clone()).unwrap_or_default());
                    names.written(file, stat.is_some());
                    written_files.insert(file.clone(), stat);
                    memory.sealed.missing.remove(key);
                    memory.sealed.failing.remove(key);
                    if let Some(copy) = copy {
                        outcome.problems.push(format!("{}:{copy}", if value.is_some() { "share-conflict" } else { "share-conflict-gone" }));
                    }
                }
                // Not here yet: it comes with the sync app, or fetched from the
                // folder's server (`remote::fetch_wanted`), and is written then; said after a day.
                Err(crate::blobs::Fault::Missing) => {
                    *outcome.waits.entry("no-blob".into()).or_default() += 1;
                    if now_ms - *memory.sealed.missing.entry(key.clone()).or_insert(now_ms) > DAY {
                        outcome.problems.push(format!("share-missing:{file}"));
                    }
                }
                Err(crate::blobs::Fault::Broken) => outcome.problems.push(format!("share-damaged:{file}")),
                Err(crate::blobs::Fault::Room) => {
                    outcome.problems.push(format!("share-no-room:{file}"));
                    back_off(&mut memory.sealed.failing);
                }
                Err(crate::blobs::Fault::Local(e)) => {
                    outcome.problems.push(e);
                    back_off(&mut memory.sealed.failing);
                }
            }
            continue;
        }
        if found.unknown.contains(file) && !matches!(store.shape, Shape::Whole) && path.exists() {
            // Half written, or written by hand and broken: left as it is.
            outcome.problems.push(format!("share-unreadable:{}", path.display()));
            continue;
        }
        if store.folder && !writable(store, &path, sharing) {
            outcome.problems.push(format!("share-refused:{file}"));
            continue;
        }
        let entries: Vec<(&str, Option<&str>)> = changes.iter().map(|(key, value)| (entry_of(key), value.as_deref())).collect();
        // The file as it was, kept to be put back; never a log of calls, which
        // has nothing to put back and leaves every device after its month.
        let keep = || {
            if calls_store(file) {
                return Ok(());
            }
            kept = true;
            crate::history::keep(&history, store.part, file, &path, now_ms)
        };
        match write_entries(store, &path, &entries, keep) {
            Ok(hashes) => {
                outcome.written.insert(store.name.clone());
                outcome.received += changes.len();
                for (key, _) in changes {
                    written_keys.insert(key.clone());
                    written_hashes.insert(key.clone(), hashes.get(entry_of(key)).cloned().unwrap_or_default());
                }
                written_files.insert(file.clone(), None);
            }
            Err(e) => outcome.problems.push(e),
        }
    }
    for (key, (value, clock, computer)) in winners {
        if written_keys.contains(&key) || settled.contains(&key) {
            let h = written_hashes.get(&key).cloned().unwrap_or_else(|| value.as_deref().map(|v| value_hash(&key, v)).unwrap_or_default());
            memory.entries.insert(key, Known { c: clock, w: computer, h, b: String::new() });
        } else {
            if let Some(base) = bases.remove(&key).filter(|b| !b.is_empty()) {
                memory.sealed.bases.insert(key.clone(), base);
            }
            if let Some(contents) = named.remove(&key) {
                memory.sealed.named.insert(key.clone(), contents);
            }
            memory.pending.insert(key, (value, clock, computer));
        }
    }
    // A session whose id was kept here as format 1 changed it (`translate`):
    // sent again from here, under that id, and the name a device holding none
    // of it would give taken out, so that every device, one joining later
    // too, holds it once.
    for (name, fallback) in again.into_iter().filter(|(name, _)| written_keys.contains(name)) {
        let value = value_of(stores, &name);
        let clock = memory.tick(now_ms);
        memory.entries.insert(name.clone(), Known { c: clock, w: sharing.computer.to_string(), h: value.as_deref().map(hash).unwrap_or_default(), b: String::new() });
        out.push((name.clone(), value, clock, String::new()));
        if fallback != name {
            let clock = memory.tick(now_ms);
            memory.entries.insert(fallback.clone(), Known { c: clock, w: sharing.computer.to_string(), h: String::new(), b: String::new() });
            out.push((fallback, None, clock, String::new()));
        }
    }
    // What the next look compares with: the files as found, those written
    // here as they are now (notes and papers), or to read again (the rest:
    // small). What was written is known by what was written (`written_hashes`):
    // a change made here after it is a change made here, sent.
    let mut files = found.files.clone();
    for (file, stat) in written_files {
        match stat {
            Some(stat) => files.insert(file, stat),
            None => files.remove(&file),
        };
    }

    // Joining, the whole sharing, a store or a file rebuilt: what only this computer holds goes out.
    if !memory.joined || !rebuilt_here.is_empty() {
        for (key, h) in &found.hashes {
            if memory.entries.contains_key(key) || memory.pending.contains_key(key) || (memory.joined && !joins(key)) || (key.starts_with(FILES) && hurried()) || holds(key) {
                continue;
            }
            let Some(value) = value(key) else { continue };
            if !seal_apart(sharing, stores, key, &value, &mut memory.sealed, &mut outcome.problems, now_ms) {
                continue;
            }
            let clock = memory.tick(found.changed.get(file_of(key)).copied().unwrap_or(now_ms).min(now_ms));
            memory.entries.insert(key.clone(), Known { c: clock, w: sharing.computer.to_string(), h: h.clone(), b: String::new() });
            out.push((key.clone(), Some(value), clock, String::new()));
        }
        memory.joined = true;
    }

    // Older copies put back by hand: the version last seen here comes back,
    // the copy kept beside, said; one that cannot come back now (not here
    // yet) is held, its copy not sent.
    for key in older.into_iter().filter(|key| !written_keys.contains(key)) {
        let file = file_of(&key).to_string();
        let (Some((store, path)), Some(known), Some(before)) = (locate(stores, &file), memory.entries.get(&key), memory.files.get(&file).cloned()) else { continue };
        let back = serde_json::to_string(&Reference { h: known.h.clone(), s: before.size, t: (before.modified / 1_000_000) as i64 }).unwrap_or_default();
        let came = if hurried() || !writable(store, &path, sharing) { Ok(Received::Later) } else { receive(&receiving, store, &file, &path, Some(&back), found.hashes.get(&key).map(String::as_str), &|_| false, Some(known), found.files.get(&file), &mut memory.sealed.damaged) };
        match came {
            Ok(Received::Written { stat, copy, kept: into_history }) => {
                kept |= into_history;
                outcome.problems.push(format!("share-older-copy:{}", copy.unwrap_or_else(|| shown(&file).to_string())));
                if let Some(stat) = stat {
                    files.insert(file, stat);
                }
            }
            _ => {
                outcome.problems.push(format!("share-older-copy:{}", shown(&file)));
                files.insert(file, before);
            }
        }
    }

    outcome.sent = out.len();
    outcome.pending = memory.pending.len();
    if memory.round == 0 {
        memory.round = 1;
    }
    // This computer's file cut short, or gone: a sync app put back an older copy
    // (eDrive keeps a file's old content when only its version changed, and may
    // send it back). What it said past that point is lost for whoever had not
    // read it: a new file opens on every entry this computer has the last word on.
    let own = |memory: &Memory| std::fs::metadata(round_file(sharing.folder, sharing.computer, memory.round)).map_or(0, |m| m.len());
    if memory.own_size > own(&memory) || restate {
        if !restate {
            outcome.problems.push("share-own-cut".into());
        }
        new_round(sharing, &mut memory, stores, &found, &hurried, now_ms, true)?;
        memory.round_base = own(&memory);
    }
    // Past `SEGMENT`, what comes goes into a new round continuing this one,
    // nothing restated: the file sent at each change stays small.
    if !out.is_empty() && own(&memory) >= SEGMENT {
        if memory.full_round == 0 {
            memory.full_round = memory.round;
        }
        // Said on its first line: a reader enters it once it read this round to its last line (`Turn`).
        memory.continues = memory.seq;
        memory.round += 1;
        memory.seq = 0;
        memory.round_base = 0;
    }
    let before = own(&memory);
    append(sharing, &mut memory, &out)?;
    // This device's own take-outs of files sealed apart, and the round they went into (`removed_due`);
    // the contents its own changes replaced (`Sealed::replaced`).
    for (key, value, _, base) in &out {
        if value.is_none() && key.starts_with(FILES) && !base.is_empty() {
            removed_now.push((base.clone(), sharing.computer.to_string(), memory.round));
        }
        if value.is_some() && key.starts_with(FILES) && !base.is_empty() {
            replaced_now.push(base.clone());
        }
    }
    memory.grown += own(&memory).saturating_sub(before);
    // The first round holds all this computer had when it joined: a full one.
    if memory.full_round == 0 && memory.round == 1 {
        memory.full_round = 1;
        memory.grown = 0;
    }
    // When each part last sent and received a change, for the window.
    let part_of = |key: &str| locate(stores, file_of(key)).map(|(store, _)| store.part);
    for part in out.iter().filter_map(|(key, ..)| part_of(key)) {
        memory.traffic.entry(part.to_string()).or_default().0 = now_ms / 1000;
    }
    for part in written_keys.iter().filter_map(|key| part_of(key)) {
        memory.traffic.entry(part.to_string()).or_default().1 = now_ms / 1000;
    }
    // Now and then, the sealed files this computer's records point to looked for (`look_after_sealed`).
    if sharing.files && !hurried() && now_ms - memory.checked >= 10 * MINUTE {
        look_after_sealed(sharing, stores, &mut memory, &found, &hurried, &mut outcome.problems, now_ms);
        memory.checked = now_ms;
    }
    note_wanted(sharing, &memory, &wanted, &there, now_ms);
    // Damaged sealed files no change waits for any more are forgotten.
    if !memory.sealed.damaged.is_empty() {
        let waited: BTreeSet<String> = memory.pending.iter().filter(|(key, _)| key.starts_with(FILES)).filter_map(|(key, (value, _, _))| value.as_deref().map(|v| crate::blobs::name(sharing.key, &value_hash(key, v)))).collect();
        memory.sealed.damaged.retain(|name, _| waited.contains(name));
    }
    // Where each other device stands (`counted`): who holds rounds back
    // (`readers`), and whose past files are another device's to take out.
    let counts = counted(sharing.folder, sharing.key, sharing.computer, &memory, now_ms);
    let reading = readers(sharing.folder, &counts, now_ms);
    // The contents replaced lately, by name, for `history::SEALED_DAYS` and a day.
    for h in replaced_now {
        memory.sealed.replaced.insert(crate::blobs::name(sharing.key, &h), now_ms);
    }
    memory.sealed.replaced.retain(|_, at| now_ms - *at < (crate::history::SEALED_DAYS + 1) * DAY);
    // The files this computer sealed in the folder that no record points to
    // any more go, in time (`unused_days`); never one a record named lately.
    let days = if memory.sealed.named_at.is_empty() && memory.sealed.mine.is_empty() { crate::blobs::UNUSED_DAYS } else { unused_days(sharing, &memory, now_ms) };
    memory.sealed.named_at.retain(|_, at| now_ms - *at < days * DAY);
    if !memory.sealed.mine.is_empty() {
        let current: BTreeSet<String> = memory.entries.iter().filter(|(key, known)| key.starts_with(FILES) && !known.h.is_empty()).map(|(_, known)| known.h.clone()).collect();
        let used: BTreeSet<String> = current
            .iter()
            .cloned()
            .chain(memory.pending.iter().filter(|(key, _)| key.starts_with(FILES)).filter_map(|(key, (value, _, _))| value.as_deref().map(|v| value_hash(key, v))))
            .map(|h| crate::blobs::name(sharing.key, &h))
            .chain(memory.sealed.named_at.keys().cloned())
            .collect();
        prune_tables(sharing.folder, &mut memory.sealed, &used);
        // What this exchange found current and replaced, used in it (`current_before`).
        let used: BTreeSet<String> = current_before.difference(&current).map(|h| crate::blobs::name(sharing.key, h)).chain(used).collect();
        let mut last: BTreeMap<String, i64> = memory.sealed.mine.iter().map(|(name, (at, _))| (name.clone(), *at)).collect();
        // Those whose file was taken out, as soon as every device that counts
        // read so, once each keeps such a file as a copy (`removed_due`).
        let early = counts.iter().all(|(_, counted)| match counted {
            Counted::Yes(entry, _) => entry.as_ref().is_some_and(|e| e.keeping >= crate::blobs::KEEPING_MOVED),
            _ => true,
        });
        removed_due(sharing.folder, sharing.key, &mut memory.sealed, std::mem::take(&mut removed_now), &current, &reading, &mut last, days, early, now_ms);
        crate::blobs::sweep_after(sharing.folder, &mut last, &used, now_ms, days);
        memory.sealed.mine.retain(|name, (at, _)| last.get(name).map(|kept| *at = *kept).is_some());
        let mine = &memory.sealed.mine;
        memory.sealed.removed.retain(|name, _| mine.contains_key(name));
    } else {
        memory.sealed.removed.clear();
    }
    // The others' contents that stopped being current here; those of a
    // device that no longer counts swept in time (`sweep_theirs`).
    sweep_theirs(sharing, stores, &mut memory, &counts, theirs_now, &current_before, now_ms);
    // The history held within bounds, and what a crash left half written there cleaned: after a writing, or hourly.
    if kept || now_ms - memory.tidied >= HOUR {
        crate::history::prune(&history, now_ms, crate::history::cap(&history), &|_, file| locate(stores, file).is_some_and(|(_, path)| path.exists()));
        memory.tidied = now_ms;
    }
    // What a crash left half written among the folder's sealed files, and in
    // the folders whose files travel whole (F17), once a day
    // (`Memory::cleaned`): listing them reads thousands of names.
    // What a crash left of the memory written ahead (`Memory::prepare_save`) beside it, at each
    // exchange: a few names (check of a23cf0c, C-4).
    if let Some(dir) = sharing.memory.parent() {
        clean_leftovers(dir);
    }
    if now_ms - memory.cleaned >= DAY {
        clean_leftovers(&sharing.folder.join("blobs"));
        for store in stores.iter().filter(|s| s.folder && matches!(s.shape, Shape::Whole)) {
            clean_leftovers_below(&store.path, 3);
        }
        memory.cleaned = now_ms;
    }
    // A full round, once as much as the last one restated was appended since,
    // a megabyte at least (`full_round_after`): then the rounds before it can
    // go. Waits while the connection is metered or slow, and while a bulk
    // import goes on (`set_importing`).
    let waits = if importing(sharing.memory) { memory.grown <= IMPORT_ROUND_SIZE } else { frugal(sharing.memory) && memory.grown <= FRUGAL_ROUND_SIZE };
    // Another device asks for one (it lost some of this computer's records:
    // `Seen::full`): owed.
    if !memory.owed && asked_for_full(sharing, &memory, now_ms) {
        memory.owed = true;
    }
    // One owed (a round after lost lines that could not restate all, R7, or
    // asked for): as soon as all reads again, and not while the connection is
    // metered or slow, nor while a bulk import goes on, as a full round past
    // its growth waits (on a phone always on mobile data, a full round
    // restates every text it holds: review of 10 October 2026, third pass).
    // The others' doubt holds meanwhile. Metered, it waits `OWED_METERED` of
    // exchanges at most (counted as `AWAITED` is), then goes all the same: a
    // phone always on mobile data, which marks most doses, never leaves the
    // others in doubt for days. Sooner, the full round that growth opens:
    // once more than the last full round restated was appended
    // (`full_round_after`), past what those waits allow.
    let metered = frugal(sharing.memory) && !importing(sharing.memory);
    if memory.owed && metered {
        if memory.owed_last > 0 {
            memory.owed_waited += (now_ms - memory.owed_last).clamp(0, AWAIT_STEP);
        }
        memory.owed_last = now_ms;
    }
    let thrifty = importing(sharing.memory) || (metered && memory.owed_waited < OWED_METERED);
    let owed = memory.owed && !thrifty && restatement(sharing, &memory, stores, &found).1 == 0;
    if (memory.grown > full_round_after(sharing, &mut memory) && !waits) || owed {
        new_round(sharing, &mut memory, stores, &found, &hurried, now_ms, false)?;
        memory.round_base = own(&memory);
    }
    memory.own_size = own(&memory);
    memory.files = files;
    // Where each store was read; one not read this time where it was.
    let places: BTreeMap<String, String> = stores.iter().filter_map(|s| if reads(s) { Some((s.name.clone(), place(s))) } else { memory.places.get(&s.name).map(|p| (s.name.clone(), p.clone())) }).collect();
    memory.places = places;
    // What you said to take out went with this exchange; what waited and no longer does is forgotten.
    memory.sealed.confirmed.retain(|folder| !stores.iter().any(|s| folder.starts_with(s.name.as_str()) && reads(s)));
    memory.sealed.missing.retain(|key, _| memory.pending.contains_key(key));
    memory.sealed.failing.retain(|key, _| memory.pending.contains_key(key));
    let seen_due = write_seen(sharing, &memory, &all, now_ms);
    // What the devices' registry says of this export (`devices`).
    // The doses' part held (a newer format met): this device's answers wait
    // here, unsent, so its export claims nothing (`Entry::exported`): the
    // others then doubt rather than know (docs/health.md, "Knowing").
    outcome.looked = if memory.newer.contains_key("health") { 0 } else { clock };
    outcome.wrote = memory.joined.then_some((memory.round.max(1), memory.seq));
    // Who holds rounds back, by sealed facts, kept for the sending, which
    // has no key (`rounds_past`); the past rounds of the devices that no
    // longer count (`departed_rounds`); then the rounds past their time go.
    memory.counting = Some(counts.iter().filter(|(_, counted)| matches!(counted, Counted::Yes(..))).map(|(id, _)| id.clone()).collect());
    memory.uncounted = counts.iter().filter(|(_, counted)| !matches!(counted, Counted::Yes(..) | Counted::Stray)).map(|(id, _)| id.clone()).collect();
    memory.departed = departed_rounds(sharing, &memory, &counts, &reading);
    // Devices whose files you removed (`remove_device_files`): none of their
    // rounds is kept, nor a file of theirs a sync app brought back; one that
    // counts again (it said anything newer) is no longer removed.
    memory.removed_devices.retain(|id, _| counts.iter().any(|(other, counted)| other == id && counted.departed()));
    // What goes with each judged again: forgotten here, then replaced, its entry and note go then.
    let judged: BTreeMap<String, (bool, bool)> = memory.removed_devices.keys().filter_map(|id| counts.iter().find(|(other, _)| other == id).map(|(_, counted)| (id.clone(), small_go(counted, last_heard(memory.seen.get(id), &memory, id), now_ms)))).collect();
    for (id, removed) in memory.removed_devices.iter_mut() {
        let floor = memory.departed.entry(id.clone()).or_default();
        *floor = (*floor).max(removed.last);
        if let Some((entry, notes)) = judged.get(id) {
            (removed.entry, removed.notes) = (removed.entry || *entry, removed.notes || *notes);
        }
        let last = std::iter::once(sharing.folder.to_path_buf()).chain(crate::remote::overlay(sharing.folder)).map(|dir| round_file(&dir, id, removed.last)).filter(|path| std::fs::metadata(path).is_ok_and(|m| removed.holds_round(removed.last, m.len())));
        // A small file only while it is as it was when its files went: a copy brought back, never one it wrote since.
        let as_it_went = |path: &Path, place: &str| match removed.small_seen.get(place) {
            Some(h) => content_hash(path).as_deref() == Some(h.as_str()),
            None => removed.small.get(place).is_some_and(|size| std::fs::metadata(path).is_ok_and(|m| m.len() == *size)),
        };
        let small = device_small_places(sharing.folder, id, removed.entry, removed.notes).into_iter().filter(|(path, place)| as_it_went(path, place)).map(|(path, _)| path);
        for path in small.chain(last).collect::<Vec<_>>() {
            let _ = std::fs::remove_file(path);
        }
    }
    remove_old_rounds(sharing, &memory, &reading);
    // Still on format 1: what each whole list holds now, and what one took out (`Floor::removed` at the switch).
    if memory.format < 2 {
        note_whole_lists(originals, &mut memory);
    }
    // Everything settled, nothing said: the next exchanges have nothing to do
    // while nothing they read changes, until the hour's tidying or this
    // device's notes are due again (`quiet`). Changes of others' that wait
    // only for notes or papers (not read here) wait there as well.
    let settled = outcome.problems.is_empty()
        && memory.joined
        && !memory.switch
        && memory.newer.is_empty()
        && memory.waiting.is_empty()
        && memory.held.is_empty()
        && memory.emptied.is_empty()
        && memory.sealed.gone.is_empty()
        && memory.sealed.failing.is_empty()
        && memory.sealed.missing.is_empty()
        && memory.waiting_for.is_empty()
        && !memory.owed
        && memory.pending.keys().all(|key| locate(stores, file_of(key)).is_some_and(|(store, _)| !reads(store)));
    let until = (now_ms + HOUR).min(memory.tidied + HOUR).min(memory.cleaned + DAY).min(seen_due);
    let (round, own_size) = (memory.round, memory.own_size);
    // Drafts' versions kept while their draft is known here.
    let drafts: BTreeSet<String> = memory.drafts.keys().filter(|key| !memory.entries.contains_key(*key) && !memory.pending.contains_key(*key)).cloned().collect();
    for key in drafts {
        memory.drafts.remove(&key);
    }
    outcome.withheld = Some(memory.withheld.clone());
    let needed: Option<BTreeSet<String>> = keeps_itself(sharing).then(|| {
        let name = |h: &str| crate::blobs::name(sharing.key, h);
        let waiting = memory.pending.iter().filter(|(key, _)| key.starts_with(FILES)).filter_map(|(key, (value, _, _))| value.as_deref().map(|v| name(&value_hash(key, v))));
        // The current contents of the parts shared here, the held ones among them.
        let current = memory.entries.iter().filter(|(key, known)| key.starts_with(FILES) && !known.h.is_empty() && (locate(stores, file_of(key)).is_some() || memory.sealed.gone.contains_key(file_of(key)))).map(|(_, known)| name(&known.h));
        waiting.chain(current).chain(memory.sealed.replaced.keys().cloned()).collect()
    });
    memory.sealed.needed = needed;
    memory.save(sharing.memory)?;
    if let Some((standing, _)) = standing.filter(|(standing, taken)| settled && (standing.newest / 1_000_000) as i64 + settling_ms() < *taken) {
        let quiet = Quiet { standing, at: now_ms, until, own: (stamp_at(sharing.memory), stamp_at(&sealed_path(sharing.memory))), round, own_size, wrote: outcome.wrote, pending: outcome.pending };
        if let Ok(mut all) = QUIET.lock() {
            all.insert(sharing.memory.to_path_buf(), quiet);
        }
    }
    memory.keep(sharing.memory);
    Ok(outcome)
}

// ---------------------------------------------------------------- nothing to do

/// What an exchange reads, as it stands before it reads anything: the files
/// of the stores it reads (each by its stamp), the folder's top and what was
/// fetched from the server beside it (`remote::overlay`: the pull writes there
/// only what changed on the server), the other devices' rounds and the seal
/// by their stamps, every other name there by itself, and what each other
/// device's entry says but for its exchanges' times (`devices::steady`). The
/// same at the next exchange, and that one has nothing to read (`quiet`).
#[derive(Debug, Clone, Default, PartialEq, Eq)]
struct Standing {
    sharing: (PathBuf, String, String),
    stores: Vec<(String, PathBuf)>,
    files: BTreeMap<PathBuf, FileStamp>,
    folder: BTreeMap<PathBuf, Option<FileStamp>>,
    entries: BTreeMap<String, String>,
    overlay: Option<PathBuf>,
    /// Full rounds waiting (`set_frugal`, `set_importing`), and this device in
    /// use (its notes then restated each quarter of an hour, `write_seen`).
    waits: (bool, bool),
    in_use: bool,
    /// The latest time among the files stamped (nanoseconds).
    newest: u64,
}

impl Standing {
    fn now(sharing: &Sharing, stores: &[Store], reads: &dyn Fn(&Store) -> bool) -> Standing {
        let mut standing = Standing { sharing: (sharing.folder.to_path_buf(), sharing.computer.to_string(), hash(&B64.encode(sharing.key))), ..Standing::default() };
        for store in stores.iter().filter(|s| reads(s)) {
            standing.stores.push((store.name.clone(), store.path.clone()));
            stamp_below(&store.path, &mut standing.files);
        }
        let overlay = crate::remote::overlay(sharing.folder);
        for dir in std::iter::once(sharing.folder.to_path_buf()).chain(overlay.clone()) {
            for entry in std::fs::read_dir(&dir).into_iter().flatten().filter_map(Result::ok) {
                let name = entry.file_name().to_string_lossy().to_string();
                if name.starts_with('.') || entry.file_type().is_ok_and(|t| t.is_dir()) {
                    continue;
                }
                // This device's own files change only by its hand (their size checked apart, `quiet`).
                let stamped = !name.starts_with(sharing.computer) && (name.ends_with(".jsonl") || name == "seal.toml");
                standing.folder.insert(entry.path(), if stamped { entry.metadata().ok().map(|m| file_stamp(&m)) } else { None });
            }
        }
        let (entries, unread) = crate::devices::all(sharing.folder, sharing.key);
        standing.entries = entries.iter().filter(|e| e.id != sharing.computer).map(|e| (e.id.clone(), crate::devices::steady(e))).chain(unread.into_iter().map(|id| (id, String::new()))).collect();
        standing.overlay = overlay;
        standing.waits = (frugal(sharing.memory), importing(sharing.memory));
        standing.in_use = crate::devices::in_use(sharing.memory);
        standing.newest = standing.files.values().chain(standing.folder.values().flatten()).map(|s| s.modified).max().unwrap_or(0);
        standing
    }
}

/// Every file below `path` (or `path` itself), hidden ones left out, by its stamp.
fn stamp_below(path: &Path, out: &mut BTreeMap<PathBuf, FileStamp>) {
    let Ok(meta) = std::fs::metadata(path) else { return };
    if meta.is_file() {
        out.insert(path.to_path_buf(), file_stamp(&meta));
        return;
    }
    for entry in std::fs::read_dir(path).into_iter().flatten().filter_map(Result::ok) {
        if entry.file_name().to_string_lossy().starts_with('.') {
            continue;
        }
        stamp_below(&entry.path(), out);
    }
}

/// An exchange that left everything settled (`exchange`): what it read, as
/// it stood (`Standing`); its time and until when the next may do nothing
/// (the hour's tidying, this device's notes due again); its memory's two
/// files as it wrote them; its own round and that file's size; what it said.
struct Quiet {
    standing: Standing,
    at: i64,
    until: i64,
    own: (Option<FileStamp>, Option<FileStamp>),
    round: u32,
    own_size: u64,
    wrote: Option<(u32, u64)>,
    pending: usize,
}

/// The settled exchanges of this process, by the path of their memory.
static QUIET: std::sync::Mutex<BTreeMap<PathBuf, Quiet>> = std::sync::Mutex::new(BTreeMap::new());

/// An exchange with nothing to do: the last one here left everything settled
/// (`Quiet`), and since then nothing it reads changed (`Standing`, noted at
/// `taken`, this computer's clock), neither its memory nor this device's own
/// file in the folder (a sync app putting back an older copy changes its
/// size), and nothing fell due. Its outcome is that one's: nothing sent,
/// nothing received, how far this device wrote, and its files looked at when
/// their stamps were: as they were, so every answer captured here before is
/// in its records (`Outcome::looked`). Else none, and the exchange runs.
fn quiet(sharing: &Sharing, standing: &Standing, taken: i64, now_ms: i64) -> Option<Outcome> {
    let mut all = QUIET.lock().ok()?;
    let quiet = all.get(sharing.memory)?;
    let own_size = std::fs::metadata(round_file(sharing.folder, sharing.computer, quiet.round)).map_or(0, |m| m.len());
    let still = quiet.standing == *standing && (quiet.at..quiet.until).contains(&now_ms) && (stamp_at(sharing.memory), stamp_at(&sealed_path(sharing.memory))) == quiet.own && own_size == quiet.own_size;
    if !still {
        all.remove(sharing.memory);
        return None;
    }
    #[cfg(test)]
    QUIETED.with(|n| n.set(n.get() + 1));
    Some(Outcome { looked: taken, wrote: quiet.wrote, pending: quiet.pending, quiet: true, ..Outcome::default() })
}

#[cfg(test)]
thread_local! {
    /// In this test's thread: the exchanges that had nothing to do (`quiet`),
    /// and the logs of lines read through (`lines_of`).
    pub(super) static QUIETED: std::cell::Cell<u32> = const { std::cell::Cell::new(0) };
    pub(super) static LINES_READ: std::cell::Cell<u32> = const { std::cell::Cell::new(0) };
}

/// The whole lines of a computer's records from where they were left, read a
/// piece at a time (`READ_CHUNK`), one line held whole at most: a line longer
/// than any record (`LONGEST_LINE`: whoever wrote it) is given empty, a
/// broken line, and skipped to its end. A last line not ended yet is left for
/// the next exchange.
struct LineReader {
    file: std::fs::File,
    held: Vec<u8>,
    start: usize,
    /// Inside a line too long: its bytes so far, skipped.
    skipping: Option<u64>,
    end: bool,
}

impl LineReader {
    fn new(file: std::fs::File) -> LineReader {
        LineReader { file, held: Vec::new(), start: 0, skipping: None, end: false }
    }

    /// The next whole line and its length in the file.
    fn next(&mut self) -> Option<(Vec<u8>, u64)> {
        use std::io::Read;
        loop {
            if let Some(at) = self.held[self.start..].iter().position(|b| *b == b'\n') {
                let line = &self.held[self.start..=self.start + at];
                self.start += at + 1;
                return Some(match self.skipping.take() {
                    Some(skipped) => (Vec::new(), skipped + line.len() as u64),
                    None => (line.to_vec(), line.len() as u64),
                });
            }
            self.held.drain(..self.start);
            self.start = 0;
            if self.skipping.is_some() || self.held.len() > LONGEST_LINE {
                *self.skipping.get_or_insert(0) += self.held.len() as u64;
                self.held.clear();
            }
            if self.end {
                return None;
            }
            let mut piece = vec![0u8; READ_CHUNK];
            match self.file.read(&mut piece) {
                Ok(0) | Err(_) => self.end = true,
                Ok(n) => self.held.extend_from_slice(&piece[..n]),
            }
        }
    }
}

/// A line of another computer's round found damaged here (it does not read,
/// or does not open), said and dated already (`lost_line`): its number, as
/// the line says it (one that does not open), or the one after the line met
/// before in its round (one that does not read). Met (`Memory::met`), so that
/// a round continuing this one is entered and the rest of that computer's
/// records flow; never counted as read (`read_n` stays before it): what that
/// computer wrote is not all known here until its next full round, and the
/// doses doubt until then, as they did before rounds turned aside (5fa4dd1:
/// review of 10 October 2026, S2-A). This device asks for that full round
/// (`Seen::full`).
fn lost_here(memory: &mut Memory, computer: &str, round: u32, n: Option<u64>) {
    let met = memory.met.get(computer).or_else(|| memory.read_n.get(computer)).copied();
    let n = n.unwrap_or(match met {
        Some((r, m)) if r == round => m + 1,
        _ => 1,
    });
    if met.is_none_or(|met| (round, n) > met) {
        memory.met.insert(computer.to_string(), (round, n));
    }
}

/// A line of another computer's lost here, dated (`Memory::broken`): the
/// latest such date is kept, never an earlier one, so a doubt once said only
/// grows.
fn say_broken(memory: &mut Memory, computer: &str, at: i64) {
    let kept = memory.broken.entry(computer.to_string()).or_insert(at);
    *kept = (*kept).max(at);
}

/// The first of another computer's rounds after `round` that opens full
/// (`Turn`): it restates all that computer held, so a reader waiting for the
/// end of an earlier round, which may never come (an older copy of it put
/// back), reads on from there. Each round's first line read alone.
fn later_full(sharing: &Sharing, computer: &str, rounds: &[u32], round: u32) -> Option<u32> {
    rounds.iter().copied().filter(|r| *r > round).find(|r| opens_full(sharing, computer, *r))
}

/// The last of a computer's rounds in the folder that opens full (`Turn`):
/// it restates all that computer held then, and every round before it is
/// past for whoever read that far (`departed_rounds`).
fn last_full(sharing: &Sharing, computer: &str, rounds: &[u32]) -> Option<u32> {
    rounds.iter().rev().copied().find(|r| opens_full(sharing, computer, *r))
}

/// Whether a computer's round opens full: its first line opens with the key,
/// bound to that computer and round, and says so (`Turn::full`).
fn opens_full(sharing: &Sharing, computer: &str, round: u32) -> bool {
    // A round's first line never changes (records only grow): read once per process.
    let at = (sharing.folder.to_path_buf(), computer.to_string(), round);
    if let Some(full) = FIRST_LINES.lock().ok().and_then(|seen| seen.get(&at).copied()) {
        return full;
    }
    let Ok(file) = open_round(sharing.folder, computer, round) else { return false };
    let Some((line, _)) = LineReader::new(file).next() else { return false };
    let Some(record) = std::str::from_utf8(&line).ok().and_then(|text| serde_json::from_str::<Line>(text).ok()) else { return false };
    let Some(turn) = open(sharing.key, &bound(computer, round, record.n, record.c), &record.s).and_then(|plain| serde_json::from_slice::<Turn>(&plain).ok()) else { return false };
    let full = record.n == 1 && turn.full;
    if let Ok(mut seen) = FIRST_LINES.lock() {
        seen.insert(at, full);
    }
    full
}

/// Whether each round's first line read by `later_full` opens a full round,
/// by folder, computer and round: a reader waiting for a round's end looks at
/// the later rounds once, not at each exchange.
static FIRST_LINES: std::sync::Mutex<BTreeMap<(PathBuf, String, u32), bool>> = std::sync::Mutex::new(BTreeMap::new());

/// A line of another computer's round lost here (it does not read, or does
/// not open): when its computer wrote it, at the latest, in seconds (the
/// clock of the line after it, else now; never the line before it, which
/// may be days older: review of 10 October 2026, S2-A), for the doses'
/// doubt (`Memory::broken`). None when it was met before: a line after
/// it was read already (`read_n`), and this reading goes over the round again
/// (a store joining, a record rebuilt): said once, never stamped anew.
/// `good`: the last line of the round that opened in this reading, its
/// number and clock (none for where an earlier reading stopped).
fn lost_line(read_n: Option<(u32, u64)>, round: u32, good: Option<(u64, Option<u64>)>, next: Option<&[u8]>, now_ms: i64) -> Option<i64> {
    let before = good.map_or(0, |(n, _)| n);
    if read_n.is_some_and(|read| read >= (round, before + 1)) {
        return None;
    }
    let after = next.and_then(|line| std::str::from_utf8(line).ok()).and_then(|text| serde_json::from_str::<Line>(text).ok()).map(|line| line.c);
    Some(after.map_or(now_ms / 1000, |c| ((c >> 16) as i64 / 1000).min(now_ms / 1000)))
}

/// The sealed files this computer's records point to, looked for now and
/// then: one gone from the folder (taken out by hand, by another device that
/// sealed it long ago and swept it, by the server) or not of the size it was
/// sealed at (cut, damaged on the way) is sealed again from the file here,
/// while the file still holds that content.
fn look_after_sealed(sharing: &Sharing, stores: &[Store], memory: &mut Memory, found: &Found, hurried: &dyn Fn() -> bool, problems: &mut Vec<String>, now_ms: i64) {
    let ours: Vec<(String, String)> = memory.entries.iter().filter(|(key, known)| key.starts_with(FILES) && known.w == sharing.computer && !known.h.is_empty() && found.hashes.get(*key) == Some(&known.h)).map(|(key, known)| (key.clone(), known.h.clone())).collect();
    for (key, h) in ours {
        if hurried() {
            return;
        }
        let name = crate::blobs::name(sharing.key, &h);
        let there = std::fs::metadata(sharing.folder.join("blobs").join(&name)).map_or(0, |m| m.len());
        if there > 0 && memory.sealed.mine.get(&name).is_none_or(|(_, size)| *size == there) {
            continue;
        }
        let Some((_, path)) = locate(stores, file_of(&key)) else { continue };
        match crate::blobs::put_again(sharing.folder, sharing.key, &path, &h) {
            Ok(size) => {
                memory.sealed.mine.insert(name, (now_ms, size));
            }
            Err(e) => problems.push(e),
        }
    }
}

/// The names of the notes and papers here or known, as a storage that does not
/// tell case, nor how an accent is written, sees them (a phone's, a memory
/// card's, Windows', a Mac's): two it would take for one are never both written.
struct Names {
    by_folded: BTreeMap<String, String>,
}

impl Names {
    fn new(entries: &BTreeMap<String, Known>, found: &Found) -> Names {
        let known = entries.iter().filter(|(key, known)| key.starts_with(FILES) && !known.h.is_empty()).map(|(key, _)| key);
        let here = found.hashes.keys().filter(|key| key.starts_with(FILES));
        Names { by_folded: known.chain(here).map(|key| (folded(file_of(key)), file_of(key).to_string())).collect() }
    }

    /// Whether another file of that name, as such a storage sees it, is here or known.
    fn clash(&self, file: &str) -> bool {
        self.by_folded.get(&folded(file)).is_some_and(|other| other != file)
    }

    fn written(&mut self, file: &str, there: bool) {
        let name = folded(file);
        if there {
            self.by_folded.insert(name, file.to_string());
        } else if self.by_folded.get(&name).is_some_and(|other| other == file) {
            self.by_folded.remove(&name);
        }
    }
}

/// A name composed one way (NFC), its case folded.
fn folded(name: &str) -> String {
    icu_normalizer::ComposingNormalizerBorrowed::new_nfc().normalize(name).to_lowercase()
}

/// The sealed files this device waits for, said for the pull to fetch
/// (`blobs::Wanted`, `remote::fetch_wanted`): those this exchange found
/// neither in the folder nor fetched beside it (`missing`: their content's
/// hash and size) join; those it found (`there`), and those no change waits
/// for any more (written, or another change came), leave. Those of changes it
/// did not look at (not read this time, hurried) stay. Nothing read nor
/// written while nothing waits.
fn note_wanted(sharing: &Sharing, memory: &Memory, missing: &BTreeMap<String, (String, u64)>, there: &BTreeSet<String>, now_ms: i64) {
    if missing.is_empty() && !crate::blobs::Wanted::path(sharing.memory).exists() {
        return;
    }
    let waited: BTreeSet<String> = memory.pending.iter().filter(|(key, _)| key.starts_with(FILES)).filter_map(|(key, (value, _, _))| value.as_deref().map(|v| crate::blobs::name(sharing.key, &value_hash(key, v)))).collect();
    let _ = crate::blobs::Wanted::change(sharing.memory, |wanted| {
        wanted.blobs.retain(|name, _| waited.contains(name) && !there.contains(name));
        for (name, (hash, size)) in missing.iter().filter(|(name, _)| waited.contains(*name)) {
            wanted.blobs.entry(name.clone()).or_insert_with(|| crate::blobs::Want { hash: hash.clone(), size: *size, since: now_ms / 1000, ..Default::default() });
        }
    });
}

/// What came of another device's change to a file sealed apart.
enum Received {
    /// The file here holds it already.
    AlreadySo,
    /// Written: the file as it is now, for the next look to compare with
    /// (none once taken out); the copy kept beside of a version changed here
    /// too, if one was made; whether a version went into the history.
    Written { stat: Option<Stat>, copy: Option<String>, kept: bool },
    /// The file changed here since it was looked at: left for the next
    /// exchange, which sends that change, both kept.
    Later,
}

/// What writing the others' changes needs.
struct Receiving<'a> {
    sharing: &'a Sharing<'a>,
    history: &'a Path,
    now_ms: i64,
    /// This computer's clock (milliseconds): a file is never dated after it.
    clock: i64,
    /// Bytes the take-outs of this exchange copied into the history (`TAKE_OUT_COPIES`).
    copied: std::cell::Cell<u64>,
}

/// The take-outs of an exchange copy at most this many bytes into the
/// earlier versions (where a file cannot be moved there: a phone's shared
/// storage), the first whatever its size; the rest wait for the next
/// exchanges, a minute apart. A bulk of thousands of notes taken out on a
/// phone would otherwise copy them all in one exchange (review of 17
/// October 2026, L9); the history's cap holds them all in time (a GB, or a
/// twentieth of the disk).
pub(crate) const TAKE_OUT_COPIES: u64 = 64 << 20;

#[cfg(test)]
thread_local! {
    /// The bytes an exchange's take-outs copy, in this test's thread (`TAKE_OUT_COPIES` unless a test says).
    pub(crate) static TAKE_OUT_BUDGET: std::cell::Cell<u64> = const { std::cell::Cell::new(TAKE_OUT_COPIES) };
}

fn take_out_copies() -> u64 {
    #[cfg(test)]
    return TAKE_OUT_BUDGET.with(std::cell::Cell::get);
    #[cfg(not(test))]
    TAKE_OUT_COPIES
}

#[cfg(test)]
thread_local! {
    /// Run just before a received file takes its place, in this test's thread: an edit made then.
    static BEFORE_WRITING: std::cell::RefCell<Option<Box<dyn Fn(&Path)>>> = std::cell::RefCell::new(None);
}

/// Another device's change to a file sealed apart, written here: its content
/// opened from the folder beside the file and checked, then put in its place,
/// the file as it was kept first (`history`: by reference when a record named
/// that content, else copied). A file here that is neither what that change
/// replaced nor a content the others' records name (`seen`) changed here too:
/// it is kept beside, under a name that says so (its path in the folder
/// returned), never lost. A file changed here since it was looked at
/// (`gathered`) is not written over. Nothing is written without room for it,
/// for the copy kept, and some left (`disk::kept_free`).
#[allow(clippy::too_many_arguments)]
fn receive(how: &Receiving, store: &Store, file: &str, path: &Path, value: Option<&str>, current: Option<&str>, seen: &dyn Fn(&str) -> bool, known: Option<&Known>, gathered: Option<&Stat>, damaged: &mut BTreeMap<String, (u64, u64, u64)>) -> Result<Received, crate::blobs::Fault> {
    use crate::blobs::Fault;
    let sharing = how.sharing;
    let wanted = value.map(serde_json::from_str::<Reference>).transpose().map_err(|_| Fault::Broken)?;
    // What is here: as gathered, else (written since, or not read) read now.
    let current = match current {
        Some(here) => Some(here.to_string()),
        None if path.is_file() => crate::blobs::hash_file(path).ok().map(|(h, _)| h),
        None => None,
    };
    match (&wanted, &current) {
        (Some(wanted), Some(here)) if wanted.h == *here => return Ok(Received::AlreadySo),
        (None, None) => return Ok(Received::AlreadySo),
        _ => {}
    }
    let local = |e: std::io::Error| Fault::Local(format!("{}: {e}", path.display()));
    let size_here = std::fs::metadata(path).map_or(0, |m| m.len());
    // The version this device last received from another device, unchanged
    // here since (a change made here is this device's own word, `Known::w`,
    // sent before the others' records are read): an older version, never a
    // change of its own, even when no record read now names it. A device back
    // after its rounds went reads only what a full round restates, and made a
    // conflicted copy of every note changed twice meanwhile (16 October 2026).
    let received = |here: &str| known.is_some_and(|k| k.h == here && k.w != sharing.computer);
    let diverged = current.as_deref().is_some_and(|here| !seen(here) && !received(here));
    // The version here kept by reference when a record named it and its
    // content is in the folder, or fetched beside it; else copied, as any
    // file is: a device back after weeks away, whose content left the folder
    // meanwhile (two weeks after it was replaced, `blobs::UNUSED_DAYS`), keeps
    // its own last version, not a reference that no longer opens.
    let sealed_there = |h: &str| {
        let name = crate::blobs::name(sharing.key, h);
        std::iter::once(sharing.folder.to_path_buf()).chain(crate::remote::overlay(sharing.folder)).any(|dir| std::fs::metadata(dir.join("blobs").join(&name)).is_ok_and(|m| m.len() > 0))
    };
    // Taken out by another device's change: the file moved among the earlier
    // versions as it is (`history::keep_moved`), never a reference to its
    // content, which leaves the folder as soon as every device read that it
    // was taken out (`removed_due`); moved, it costs no room (copied when it
    // cannot be moved, `history::keep` asks for the room).
    let by_reference = wanted.is_some() && current.as_deref().is_some_and(|here| (known.is_some_and(|k| k.h == here) || seen(here)) && sealed_there(here));
    let room = wanted.as_ref().map_or(0, |w| w.s) + if by_reference || wanted.is_none() { 0 } else { size_here } + if diverged { size_here } else { 0 };
    if wanted.as_ref().is_some_and(|w| w.s > crate::blobs::LARGEST) {
        return Err(Fault::Broken);
    }
    if !crate::disk::fits(path, room) {
        return Err(Fault::Room);
    }
    let temporary = temporary(path);
    if let Some(wanted) = &wanted {
        // The folder's copy found damaged before, and the same copy still: not
        // opened again (the one fetched from the server beside it is, `blobs::get`).
        let blob = crate::blobs::name(sharing.key, &wanted.h);
        let copy = std::fs::metadata(crate::blobs::path(sharing.folder, sharing.key, &wanted.h)).ok().map(|m| crate::blobs::fingerprint(&m));
        let known_damaged = copy.is_some() && damaged.get(&blob) == copy.as_ref();
        if let Some(parent) = path.parent() {
            private_dirs(parent).map_err(local)?;
        }
        match crate::blobs::get_unless(sharing.folder, sharing.key, &wanted.h, &temporary, known_damaged) {
            Err(Fault::Broken) => {
                damaged.extend(copy.map(|copy| (blob, copy)));
                return Err(Fault::Broken);
            }
            Err(fault) => return Err(fault),
            Ok(()) => {
                damaged.remove(&blob);
            }
        }
    }
    let placed = (|| {
        #[cfg(test)]
        BEFORE_WRITING.with(|hook| {
            if let Some(hook) = hook.borrow().as_ref() {
                hook(path);
            }
        });
        // Changed here since it was looked at (an editor, another program): not
        // written over; the next exchange sends that change first.
        let same = match (std::fs::symlink_metadata(path).ok(), gathered) {
            (None, None) => true,
            (Some(now), Some(then)) => now.len() == then.size && modified_ns(&now) == then.modified,
            _ => false,
        };
        if !same {
            return Ok(None);
        }
        let copy = match &current {
            Some(here) if diverged => Some(conflict_copy(path, here, known, how.now_ms).map_err(Fault::Local)?),
            _ => None,
        };
        let mut kept = false;
        if let Some(here) = current.as_deref()
            && path.exists()
        {
            let kept_now = if by_reference {
                crate::history::keep_sealed(how.history, store.part, file, here, size_here, how.now_ms)
            } else if wanted.is_none() {
                crate::history::keep_moved(how.history, store.part, file, path, how.now_ms).map(|copied| how.copied.set(how.copied.get() + copied))
            } else {
                crate::history::keep(how.history, store.part, file, path, how.now_ms)
            };
            kept_now.map_err(|e| if e.starts_with("share-no-room") { Fault::Room } else { Fault::Local(e) })?;
            kept = true;
        }
        let stat = match &wanted {
            Some(wanted) => {
                // The spam filter's table it replaces, kept beside when this Sioul can use it (`table.prev.bin`).
                if store.name == SPAM_TABLE {
                    sioul_core::spam::table::keep_previous(path);
                }
                std::fs::rename(&temporary, path).map_err(local)?;
                // Its time as where it was made, never after this computer's clock (another's may be ahead).
                let _ = set_time(path, std::time::UNIX_EPOCH + std::time::Duration::from_millis(wanted.t.min(how.clock).max(0) as u64));
                let now = std::fs::metadata(path).map_err(local)?;
                Some(Stat { size: now.len(), modified: modified_ns(&now), entries: vec![(String::new(), wanted.h.clone())], seen: how.clock })
            }
            None => {
                match std::fs::remove_file(path) {
                    Err(e) if e.kind() != std::io::ErrorKind::NotFound => return Err(local(e)),
                    _ => {}
                }
                // Its folders, left empty, go too.
                let mut dir = path.parent();
                while let Some(folder) = dir.filter(|d| *d != store.path && d.starts_with(&store.path)) {
                    if std::fs::remove_dir(folder).is_err() {
                        break;
                    }
                    dir = folder.parent();
                }
                None
            }
        };
        Ok(Some((stat, copy, kept)))
    })();
    if !matches!(placed, Ok(Some(_))) {
        let _ = std::fs::remove_file(&temporary);
    }
    let in_store = |copy: PathBuf| copy.strip_prefix(&store.path).map_or_else(|_| copy.display().to_string(), |r| r.components().map(|c| c.as_os_str().to_string_lossy()).collect::<Vec<_>>().join("/"));
    Ok(match placed? {
        Some((stat, copy, kept)) => Received::Written { stat, copy: copy.map(in_store), kept },
        None => Received::Later,
    })
}

/// The name of the copy kept beside a file two devices changed, the same on
/// every device whatever its language: "lease (conflict 2026-10-05 16.05)",
/// dated (in this computer's time zone) by when the version it holds was made.
pub fn conflict_name(stem: &str, at_ms: i64) -> String {
    let when = jiff::Timestamp::from_millisecond(at_ms).map(|t| t.to_zoned(jiff::tz::TimeZone::system()).strftime("%Y-%m-%d %H.%M").to_string()).unwrap_or_default();
    format!("{stem} (conflict {when})")
}

/// A file two devices changed, copied beside it before the other's version
/// takes its place, under `conflict_name`: dated by when the version it holds
/// was made, so that every device holding that version names it alike and one
/// copy travels, not one each. Returns where it is.
fn conflict_copy(path: &Path, here: &str, known: Option<&Known>, now_ms: i64) -> Result<PathBuf, String> {
    let at = known.filter(|k| k.h == here).map(|k| (k.c >> 16) as i64).or_else(|| std::fs::metadata(path).ok().map(|m| (modified_ns(&m) / 1_000_000) as i64)).unwrap_or(now_ms);
    let name = path.file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_default();
    let (stem, extension) = match name.rsplit_once('.') {
        Some((stem, extension)) if !stem.is_empty() => (stem.to_string(), format!(".{extension}")),
        _ => (name.clone(), String::new()),
    };
    let named = conflict_name(&stem, at);
    let mut n = 1;
    loop {
        let copy = path.with_file_name(if n == 1 { format!("{named}{extension}") } else { format!("{named} {n}{extension}") });
        if !copy.exists() {
            let temporary = temporary(&copy);
            return copy_private(path, &temporary).and_then(|()| std::fs::rename(&temporary, &copy)).map(|()| copy.clone()).map_err(|e| {
                let _ = std::fs::remove_file(&temporary);
                format!("{}: {e}", copy.display())
            });
        }
        // Kept already: another device's copy of the same version came first.
        if crate::blobs::hash_file(&copy).is_ok_and(|(h, _)| h == here) {
            return Ok(copy);
        }
        n += 1;
    }
}

/// Whether a file may be written where a record says: never through a link
/// below its store's folder (a link to elsewhere would carry the write out of
/// it), nor over a link, nor inside the sharing folder (it would travel in
/// plain) or Sioul's own state, but for the stores of that state itself
/// (`state/…`: the shield's answers, local lists' state, the spam filter's
/// label logs), which live there by design, each in its own folder.
fn writable(store: &Store, path: &Path, sharing: &Sharing) -> bool {
    writable_in(store, path, Some(sharing.folder), sharing.memory)
}

fn writable_in(store: &Store, path: &Path, folder: Option<&Path>, memory: &Path) -> bool {
    let Ok(relative) = path.strip_prefix(&store.path) else { return false };
    let mut at = store.path.clone();
    for part in relative.components() {
        at.push(part);
        match std::fs::symlink_metadata(&at) {
            Ok(meta) if meta.file_type().is_symlink() => return false,
            Ok(_) => {}
            Err(_) => break,
        }
    }
    // Where it would land: the deepest of its folders that is there.
    let Some(there) = path.ancestors().skip(1).find(|p| p.exists()).and_then(|p| p.canonicalize().ok()) else { return true };
    let inside = |root: &Path| root.canonicalize().is_ok_and(|root| there.starts_with(root));
    let state = memory.parent().and_then(Path::parent);
    // A store of Sioul's own state writes in its own folder there (the path was
    // checked above: no link, nothing outside it); every other store, never in that state.
    let own_state = store.name.starts_with("state/") && state.is_some_and(|state| store.path.starts_with(state));
    !folder.is_some_and(inside) && (own_state || !state.is_some_and(inside))
}

/// Names Windows keeps for its devices ("aux.md", "COM1.txt"), and names
/// ending in a dot or a space, which it cuts.
fn kept_by_windows(name: &str) -> bool {
    let stem = name.split('.').next().unwrap_or(name).to_ascii_uppercase();
    let numbered = (stem.starts_with("COM") || stem.starts_with("LPT")) && stem.len() == 4 && matches!(stem.as_bytes()[3], b'1'..=b'9');
    matches!(stem.as_str(), "CON" | "PRN" | "AUX" | "NUL") || numbered || name.ends_with('.') || name.ends_with(' ')
}

/// The store and the file a key's file part names.
fn locate<'a>(stores: &'a [Store], file: &str) -> Option<(&'a Store, PathBuf)> {
    if let Some(store) = stores.iter().find(|s| !s.folder && s.name == file) {
        return Some((store, store.path.clone()));
    }
    let store = stores.iter().filter(|s| s.folder && file.starts_with(s.name.as_str())).max_by_key(|s| s.name.len())?;
    let relative = &file[store.name.len()..];
    // Never outside its folder, on Windows too, where "\" also separates and
    // "C:" starts another place.
    if relative.is_empty() || relative.split('/').any(|part| part.is_empty() || part == ".." || part == "." || part.contains(['\\', ':'])) {
        return None;
    }
    // Files sealed apart: never what tools make, nor what another part carries
    // (whatever its case), nor a name Windows keeps for itself, there.
    if matches!(store.shape, Shape::Files)
        && (relative.split('/').any(|part| made_by_tools(part) || matches!(part, "node_modules" | "target") || (cfg!(windows) && kept_by_windows(part))) || relative.split('/').next().is_some_and(|top| store.skip.iter().any(|skip| skip.eq_ignore_ascii_case(top))))
    {
        return None;
    }
    Some((store, relative.split('/').fold(store.path.clone(), |path, part| path.join(part))))
}

/// What putting a version back would change, said before it is done (`put_back_preview`).
#[derive(Debug, Default, PartialEq, Eq)]
pub struct Back {
    /// A file whole (a note, a paper, a draft): it goes back as it was.
    pub whole: bool,
    /// Entries (settings, lines, marks, sessions) that go back to what they were.
    pub changed: usize,
    /// Entries taken out since, which come back.
    pub returning: usize,
    /// Entries added since, which stay.
    pub kept: usize,
}

/// What putting back `stamp` would change in `file` (`put_back`).
pub fn put_back_preview(memory: &Path, stores: &[Store], part: &str, file: &str, stamp: &str) -> Result<Back, String> {
    // Entries as this device's format divides the file.
    let shaped_stores = shaped(stores, format_of(memory));
    let stores = shaped_stores.as_slice();
    let (store, path) = locate(stores, file).filter(|(store, _)| store.part == part).ok_or_else(|| format!("{file}: not shared"))?;
    let kept = crate::history::version(&crate::history::root(memory), part, file, stamp).ok_or_else(|| format!("{file}: {stamp}: not kept"))?;
    let (crate::history::Kept::Copy(version), Shape::Toml(_) | Shape::Lines) = (kept, store.shape) else { return Ok(Back { whole: true, ..Back::default() }) };
    let (old, now) = entries_then_and_now(store, &version, &path)?;
    Ok(Back {
        whole: false,
        changed: old.iter().filter(|(entry, value)| now.get(*entry).is_some_and(|v| v != *value)).count(),
        returning: old.keys().filter(|entry| !now.contains_key(*entry)).count(),
        kept: now.keys().filter(|entry| !old.contains_key(*entry)).count(),
    })
}

/// A file's entries in a version kept, and in the file now.
fn entries_then_and_now(store: &Store, version: &Path, path: &Path) -> Result<(BTreeMap<String, String>, BTreeMap<String, String>), String> {
    let old = std::fs::read(version).ok().and_then(|bytes| entries_of(store, &bytes)).ok_or_else(|| format!("{}: not readable", version.display()))?;
    let now = std::fs::read(path).ok().and_then(|bytes| entries_of(store, &bytes)).unwrap_or_default();
    Ok((old.into_iter().collect(), now.into_iter().collect()))
}

/// A version put back (`history`). A file whole goes back as it was, the file
/// as it is now kept first. A file of entries (settings, lists, the doses'
/// record, sessions) is put back entry by entry: each entry the version held
/// goes back to what it was, those taken out since come back, and those added
/// since stay. Putting back never takes out, on any device, what was added
/// after that version. The next exchange sends what changed as changes made
/// here, dated now. `stores` holds every part, those switched off too (a part
/// off here is put back here only); `vault` the sharing folder and its key,
/// for a version kept by reference. Waits for an exchange running.
pub fn put_back(memory: &Path, vault: Option<(&Path, &[u8; 32])>, stores: &[Store], part: &str, file: &str, stamp: &str, now_ms: i64) -> Result<(), String> {
    let shaped_stores = shaped(stores, format_of(memory));
    let stores = shaped_stores.as_slice();
    let (store, path) = locate(stores, file).filter(|(store, _)| store.part == part).ok_or_else(|| format!("{file}: not shared"))?;
    let root = crate::history::root(memory);
    let kept = crate::history::version(&root, part, file, stamp).ok_or_else(|| format!("{file}: {stamp}: not kept"))?;
    let not_there = || format!("{}: not written there", path.display());
    if let (crate::history::Kept::Copy(version), Shape::Toml(_) | Shape::Lines) = (&kept, store.shape) {
        // A file of entries (settings, lists, records): small, put back entry by entry under the lock.
        let _running = exchange_lock(memory, true)?;
        if store.folder && !writable_in(store, &path, vault.map(|(folder, _)| folder), memory) {
            return Err(not_there());
        }
        let (old, now) = entries_then_and_now(store, version, &path)?;
        let back: Vec<(&str, Option<&str>)> = old.iter().filter(|(entry, value)| now.get(*entry) != Some(*value)).map(|(entry, value)| (entry.as_str(), Some(value.as_str()))).collect();
        if back.is_empty() {
            return Ok(());
        }
        return write_entries(store, &path, &back, || crate::history::keep(&root, part, file, &path, now_ms)).map(|_| ());
    }
    let fail = |e: std::io::Error| format!("{}: {e}", path.display());
    let bring = |to: &Path| match &kept {
        crate::history::Kept::Copy(version) => copy_private(version, to).map_err(fail),
        crate::history::Kept::Sealed { hash, .. } => {
            let (folder, key) = vault.ok_or_else(|| format!("{file}: kept in the sharing folder, which is not set here"))?;
            crate::blobs::get(folder, key, hash, to).map_err(|fault| match fault {
                crate::blobs::Fault::Missing => format!("share-missing:{file}"),
                crate::blobs::Fault::Broken => format!("share-damaged:{file}"),
                crate::blobs::Fault::Room => format!("share-no-room:{file}"),
                crate::blobs::Fault::Local(e) => e,
            })
        }
    };
    // A whole file: its version opened beside its place outside the exchanges' lock (a
    // large note's takes a second here, more on a phone, and a dose's exchange waits for
    // the lock), in the deepest of its folders that is there, never in one made now (L-1),
    // dated now while it waits (an exchange's sweep leaves a leftover alone its first
    // hour); the lock is taken only to keep the file as it is, date it and put it in
    // place (review of part 3, J2, as `put_back_withheld` does since L-a).
    let name = path.file_name().ok_or_else(not_there)?;
    let there = path.ancestors().skip(1).find(|dir| dir.is_dir()).filter(|dir| path.parent() == Some(*dir) || dir.starts_with(&store.path)).ok_or_else(not_there)?;
    let opened = temporary(&there.join(name));
    if let Err(e) = bring(&opened) {
        let _ = std::fs::remove_file(&opened);
        return Err(e);
    }
    let _ = set_time(&opened, std::time::SystemTime::now());
    // The file as it is now copied into its versions ahead of the lock too, closed there, so that
    // under the lock it is kept by a rename alone, while it is as it was copied (review of part 3, R-7).
    let prepare = || {
        let prepared = if path.exists() { crate::history::prepare(&root, part, file, &path).map(Some) } else { Ok(None) };
        after_prepare();
        prepared
    };
    let mut prepared = match prepare() {
        Ok(prepared) => prepared,
        Err(e) => {
            let _ = std::fs::remove_file(&opened);
            return Err(e);
        }
    };
    // The file changed between its copy and the lock (another program wrote
    // it): copied again outside the lock, a few times, never under it
    // (22 October 2026: CI's Linux job waited 0.49 s for a 64 MB copy made under it).
    let mut again = 0;
    let placed = loop {
        let changed = |prepared: &Option<crate::history::Prepared>| prepared.as_ref().and_then(crate::history::Prepared::changed);
        let looked = (|| {
            let running = exchange_lock(memory, true)?;
            if again < PREPARE_AGAIN && changed(&prepared).is_some() {
                return Ok(None);
            }
            Ok(Some(running))
        })();
        let running = match looked {
            Ok(Some(running)) => running,
            Ok(None) => {
                again += 1;
                prepared = match prepare() {
                    Ok(prepared) => prepared,
                    Err(e) => break Err(e),
                };
                continue;
            }
            Err(e) => break Err(e),
        };
        break (|| {
        let _running = running;
        // A last look, under the lock.
        if store.folder && !writable_in(store, &path, vault.map(|(folder, _)| folder), memory) {
            return Err(not_there());
        }
        let parent = path.parent().ok_or_else(not_there)?;
        private_dirs(parent).map_err(fail)?;
        // Into its own folder: a rename on one disk; across disks (one mounted below), opened there again.
        let beside = if opened.parent() == Some(parent) {
            opened.clone()
        } else {
            let beside = temporary(&path);
            if std::fs::rename(&opened, &beside).is_err() {
                let _ = std::fs::remove_file(&opened);
                if let Err(e) = bring(&beside) {
                    let _ = std::fs::remove_file(&beside);
                    return Err(e);
                }
            }
            beside
        };
        let mut put = || {
            // Kept by its copy made ahead; copied now only when the file came, or changed again and again.
            let why = match &prepared {
                Some(prepared) => prepared.changed().unwrap_or_else(|| "its copy could not be renamed".into()),
                None => "it came meanwhile".into(),
            };
            let kept_ahead = prepared.take().is_some_and(|prepared| prepared.keep(now_ms));
            if path.exists() && !kept_ahead {
                crate::history::copied_under_lock(&why);
                crate::history::keep(&root, part, file, &path, now_ms)?;
            }
            // Dated now, wherever the copy took its time from: a change made here, which the others take.
            let _ = set_time(&beside, std::time::SystemTime::now());
            std::fs::rename(&beside, &path).map_err(fail)
        };
        // A file sealed apart (a note) under its lock only when one of Sioul's own writers takes it (the letters' list).
        let done = if matches!(store.shape, Shape::Files) && !sioul_core::filelock::has_lock(&path) { put() } else { sioul_core::filelock::with_lock(&path, put) };
        if done.is_err() {
            let _ = std::fs::remove_file(&beside);
        }
        done
        })();
    };
    let _ = std::fs::remove_file(&opened);
    placed
}

/// How many times a file changed between its copy and the exchanges' lock
/// is copied again outside it before it is copied under it (`put_back`).
const PREPARE_AGAIN: usize = 3;

/// For a file sealed apart, the content a change made here replaces: its hash as last known ("" new).
fn base_of(memory: &Memory, key: &str) -> String {
    if key.starts_with(FILES) || key.starts_with(DRAFTS) { memory.entries.get(key).map(|k| k.h.clone()).unwrap_or_default() } else { String::new() }
}

/// A version of a draft met here (`Memory::drafts`), with the one it replaced.
fn met_draft(memory: &mut Memory, key: &str, versions: [&str; 2]) {
    if key.starts_with(DRAFTS) {
        memory.drafts.entry(key.to_string()).or_default().extend(versions.iter().filter(|v| !v.is_empty()).map(|v| (*v).to_string()));
    }
}

/// A file sealed apart put in the folder before its record goes out (`blobs`);
/// false when it could not be (it changed while read, a full disk): its record
/// waits for the next look. Anything else needs nothing.
fn seal_apart(sharing: &Sharing, stores: &[Store], key: &str, value: &str, sealed: &mut Sealed, problems: &mut Vec<String>, now_ms: i64) -> bool {
    if !key.starts_with(FILES) {
        return true;
    }
    let (Some((_, path)), Ok(reference)) = (locate(stores, file_of(key)), serde_json::from_str::<Reference>(value)) else { return false };
    match crate::blobs::put(sharing.folder, sharing.key, &path, &reference.h) {
        Ok(written) => {
            let name = crate::blobs::name(sharing.key, &reference.h);
            if let Some(size) = written {
                sealed.mine.insert(name.clone(), (now_ms, size));
            } else if keeps_itself(sharing) && !sealed.mine.contains_key(&name) {
                // Sioul keeping the folder itself: a content already in its
                // copy (fetched there once) is this device's own now that its
                // own change names it, and its push sends it where the server
                // no longer has it (its writer took it out meanwhile: a note
                // put back from its earlier versions). Where the server has
                // it, the send finds it there and sends nothing (review of 17
                // October 2026, H1).
                let size = std::fs::metadata(crate::blobs::path(sharing.folder, sharing.key, &reference.h)).map_or(0, |m| m.len());
                sealed.mine.insert(name.clone(), (now_ms, size));
            }
            // A table of the spam filter this computer sealed: the newest of its own (`prune_tables`).
            if file_of(key) == SPAM_TABLE && sealed.mine.contains_key(&name) {
                sealed.tables.retain(|t| *t != name);
                sealed.tables.push(name);
            }
            true
        }
        Err(e) => {
            problems.push(e);
            false
        }
    }
}

/// Whether Sioul keeps this sharing's folder itself, with no sync app
/// (`remote::mirror_of`): its folder is its own copy of the server's.
fn keeps_itself(sharing: &Sharing) -> bool {
    crate::remote::mirror_of(sharing.memory) == sharing.folder
}

fn append(sharing: &Sharing, memory: &mut Memory, changes: &[(String, Option<String>, u64, String)]) -> Result<(), String> {
    if changes.is_empty() {
        return Ok(());
    }
    let path = round_file(sharing.folder, sharing.computer, memory.round);
    let mut text = String::new();
    for (at, (key, value, clock, base)) in changes.iter().enumerate() {
        // A round's first line says where it stands (`Turn`): it continues the
        // round before, to that round's last line, or it is full (its
        // computer's first round, or one restating all, `new_round`).
        let turn = if at == 0 && memory.seq == 0 {
            if memory.continues > 0 {
                Turn { p: memory.continues, full: false }
            } else if memory.full_round == memory.round || memory.round <= 1 {
                Turn { p: 0, full: true }
            } else {
                Turn::default()
            }
        } else {
            Turn::default()
        };
        memory.seq += 1;
        let build = if at == 0 { sioul_core::build::DESCRIBED.to_string() } else { String::new() };
        // Its part's format, once this device writes format 2.
        let f = if memory.format >= 2 { known_part(file_of(key)).map_or(1, part_format) } else { 1 };
        let change = Change { k: key.clone(), v: value.clone(), b: base.clone(), build, f };
        let plain = serde_json::to_vec(&Sealing { change: &change, turn }).map_err(|e| e.to_string())?;
        let line = Line { n: memory.seq, c: *clock, s: seal(sharing.key, &bound(sharing.computer, memory.round, memory.seq, *clock), &plain) };
        text.push_str(&serde_json::to_string(&line).map_err(|e| e.to_string())?);
        text.push('\n');
    }
    let fail = |e: std::io::Error| format!("{}: {e}", path.display());
    // Where this append ends, noted on the disk before it is made: its own
    // lines told from another device's under its name (`appended`). Not
    // noted (a full disk), nothing is appended: a line of its own is never
    // taken for another device's (`share-twin`).
    write_synced(&sharing.memory.with_file_name("appended.toml"), format!("computer = \"{}\"\nround = {}\nn = {}\n", sharing.computer, memory.round, memory.seq).as_bytes())?;
    // A line left half written (Sioul stopped, a full disk): cut back to the
    // last whole line, so that the next record is not glued to it and lost.
    if let Some(whole) = unfinished(&path) {
        let file = std::fs::OpenOptions::new().write(true).open(&path).map_err(fail)?;
        file.set_len(whole).map_err(fail)?;
    }
    let mut options = std::fs::OpenOptions::new();
    options.create(true).append(true);
    #[cfg(unix)]
    std::os::unix::fs::OpenOptionsExt::mode(&mut options, 0o600);
    let mut file = options.open(&path).map_err(fail)?;
    // A round begun before its files were yours alone: made so at this write.
    make_private(&path);
    file.write_all(text.as_bytes()).map_err(fail)?;
    file.sync_all().map_err(fail)
}

/// Where this device's last append ended (its round and last number), as
/// noted before it was made (`append`): its own records found ahead of its
/// memory up to there were its own, its memory not saved after (a process
/// stopped, a full disk; an append cut short ends before it), not another
/// device's under its name (`share-twin`).
fn appended(memory: &Path, computer: &str) -> Option<(u32, u64)> {
    #[derive(Deserialize)]
    struct Appended {
        computer: String,
        round: u32,
        n: u64,
    }
    let text = read_small(&memory.with_file_name("appended.toml"))?;
    toml::from_str::<Appended>(&text).ok().filter(|a| a.computer == computer).map(|a| (a.round, a.n))
}

/// Where a file's last whole line ends, when it does not end one: its end
/// read back a piece at a time, never the file whole. None when it ends a
/// line, or is empty or not there.
fn unfinished(path: &Path) -> Option<u64> {
    use std::io::{Read, Seek, SeekFrom};
    let mut file = std::fs::File::open(path).ok()?;
    let size = file.metadata().ok()?.len();
    let mut last = [0u8];
    file.seek(SeekFrom::Start(size.checked_sub(1)?)).ok()?;
    file.read_exact(&mut last).ok()?;
    if last[0] == b'\n' {
        return None;
    }
    let mut end = size;
    while end > 0 {
        let from = end.saturating_sub(64 << 10);
        let mut piece = vec![0u8; (end - from) as usize];
        file.seek(SeekFrom::Start(from)).ok()?;
        file.read_exact(&mut piece).ok()?;
        if let Some(at) = piece.iter().rposition(|b| *b == b'\n') {
            return Some(from + at as u64 + 1);
        }
        end = from;
    }
    Some(0)
}

/// This computer's last record in the folder: its round, number, and that file's size.
fn last_own(folder: &Path, computer: &str) -> Option<(u32, u64, u64)> {
    let round = *rounds(folder).get(computer)?.last()?;
    let (n, size) = last_of(&round_file(folder, computer, round))?;
    Some((round, n, size))
}

/// The number of the last line of one of a computer's rounds (0 for none).
fn last_line(folder: &Path, computer: &str, round: u32) -> Option<u64> {
    last_of(&round_file(folder, computer, round)).map(|(n, _)| n)
}

/// A round file's last line's number (0 for none) and its size.
fn last_of(path: &Path) -> Option<(u64, u64)> {
    use std::io::{Read, Seek};
    let mut file = std::fs::File::open(path).ok()?;
    let size = file.metadata().ok()?.len();
    // The tail is enough: lines are short; a line longer than that was a whole round's opening.
    let from = size.saturating_sub(64 * 1024);
    let mut tail = Vec::new();
    file.seek(std::io::SeekFrom::Start(from)).ok()?;
    file.read_to_end(&mut tail).ok()?;
    let n = tail.split(|b| *b == b'\n').rev().find_map(|line| std::str::from_utf8(line).ok().and_then(|t| serde_json::from_str::<Line>(t).ok())).map_or(0, |l| l.n);
    Some((n, size))
}

/// What a full round restates: every entry this computer holds the last
/// word on, with its value as it reads now, and how many of them it could
/// not restate though their store is here and read (their file not readable
/// now, a settings file held empty (`EMPTIED_WAIT`), a change found and not
/// sent yet: their value here is not the one this computer last said). An
/// entry of a store not here (a part switched off on this device, a store
/// that left) is passed over, as it always was: it stops no round from
/// being full (review of 10 October 2026, S2-B).
fn restatement(sharing: &Sharing, memory: &Memory, stores: &[Store], found: &Found) -> (Vec<(String, Option<String>, u64, String)>, usize) {
    let mut omitted = 0usize;
    let ours = memory
        .entries
        .iter()
        .filter(|(_, known)| known.w == sharing.computer)
        .filter_map(|(key, known)| {
            if known.h.is_empty() {
                return (!found.hashes.contains_key(key)).then(|| (key.clone(), None, known.c, known.b.clone()));
            }
            let (store, _) = locate(stores, file_of(key))?;
            // A file sealed apart from its last look, never read through for this.
            let value = match found.values.get(key) {
                Some(value) => Some(value.clone()),
                None if key.starts_with(FILES) => found.files.get(file_of(key)).and_then(|stat| stat.entries.first().map(|(_, h)| reference(h, stat.size, stat.modified))),
                None => value_of(stores, key),
            };
            match value {
                Some(value) if value_hash(key, &value) == known.h => Some((key.clone(), Some(value), known.c, known.b.clone())),
                _ => {
                    if reads_now(sharing, store) {
                        omitted += 1;
                    }
                    None
                }
            }
        })
        .collect();
    (ours, omitted)
}

/// Whether this exchange reads a store: every one, but notes and papers
/// (files sealed apart in a folder) only when it reads them (`Sharing::files`).
fn reads_now(sharing: &Sharing, store: &Store) -> bool {
    sharing.files || !matches!(store.shape, Shape::Files) || !store.folder
}

/// A new file for this computer, opening on every entry it holds the last
/// word on, with their clocks; entries taken out long ago are forgotten. A
/// file sealed apart missing from the folder (taken out there by hand) is
/// put back first. `cut`: the round before lost lines (its file cut short,
/// or found without a line), which a reader that had not read them waits for
/// until a full round restates all.
fn new_round(sharing: &Sharing, memory: &mut Memory, stores: &[Store], found: &Found, hurried: &dyn Fn() -> bool, now_ms: i64, cut: bool) -> Result<(), String> {
    let before = |days: i64| ((now_ms - days * 86_400_000).max(0) as u64) << 16;
    let (oldest, aged) = (before(TOMBSTONE_DAYS), before(AGED_TOMBSTONE_DAYS));
    memory.entries.retain(|key, known| !known.h.is_empty() || known.c >= if ages_out(key) { aged } else { oldest });
    let (ours, omitted) = restatement(sharing, memory, stores, found);
    let mut problems = Vec::new();
    for (key, value, _, _) in ours.iter().filter(|_| sharing.files && !hurried()) {
        if let Some(value) = value {
            seal_apart(sharing, stores, key, value, &mut memory.sealed, &mut problems, now_ms);
        }
    }
    // Restating all: a full round, which a reader waiting for the end of an
    // earlier round may read on from (`later_full`). One that could not
    // restate all (a file not readable now: the doses' record held empty) is
    // not (review of 10 October 2026, R7): it continues the round before,
    // whose rounds are kept; after lost lines, a full round follows once all
    // reads again (`Memory::owed`).
    let previous = memory.seq;
    memory.round += 1;
    memory.seq = 0;
    memory.grown = 0;
    if omitted == 0 {
        memory.full_round = memory.round;
        memory.continues = 0;
        memory.owed = false;
        (memory.owed_waited, memory.owed_last) = (0, 0);
    } else {
        memory.continues = if previous > 0 { previous } else { UNKNOWN_TURN };
        memory.owed |= cut;
    }
    append(sharing, memory, &ours)?;
    // What it restated, for when the next one opens (`full_round_after`).
    if omitted == 0 {
        memory.full_size = std::fs::metadata(round_file(sharing.folder, sharing.computer, memory.round)).map_or(0, |m| m.len());
    }
    Ok(())
}

/// What this computer appends since its last full round before it opens the
/// next: as much as that round restated, and a megabyte at least
/// (`ROUND_SIZE`). A phone's full round restates its whole archive of texts
/// (16 MB on the owner's phone, 14 October 2026); opened at each megabyte
/// appended, as until 15 October 2026, the full rounds cost the folder and
/// the connection many times what was appended (eDrive sends each twice).
/// Now restating never costs more than what was appended since, and the
/// rounds a device joining reads stay within twice the last full round. Its
/// size, not known to a memory from before, is read once from that round's file.
fn full_round_after(sharing: &Sharing, memory: &mut Memory) -> u64 {
    if memory.full_size == 0 {
        let full = if memory.full_round == 0 { memory.round } else { memory.full_round };
        memory.full_size = std::fs::metadata(round_file(sharing.folder, sharing.computer, full)).map_or(0, |m| m.len());
    }
    ROUND_SIZE.max(memory.full_size)
}

/// The sealed files this computer put in the folder (`blobs/<name>`), by
/// name, and the size it sealed each at: what it sends to the server itself
/// beside the sync app (`remote::send`), whole, and nothing else of `blobs/`.
/// Asked before each send: as this process last wrote or read `files.json`
/// while it is still that file (`MINE`), else from that part of the file
/// alone, the rest passed over, never built (on a phone, tens of thousands
/// of the texts' entries).
pub fn own_sealed(memory: &Path, computer: &str) -> BTreeMap<String, u64> {
    let path = sealed_path(memory);
    let stamp = stamp_at(&path);
    if let Some((whose, mine)) = MINE.lock().ok().and_then(|all| all.get(memory).filter(|(was, _, _)| stamp.is_some() && *was == stamp).map(|(_, whose, mine)| (whose.clone(), mine.clone()))) {
        return if whose == computer { mine } else { BTreeMap::new() };
    }
    #[derive(Deserialize)]
    struct Part {
        #[serde(default)]
        computer: String,
        #[serde(default)]
        mine: BTreeMap<String, (i64, u64)>,
    }
    let Some(read) = std::fs::read(&path).ok().and_then(|bytes| serde_json::from_slice::<Part>(&bytes).ok()) else { return BTreeMap::new() };
    let mine: BTreeMap<String, u64> = read.mine.into_iter().map(|(name, (_, size))| (name, size)).collect();
    if let Ok(mut all) = MINE.lock() {
        all.insert(memory.to_path_buf(), (stamp, read.computer.clone(), mine.clone()));
    }
    if read.computer == computer { mine } else { BTreeMap::new() }
}

/// How far this computer wrote its records: its round and the number of the
/// last, for its claims to say (`lease::Claim::wrote`); none before sharing.
pub fn written(memory: &Path, computer: &str) -> Option<(u32, u64)> {
    let memory = Memory::load(memory, computer);
    memory.joined.then_some((memory.round.max(1), memory.seq))
}

/// What this computer read of the others' records.
#[derive(Debug, Default, Clone)]
pub struct Heard {
    /// Each computer's last record read here: its round and number.
    pub read: BTreeMap<String, (u32, u64)>,
    /// When a line of each could not be read here (Unix seconds).
    pub broken: BTreeMap<String, i64>,
}

impl Heard {
    /// Whether everything `computer` wrote up to `wrote` (its round and
    /// number, as its claim says) is read here. Nothing written yet (number 0)
    /// is all read; a round begun anew opens with everything it holds.
    pub fn complete(&self, computer: &str, wrote: (u32, u64)) -> bool {
        wrote.1 == 0 || self.read.get(computer).is_some_and(|read| *read >= wrote)
    }
}

/// When each part last sent a change from here, and last received one (Unix seconds; 0 never).
pub fn traffic(memory: &Path, computer: &str) -> BTreeMap<String, (i64, i64)> {
    Memory::load(memory, computer).traffic
}

pub fn heard(memory: &Path, computer: &str) -> Heard {
    let memory = Memory::load(memory, computer);
    let mut read = memory.read_n;
    // A device whose doses' records wait here, in a format this Sioul does
    // not read: not all it wrote is known here, whatever was read of its file.
    for (key, (_, _, writer, f)) in &memory.waiting {
        if known_part(file_of(key)) == Some("health") && *f > part_format("health") {
            read.remove(writer);
        }
    }
    Heard { read, broken: memory.broken }
}

/// The entries of `files` read again from every computer's records, this
/// one's too, at the next exchange; this computer forgets it held them, so
/// that a record lost or broken here, started again empty, takes nothing out
/// elsewhere and gets back what was written (docs/database.md, "Prudence").
/// The files left as they are, what they hold may be what was there before:
/// at that exchange they join as a store new here does, read from the
/// records first, only what the records lack going out (`Memory::rejoin`),
/// so that an old mark never goes out again with a fresh clock (review of
/// 15 October 2026, RV-P2).
pub fn rebuild(memory: &Path, computer: &str, files: &[&str]) -> Result<(), String> {
    rebuild_with(memory, computer, files, true, || ())
}

/// As `rebuild`, then `then`, which sets the files aside (the doses' repair:
/// `HealthState::set_aside`), run while the exchanges' lock is still held,
/// before any exchange can read those files again. Run apart, an exchange
/// between the two steps filled the lost record again from the records, the
/// full record was then set aside, and the next mark written made every other
/// mark look taken out, on every device (review of 15 October 2026, P1). Set
/// aside in that same step, the files hold afterwards only what was written
/// after the repair: it goes out as changes made here, never replaced by an
/// older record of the same entry (a dose marked again after it was taken
/// back elsewhere was lost on every device: RF-J).
pub fn rebuild_then<T>(memory: &Path, computer: &str, files: &[&str], then: impl FnOnce() -> T) -> Result<T, String> {
    rebuild_with(memory, computer, files, false, then)
}

fn rebuild_with<T>(memory: &Path, computer: &str, files: &[&str], rejoin: bool, then: impl FnOnce() -> T) -> Result<T, String> {
    let _running = exchange_lock(memory, true)?;
    let mut state = Memory::load_all(memory, computer);
    state.entries.retain(|key, _| !files.contains(&file_of(key)));
    state.pending.retain(|key, _| !files.contains(&file_of(key)));
    for file in files {
        state.files.remove(*file);
        state.rebuild.insert((*file).to_string());
        if rejoin {
            state.rejoin.insert((*file).to_string());
        } else {
            state.rejoin.remove(*file);
        }
    }
    // The others' records read again from their oldest kept round.
    state.read.clear();
    state.save(memory)?;
    state.keep(memory);
    Ok(then())
}

/// Notes or papers gone many at once from this device and held (`GONE_GRACE`),
/// by folder of the records ("files/notes/"): how many, when the first and
/// the last went and when the last leave your other devices by themselves
/// (milliseconds), unless they come back, and where they were, said
/// shortly (`bulk_folders`: the deepest folder holding four in five of them,
/// else the few that hold most, else the folder above them all).
#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
pub struct Withheld {
    pub store: String,
    pub count: usize,
    pub first: i64,
    pub last: i64,
    pub leaves: i64,
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub folders: Vec<String>,
}

/// The files of a store held after going many at once, and since when
/// each (`Sealed::gone`), summed up: how many, the first and the last gone,
/// when the last leave, and where they were (`bulk_folders`).
fn withheld_of(store: &str, gone: &BTreeMap<String, i64>) -> Withheld {
    let mut sum = Withheld { store: store.to_string(), first: i64::MAX, ..Withheld::default() };
    for since in gone.values() {
        sum.count += 1;
        sum.first = sum.first.min(*since);
        sum.last = sum.last.max(*since);
    }
    sum.first = sum.first.min(sum.last);
    sum.leaves = sum.last + GONE_GRACE;
    sum.folders = bulk_folders(gone.keys().map(|file| file.strip_prefix(store).unwrap_or(file)));
    sum
}

/// Where files gone many at once were, said shortly, by their place in the
/// store ("" for its own top): the deepest folder that holds four in five of
/// them; else the few folders below it, three at most, that hold four in
/// five of them together; else that folder, which holds them all. For
/// thousands of files in hundreds of folders (a tool's run folders), the
/// folder above them all, never three of them picked at random (review of
/// 17 October 2026, L5).
fn bulk_folders<'a>(files: impl Iterator<Item = &'a str>) -> Vec<String> {
    let mut under: BTreeMap<String, usize> = BTreeMap::new();
    let mut total = 0;
    for file in files {
        total += 1;
        let dirs: Vec<&str> = file.split('/').collect();
        for depth in 0..dirs.len() {
            *under.entry(dirs[..depth].join("/")).or_default() += 1;
        }
    }
    let children = |folder: &str| -> Vec<(usize, String)> {
        let mut out: Vec<(usize, String)> = under.iter().filter(|(child, _)| !child.is_empty() && (if folder.is_empty() { !child.contains('/') } else { child.strip_prefix(folder).and_then(|rest| rest.strip_prefix('/')).is_some_and(|rest| !rest.contains('/')) })).map(|(child, n)| (*n, child.clone())).collect();
        out.sort_by(|a, b| b.0.cmp(&a.0).then(a.1.cmp(&b.1)));
        out
    };
    let most = |n: usize| n * 5 >= total * 4;
    let mut at = String::new();
    loop {
        match children(&at).first() {
            Some((n, child)) if most(*n) => at = child.clone(),
            _ => break,
        }
    }
    let few = children(&at);
    let mut held = 0;
    let mut named = Vec::new();
    for (n, child) in few.into_iter().take(3) {
        held += n;
        named.push(child);
        if most(held) {
            return named;
        }
    }
    vec![at]
}

/// The notes and papers gone many at once from this device and held, as its
/// last exchange found them (`Memory::withheld`): for the Porch to say once,
/// with "Put them back" and "Take them out now"; nothing has to be pressed.
/// Empty when the memory is not this computer's.
pub fn withheld(memory: &Path, computer: &str) -> Vec<Withheld> {
    #[derive(Deserialize)]
    struct Part {
        #[serde(default)]
        computer: String,
        #[serde(default)]
        withheld: Vec<Withheld>,
    }
    std::fs::read(memory).ok().and_then(|bytes| serde_json::from_slice::<Part>(&bytes).ok()).filter(|part| part.computer == computer).map(|part| part.withheld).unwrap_or_default()
}

/// The notes or papers gone many at once from a folder of the records
/// ("files/notes/") and held (`Sealed::bulk`, as the Porch counts them:
/// never a note you deleted on purpose beside a bulk's remainder, as Take
/// them out now takes those alone: review of 18 October 2026, I-1), put
/// back where they were, each from its content sealed in the folder (or
/// fetched beside it), dated as it was last seen here, or, held before this
/// was kept (Sioul up to 17 October 2026), as its last record was made
/// (within a minute of the change, on a computer in use; at its first
/// exchange, for a file older than the sharing): the next exchange finds
/// them back, and nothing leaves. Never through a link, nor into the
/// sharing folder or Sioul's state, nor over a file there, one written
/// there meanwhile included; never without room for it and some left (as
/// every write of the sharing, `disk::fits`). A quarter of a second's worth
/// at a time, each file opened under a hidden name in the deepest of its
/// folders that is there, outside the exchanges' lock, which is taken only
/// to make its own folders, date it and place it, after a last look under
/// that hold, a fifth of a second at a time (`in_short_holds`), then left
/// free a moment: a dose's exchange never waits for more than a fifth of a
/// second of placing them and the one file placed as it passes, even behind
/// a note or paper of tens of megabytes, even on storage that takes tens of
/// milliseconds a file (thousands take half a minute: reviews of 17 and 18
/// October 2026, L1, L-3 and L-a; CI's Windows job of 20 October 2026). No
/// exchange meets a folder made for them before its note is in it: holding
/// hidden files alone, it would list empty, taken for a folder emptied, and
/// its notes would leave the hold, for good after a stop meanwhile (L-1); a
/// stop leaves them held, and Put them back again brings them. Each is
/// dated as it was only under the lock, just before it is placed: an
/// exchange's sweep of leftovers takes a hidden file dated more than an
/// hour ago, and none runs while the lock is held (M-1). How many came
/// back, of how many were held (`PutBack`); a disk too full stops it, said.
pub fn put_back_withheld(folder: &Path, key: &[u8; 32], memory: &Path, computer: &str, stores: &[Store], store: &str) -> Result<PutBack, String> {
    // What there is to put back, and its date: read once; how many are held from that folder.
    let (held, count) = {
        let _running = exchange_lock(memory, true)?;
        let state = Memory::load_all(memory, computer);
        let gone: Vec<&String> = state.sealed.gone.keys().filter(|file| file.starts_with(store) && state.sealed.bulk.contains(*file)).collect();
        let held: Vec<(String, String, std::time::SystemTime, Option<u64>)> = gone
            .iter()
            .copied()
            .filter_map(|file| {
                let known = state.entries.get(&format!("{file}#")).filter(|known| !known.h.is_empty())?;
                let when = match state.files.get(file) {
                    Some(stat) => std::time::UNIX_EPOCH + std::time::Duration::from_nanos(stat.modified),
                    None => std::time::UNIX_EPOCH + std::time::Duration::from_millis(known.c >> 16),
                };
                Some((file.clone(), known.h.clone(), when, state.files.get(file).map(|stat| stat.size)))
            })
            .collect();
        (held, gone.len())
    };
    let mut back = 0;
    let mut rest = held.as_slice();
    while !rest.is_empty() {
        // A batch opened outside the lock: a quarter of a second's worth,
        // never a whole bulk (review of 18 October 2026, L-3).
        let (started, mut done) = (std::time::Instant::now(), 0);
        let mut ready: Vec<(std::path::PathBuf, std::path::PathBuf, &Store, std::time::SystemTime, &String)> = Vec::new();
        let mut stop = None;
        for (file, h, when, size) in rest {
            if done >= PUT_BACK_BATCH || started.elapsed() >= PUT_BACK_HOLD {
                break;
            }
            done += 1;
            let Some((store, path)) = locate(stores, file) else { continue };
            if std::fs::symlink_metadata(&path).is_ok() || !writable_in(store, &path, Some(folder), memory) {
                continue;
            }
            // Opened in the deepest of its folders that is there, never in one made now (L-1).
            let Some(name) = path.file_name() else { continue };
            let Some(there) = path.ancestors().skip(1).find(|dir| dir.is_dir()).filter(|dir| dir.starts_with(&store.path)) else { continue };
            // Its size as last seen here; else four times its sealed size (compressed).
            let size = size.unwrap_or_else(|| std::fs::metadata(crate::blobs::path(folder, key, h)).map_or(0, |m| m.len()).saturating_mul(4));
            if !crate::disk::fits(there, size) {
                stop = Some(format!("share-no-room:{file}"));
                break;
            }
            // Dated now while it waits: the exchanges' sweep leaves a leftover alone its first hour.
            let opened = temporary(&there.join(name));
            if crate::blobs::get(folder, key, h, &opened).is_err() {
                let _ = std::fs::remove_file(&opened);
                continue;
            }
            ready.push((opened, path, store, *when, h));
        }
        rest = &rest[done..];
        // The lock taken only to place them, each after a last look under the
        // hold that places it: never over a file written meanwhile, never
        // through a link (review of 18 October 2026, L-a); a fifth of a second
        // at a time, then left free a moment (`in_short_holds`): on slow
        // storage, placing a whole batch passed a second, and a dose's
        // exchange waited for it (1.1 s on CI's Windows job of 20 October 2026).
        let placed = in_short_holds(memory, ready.into_iter(), |(opened, path, store, when, h)| {
            if place_put_back(folder, key, memory, &opened, &path, store, when, h, &mut stop) {
                back += 1;
            }
        });
        if let Err((e, left)) = placed {
            for (opened, ..) in left {
                let _ = std::fs::remove_file(opened);
            }
            return Err(e);
        }
        if let Some(said) = stop {
            return Err(said);
        }
        if !rest.is_empty() {
            std::thread::sleep(PUT_BACK_FREE);
        }
    }
    Ok(PutBack { back, held: count })
}

/// One file of "Put them back" placed, under the exchanges' lock (its
/// caller's hold): after a last look (nothing at its place, a link
/// included, and still a place the sharing writes), in its own folders made
/// only now (L-1), dated as it was only now (M-1), through a hard link that
/// takes only a free name. Whether it came back; the file opened beside goes
/// in any case. A folder that cannot be made stops the put back, said.
#[allow(clippy::too_many_arguments)]
fn place_put_back(folder: &Path, key: &[u8; 32], memory: &Path, opened: &Path, path: &Path, store: &Store, when: std::time::SystemTime, h: &str, stop: &mut Option<String>) -> bool {
    slow_under_lock();
    if std::fs::symlink_metadata(path).is_ok() || !writable_in(store, path, Some(folder), memory) {
        let _ = std::fs::remove_file(opened);
        return false;
    }
    // Its own folders made only now, its note placed in them before any exchange lists them (L-1).
    let Some(parent) = path.parent() else {
        let _ = std::fs::remove_file(opened);
        return false;
    };
    if let Err(e) = private_dirs(parent) {
        let _ = std::fs::remove_file(opened);
        stop.get_or_insert_with(|| format!("{}: {e}", parent.display()));
        return false;
    }
    // Into its own folder: a rename on one disk; across disks (one
    // mounted below), opened there again, as before 18 October 2026.
    let beside = if opened.parent() == Some(parent) {
        opened.to_path_buf()
    } else {
        let beside = temporary(path);
        if std::fs::rename(opened, &beside).is_err() {
            let _ = std::fs::remove_file(opened);
            if crate::blobs::get(folder, key, h, &beside).is_err() {
                let _ = std::fs::remove_file(&beside);
                return false;
            }
        }
        beside
    };
    // Dated as it was only now, under the lock: no exchange's sweep runs meanwhile (M-1);
    // through a handle that cannot write it, which no antivirus reads at its close (`set_time`).
    let _ = set_time(&beside, when);
    place_new(&beside, path)
}

/// `each` done for every one of `items` under the exchanges' lock, a fifth
/// of a second at a time (`SHORT_HOLD`), the lock then left free a moment
/// (`PUT_BACK_FREE`) for whatever exchange waits for it, a dose's first, and
/// taken again for the rest: work that grows with a count of files never
/// keeps an exchange waiting for its whole. An exchange may run between two
/// holds: `each` looks again at what it does under its own hold. A hold
/// passes its fifth of a second by the one item it does then, at most, and
/// ends after the item it does when an exchange of this process comes to wait
/// (`waiting_here`): a dose's alarm waits for one item, not the hold's rest.
/// The lock that cannot be taken stops it: why, and the items left.
fn in_short_holds<I: Iterator>(memory: &Path, items: I, mut each: impl FnMut(I::Item)) -> Result<(), (String, std::iter::Peekable<I>)> {
    let mut items = items.peekable();
    while items.peek().is_some() {
        let running = match exchange_lock(memory, true) {
            Ok(running) => running,
            Err(e) => return Err((e, items)),
        };
        let held = std::time::Instant::now();
        while let Some(item) = items.next() {
            each(item);
            if held.elapsed() >= SHORT_HOLD || waiting_here(memory) {
                break;
            }
        }
        // Handed to an exchange waiting, before it is taken again (`hand_off`).
        if items.peek().is_some() {
            hand_off(memory, running, PUT_BACK_FREE);
        } else {
            drop(running);
        }
    }
    Ok(())
}

/// How many times "Remove its files" plans what goes outside the lock, an
/// exchange having written the memory meanwhile each time, before it says busy.
const REMOVAL_PLANS: u32 = 5;

#[cfg(test)]
thread_local! {
    /// Tests only: what runs on this thread after each plan of a removal (a
    /// slow plan, an exchange writing the memory meanwhile). Never in a build.
    pub(crate) static AFTER_PLAN: std::cell::RefCell<Option<Box<dyn FnMut()>>> = const { std::cell::RefCell::new(None) };
}

#[cfg(test)]
thread_local! {
    /// Tests only: what runs on this thread after each copy a put back makes
    /// ahead of the lock (the file written meanwhile). Never in a build.
    pub(crate) static AFTER_PREPARE: std::cell::RefCell<Option<Box<dyn FnMut()>>> = const { std::cell::RefCell::new(None) };
}

/// After each copy made ahead of the lock, what a test asks (`AFTER_PREPARE`); nothing in a build.
fn after_prepare() {
    #[cfg(test)]
    AFTER_PREPARE.with(|hook| {
        if let Some(hook) = hook.borrow_mut().as_mut() {
            hook();
        }
    });
}

/// After each plan of a removal, what a test asks (`AFTER_PLAN`); nothing in a build.
fn after_plan() {
    #[cfg(test)]
    AFTER_PLAN.with(|hook| {
        if let Some(hook) = hook.borrow_mut().as_mut() {
            hook();
        }
    });
}

/// The longest one hold of the exchanges' lock does work that grows with a
/// count of files (`in_short_holds`): placing notes put back, taking a
/// device's files out. The copies beside drafts keep the same bound
/// (`sioul_core::draftcopies`, `HOLD_AT_MOST`).
const SHORT_HOLD: std::time::Duration = std::time::Duration::from_millis(200);

#[cfg(test)]
thread_local! {
    /// Tests only: how long each file done under the lock in short holds
    /// takes more on this thread, for slow storage (Windows' scans, a
    /// phone's shared storage). Never in a build of the programs.
    pub(crate) static SLOW_UNDER_LOCK: std::cell::Cell<std::time::Duration> = const { std::cell::Cell::new(std::time::Duration::ZERO) };
}

/// Each file done under the lock in short holds, as slow as a test asks (`SLOW_UNDER_LOCK`); nothing in a build.
fn slow_under_lock() {
    #[cfg(test)]
    std::thread::sleep(SLOW_UNDER_LOCK.with(std::cell::Cell::get));
}

/// What "Put them back" did (`put_back_withheld`): how many came back, of
/// how many were held from that folder (as the Porch counts them). Fewer is
/// said as such, never as done: other files or links are at their places,
/// or their contents are not on this device (review of 18 October 2026, M-1).
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct PutBack {
    /// Written back where they were.
    pub back: usize,
    /// Held from that folder when it began.
    pub held: usize,
}

/// How many held files are opened at once, outside the exchanges' lock, at
/// most, and for how long at most (`PUT_BACK_HOLD`); they are then placed
/// under it in short holds (`in_short_holds`), the lock left free a while
/// between two (`PUT_BACK_FREE`), for whatever exchange waits for it, a
/// dose's first. Until 18 October 2026 the put back took it again at once,
/// and a dose's exchange waited up to 14 s for it on a computer; until 20
/// October 2026 it placed a whole batch in one hold, 1.1 s on CI's Windows job.
const PUT_BACK_BATCH: usize = 200;
const PUT_BACK_HOLD: std::time::Duration = std::time::Duration::from_millis(250);
const PUT_BACK_FREE: std::time::Duration = std::time::Duration::from_millis(25);

/// A file written beside its place taken there only while none is (a hard
/// link refuses to take an existing name; where links cannot be made, a
/// last look, then a rename). Whether it took the place; the file beside
/// goes in any case.
fn place_new(temporary: &Path, path: &Path) -> bool {
    let placed = match std::fs::hard_link(temporary, path) {
        Ok(()) => true,
        Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => false,
        Err(_) => std::fs::symlink_metadata(path).is_err() && std::fs::rename(temporary, path).is_ok(),
    };
    let _ = std::fs::remove_file(temporary);
    placed
}

/// The files gone at once from a folder of notes or papers (`share-vanished`)
/// taken out everywhere at the next exchange, as you said: the folder by its
/// name in the records ("files/notes/disk/", or a whole store,
/// "files/notes/"), what is below it too, never a folder beside it; or a
/// note replaced by a link ("files/notes/single.md": `confirms`).
pub fn confirm_gone(memory: &Path, computer: &str, store: &str) -> Result<(), String> {
    let _running = exchange_lock(memory, true)?;
    let mut state = Memory::load_all(memory, computer);
    state.sealed.confirmed.insert(store.to_string());
    state.save(memory)?;
    state.keep(memory);
    Ok(())
}

/// "Take them out now": the files held after going many at once from a
/// folder of the records ("files/notes/") taken out everywhere at the next
/// exchange, those alone (`Sealed::confirmed_files`): a folder that lists
/// empty beside them (a disk not mounted at its place in the notes) stays
/// unknown until its own line says so (`confirm_gone`; review of 17 October
/// 2026, M1). How many.
pub fn confirm_withheld(memory: &Path, computer: &str, store: &str) -> Result<usize, String> {
    let _running = exchange_lock(memory, true)?;
    let mut state = Memory::load_all(memory, computer);
    let held: Vec<String> = state.sealed.gone.keys().filter(|file| file.starts_with(store) && state.sealed.bulk.contains(*file)).cloned().collect();
    let count = held.len();
    state.sealed.confirmed_files.extend(held);
    state.save(memory)?;
    state.keep(memory);
    Ok(count)
}

/// One exchange at a time on this computer, whatever runs it (two Sioul
/// started, the command line): a lock on `<state>/share/exchange.lock`, held
/// while it runs, let go when the file returned is. `wait`: until the
/// running one ends; else none while another holds it a second on.
pub fn exchange_lock(memory: &Path, wait: bool) -> Result<Option<std::fs::File>, String> {
    let path = memory.with_file_name("exchange.lock");
    let fail = |e: std::io::Error| format!("{}: {e}", path.display());
    if let Some(parent) = path.parent() {
        private_dirs(parent).map_err(fail)?;
    }
    let file = std::fs::OpenOptions::new().create(true).truncate(false).write(true).open(&path).map_err(fail)?;
    // Counted while it waits, and once it holds, for a holder letting go in short holds (`hand_off`).
    let _waiting = Waiting::start(&path);
    if wait {
        lock_waiting(&path, &file).map_err(fail)?;
        _waiting.taken();
        return Ok(Some(file));
    }
    // A program starting elsewhere in Sioul holds a copy of every file open
    // then until it runs (a Mac's take milliseconds): the last exchange's lock,
    // let go a moment before, may still be held by it. Tried again for a second.
    for _ in 0..50 {
        match file.try_lock() {
            Ok(()) => {
                _waiting.taken();
                return Ok(Some(file));
            }
            Err(std::fs::TryLockError::WouldBlock) => std::thread::sleep(std::time::Duration::from_millis(20)),
            Err(std::fs::TryLockError::Error(e)) => return Err(fail(e)),
        }
    }
    Ok(None)
}

/// By the exchanges' lock file, in this process: how many wait for it now,
/// and how many times one that waited took it (`exchange_lock`).
static WAITERS: std::sync::Mutex<BTreeMap<PathBuf, (usize, u64)>> = std::sync::Mutex::new(BTreeMap::new());

/// One exchange waiting for the lock, counted until it holds it or gives up.
struct Waiting(PathBuf);

impl Waiting {
    fn start(path: &Path) -> Waiting {
        if let Ok(mut all) = WAITERS.lock() {
            all.entry(path.to_path_buf()).or_default().0 += 1;
        }
        Waiting(path.to_path_buf())
    }

    fn taken(&self) {
        if let Ok(mut all) = WAITERS.lock() {
            all.entry(self.0.clone()).or_default().1 += 1;
        }
    }
}

impl Drop for Waiting {
    fn drop(&mut self) {
        if let Ok(mut all) = WAITERS.lock()
            && let Some(counts) = all.get_mut(&self.0)
        {
            counts.0 = counts.0.saturating_sub(1);
        }
    }
}

/// Whether an exchange of this process waits for the lock beside `memory` now (`WAITERS`).
fn waiting_here(memory: &Path) -> bool {
    let path = memory.with_file_name("exchange.lock");
    WAITERS.lock().ok().and_then(|all| all.get(&path).map(|c| c.0 > 0)).unwrap_or(false)
}

/// The longest a holder letting the lock go waits for an exchange of this
/// process to take it before taking it again (`hand_off`).
const HAND_OFF_MOST: std::time::Duration = std::time::Duration::from_secs(1);

/// The exchanges' lock let go between two short holds (`in_short_holds`,
/// the copies beside drafts, "Remove its files" planning again): when an
/// exchange of this process waits for it (a dose's alarm, the window's), the
/// holder takes it again only once that one has taken it, or a second has
/// passed, so that a waiter slow to wake (a loaded machine, a busy phone)
/// never loses the hand to it again and again (CI's macOS job of 20 October
/// 2026: two holds back to back, 0.41 s). It stops waiting too as soon as
/// fewer wait than when it let go: a waiter that gave up, or that lost the
/// lock to another process, never keeps it a second (review of part 4, D-1a).
/// With none waiting here, a moment (`free`: `PUT_BACK_FREE` between short
/// holds; none for the copies beside drafts, which let go `LET_GO` between
/// their batches and nothing after the last, D-1b): a waiter in another
/// process (the command line, a phone's background service) gets that moment
/// alone, as before, since a file's lock keeps no queue.
pub(crate) fn hand_off(memory: &Path, running: Option<std::fs::File>, free: std::time::Duration) {
    let path = memory.with_file_name("exchange.lock");
    let (waiting, taken) = WAITERS.lock().ok().and_then(|all| all.get(&path).copied()).unwrap_or((0, 0));
    drop(running);
    #[cfg(test)]
    if let Ok(mut released) = RELEASED.lock() {
        released.insert(path.clone(), std::time::Instant::now());
    }
    if waiting == 0 {
        std::thread::sleep(free);
        return;
    }
    let since = std::time::Instant::now();
    while since.elapsed() < HAND_OFF_MOST && WAITERS.lock().ok().and_then(|all| all.get(&path).copied()).is_some_and(|(now_waiting, now_taken)| now_taken == taken && now_waiting >= waiting) {
        std::thread::sleep(std::time::Duration::from_millis(1));
    }
}

#[cfg(test)]
thread_local! {
    /// Tests only: an exchange waiting on this thread that takes the lock
    /// only so long after it was last let go between two short holds (a
    /// loaded machine, whose woken thread runs late). Never in a build.
    pub(crate) static SLOW_WAKE: std::cell::Cell<std::time::Duration> = const { std::cell::Cell::new(std::time::Duration::ZERO) };
}

/// Tests only: when each lock was last let go between two short holds
/// (`hand_off`), by its file: another test's lock never delays this one's.
#[cfg(test)]
static RELEASED: std::sync::Mutex<BTreeMap<PathBuf, std::time::Instant>> = std::sync::Mutex::new(BTreeMap::new());

/// The lock taken, waiting for it: the system's wait (as slow to wake as a
/// test asks, `SLOW_WAKE`).
fn lock_waiting(#[cfg_attr(not(test), allow(unused_variables))] path: &Path, file: &std::fs::File) -> std::io::Result<()> {
    #[cfg(test)]
    {
        let slow = SLOW_WAKE.with(std::cell::Cell::get);
        if !slow.is_zero() {
            loop {
                // Never before `slow` has passed since the lock was last let go: it wakes that late.
                let since = RELEASED.lock().ok().and_then(|r| r.get(path).copied()).map(|r| r.elapsed());
                if let Some(since) = since.filter(|s| *s < slow) {
                    std::thread::sleep(slow - since);
                    continue;
                }
                match file.try_lock() {
                    Ok(()) => return Ok(()),
                    Err(std::fs::TryLockError::WouldBlock) => std::thread::sleep(std::time::Duration::from_millis(1)),
                    Err(std::fs::TryLockError::Error(e)) => return Err(e),
                }
            }
        }
    }
    file.lock()
}

fn seen_path(folder: &Path, computer: &str) -> PathBuf {
    folder.join(format!("{computer}.toml"))
}

/// This computer's notes in the folder, when what they say changes (its
/// round, how far it read the others); else restated a quarter of an hour
/// after the last while this device is in use (its entry says it: another
/// device's do-not-disturb hears of a computer in use by them), once a day
/// while it is put away (a phone's background step: how far it read changes
/// rarely, and the sync is not asked to carry a file every few minutes).
/// Returns when they are due again (milliseconds).
fn write_seen(sharing: &Sharing, memory: &Memory, all: &BTreeMap<String, Vec<u32>>, now_ms: i64) -> i64 {
    let again = if crate::devices::in_use(sharing.memory) { 15 * 60 } else { 24 * 3600 };
    let mut seen = Seen {
        at: now_ms / 1000,
        round: memory.round,
        read: memory.read.iter().filter(|(c, _)| all.contains_key(*c)).map(|(c, (round, _))| (c.clone(), *round)).collect(),
        full: full_asked(memory, all),
        pad: String::new(),
    };
    if let Some(old) = read_seen_in(sharing.folder, sharing.computer).filter(|old| old.round == seen.round && old.read == seen.read && old.full == seen.full && seen.at - old.at < again) {
        return (old.at + again) * 1000;
    }
    let path = seen_path(sharing.folder, sharing.computer);
    let text = |seen: &Seen, pad: usize| toml::to_string(&Seen { pad: ".".repeat(pad), read: seen.read.clone(), full: seen.full.clone(), ..*seen }).unwrap_or_default();
    seen.pad = ".".repeat(pad_for(&path, |pad| text(&seen, pad).len() as u64));
    if let Ok(text) = toml::to_string(&seen) {
        let _ = write_atomically(&path, text.as_bytes());
    }
    (seen.at + again) * 1000
}

/// The other computers whose records this one met past what it read in
/// order (`Memory::met` ahead of `read_n`: a line lost, a round passed over
/// as lost, a device first read from a round continuing one gone), each with
/// the latest round of theirs met: a full round of theirs after it tells
/// where they stand (`Seen::full`).
fn full_asked(memory: &Memory, all: &BTreeMap<String, Vec<u32>>) -> BTreeMap<String, u32> {
    memory.met.iter().filter(|(computer, met)| all.contains_key(*computer) && memory.read_n.get(*computer) != Some(*met)).map(|(computer, (round, _))| (computer.clone(), *round)).collect()
}

/// Whether another computer heard lately asks this one for a full round
/// after a round of its own that no full round followed yet (`Seen::full`):
/// a round this computer wrote, at or after its last full one.
fn asked_for_full(sharing: &Sharing, memory: &Memory, now_ms: i64) -> bool {
    let last_full = memory.full_round.max(1);
    computers(sharing.folder)
        .iter()
        .filter(|c| *c != sharing.computer)
        .filter_map(|c| read_seen(sharing.folder, c))
        .filter(|s| now_ms / 1000 - s.at < SILENT_DAYS * 86_400)
        .any(|s| s.full.get(sharing.computer).is_some_and(|round| (last_full..=memory.round).contains(round)))
}

fn read_seen_in(folder: &Path, computer: &str) -> Option<Seen> {
    read_small(&seen_path(folder, computer)).and_then(|t| toml::from_str(&t).ok())
}

/// Another computer's notes, the later of the folder's and the copy fetched
/// from the server (`remote::overlay`); the folder's on a tie.
fn read_seen(folder: &Path, computer: &str) -> Option<Seen> {
    let here = read_seen_in(folder, computer);
    match (here, crate::remote::overlay(folder).and_then(|fetched| read_seen_in(&fetched, computer))) {
        (Some(here), Some(fetched)) => Some(if fetched.at > here.at { fetched } else { here }),
        (here, fetched) => here.or(fetched),
    }
}

/// This computer's old files, once every device that counts has read past
/// them (`readers`), and the past rounds of the devices that no longer count
/// by a sealed fact (`Memory::departed`), here and in the copy fetched from
/// the server beside (`remote::overlay`): never fetched again, and taken out
/// of the server by the sending (`remote`).
fn remove_old_rounds(sharing: &Sharing, memory: &Memory, readers: &BTreeSet<String>) {
    let all = rounds(sharing.folder);
    let below = past_below(sharing.folder, sharing.computer, memory.round, memory.full_round, readers);
    for round in all.get(sharing.computer).into_iter().flatten().filter(|r| **r < below) {
        let _ = std::fs::remove_file(round_file(sharing.folder, sharing.computer, *round));
    }
    if memory.departed.is_empty() {
        return;
    }
    for dir in std::iter::once(sharing.folder.to_path_buf()).chain(crate::remote::overlay(sharing.folder)) {
        let theirs = if dir == sharing.folder { all.clone() } else { rounds(&dir) };
        for (id, floor) in &memory.departed {
            for round in theirs.get(id).into_iter().flatten().filter(|r| **r < *floor) {
                let _ = std::fs::remove_file(round_file(&dir, id, *round));
            }
        }
    }
}

/// The round below which a computer's rounds are past their time: every
/// reader (`readers`) read past them (its notes say a later round: it met
/// their end, `Memory::met`, or read on from a later full round; a reader
/// without notes in the folder read none), and never its last full round nor
/// the rounds continuing it: a device joining reads from the oldest kept, and
/// finds every entry there (`share::rounds_tests`). A device forgotten that
/// comes back counts again at once, its notes with it, and reads from the
/// oldest kept the same way.
fn past_below(folder: &Path, computer: &str, round: u32, full_round: u32, readers: &BTreeSet<String>) -> u32 {
    let read_up_to = readers.iter().filter(|r| *r != computer).map(|r| read_seen(folder, r).and_then(|s| s.read.get(computer).copied()).unwrap_or(0)).min().unwrap_or(round);
    let full = if full_round == 0 { round } else { full_round };
    full.min(read_up_to)
}

/// The readers as the rule was until 16 October 2026: every other computer
/// whose plain notes were heard within `SILENT_DAYS`. For a memory that does
/// not say who counts yet (`Memory::counting`: one saved by an older Sioul,
/// before its first exchange since).
fn readers_by_notes(folder: &Path, computer: &str, now_ms: i64) -> BTreeSet<String> {
    computers(folder).into_iter().filter(|c| c != computer).filter(|c| read_seen(folder, c).is_some_and(|s| now_ms / 1000 - s.at < SILENT_DAYS * 86_400)).collect()
}

/// This computer's rounds below the one returned are past their time, as
/// `remove_old_rounds` judges them from its memory as last saved and the
/// others' notes: its sending takes those still on the server out of it
/// (`remote`), where a sync app left them (eDrive passes no deletion on).
/// Who counts comes from the memory, as the last exchange found it by sealed
/// facts (`Memory::counting`, `Memory::uncounted`: the sending has no key);
/// a file of notes alone that it did not know of holds back as before, by its
/// notes; a memory that does not say: the rule as it was (`readers_by_notes`).
/// None when the memory does not read, or is not this computer's.
pub fn rounds_past(folder: &Path, memory: &Path, computer: &str, now_ms: i64) -> Option<u32> {
    #[derive(Deserialize)]
    struct Part {
        #[serde(default)]
        computer: String,
        #[serde(default)]
        round: u32,
        #[serde(default)]
        full_round: u32,
        #[serde(default)]
        counting: Option<BTreeSet<String>>,
        #[serde(default)]
        uncounted: BTreeSet<String>,
    }
    let part = std::fs::read(memory).ok().and_then(|bytes| serde_json::from_slice::<Part>(&bytes).ok())?;
    if part.computer != computer || part.round == 0 {
        return None;
    }
    let readers = match part.counting {
        Some(counting) => {
            let strays: Vec<String> = readers_by_notes(folder, computer, now_ms).into_iter().filter(|id| !counting.contains(id) && !part.uncounted.contains(id)).collect();
            counting.into_iter().chain(strays).collect()
        }
        None => readers_by_notes(folder, computer, now_ms),
    };
    Some(past_below(folder, computer, part.round, part.full_round, &readers))
}

/// The past rounds of the devices that no longer count by a sealed fact
/// (`Counted::departed`: they left, you forgot them, another device replaces
/// them), each device's below the round returned: below its last full round
/// found in the folder (`Turn::full` on its first line, sealed: a hostile
/// folder can hide a later one, never show one that is not), never that round
/// nor those continuing it, and only those every reader read past
/// (`readers`, this device's own reading among them). Such a device never
/// takes its own out again (a phone dead for good): any device that counts
/// does, each in its own folder, and its sending on the server over the ETag
/// listed there; two at once find it gone (`404`) or changed (`412`), and
/// leave it. A device with no full round found (an older Sioul's rounds say
/// none) keeps every round. A device forgotten that says anything newer
/// counts again at once (`counted`), and its rounds are its own again.
fn departed_rounds(sharing: &Sharing, memory: &Memory, counted: &[(String, Counted)], readers: &BTreeSet<String>) -> BTreeMap<String, u32> {
    let all = rounds_with(sharing.folder);
    let mut out = BTreeMap::new();
    for (id, _) in counted.iter().filter(|(_, counted)| counted.departed()) {
        let Some(theirs) = all.get(id).filter(|rounds| !rounds.is_empty()) else { continue };
        let Some(full) = last_full(sharing, id, theirs) else { continue };
        let own = memory.read.get(id).map_or(0, |(round, _)| *round);
        let others = readers.iter().filter(|r| *r != id).map(|r| read_seen(sharing.folder, r).and_then(|s| s.read.get(id).copied()).unwrap_or(0));
        let floor = std::iter::once(full).chain(std::iter::once(own)).chain(others).min().unwrap_or(0);
        out.insert(id.clone(), floor);
    }
    out
}

/// What the sending and the pull ask of the memory without the key
/// (`remote`), as the last exchange left it: each device that no longer
/// counts by a sealed fact, and the round below which its rounds are past
/// their time here (`Memory::departed`): never fetched again, taken out of
/// the server at a listing. Empty when the memory is not this computer's.
pub fn departed_past(memory: &Path, computer: &str) -> BTreeMap<String, u32> {
    #[derive(Deserialize)]
    struct Part {
        #[serde(default)]
        computer: String,
        #[serde(default)]
        departed: BTreeMap<String, u32>,
    }
    std::fs::read(memory).ok().and_then(|bytes| serde_json::from_slice::<Part>(&bytes).ok()).filter(|part| part.computer == computer).map(|part| part.departed).unwrap_or_default()
}

/// The sealed files this device swept as written by a device that no longer
/// counts (`Memory::taken`, `sweep_theirs`), by name, and when (milliseconds):
/// the sending takes each out of the server too, when it is still as old
/// there, and the pull of Sioul keeping the folder itself never brings it
/// again. Empty when the memory is not this computer's.
pub fn swept_theirs(memory: &Path, computer: &str) -> BTreeMap<String, i64> {
    #[derive(Deserialize)]
    struct Part {
        #[serde(default)]
        computer: String,
        #[serde(default)]
        taken: BTreeMap<String, i64>,
    }
    std::fs::read(memory).ok().and_then(|bytes| serde_json::from_slice::<Part>(&bytes).ok()).filter(|part| part.computer == computer).map(|part| part.taken).unwrap_or_default()
}

/// A device whose files you removed here (`Memory::removed_devices`): when
/// (milliseconds); its last round then and that round's size: the rounds
/// before it stay out by the floor of the rounds past (`Memory::departed`),
/// that one while it is no longer than it was (a copy a sync app brings
/// back; a device still in use that goes on writing it makes it longer, and
/// it comes); whether its entry and its note of how far it read go too
/// (`small_go`, judged again at each exchange: forgotten here, then
/// replaced, they go then); and each of its small files then, by its place
/// in the folder and its content (`small_seen`; its size, `small`, for a
/// removal by an earlier build): a copy of one is taken out again only
/// while it is the same bytes (a sync app bringing it back), never one it
/// wrote since (a claim renewed, its texts to send) (reviews of 17 and 18
/// October 2026, L7 and L-5). Its claims and its texts to send went in
/// every case.
#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
pub struct RemovedDevice {
    pub at: i64,
    pub last: u32,
    #[serde(default)]
    pub last_size: u64,
    #[serde(default)]
    pub entry: bool,
    #[serde(default)]
    pub notes: bool,
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    pub small: BTreeMap<String, u64>,
    /// The same, by each file's content (`content_hash`), from 18 October
    /// 2026: a claim written again from nothing has the size its first had
    /// (`pad_for` pads nothing then), never the same bytes (sealed anew).
    /// Read before `small`, which a removal by an earlier build kept alone.
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    pub small_seen: BTreeMap<String, String>,
}

impl RemovedDevice {
    /// Whether a copy of its round `round`, of `size` bytes, is one it had
    /// written when you removed its files: out (one before its last by the
    /// floor of the rounds past).
    pub fn holds_round(&self, round: u32, size: u64) -> bool {
        round < self.last || (round == self.last && size <= self.last_size)
    }
}

/// Whether a removed device's entry and its note of how far it read go with
/// its files, as nothing needs them any more; a few hundred bytes each.
/// - Its note: once it left or another device replaces it, every device has
///   stopped counting it. One you only forgot here may still count
///   elsewhere, where that note says how far it read: without it, it would
///   hold back every round there (`readers`).
/// - Its entry: once another device's entry says it replaces it (a sealed
///   fact every device reads: none counts it then, the doses neither), or
///   once it left `SILENT_DAYS` ago. Before, its entry is what tells your
///   other devices, the doses first, that it left or how it closed: without
///   it, they would know it by its claims, as an older Sioul, and doubt.
fn small_go(counted: &Counted, heard_ms: i64, now_ms: i64) -> (bool, bool) {
    let entry = match counted {
        Counted::Replaced => true,
        Counted::Left => now_ms - heard_ms > SILENT_DAYS * DAY,
        _ => false,
    };
    (entry, matches!(counted, Counted::Left | Counted::Replaced))
}

/// A device's own small files in the folder and in what was fetched beside
/// it (`remote::overlay`): its claims, its texts to send, its entry when
/// `entry`, its note of how far it read when `notes`. Those there only.
fn device_small_files(folder: &Path, id: &str, entry: bool, notes: bool) -> Vec<PathBuf> {
    device_small_places(folder, id, entry, notes).into_iter().map(|(path, _)| path).collect()
}

/// A small file's content, by its hash (SHA-256): a copy brought back is the
/// same bytes; one written since never is, whatever its size.
fn content_hash(path: &Path) -> Option<String> {
    use sha2::Digest;
    let bytes = std::fs::read(path).ok()?;
    Some(sha2::Sha256::digest(&bytes).iter().map(|b| format!("{b:02x}")).collect())
}

/// The same, each with its place in the folder (`leases/health/<id>.lease`).
fn device_small_places(folder: &Path, id: &str, entry: bool, notes: bool) -> Vec<(PathBuf, String)> {
    let mut out = Vec::new();
    for dir in std::iter::once(folder.to_path_buf()).chain(crate::remote::overlay(folder)) {
        let mut names = vec![format!("texts/send/{id}.jsonl"), format!("phone-messages/ask/{id}.jsonl")];
        if entry {
            names.push(format!("devices/{id}.device"));
        }
        if notes {
            names.push(format!("{id}.toml"));
        }
        for part in std::fs::read_dir(dir.join("leases")).into_iter().flatten().filter_map(Result::ok).filter(|e| e.file_type().is_ok_and(|t| t.is_dir())) {
            names.push(format!("leases/{}/{id}.lease", part.file_name().to_string_lossy()));
        }
        out.extend(names.into_iter().map(|place| (dir.join(&place), place)).filter(|(path, _)| path.is_file()));
    }
    out
}

/// What "Remove its files" takes out for a device, and what stays, as the
/// window says it before you press (`device_files`, `remove_device_files`).
#[derive(Debug, Clone, Default, PartialEq, Eq)]
pub struct DeviceFiles {
    pub id: String,
    /// It still counts here: forgotten first; if it is still in use, it sends everything again.
    pub counts: bool,
    /// Its rounds of records, every one (its last full round too), and their bytes.
    pub rounds: usize,
    pub round_bytes: u64,
    /// Its claims, its texts to send, its entry and its note of how far it
    /// read when nothing needs them any more (`small_go`), and their bytes.
    pub small: usize,
    pub small_bytes: u64,
    /// Its note of how far it read stays: you only forgot it here, and a device that still counts it reads it.
    pub notes_stay: bool,
    /// Its entry stays: your other devices may still count it, the doses
    /// first, and read in it that it left or how it closed (`small_go`).
    pub entry_stays: bool,
    /// Whether its entry and its note of how far it read go (`small_go`).
    pub entry_goes: bool,
    pub notes_go: bool,
    /// The sealed contents of its notes and papers still current (its last
    /// word on them) that no other record names: they go now, but those
    /// sealed or used again lately, which go once that is as old as the
    /// sweep wants (`sealed_later`; `sweep_theirs`). Its earlier contents,
    /// replaced since, go in time as any departed device's (`sweep_theirs`).
    pub sealed: usize,
    pub sealed_bytes: u64,
    pub sealed_later: usize,
    /// How old (days) those sealed lately must be before they go: two weeks, 90 while an older Sioul counts.
    pub later_days: i64,
    /// When it was last heard of, by sealed facts (`last_heard`, milliseconds; 0 when never).
    pub heard: i64,
    /// Whether its sealed files could be weighed here at all: this device
    /// shares every part whose files are sealed apart, and knows the texts'
    /// media; else none of them goes.
    pub sealed_known: bool,
    /// The devices that count and have not read all of it yet, with their
    /// name and kind as their entries said them ("" when none did): what they
    /// have not read never reaches them.
    pub unread_by: Vec<(String, String, String)>,
    /// Its last round in the folder, and its size: those up to it go.
    pub last_round: u32,
    pub last_size: u64,
    /// Its name and kind, as its last entry seen here said them; "" when none did.
    pub name: String,
    pub kind: String,
}

/// What "Remove its files" would take out for `device`: its paths, its
/// sealed files' names, those that go later, and what is said
/// (`DeviceFiles`). None for a device not known here.
fn plan_removal(sharing: &Sharing, stores: &[Store], memory: &Memory, device: &str, now_ms: i64) -> Option<(DeviceFiles, Vec<PathBuf>, Vec<String>, Vec<String>)> {
    let counts = counted(sharing.folder, sharing.key, sharing.computer, memory, now_ms);
    let standing = counts.iter().find(|(id, _)| id == device).map(|(_, counted)| counted.clone())?;
    let departed = standing.departed();
    let mut files = DeviceFiles { id: device.to_string(), counts: !departed, ..DeviceFiles::default() };
    if let Some(entry) = memory.seen.get(device) {
        (files.name, files.kind) = (entry.name.clone(), entry.kind.clone());
    }
    // Its rounds, here and fetched beside: each once, at the longer copy's size.
    let mut paths = Vec::new();
    let mut sizes: BTreeMap<u32, u64> = BTreeMap::new();
    for dir in std::iter::once(sharing.folder.to_path_buf()).chain(crate::remote::overlay(sharing.folder)) {
        for round in rounds(&dir).get(device).into_iter().flatten() {
            let path = round_file(&dir, device, *round);
            let size = sizes.entry(*round).or_default();
            *size = (*size).max(std::fs::metadata(&path).map_or(0, |m| m.len()));
            paths.push(path);
        }
    }
    (files.rounds, files.round_bytes) = (sizes.len(), sizes.values().sum());
    let last_round = sizes.keys().max().copied().unwrap_or(0);
    (files.last_round, files.last_size) = (last_round, sizes.get(&last_round).copied().unwrap_or(0));
    // A live device is forgotten first: what stays is judged as for one forgotten.
    let entry_seen = memory.seen.get(device).cloned().or_else(|| crate::devices::all(sharing.folder, sharing.key).0.into_iter().find(|e| e.id == device));
    files.heard = last_heard(entry_seen.as_ref(), memory, device);
    let (entry, notes) = if departed { small_go(&standing, files.heard, now_ms) } else { (false, false) };
    (files.entry_goes, files.notes_go) = (entry, notes);
    files.notes_stay = !notes && seen_path(sharing.folder, device).is_file();
    files.entry_stays = !entry && sharing.folder.join("devices").join(format!("{device}.device")).is_file();
    for path in device_small_files(sharing.folder, device, entry, notes) {
        files.small += usize::from(path.starts_with(sharing.folder));
        files.small_bytes += std::fs::metadata(&path).map_or(0, |m| m.len()) * u64::from(path.starts_with(sharing.folder));
        paths.push(path);
    }
    let reading = readers(sharing.folder, &counts, now_ms);
    files.unread_by = reading
        .iter()
        .filter(|r| *r != device)
        .filter(|r| read_seen(sharing.folder, r).and_then(|s| s.read.get(device).copied()).unwrap_or(0) < last_round)
        .map(|r| {
            let entry = memory.seen.get(r);
            (r.clone(), entry.map(|e| e.name.clone()).unwrap_or_default(), entry.map(|e| e.kind.clone()).unwrap_or_default())
        })
        .collect();
    // The sealed contents its last words on notes and papers name, that no
    // other record known here names: never a content another record names,
    // nor one named lately, nor one this device sealed, nor a medium a text
    // names; none at all while a part whose files are sealed apart is not
    // shared here, or the texts' media are not known (as `sweep_theirs`).
    // One sealed or used again lately (`fresh`, as the sweep judges it: a
    // device may have sealed the same bytes again in a record not read here
    // yet) goes later, swept as a departed device's replaced contents are.
    let every_part = FILE_PARTS.iter().all(|part| stores.iter().any(|s| s.part == *part && matches!(s.shape, Shape::Files)));
    let media = if every_part { texts_media(sharing, stores, memory, &counts) } else { None };
    files.sealed_known = media.is_some();
    let (mut names, mut later) = (Vec::new(), Vec::new());
    if let Some(media) = media {
        // As the sweep keeps them once this device no longer counts it (`unused_days`).
        let keeps = present(sharing.folder, sharing.key, sharing.computer, memory, now_ms).iter().filter(|(id, _, _)| id != device).all(|(_, entry, _)| entry.as_ref().is_some_and(|e| e.keeping >= crate::blobs::KEEPING_TWO_WEEKS));
        let unused = if keeps { crate::blobs::UNUSED_DAYS } else { crate::blobs::UNUSED_DAYS_BEFORE } * DAY;
        files.later_days = unused / DAY;
        let fresh = |path: &Path| std::fs::metadata(path).ok().and_then(|m| m.modified().ok()).and_then(|t| t.elapsed().ok()).is_some_and(|age| (age.as_millis() as i64) < unused);
        let theirs: BTreeSet<String> = memory.entries.iter().filter(|(key, known)| key.starts_with(FILES) && !known.h.is_empty() && known.w == device).map(|(_, known)| crate::blobs::name(sharing.key, &known.h)).collect();
        // Not the names its own records gave lately (`Sealed::named_at` says
        // not whose): another device's content replaced lately, which a
        // device may keep by reference among its earlier versions, is.
        let used: BTreeSet<String> = memory
            .entries
            .iter()
            .filter(|(key, known)| key.starts_with(FILES) && !known.h.is_empty() && known.w != device)
            .map(|(_, known)| known.h.clone())
            .chain(memory.pending.iter().filter(|(key, _)| key.starts_with(FILES)).filter_map(|(key, (value, _, _))| value.as_deref().map(|v| value_hash(key, v))))
            .map(|h| crate::blobs::name(sharing.key, &h))
            .chain(memory.sealed.theirs.iter().filter(|(_, (writer, at))| writer != device && now_ms - *at < unused).map(|(name, _)| name.clone()))
            .chain(memory.sealed.mine.keys().cloned())
            // Nor the contents of the notes and papers held after going many
            // at once here: "Put them back" writes them from there (review of
            // 17 October 2026, M3); they go with the hold, or in their time.
            .chain(memory.sealed.gone.keys().filter_map(|file| memory.entries.get(&format!("{file}#")).filter(|known| !known.h.is_empty()).map(|known| crate::blobs::name(sharing.key, &known.h))))
            .chain(media)
            .collect();
        for name in theirs.difference(&used) {
            let path = sharing.folder.join("blobs").join(name);
            let Ok(meta) = std::fs::metadata(&path) else { continue };
            if fresh(&path) {
                files.sealed_later += 1;
                later.push(name.clone());
            } else {
                files.sealed += 1;
                files.sealed_bytes += meta.len();
                names.push(name.clone());
            }
        }
    }
    Some((files, paths, names, later))
}

/// What "Remove its files" would take out for `device`, and what stays, for
/// the window to say before you press; None for a device not known here.
pub fn device_files(folder: &Path, key: &[u8; 32], memory: &Path, computer: &str, stores: &[Store], device: &str, now_ms: i64) -> Option<DeviceFiles> {
    let state = Memory::load_all(memory, computer);
    let sharing = Sharing { folder, computer, key, memory, files: false, hurry: None };
    plan_removal(&sharing, stores, &state, device, now_ms).map(|(files, ..)| files)
}

/// "Remove its files" for a device that no longer counts here (it left, you
/// forgot it, another replaces it: sealed facts and your own word only; a
/// live one is forgotten first, by the window): every round of its records
/// (its last full round too), its entry, its claims, its texts to send, its
/// note of how far it read once it left or was replaced, and its notes' and
/// papers' sealed files that no record known here names, taken out of the
/// folder here and of what was fetched beside it; the sending takes them out
/// of the server (`remote::Departed`), and none is fetched again. Each device
/// keeps what it already read; a device joining later never gets its records
/// unless another device's records carry them (texts restored on a new
/// phone). A device that counts here is refused ("share-device-counts").
pub fn remove_device_files(folder: &Path, key: &[u8; 32], memory: &Path, computer: &str, stores: &[Store], device: &str, now_ms: i64) -> Result<DeviceFiles, String> {
    let sharing = Sharing { folder, computer, key, memory, files: false, hurry: None };
    // The removal planned outside the exchanges' lock (it reads every entry of the devices,
    // each round of the device and the sealed names, and hashes its small files: it grows
    // with them; review of part 3, J1), then kept under the lock while the memory it was
    // planned from is the memory there; planned again there when an exchange wrote it meanwhile.
    // The size of each of its small files before they go, the entry and note too (they may go later, `small_go`).
    let small_seen = || -> BTreeMap<String, String> { device_small_places(folder, device, true, true).into_iter().filter_map(|(path, place)| content_hash(&path).map(|h| (place, h))).collect() };
    // Planned, and the memory written as it will be, outside the lock; under it, only a look
    // at the memory's stamps and two renames, so that nothing there grows with the device's
    // files or the memory's size (review of part 3, R-6). An exchange having written the memory
    // meanwhile, all of it is done again outside the lock, a few times, then said busy.
    let mut tries = 0;
    let (files, going, state) = loop {
        let read_from = (stamp_at(memory), stamp_at(&sealed_path(memory)));
        let mut state = Memory::load_all(memory, computer);
        let planned = plan_removal(&sharing, stores, &state, device, now_ms);
        let small_seen = small_seen();
        after_plan();
        let Some((files, paths, names, later)) = planned else { return Err("share-device-unknown".into()) };
        if files.counts {
            return Err("share-device-counts".into());
        }
        let mut going = paths;
        for name in names {
            going.push(folder.join("blobs").join(&name));
            state.sealed.theirs.remove(&name);
            state.taken.insert(name, now_ms);
        }
        // Those sealed or used again lately: swept in time, from now (`sweep_theirs`).
        for name in later {
            state.sealed.theirs.insert(name, (device.to_string(), now_ms));
        }
        state.removed_devices.insert(device.to_string(), RemovedDevice { at: now_ms, last: files.last_round, last_size: files.last_size, entry: files.entry_goes, notes: files.notes_go, small: BTreeMap::new(), small_seen });
        let floor = state.departed.entry(device.to_string()).or_default();
        *floor = (*floor).max(files.last_round);
        let prepared = state.prepare_save(memory)?;
        let running = exchange_lock(memory, true)?;
        if (stamp_at(memory), stamp_at(&sealed_path(memory))) == read_from {
            prepared.commit()?;
            drop(running);
            break (files, going, state);
        }
        drop(prepared);
        tries += 1;
        if tries >= REMOVAL_PLANS {
            return Err("share-busy".into());
        }
        hand_off(memory, running, PUT_BACK_FREE);
    };
    // Kept in this process, once the lock is let go: an exchange that wrote the memory since
    // leaves files this one never takes for its own (`Memory::kept`).
    state.keep(memory);
    // Then its files go, a short hold at a time (`in_short_holds`), its
    // rounds oldest first: thousands of them never keep a dose's exchange
    // waiting. An exchange between two holds reads the memory written above:
    // none of its rounds below that floor is read, what is left of its
    // rounds and small files it takes out itself (`Memory::removed_devices`),
    // its sealed files are taken (`Memory::taken`).
    in_short_holds(memory, going.into_iter(), |path| {
        slow_under_lock();
        let _ = std::fs::remove_file(path);
    })
    .map_err(|(e, _)| e)?;
    Ok(files)
}

/// Sioul keeping the folder itself: the sealed files its copy keeps though
/// the server may no longer list them (`Sealed::needed`), by name, as the
/// last exchange said them; for the pull, which has no key and lets go of
/// the others (`remote`). None when the memory is not this computer's, or
/// does not say it yet (an older Sioul's, before this one's first
/// exchange): then nothing is let go.
pub fn needed_sealed(memory: &Path, computer: &str) -> Option<BTreeSet<String>> {
    #[derive(Deserialize)]
    struct Part {
        #[serde(default)]
        computer: String,
        #[serde(default)]
        needed: Option<BTreeSet<String>>,
    }
    std::fs::read(sealed_path(memory)).ok().and_then(|bytes| serde_json::from_slice::<Part>(&bytes).ok()).filter(|part| part.computer == computer).and_then(|part| part.needed)
}

/// The devices whose files you removed here (`remove_device_files`), and
/// what went, as the last exchange or removal left them: for the sending and
/// the pull (`remote::Departed`), which never fetch such a file again and
/// take those still on the server out. Empty when the memory is not this computer's.
pub fn removed_devices(memory: &Path, computer: &str) -> BTreeMap<String, RemovedDevice> {
    #[derive(Deserialize)]
    struct Part {
        #[serde(default)]
        computer: String,
        #[serde(default)]
        removed_devices: BTreeMap<String, RemovedDevice>,
    }
    std::fs::read(memory).ok().and_then(|bytes| serde_json::from_slice::<Part>(&bytes).ok()).filter(|part| part.computer == computer).map(|part| part.removed_devices).unwrap_or_default()
}

/// A device that no longer counts here and still has files in the folder
/// (`departed_devices`): why it no longer counts ("left", "forgotten",
/// "replaced"), the bytes of its records, its name and kind as its last
/// entry seen here said them.
#[derive(Debug, Clone, Default, PartialEq, Eq)]
pub struct GoneDevice {
    pub id: String,
    pub why: &'static str,
    pub bytes: u64,
    pub name: String,
    pub kind: String,
}

/// The devices that no longer count here (they left, you forgot them,
/// another replaces them) and still have files in the folder: Settings
/// lists each with "Remove its files".
pub fn departed_devices(folder: &Path, key: &[u8; 32], memory: &Path, computer: &str, now_ms: i64) -> Vec<GoneDevice> {
    let state = Memory::load(memory, computer);
    let all = rounds_with(folder);
    counted(folder, key, computer, &state, now_ms)
        .into_iter()
        .filter_map(|(id, counted)| {
            let why = match counted {
                Counted::Left => "left",
                Counted::Forgotten => "forgotten",
                Counted::Replaced => "replaced",
                _ => return None,
            };
            let bytes: u64 = all.get(&id).into_iter().flatten().map(|round| std::fs::metadata(round_file(folder, &id, *round)).map_or(0, |m| m.len())).sum();
            let entry = state.seen.get(&id);
            let (entry_goes, notes_go) = small_go(&counted, last_heard(entry, &state, &id), now_ms);
            let small = device_small_files(folder, &id, entry_goes, notes_go);
            let bytes = bytes + small.iter().filter(|path| path.starts_with(folder)).map(|path| std::fs::metadata(path).map_or(0, |m| m.len())).sum::<u64>();
            (bytes > 0 || !small.is_empty()).then(|| GoneDevice { why, bytes, name: entry.map(|e| e.name.clone()).unwrap_or_default(), kind: entry.map(|e| e.kind.clone()).unwrap_or_default(), id })
        })
        .collect()
}

/// The other devices that count here now, by sealed facts (`counted`): not
/// left, forgotten, replaced, silent for `SILENT_DAYS`, nor a stray file.
/// Only these may ask this phone for what your own devices alone may ask
/// (a reply from a computer, `sioul_core::replies::verdict`).
pub fn counting(folder: &Path, key: &[u8; 32], memory: &Path, computer: &str, now_ms: i64) -> BTreeSet<String> {
    let state = Memory::load(memory, computer);
    present(folder, key, computer, &state, now_ms).into_iter().map(|(id, _, _)| id).collect()
}

/// Who may ask this device to act for them (texts' and replies' requests),
/// in two sets: the devices the sharing counts now (as `counting`), and
/// those gone by a sealed fact (they left, you forgot them, another device
/// replaces them: `Counted::departed`). Any other device is not known yet:
/// its records have not come (a new computer's first request may come before
/// them), a file alone, or a device silent for weeks that wakes; its request
/// waits while it is fresh, never refused for good.
pub fn asking(folder: &Path, key: &[u8; 32], memory: &Path, computer: &str, now_ms: i64) -> (BTreeSet<String>, BTreeSet<String>) {
    let state = Memory::load(memory, computer);
    let (mut counts, mut gone) = (BTreeSet::new(), BTreeSet::new());
    for (id, standing) in counted(folder, key, computer, &state, now_ms) {
        match standing {
            Counted::Yes(..) => {
                counts.insert(id);
            }
            standing if standing.departed() => {
                gone.insert(id);
            }
            _ => {}
        }
    }
    (counts, gone)
}

/// Another computer sharing through the folder, and when it last exchanged (Unix seconds).
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Other {
    pub id: String,
    pub heard: i64,
}

/// The other computers sharing through the folder.
pub fn others(folder: &Path, computer: &str) -> Vec<Other> {
    computers(folder).into_iter().filter(|c| c != computer).map(|c| Other { heard: read_seen(folder, &c).map_or(0, |s| s.at), id: c }).collect()
}

/// The same, each heard when its notes, its entry in the devices' registry
/// (`devices`) or its last record that opens last said so, the latest: a
/// device put away restates its notes once a day (`write_seen`), its entry
/// once an hour (`devices::RESTATED`), as Settings says when each was last
/// heard of. A device whose records came before its notes and its entry (each
/// file travels on its own) is heard of by its records: the doses count it,
/// in doubt, until its entry comes (review of 5 October 2026, F5).
pub fn others_heard(folder: &Path, key: &[u8; 32], computer: &str) -> Vec<Other> {
    let (entries, _) = crate::devices::all(folder, key);
    let all = rounds_with(folder);
    let mut out = others(folder, computer);
    for other in &mut out {
        if let Some(entry) = entries.iter().find(|e| e.id == other.id) {
            other.heard = other.heard.max(entry_stamp(entry));
        }
        if let Some(clock) = all.get(&other.id).and_then(|rounds| rounds.last()).and_then(|round| last_record_clock(folder, key, &other.id, *round)) {
            other.heard = other.heard.max((clock >> 16) as i64 / 1000);
        }
    }
    out
}

/// Whether the folder already holds a seal: another computer shares through it.
pub fn sealed(folder: &Path) -> bool {
    folder.join("seal.toml").is_file()
}

#[cfg(test)]
mod tests {
    use super::*;

    thread_local! {
        /// Stores this thread's exchanges know nothing of, as an older Sioul's
        /// (`known_part`): their records wait, written nowhere, taken out nowhere.
        pub(super) static OLDER: std::cell::RefCell<Vec<String>> = const { std::cell::RefCell::new(Vec::new()) };
    }

    /// A computer of its own: its folders, its name, its memory.
    pub(super) struct Computer {
        pub(super) roots: Roots,
        pub(super) id: String,
        pub(super) memory: PathBuf,
    }

    impl Computer {
        pub(super) fn new(base: &Path, name: &str) -> Computer {
            let root = base.join(name);
            let roots = Roots { config: root.join("config"), data: root.join("data"), state: root.join("state") };
            for dir in [&roots.config, &roots.data, &roots.state] {
                std::fs::create_dir_all(dir).unwrap();
            }
            let memory = roots.state.join("share").join("memory.json");
            Computer { roots, id: uuid::Uuid::new_v4().to_string(), memory }
        }

        pub(super) fn exchange(&self, folder: &Path, key: &[u8; 32], now: i64) -> Outcome {
            let stores = stores(&Config::default(), &self.roots);
            exchange(&Sharing { folder, computer: &self.id, key, memory: &self.memory, files: true, hurry: None }, &stores, now).unwrap()
        }

        /// An exchange carrying the projects and budgets of `notes`, this computer's notes folder.
        pub(super) fn exchange_notes(&self, folder: &Path, key: &[u8; 32], now: i64, notes: &Path) -> Outcome {
            let config = Config { share_projects: true, notes_root: Some(notes.display().to_string()), ..Config::default() };
            let stores = stores(&config, &self.roots);
            exchange(&Sharing { folder, computer: &self.id, key, memory: &self.memory, files: true, hurry: None }, &stores, now).unwrap()
        }

        /// An exchange with `notes` as this computer's notes folder, the parts `on` shared besides those shared by default.
        fn exchange_with(&self, folder: &Path, key: &[u8; 32], now: i64, notes: &Path, on: &[&str]) -> Outcome {
            let stores = self.stores_with(notes, &|part| on.contains(&part));
            exchange(&Sharing { folder, computer: &self.id, key, memory: &self.memory, files: true, hurry: None }, &stores, now).unwrap()
        }

        fn stores_with(&self, notes: &Path, on: &dyn Fn(&str) -> bool) -> Vec<Store> {
            let config = Config { notes_root: Some(notes.display().to_string()), ..Config::default() };
            stores_of(&config, &self.roots, &|part| on(part) || shared_by_default(part, &config))
        }

        pub(super) fn write(&self, relative: &str, text: &str) {
            let path = self.path(relative);
            std::fs::create_dir_all(path.parent().unwrap()).unwrap();
            std::fs::write(path, text).unwrap();
        }

        pub(super) fn read(&self, relative: &str) -> String {
            std::fs::read_to_string(self.path(relative)).unwrap_or_default()
        }

        pub(super) fn path(&self, relative: &str) -> PathBuf {
            let (root, rest) = relative.split_once('/').unwrap();
            match root {
                "config" => self.roots.config.join(rest),
                "data" => self.roots.data.join(rest),
                _ => self.roots.state.join(rest),
            }
        }
    }

    pub(super) fn scratch(name: &str) -> PathBuf {
        let dir = std::env::temp_dir().join(format!("sioul-share-{name}-{}", std::process::id()));
        let _ = std::fs::remove_dir_all(&dir);
        std::fs::create_dir_all(&dir).unwrap();
        dir
    }

    pub(super) fn quick_key(folder: &Path, passphrase: &str) -> Result<[u8; 32], Refused> {
        key_with(folder, passphrase, 64, 1)
    }

    /// A file dated through a handle that cannot write it (`set_time`: on
    /// Windows its attributes alone, no antivirus reading the file at its
    /// close; elsewhere a read handle): its time set, the file unchanged; a
    /// file only its owner may read dated too, where a write handle could
    /// not even be opened.
    #[test]
    fn a_file_is_dated_without_a_handle_that_writes_it() {
        let base = scratch("set-time");
        let path = base.join("note.md");
        std::fs::write(&path, b"# Note\n").unwrap();
        let when = std::time::UNIX_EPOCH + std::time::Duration::from_secs(1_789_990_000);
        set_time(&path, when).unwrap();
        assert_eq!(std::fs::metadata(&path).unwrap().modified().unwrap(), when);
        assert_eq!(std::fs::read(&path).unwrap(), b"# Note\n");
        #[cfg(unix)]
        {
            use std::os::unix::fs::PermissionsExt;
            std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o400)).unwrap();
            let later = when + std::time::Duration::from_secs(60);
            set_time(&path, later).unwrap();
            assert_eq!(std::fs::metadata(&path).unwrap().modified().unwrap(), later, "read-only: dated all the same");
            std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600)).unwrap();
        }
        assert!(set_time(&base.join("gone.md"), when).is_err());
        let _ = std::fs::remove_dir_all(&base);
    }

    fn put(dir: &Path, relative: &str, bytes: &[u8]) {
        let path = dir.join(relative);
        std::fs::create_dir_all(path.parent().unwrap()).unwrap();
        std::fs::write(path, bytes).unwrap();
    }

    /// Bytes that do not compress, the same for the same seed: a scan, a picture.
    fn noise(length: usize, seed: u32) -> Vec<u8> {
        let mut x = seed.wrapping_mul(2_654_435_761).wrapping_add(1);
        (0..length)
            .map(|_| {
                x ^= x << 13;
                x ^= x >> 17;
                x ^= x << 5;
                x as u8
            })
            .collect()
    }

    /// The files of a notes folder, hidden ones left out, by their path from it.
    fn files_in(dir: &Path) -> BTreeMap<String, Vec<u8>> {
        let mut found = Vec::new();
        list_files(dir, dir, &[], &mut found);
        found.into_iter().map(|(name, path)| (name, std::fs::read(path).unwrap())).collect()
    }

    /// A version kept, copied or by reference (its content opened from the folder).
    fn version_text(history: &Path, part: &str, file: &str, stamp: &str, folder: &Path, key: &[u8; 32]) -> String {
        match crate::history::version(history, part, file, stamp) {
            Some(crate::history::Kept::Copy(path)) => std::fs::read_to_string(path).unwrap(),
            Some(crate::history::Kept::Sealed { hash, .. }) => {
                let target = temporary(&history.join("opened"));
                crate::blobs::get(folder, key, &hash, &target).unwrap();
                let text = std::fs::read_to_string(&target).unwrap();
                std::fs::remove_file(target).unwrap();
                text
            }
            None => panic!("{file}: {stamp}: not kept"),
        }
    }

    /// The copies a device kept of a file two devices changed: "lease (… …).md", not a sync app's.
    fn copies_of(dir: &Path, stem: &str) -> Vec<Vec<u8>> {
        files_in(dir).into_iter().filter(|(name, _)| name.starts_with(&format!("{stem} (")) && name.ends_with(").md") && !made_by_tools(name)).map(|(_, bytes)| bytes).collect()
    }

    pub(super) const MINUTE: i64 = 60_000;
    pub(super) const NOW: i64 = 1_790_000_000_000;

    /// How eDrive (Murena's sync on /e/OS) carries a folder between a phone and
    /// the server, after its `FileDiffUtils`: a file new on either side is
    /// copied; a file changed on the phone goes up; a file changed on the server
    /// comes down only when its size differs from the phone's copy (else only
    /// its version is noted); nothing is ever deleted. The server here is the
    /// desktop's folder: Nextcloud's client keeps them equal.
    #[derive(Default)]
    struct Edrive {
        /// path → (the server's content when last seen, the phone's content then).
        known: BTreeMap<String, (String, String)>,
    }

    impl Edrive {
        fn files(root: &Path) -> BTreeMap<String, Vec<u8>> {
            let mut found = Vec::new();
            list_files(root, root, &[], &mut found);
            found.into_iter().filter(|(name, _)| !name.split('/').any(|p| p.starts_with('.'))).filter_map(|(name, path)| std::fs::read(path).ok().map(|b| (name, b))).collect()
        }

        fn carry(&mut self, server: &Path, phone: &Path) {
            let digest = |bytes: &[u8]| hash(&String::from_utf8_lossy(bytes));
            let (up, down) = (Self::files(phone), Self::files(server));
            for (name, bytes) in &up {
                let changed_here = self.known.get(name).is_none_or(|(_, local)| *local != digest(bytes));
                if changed_here {
                    let to = server.join(name);
                    std::fs::create_dir_all(to.parent().unwrap()).unwrap();
                    std::fs::write(&to, bytes).unwrap();
                    self.known.insert(name.clone(), (digest(bytes), digest(bytes)));
                }
            }
            for (name, bytes) in &down {
                let local = phone.join(name);
                match (self.known.get(name), std::fs::read(&local)) {
                    (Some((remote, _)), _) if *remote == digest(bytes) => {}
                    // Changed there, the same size here: only the version is noted.
                    (Some(_), Ok(here)) if here.len() == bytes.len() => {
                        self.known.insert(name.clone(), (digest(bytes), digest(&here)));
                    }
                    _ => {
                        std::fs::create_dir_all(local.parent().unwrap()).unwrap();
                        std::fs::write(&local, bytes).unwrap();
                        self.known.insert(name.clone(), (digest(bytes), digest(bytes)));
                    }
                }
            }
        }
    }

    /// How a sync app carries the folder between a phone and the server, in
    /// the ways they differ: the sharing must hold with each (docs/database.md,
    /// "What the sync app must do").
    #[derive(Clone, Copy, Debug, PartialEq)]
    enum Carrying {
        /// Every change, both ways, deletions too (Nextcloud's desktop client, Dropbox, Drive, OneDrive).
        Exact,
        /// A change from the server comes only when the size differs (eDrive).
        SizeOnly,
        /// Half the files each time, late, in any order; nothing deleted.
        Late,
        /// An older copy of a file put back from time to time, a conflicted copy beside it.
        StaleCopies,
        /// New files first come as empty placeholders, the content at the next look (on-demand files).
        Placeholders,
    }

    struct Carrier {
        how: Carrying,
        turn: u64,
        /// path → (the server's content when last seen, the phone's content then).
        known: BTreeMap<String, (String, String)>,
        /// Every version seen on the server, to put an older one back.
        history: BTreeMap<String, Vec<Vec<u8>>>,
    }

    impl Carrier {
        fn new(how: Carrying) -> Carrier {
            Carrier { how, turn: 0, known: BTreeMap::new(), history: BTreeMap::new() }
        }

        fn files(root: &Path) -> BTreeMap<String, Vec<u8>> {
            let mut found = Vec::new();
            list_files(root, root, &[], &mut found);
            found.into_iter().filter(|(name, _)| !name.split('/').any(|p| p.starts_with('.'))).filter_map(|(name, path)| std::fs::read(path).ok().map(|b| (name, b))).collect()
        }

        fn write(path: &Path, bytes: &[u8]) {
            std::fs::create_dir_all(path.parent().unwrap()).unwrap();
            std::fs::write(path, bytes).unwrap();
        }

        fn carry(&mut self, server: &Path, phone: &Path) {
            self.turn += 1;
            let digest = |bytes: &[u8]| hash(&String::from_utf8_lossy(bytes));
            let (up, down) = (Self::files(phone), Self::files(server));
            for (name, bytes) in &up {
                let changed_here = self.known.get(name).is_none_or(|(_, local)| *local != digest(bytes));
                // A placeholder never goes up.
                if changed_here && !(self.how == Carrying::Placeholders && bytes.is_empty() && down.contains_key(name)) {
                    Self::write(&server.join(name), bytes);
                    self.known.insert(name.clone(), (digest(bytes), digest(bytes)));
                }
            }
            for (i, (name, bytes)) in down.iter().enumerate() {
                self.history.entry(name.clone()).or_default().push(bytes.clone());
                if self.how == Carrying::Late && (i as u64 + self.turn) % 2 == 0 {
                    continue;
                }
                let local = phone.join(name);
                let here = std::fs::read(&local).ok();
                match (self.known.get(name), here) {
                    (Some((remote, _)), _) if *remote == digest(bytes) => {}
                    (Some(_), Some(here)) if self.how == Carrying::SizeOnly && here.len() == bytes.len() => {
                        self.known.insert(name.clone(), (digest(bytes), digest(&here)));
                    }
                    (None, None) if self.how == Carrying::Placeholders => {
                        Self::write(&local, b"");
                        self.known.insert(name.clone(), (String::new(), digest(b"")));
                    }
                    _ => {
                        Self::write(&local, bytes);
                        self.known.insert(name.clone(), (digest(bytes), digest(bytes)));
                    }
                }
            }
            if self.how == Carrying::Exact {
                for name in up.keys().filter(|n| !down.contains_key(*n) && self.known.contains_key(*n)) {
                    let _ = std::fs::remove_file(phone.join(name));
                }
            }
            // From time to time, an older copy of a record put back on the server, a conflicted copy beside it.
            if self.how == Carrying::StaleCopies && self.turn % 7 == 0 {
                for (name, versions) in self.history.iter().filter(|(n, _)| n.ends_with(".jsonl")) {
                    if versions.len() > 2 {
                        let current = std::fs::read(server.join(name)).unwrap_or_default();
                        Self::write(&server.join(format!("{name} (conflicted copy)")), &current);
                        Self::write(&server.join(name), &versions[versions.len() / 2]);
                    }
                }
            }
        }
    }

    #[test]
    fn doses_are_never_known_wrongly_whatever_carries_them() {
        for how in [Carrying::Exact, Carrying::SizeOnly, Carrying::Late, Carrying::StaleCopies, Carrying::Placeholders] {
            let base = scratch(&format!("carrier-{how:?}").to_lowercase());
            let (server, phone_folder) = (base.join("server").join("Sioul"), base.join("phone").join("Sioul"));
            let key = quick_key(&server, "four words make a passphrase").unwrap();
            let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
            let mut carrier = Carrier::new(how);
            let mut marked: Vec<String> = Vec::new();
            for minute in 0..120 {
                let now = NOW + minute * MINUTE;
                // A dose marked on the desk every ten minutes, its claim renewed each minute.
                if minute % 10 == 0 {
                    marked.push(format!("dose@{minute}"));
                    let record: String = marked.iter().map(|d| format!("\"{d}\" = {minute}\n")).collect();
                    desk.write("state/health-state.toml", &format!("[taken]\n{record}"));
                }
                desk.exchange(&server, &key, now);
                let wrote = written(&desk.memory, &desk.id);
                crate::lease::renew(&server, &key, "health", &desk.id, now / 1000, now / 1000, false, crate::lease::Rule::FollowsYou, wrote).unwrap();
                carrier.carry(&server, &phone_folder);
                // texts: a first import running on the phone beside it, a batch each minute and a picture each ten.
                let import: Vec<sioul_core::texts::Text> = (0..20).map(|i| sioul_core::texts::Text { id: format!("sms-{minute}-{i}"), at: NOW - 86_400_000 + minute * MINUTE + i, direction: "in".into(), with: vec!["+33199001234".into()], body: format!("Message {minute}-{i}"), ..sioul_core::texts::Text::default() }).collect();
                sioul_core::texts::append(&sioul_core::texts::own_file(&texts_of(&phone), sioul_core::texts::LOG, &phone.id), &import, &crate::textseal::TextSeal::new(&key), None).unwrap();
                if minute % 10 == 0 {
                    let picture = base.join(format!("picture-{minute}.bin"));
                    std::fs::write(&picture, vec![minute as u8; 256 * 1024]).unwrap();
                    let (hash, _) = crate::blobs::hash_file(&picture).unwrap();
                    crate::blobs::put(&phone_folder, &key, &picture, &hash).unwrap();
                }
                phone.exchange_with(&phone_folder, &key, now + 30_000, &base.join("phone-notes"), &[sioul_core::texts::PART]);
                // What the phone takes as known must be there: a dose known not taken that was taken is the harm.
                if let Some(claim) = crate::lease::claims(&phone_folder, &key, "health").into_iter().find(|c| c.computer == desk.id)
                    && let Some(wrote) = claim.wrote
                    && heard(&phone.memory, &phone.id).complete(&desk.id, wrote)
                {
                    let record = phone.read("state/health-state.toml");
                    let claimed = (claim.renewed - NOW / 1000) / 60;
                    for dose in marked.iter().filter(|d| d[5..].parse::<i64>().unwrap() < claimed) {
                        assert!(record.contains(dose.as_str()), "{how:?}, minute {minute}: the phone takes {dose} as known, its record lacks it:\n{record}");
                    }
                }
            }
            // In the end every dose is there, whatever carried them.
            for minute in 120..140 {
                let now = NOW + minute * MINUTE;
                desk.exchange(&server, &key, now);
                carrier.carry(&server, &phone_folder);
                phone.exchange(&phone_folder, &key, now + 30_000);
            }
            let record = phone.read("state/health-state.toml");
            for dose in &marked {
                assert!(record.contains(dose.as_str()), "{how:?}: {dose} never came:\n{record}");
            }
            let _ = std::fs::remove_dir_all(&base);
        }
    }

    #[test]
    fn edrive_brings_every_rewrite() {
        let base = scratch("edrive");
        let (server, phone_folder) = (base.join("server").join("Sioul"), base.join("phone").join("Sioul"));
        let key = quick_key(&server, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let mut edrive = Edrive::default();
        let health = |computer: &Computer, folder: &Path, now: i64, closed: bool| {
            let wrote = written(&computer.memory, &computer.id);
            if closed {
                crate::lease::close(folder, &key, "health", &computer.id, now / 1000, wrote).unwrap();
            } else {
                crate::lease::renew(folder, &key, "health", &computer.id, now / 1000, now / 1000, false, crate::lease::Rule::FollowsYou, wrote).unwrap();
            }
        };

        // The desk marks a dose and shares it; the phone joins through eDrive.
        desk.write("state/health-state.toml", "[taken]\n\"levothyroxine@2026-10-05T07:30\" = 1790000000\n");
        desk.exchange(&server, &key, NOW);
        health(&desk, &server, NOW, false);
        edrive.carry(&server, &phone_folder);
        phone.exchange(&phone_folder, &key, NOW + MINUTE);
        assert!(phone.read("state/health-state.toml").contains("levothyroxine@2026-10-05T07:30"));

        // Hours of rewrites on the desk, each carried: every one comes, the last one closed.
        for minute in 2..200 {
            let now = NOW + minute * MINUTE;
            if minute == 120 {
                desk.write("state/health-state.toml", &format!("{}\"levothyroxine@2026-10-06T07:30\" = 1790090000\n", desk.read("state/health-state.toml")));
            }
            desk.exchange(&server, &key, now);
            health(&desk, &server, now, minute == 199);
            edrive.carry(&server, &phone_folder);
            for name in [format!("{}.toml", desk.id), format!("leases/health/{}.lease", desk.id)] {
                assert_eq!(std::fs::read(phone_folder.join(&name)).ok(), std::fs::read(server.join(&name)).ok(), "minute {minute}: {name} stale on the phone");
            }
        }
        // On the phone: the second dose, and the desk's claim saying it closed and how far it wrote.
        phone.exchange(&phone_folder, &key, NOW + 200 * MINUTE);
        assert!(phone.read("state/health-state.toml").contains("levothyroxine@2026-10-06T07:30"));
        let claim = crate::lease::claims(&phone_folder, &key, "health").into_iter().find(|c| c.computer == desk.id).unwrap();
        assert!(claim.closed && claim.wrote == written(&desk.memory, &desk.id), "{claim:?}");
        // The phone's own files went up untouched.
        let phone_record = format!("{}-1.jsonl", phone.id);
        assert_eq!(std::fs::read(server.join(&phone_record)).ok(), std::fs::read(phone_folder.join(&phone_record)).ok());
        let _ = std::fs::remove_dir_all(&base);
    }

    /// The build that wrote them (docs/database.md, "The log"): on the first
    /// line of each batch a computer appends, sealed with it; lines without it
    /// (an older Sioul's) read as ever.
    #[test]
    fn each_batch_of_records_says_its_build() {
        let base = scratch("build");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let desk = Computer::new(&base, "desk");
        desk.write("config/safe-senders.txt", "a@example.org\nb@example.org\n");
        desk.exchange(&folder, &key, NOW);
        let own = round_file(&folder, &desk.id, 1);
        let first = std::fs::read_to_string(&own).unwrap().lines().count();
        desk.write("config/safe-senders.txt", "a@example.org\nb@example.org\nc@example.org\n");
        desk.exchange(&folder, &key, NOW + MINUTE);
        let text = std::fs::read_to_string(&own).unwrap();
        let builds: Vec<String> = text
            .lines()
            .map(|l| {
                let line: Line = serde_json::from_str(l).unwrap();
                serde_json::from_slice::<Change>(&open(&key, &bound(&desk.id, 1, line.n, line.c), &line.s).unwrap()).unwrap().build
            })
            .collect();
        assert!(first >= 2 && builds.len() > first, "{builds:?}");
        for (n, build) in builds.iter().enumerate() {
            assert_eq!(build.as_str(), if n == 0 || n == first { sioul_core::build::DESCRIBED } else { "" }, "line {n}");
        }
        assert!(!text.contains(sioul_core::build::DESCRIBED), "sealed: the server never learns it");
        // A new round opens with the build too.
        std::fs::write(&own, text.lines().next().unwrap().to_string() + "\n").unwrap();
        desk.exchange(&folder, &key, NOW + 2 * MINUTE);
        let line: Line = serde_json::from_str(std::fs::read_to_string(round_file(&folder, &desk.id, 2)).unwrap().lines().next().unwrap()).unwrap();
        let change: Change = serde_json::from_slice(&open(&key, &bound(&desk.id, 2, line.n, line.c), &line.s).unwrap()).unwrap();
        assert_eq!(change.build, sioul_core::build::DESCRIBED);
        // Another computer reads them all, those written before the build was said among them.
        let laptop = Computer::new(&base, "laptop");
        let stranger = uuid::Uuid::new_v4().to_string();
        append_to(&round_file(&folder, &stranger, 1), &record_of(&key, &stranger, 1, ((NOW + MINUTE) as u64) << 16, &Change { k: "config/safe-senders.txt#d@example.org".into(), v: Some(String::new()), b: String::new(), build: String::new(), f: 0 }));
        laptop.exchange(&folder, &key, NOW + 3 * MINUTE);
        let safe = laptop.read("config/safe-senders.txt");
        assert!(["a@", "b@", "c@", "d@"].iter().all(|a| safe.contains(a)), "{safe}");
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn a_record_put_back_shorter_starts_again() {
        let base = scratch("cut");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let desk = Computer::new(&base, "desk");
        desk.write("config/safe-senders.txt", "a@example.org\n");
        desk.exchange(&folder, &key, NOW);
        desk.write("config/safe-senders.txt", "a@example.org\nb@example.org\n");
        desk.exchange(&folder, &key, NOW + MINUTE);
        // A sync app puts back the first version of the desk's file: its second line is lost.
        let own = round_file(&folder, &desk.id, 1);
        let text = std::fs::read_to_string(&own).unwrap();
        std::fs::write(&own, text.lines().next().unwrap().to_string() + "\n").unwrap();
        desk.write("config/safe-senders.txt", "a@example.org\nb@example.org\nc@example.org\n");
        let outcome = desk.exchange(&folder, &key, NOW + 2 * MINUTE);
        assert!(outcome.problems.iter().any(|p| p == "share-own-cut"), "{outcome:?}");
        assert!(round_file(&folder, &desk.id, 2).exists(), "a new file, opening on all the desk holds");
        // A computer joining now hears all three.
        let laptop = Computer::new(&base, "laptop");
        laptop.exchange(&folder, &key, NOW + 3 * MINUTE);
        let safe = laptop.read("config/safe-senders.txt");
        assert!(["a@", "b@", "c@"].iter().all(|a| safe.contains(a)), "{safe}");
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn a_memory_restored_or_lost_goes_on_numbering() {
        let base = scratch("restored");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        desk.write("state/health-state.toml", "[taken]\n\"a@100\" = 100\n");
        desk.exchange(&folder, &key, NOW);
        phone.exchange(&folder, &key, NOW + MINUTE);
        // A backup of the desk now; then a dose marked and shared.
        let backup = (std::fs::read(&desk.memory).unwrap(), desk.read("state/health-state.toml"));
        desk.write("state/health-state.toml", "[taken]\n\"a@100\" = 100\n\"b@800\" = 800\n");
        desk.exchange(&folder, &key, NOW + 2 * MINUTE);
        phone.exchange(&folder, &key, NOW + 3 * MINUTE);
        assert!(phone.read("state/health-state.toml").contains("b@800"));
        let before = written(&desk.memory, &desk.id).unwrap();
        // The desk restored from its backup: the dose it marked comes back, its numbering goes on.
        std::fs::write(&desk.memory, &backup.0).unwrap();
        desk.write("state/health-state.toml", &backup.1);
        let outcome = desk.exchange(&folder, &key, NOW + 4 * MINUTE);
        assert!(outcome.problems.iter().any(|p| p == "share-own-ahead"), "{outcome:?}");
        assert!(desk.read("state/health-state.toml").contains("b@800"), "{}", desk.read("state/health-state.toml"));
        desk.write("state/health-state.toml", &format!("{}\"c@900\" = 900\n", desk.read("state/health-state.toml")));
        desk.exchange(&folder, &key, NOW + 5 * MINUTE);
        let after = written(&desk.memory, &desk.id).unwrap();
        assert!(after > before && after.0 == before.0, "numbering goes on in the same round: {before:?} → {after:?}");
        // The phone reads it all, without a gap, and knows it all.
        let outcome = phone.exchange(&folder, &key, NOW + 6 * MINUTE);
        assert!(!outcome.problems.iter().any(|p| p.starts_with("share-other-gap")), "{outcome:?}");
        assert!(phone.read("state/health-state.toml").contains("c@900"));
        assert!(heard(&phone.memory, &phone.id).complete(&desk.id, after));
        // "Stop sharing", then again: the memory gone, the same.
        std::fs::remove_file(&desk.memory).unwrap();
        desk.write("state/health-state.toml", &format!("{}\"d@950\" = 950\n", desk.read("state/health-state.toml")));
        desk.exchange(&folder, &key, NOW + 7 * MINUTE);
        assert!(written(&desk.memory, &desk.id).unwrap() > after);
        phone.exchange(&folder, &key, NOW + 8 * MINUTE);
        assert!(phone.read("state/health-state.toml").contains("d@950"));
        assert!(heard(&phone.memory, &phone.id).complete(&desk.id, written(&desk.memory, &desk.id).unwrap()));
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn a_gap_is_a_doubt_and_a_damaged_line_is_one_line() {
        let base = scratch("gap");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        desk.write("config/safe-senders.txt", "a@example.org\n");
        desk.exchange(&folder, &key, NOW);
        phone.exchange(&folder, &key, NOW + MINUTE);
        // A line that is not text, then one that is: the second is read all the same.
        let own = round_file(&folder, &desk.id, 1);
        let mut bytes = std::fs::read(&own).unwrap();
        bytes.extend_from_slice(b"\xff\xfe broken\n");
        std::fs::write(&own, &bytes).unwrap();
        desk.write("config/safe-senders.txt", "a@example.org\nb@example.org\n");
        desk.exchange(&folder, &key, NOW + 2 * MINUTE);
        let outcome = phone.exchange(&folder, &key, NOW + 3 * MINUTE);
        assert!(outcome.problems.iter().any(|p| p.starts_with("share-other-line")), "{outcome:?}");
        assert!(phone.read("config/safe-senders.txt").contains("b@example.org"));
        // Lines missing (a stale copy of the file put back, then written after): a gap, said, and not known.
        let line = |n: u64, value: &str| {
            let clock = (NOW as u64) << 16 | n;
            let plain = serde_json::to_vec(&Change { k: "config/safe-senders.txt#".to_string() + value, v: Some(String::new()), b: String::new(), build: String::new(), f: 0 }).unwrap();
            serde_json::to_string(&Line { n, c: clock, s: seal(&key, &bound(&desk.id, 1, n, clock), &plain) }).unwrap() + "\n"
        };
        let last = written(&desk.memory, &desk.id).unwrap().1;
        let mut bytes = std::fs::read(&own).unwrap();
        bytes.extend_from_slice(line(last + 3, "c@example.org").as_bytes());
        std::fs::write(&own, bytes).unwrap();
        let outcome = phone.exchange(&folder, &key, NOW + 4 * MINUTE);
        assert!(outcome.problems.iter().any(|p| p.starts_with("share-other-gap")), "{outcome:?}");
        assert!(!heard(&phone.memory, &phone.id).complete(&desk.id, (1, last + 3)), "past a gap, nothing is known");
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn stores_that_leave_arrive_or_move_take_nothing_out() {
        let base = scratch("stores");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let (desk_notes, phone_notes, moved) = (base.join("desk-notes"), base.join("phone-notes"), base.join("moved-notes"));
        let ledger = |notes: &Path| std::fs::read_to_string(notes.join("sioul-budgets.toml")).unwrap_or_default();
        let line = |label: &str, amount: f64| format!("\n[[line]]\nbudget = \"home\"\ndate = \"2026-10-01\"\namount = {amount}\nlabel = \"{label}\"\n");
        std::fs::create_dir_all(&desk_notes).unwrap();
        std::fs::write(desk_notes.join("sioul-budgets.toml"), format!("[[budget]]\nid = \"home\"\ntitle = \"Home\"\n{}", line("Rent", -620.0))).unwrap();
        // The phone holds an old copy of its own, made long ago, and shares without its projects.
        std::fs::create_dir_all(&phone_notes).unwrap();
        std::fs::write(phone_notes.join("sioul-budgets.toml"), format!("[[budget]]\nid = \"home\"\ntitle = \"Old home\"\n{}", line("Old", -1.0))).unwrap();
        let old = std::fs::File::options().write(true).open(phone_notes.join("sioul-budgets.toml")).unwrap();
        old.set_modified(std::time::UNIX_EPOCH + std::time::Duration::from_secs(1_700_000_000)).unwrap();
        desk.exchange_notes(&folder, &key, NOW, &desk_notes);
        phone.exchange(&folder, &key, NOW + MINUTE);
        // Projects shared on the phone from now on: the desk's newer budget wins there, nothing old goes out.
        phone.exchange_notes(&folder, &key, NOW + 2 * MINUTE, &phone_notes);
        desk.exchange_notes(&folder, &key, NOW + 3 * MINUTE, &desk_notes);
        assert!(ledger(&phone_notes).contains("title = \"Home\"") && ledger(&phone_notes).contains("Rent"), "{}", ledger(&phone_notes));
        assert!(ledger(&desk_notes).contains("title = \"Home\""), "{}", ledger(&desk_notes));
        // The phone's notes folder moved to an empty one: filled; nothing taken out on the desk.
        phone.exchange_notes(&folder, &key, NOW + 4 * MINUTE, &moved);
        desk.exchange_notes(&folder, &key, NOW + 5 * MINUTE, &desk_notes);
        assert!(ledger(&moved).contains("Rent"), "{}", ledger(&moved));
        assert!(ledger(&desk_notes).contains("Rent"), "{}", ledger(&desk_notes));
        // Projects no longer shared on the phone: nothing taken out on the desk.
        phone.exchange(&folder, &key, NOW + 6 * MINUTE);
        desk.exchange_notes(&folder, &key, NOW + 7 * MINUTE, &desk_notes);
        assert!(ledger(&desk_notes).contains("Rent"), "{}", ledger(&desk_notes));
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn a_file_emptied_takes_nothing_out_at_once() {
        let base = scratch("emptied");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, laptop) = (Computer::new(&base, "desk"), Computer::new(&base, "laptop"));
        let settings = "language = \"fr\"\n\n[tasks]\nkind = \"plan\"\n";
        desk.write("config/config.toml", settings);
        desk.exchange(&folder, &key, NOW);
        laptop.exchange(&folder, &key, NOW + MINUTE);
        // Read of no bytes (a crash, a full disk, written in place): held.
        desk.write("config/config.toml", "");
        let outcome = desk.exchange(&folder, &key, NOW + 2 * MINUTE);
        assert!(outcome.problems.iter().any(|p| p.starts_with("share-emptied")), "{outcome:?}");
        laptop.exchange(&folder, &key, NOW + 3 * MINUTE);
        assert!(laptop.read("config/config.toml").contains("language = \"fr\""));
        // Back before the wait: nothing happened.
        desk.write("config/config.toml", settings);
        assert_eq!(desk.exchange(&folder, &key, NOW + 4 * MINUTE).sent, 0);
        // A list emptied on purpose is taken out at once.
        desk.write("config/safe-senders.txt", "a@example.org\n");
        desk.exchange(&folder, &key, NOW + 5 * MINUTE);
        desk.write("config/safe-senders.txt", "");
        desk.exchange(&folder, &key, NOW + 6 * MINUTE);
        laptop.exchange(&folder, &key, NOW + 7 * MINUTE);
        assert!(!laptop.read("config/safe-senders.txt").contains("a@example.org"));
        let _ = std::fs::remove_dir_all(&base);
    }

    /// The file a server is sent at each change stays small (docs/database.md,
    /// "The log"): past `SEGMENT`, a round is continued in a new one, nothing
    /// restated; a full round only past `ROUND_SIZE` appended (or later while
    /// the connection is metered); old rounds go only before the last full
    /// one; a device joining late reads every entry from what is kept.
    #[test]
    fn a_change_sends_a_small_file_and_a_late_joiner_reads_everything() {
        let base = scratch("segments");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, laptop) = (Computer::new(&base, "desk"), Computer::new(&base, "laptop"));
        // A desk holding much: three thousand senders, its opening far past a segment.
        let many: String = (0..3000).map(|n| format!("sender{n}@example.org\n")).collect();
        desk.write("config/known-senders.txt", &many);
        desk.exchange(&folder, &key, NOW);
        laptop.exchange(&folder, &key, NOW + 30_000);
        let current = |c: &Computer| {
            let all = rounds(&folder);
            let last = *all.get(&c.id).unwrap().last().unwrap();
            std::fs::metadata(round_file(&folder, &c.id, last)).unwrap().len()
        };
        assert!(current(&desk) > SEGMENT, "the first file holds it all");
        // A sender a minute for an hour: each change goes into a small file.
        let mut list = many.clone();
        for minute in 1..=60 {
            list.push_str(&format!("new{minute}@example.org\n"));
            desk.write("config/known-senders.txt", &list);
            desk.exchange(&folder, &key, NOW + minute * MINUTE);
            assert!(current(&desk) <= SEGMENT + 4096, "minute {minute}: the file sent is {} bytes", current(&desk));
            laptop.exchange(&folder, &key, NOW + minute * MINUTE + 30_000);
        }
        assert!(laptop.read("config/known-senders.txt").contains("new60@example.org"));
        // Past a megabyte appended: a full round, then the rounds before it go once the laptop read past them.
        let more: String = (0..8000).map(|n| format!("later{n}@example.org\n")).collect();
        list.push_str(&more);
        desk.write("config/known-senders.txt", &list);
        desk.exchange(&folder, &key, NOW + 61 * MINUTE);
        let full = Memory::load(&desk.memory, &desk.id).full_round;
        assert!(full > 1, "a full round opened");
        for minute in 62..66 {
            laptop.exchange(&folder, &key, NOW + minute * MINUTE + 30_000);
            list.push_str(&format!("after{minute}@example.org\n"));
            desk.write("config/known-senders.txt", &list);
            desk.exchange(&folder, &key, NOW + minute * MINUTE);
        }
        let kept = rounds(&folder).get(&desk.id).cloned().unwrap();
        assert!(kept[0] >= full && kept.len() > 1, "only the last full round and those continuing it: {kept:?} (full {full})");
        // A device joining now reads everything from what is kept.
        let late = Computer::new(&base, "late");
        late.exchange(&folder, &key, NOW + 70 * MINUTE);
        let known = late.read("config/known-senders.txt");
        for address in ["sender0@", "sender2999@", "new1@", "new60@", "later7999@", "after65@"] {
            assert!(known.contains(address), "{address} missing for the late joiner");
        }
        let _ = std::fs::remove_dir_all(&base);
    }

    /// While the connection is metered or slow, a full round waits, within
    /// `FRUGAL_ROUND_SIZE`; then it opens all the same.
    #[test]
    fn a_full_round_waits_while_the_connection_is_metered() {
        let base = scratch("frugal");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let desk = Computer::new(&base, "desk");
        let memory_full = || Memory::load(&desk.memory, &desk.id).full_round;
        let lines = |from: usize, count: usize| -> String { (from..from + count).map(|n| format!("s{n}@example.org\n")).collect() };
        set_frugal(&desk.memory, true);
        let mut list = lines(0, 6000);
        desk.write("config/known-senders.txt", &list);
        desk.exchange(&folder, &key, NOW);
        list.push_str(&lines(6000, 7000));
        desk.write("config/known-senders.txt", &list);
        desk.exchange(&folder, &key, NOW + MINUTE);
        let waited = memory_full();
        assert!(Memory::load(&desk.memory, &desk.id).grown > ROUND_SIZE && waited <= 1, "past a megabyte, metered: no full round yet ({waited})");
        set_frugal(&desk.memory, false);
        list.push_str(&lines(13000, 10));
        desk.write("config/known-senders.txt", &list);
        desk.exchange(&folder, &key, NOW + 2 * MINUTE);
        assert!(memory_full() > 1, "not metered any more: the full round opens");
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn a_big_round_does_not_start_another_each_minute() {
        let base = scratch("big");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let desk = Computer::new(&base, "desk");
        desk.write("data/drafts/big.toml", &format!("body = \"{}\"\n", "x".repeat(ROUND_SIZE as usize + 1000)));
        desk.exchange(&folder, &key, NOW);
        desk.write("config/safe-senders.txt", "a@example.org\n");
        desk.exchange(&folder, &key, NOW + MINUTE);
        let rounds_then = rounds(&folder).get(&desk.id).map_or(0, |r| *r.last().unwrap());
        for minute in 2..6 {
            desk.write("config/safe-senders.txt", &format!("a@example.org\nn{minute}@example.org\n"));
            desk.exchange(&folder, &key, NOW + minute * MINUTE);
        }
        assert_eq!(rounds(&folder).get(&desk.id).map_or(0, |r| *r.last().unwrap()), rounds_then, "small changes after a big round stay in it");
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn a_half_written_line_is_cut_before_the_next() {
        let base = scratch("half");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, laptop) = (Computer::new(&base, "desk"), Computer::new(&base, "laptop"));
        desk.write("config/safe-senders.txt", "a@example.org\n");
        desk.exchange(&folder, &key, NOW);
        let own = round_file(&folder, &desk.id, 1);
        let mut text = std::fs::read_to_string(&own).unwrap();
        text.push_str("{\"n\":99,\"c\":1,\"s\":\"half");
        std::fs::write(&own, text).unwrap();
        desk.write("config/safe-senders.txt", "a@example.org\nb@example.org\n");
        desk.exchange(&folder, &key, NOW + MINUTE);
        assert!(std::fs::read_to_string(&own).unwrap().lines().all(|l| l.ends_with('}')), "whole lines only");
        laptop.exchange(&folder, &key, NOW + 2 * MINUTE);
        assert!(laptop.read("config/safe-senders.txt").contains("b@example.org"));
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn the_days_reviews_travel_whole() {
        use sioul_core::reviews::{Felt, Mix, Reviews};
        let base = scratch("reviews");
        let folder = base.join("Nextcloud").join("sioul-shared");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let at = |ms: i64| std::time::UNIX_EPOCH + std::time::Duration::from_millis(ms as u64);
        let month = "data/reviews/2026-10.toml";
        // The morning's weather and the end of work, on the desk.
        desk.write(month, "[2026-10-06]\nweather = \"haze\"\n\n[2026-10-06.work]\nat = \"2026-10-06T17:04:00+02:00\"\nfelt = \"heavy\"\nmix = \"too_much\"\n");
        dated(&desk.path(month), at(NOW - 10 * MINUTE));
        desk.exchange(&folder, &key, NOW);
        phone.exchange(&folder, &key, NOW + MINUTE);
        assert!(phone.read(month).contains("felt = \"heavy\""));
        // The same work review answered again on both: its feeling on the desk,
        // then its mix on the phone, with the night.
        desk.write(month, &desk.read(month).replace("felt = \"heavy\"", "felt = \"usual\""));
        dated(&desk.path(month), at(NOW + 90_000));
        phone.write(month, &format!("{}\n[2026-10-06.night]\nat = \"2026-10-06T22:10:00+02:00\"\nmix = \"about_right\"\nmemo = \"\"\"\nA walk.\n\"\"\"\n", phone.read(month).replace("mix = \"too_much\"", "mix = \"about_right\"")));
        dated(&phone.path(month), at(NOW + 100_000));
        phone.exchange(&folder, &key, NOW + 2 * MINUTE);
        desk.exchange(&folder, &key, NOW + 3 * MINUTE);
        phone.exchange(&folder, &key, NOW + 4 * MINUTE);
        for computer in [&desk, &phone] {
            let text = computer.read(month);
            let reviews = Reviews::load(&computer.path("data/reviews"));
            let day = reviews.day("2026-10-06".parse().unwrap()).unwrap();
            assert_eq!(day.weather, Some(sioul_core::today::Weather::Haze), "{text}");
            // The later answer whole: never the desk's feeling with the phone's mix.
            assert_eq!(day.work.as_ref().map(|r| (r.felt, r.mix)), Some((Some(Felt::Heavy), Some(Mix::AboutRight))), "{text}");
            assert_eq!(day.night.as_ref().map(|r| (r.mix, r.memo.trim().to_string())), Some((Some(Mix::AboutRight), "A walk.".to_string())), "{text}");
        }
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn two_computers_agree() {
        let base = scratch("agree");
        let folder = base.join("Nextcloud").join("sioul-shared");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, laptop) = (Computer::new(&base, "desk"), Computer::new(&base, "laptop"));

        // The desk shares first: its settings, its lists, a draft, a session.
        desk.write("config/config.toml", "language = \"fr\"\ncase_store = \"~/Notes\"\n\n[tasks]\nkind = \"plan\"\n\n[[account]]\nid = \"perso\"\nkind = \"imap\"\nmaildir = \"/desk/mail\"\n");
        desk.write("config/blocked-senders.txt", "spam@example.org\n");
        desk.write("data/drafts/a1.toml", "subject = \"Hello\"\n");
        desk.write("data/time/2026-10.toml", "[[session]]\ntask = \"t1\"\nstart = 100\nminutes = 25\n");
        assert_eq!(desk.exchange(&folder, &key, NOW).received, 0);

        // The laptop joins with its own: its notes folder stays, its blocked sender joins the desk's.
        laptop.write("config/config.toml", "language = \"en\"\ncase_store = \"~/Nextcloud/Notes\"\n");
        laptop.write("config/blocked-senders.txt", "*@pushy.example.com\n");
        let outcome = laptop.exchange(&folder, &key, NOW + MINUTE);
        assert!(outcome.received > 0 && outcome.sent > 0, "{outcome:?}");
        let config = laptop.read("config/config.toml");
        assert!(config.contains("language = \"fr\""), "the shared settings win when joining: {config}");
        assert!(config.contains("case_store = \"~/Nextcloud/Notes\""), "where things are stays here: {config}");
        assert!(config.contains("id = \"perso\"") && !config.contains("/desk/mail"), "accounts come, without this computer's paths: {config}");
        assert_eq!(laptop.read("data/drafts/a1.toml"), "subject = \"Hello\"\n");
        assert!(laptop.read("data/time/2026-10.toml").contains("task = \"t1\""));
        let blocked = laptop.read("config/blocked-senders.txt");
        assert!(blocked.contains("spam@example.org") && blocked.contains("*@pushy.example.com"), "{blocked}");

        // The desk hears the laptop's sender.
        desk.exchange(&folder, &key, NOW + 2 * MINUTE);
        assert!(desk.read("config/blocked-senders.txt").contains("*@pushy.example.com"));

        // Both work apart: a session each in the same month, a setting each, a draft sent on the laptop.
        desk.write("data/time/2026-10.toml", "[[session]]\ntask = \"t1\"\nstart = 100\nminutes = 25\n\n[[session]]\ntask = \"t2\"\nstart = 200\nminutes = 50\n");
        desk.write("config/config.toml", &desk.read("config/config.toml").replace("kind = \"plan\"", "kind = \"list\""));
        laptop.write("data/time/2026-10.toml", &format!("{}\n[[session]]\nproject = \"p\"\nstart = 300\nminutes = 10\n", laptop.read("data/time/2026-10.toml")));
        let config = laptop.read("config/config.toml").replace("language = \"fr\"", "language = \"de\"");
        laptop.write("config/config.toml", &config);
        std::fs::remove_file(laptop.path("data/drafts/a1.toml")).unwrap();
        desk.exchange(&folder, &key, NOW + 3 * MINUTE);
        laptop.exchange(&folder, &key, NOW + 4 * MINUTE);
        desk.exchange(&folder, &key, NOW + 5 * MINUTE);
        for computer in [&desk, &laptop] {
            let time = computer.read("data/time/2026-10.toml");
            assert!(time.contains("\"t1\"") && time.contains("\"t2\"") && time.contains("project = \"p\""), "{time}");
            let config = computer.read("config/config.toml");
            assert!(config.contains("language = \"de\"") && config.contains("kind = \"list\""), "{config}");
            assert!(!computer.path("data/drafts/a1.toml").exists(), "a draft sent on one is gone on both");
        }
        assert!(desk.read("config/config.toml").contains("maildir = \"/desk/mail\""), "the desk keeps its own path");

        // Nothing changed: nothing goes out.
        assert_eq!(desk.exchange(&folder, &key, NOW + 6 * MINUTE).sent, 0);
        assert_eq!(laptop.exchange(&folder, &key, NOW + 7 * MINUTE).sent, 0);
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn projects_and_budgets_travel_when_asked() {
        let base = scratch("projects");
        let folder = base.join("Nextcloud").join("Documents").join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let (desk_notes, phone_notes) = (base.join("desk-notes"), base.join("phone-notes"));
        let projects = |notes: &Path| std::fs::read_to_string(sioul_core::projects::file_in(notes)).unwrap_or_default();
        let ledger = |notes: &Path| std::fs::read_to_string(notes.join("sioul-budgets.toml")).unwrap_or_default();
        let bank = |notes: &Path| std::fs::read_to_string(notes.join("sioul-bank.toml")).unwrap_or_default();
        let movement = |id: &str, label: &str| format!("\n[[movement]]\naccount = \"main\"\ndate = 2026-10-01\namount = -20.0\nlabel = \"{label}\"\nid = \"{id}\"\n");
        std::fs::create_dir_all(&desk_notes).unwrap();
        std::fs::write(desk_notes.join("sioul-cases.toml"), "[[case]]\nid = \"acme\"\ntitle = \"Acme site\"\nstatus = \"open\"\n\n[[case.route]]\nfrom_domains = [\"acme.example\"]\n").unwrap();
        std::fs::write(desk_notes.join("sioul-budgets.toml"), "[[budget]]\nid = \"home\"\ntitle = \"Home\"\n\n[[line]]\nbudget = \"home\"\ndate = \"2026-10-01\"\namount = -620.0\nlabel = \"Rent\"\n").unwrap();
        std::fs::write(desk_notes.join("sioul-bank.toml"), format!("[[account]]\nid = \"main\"\ntitle = \"Main\"\nbalance = 1200.0\nas_of = 2026-10-01\n{}", movement("fitid-1", "Rent"))).unwrap();
        desk.exchange_notes(&folder, &key, NOW, &desk_notes);

        // The phone, with a notes folder of its own: the project, the budget and the bank come.
        phone.exchange_notes(&folder, &key, NOW + MINUTE, &phone_notes);
        assert!(projects(&phone_notes).contains("id = \"acme\"") && projects(&phone_notes).contains("acme.example"), "{}", projects(&phone_notes));
        assert!(ledger(&phone_notes).contains("Rent"), "{}", ledger(&phone_notes));
        assert!(bank(&phone_notes).contains("fitid-1") && bank(&phone_notes).contains("1200"), "{}", bank(&phone_notes));
        // The phone had no projects' file: it makes one of the new name, the desk keeps its own.
        assert!(phone_notes.join(sioul_core::projects::FILE).exists() && projects(&phone_notes).contains("[[project]]") && !projects(&phone_notes).contains("[[case"), "{}", projects(&phone_notes));
        assert!(projects(&desk_notes).contains("[[case]]") && !desk_notes.join(sioul_core::projects::FILE).exists());

        // A line each, apart: both kept on both.
        std::fs::write(desk_notes.join("sioul-budgets.toml"), format!("{}\n[[line]]\nbudget = \"home\"\ndate = \"2026-10-02\"\namount = -12.5\nlabel = \"Bread\"\n", ledger(&desk_notes))).unwrap();
        std::fs::write(phone_notes.join("sioul-budgets.toml"), format!("{}\n[[line]]\nbudget = \"home\"\ndate = \"2026-10-02\"\namount = -3.2\nlabel = \"Coffee\"\n", ledger(&phone_notes))).unwrap();
        // An export taken in on each: both movements on both.
        std::fs::write(desk_notes.join("sioul-bank.toml"), format!("{}{}", bank(&desk_notes), movement("fitid-2", "Bread"))).unwrap();
        std::fs::write(phone_notes.join("sioul-bank.toml"), format!("{}{}", bank(&phone_notes), movement("fitid-3", "Coffee"))).unwrap();
        desk.exchange_notes(&folder, &key, NOW + 2 * MINUTE, &desk_notes);
        phone.exchange_notes(&folder, &key, NOW + 3 * MINUTE, &phone_notes);
        desk.exchange_notes(&folder, &key, NOW + 4 * MINUTE, &desk_notes);
        for notes in [&desk_notes, &phone_notes] {
            let text = ledger(notes);
            assert!(text.contains("Rent") && text.contains("Bread") && text.contains("Coffee"), "{text}");
            let mut ids: Vec<String> = sioul_core::bank::Bank::load(notes).unwrap().movements.into_iter().map(|m| m.id).collect();
            ids.sort();
            assert_eq!(ids, ["fitid-1", "fitid-2", "fitid-3"], "{}", bank(notes));
        }

        // Each file keeps its names: a project made on the phone reaches the desk's
        // `[[case]]`, as an older Sioul reads it; renamed on the desk, the file
        // still exchanges under the same records, both ways.
        use sioul_core::projects::{ProjectEdit, ProjectStore, file_in, rename_file, save_project, set_ai};
        save_project(&file_in(&phone_notes), "", &ProjectEdit { title: "Garden".into(), ..ProjectEdit::default() }).unwrap();
        phone.exchange_notes(&folder, &key, NOW + 5 * MINUTE, &phone_notes);
        desk.exchange_notes(&folder, &key, NOW + 6 * MINUTE, &desk_notes);
        assert!(projects(&desk_notes).matches("[[case]]").count() == 2 && !projects(&desk_notes).contains("[[project"), "{}", projects(&desk_notes));
        // Added after a project with a route: each route stays under its own project.
        let desk_store = ProjectStore::load(&desk_notes).unwrap();
        assert!(desk_store.get("acme").unwrap().routes.len() == 1 && desk_store.get("garden").unwrap().routes.is_empty(), "{}", projects(&desk_notes));
        rename_file(&desk_notes).unwrap();
        set_ai(&file_in(&desk_notes), "acme", true).unwrap();
        desk.exchange_notes(&folder, &key, NOW + 7 * MINUTE, &desk_notes);
        phone.exchange_notes(&folder, &key, NOW + 8 * MINUTE, &phone_notes);
        desk.exchange_notes(&folder, &key, NOW + 9 * MINUTE, &desk_notes);
        for notes in [&desk_notes, &phone_notes] {
            let store = ProjectStore::load(notes).unwrap();
            let mut ids: Vec<&str> = store.projects.iter().map(|p| p.id.as_str()).collect();
            ids.sort();
            assert_eq!(ids, ["acme", "garden"], "{}", projects(notes));
            assert!(store.get("acme").unwrap().ai && store.get("acme").unwrap().routes.len() == 1 && store.get("garden").unwrap().routes.is_empty(), "{}", projects(notes));
            assert!(!projects(notes).contains("[[case"), "{}", projects(notes));
        }
        assert!(desk_notes.join(sioul_core::projects::BEFORE_RENAME).exists());

        // Without the choice, a notes folder stays home.
        let laptop = Computer::new(&base, "laptop");
        // A literal string: a Windows path's backslashes are no escapes.
        laptop.write("config/config.toml", &format!("case_store = '{}'\n", base.join("laptop-notes").display()));
        let config: Config = toml::from_str(&laptop.read("config/config.toml")).unwrap();
        assert!(stores(&config, &laptop.roots).iter().all(|s| !s.name.starts_with("notes/")));
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn what_was_read_is_known_and_a_lost_record_comes_back() {
        let base = scratch("doses");
        let folder = base.join("shared");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        desk.write("state/health-state.toml", "[taken]\n\"d@100\" = 110\n");
        desk.exchange(&folder, &key, NOW);
        phone.exchange(&folder, &key, NOW + MINUTE);
        assert!(phone.read("state/health-state.toml").contains("d@100"));
        // What the desk wrote, the phone read: as far as the desk's claim would say.
        let wrote = written(&desk.memory, &desk.id).unwrap();
        assert!(wrote.1 > 0);
        let read = heard(&phone.memory, &phone.id);
        assert!(read.complete(&desk.id, wrote));
        assert!(!read.complete(&desk.id, (wrote.0, wrote.1 + 1)), "a record not read yet is not known");
        assert!(read.complete("someone", (1, 0)), "nothing written, nothing to read");

        // A line of the desk's that does not read is said, never passed over; what follows is still read.
        desk.write("state/health-state.toml", "[taken]\n\"d@100\" = 110\n\"d@200\" = 210\n");
        desk.exchange(&folder, &key, NOW + 2 * MINUTE);
        let round = round_file(&folder, &desk.id, wrote.0);
        let mut text = std::fs::read_to_string(&round).unwrap();
        let last = text.trim_end().rfind('\n').map_or(0, |i| i + 1);
        text.insert_str(last, "{broken\n");
        std::fs::write(&round, text).unwrap();
        let outcome = phone.exchange(&folder, &key, NOW + 3 * MINUTE);
        assert!(outcome.problems.iter().any(|p| p == &format!("share-other-line:{}", desk.id)), "{:?}", outcome.problems);
        assert!(heard(&phone.memory, &phone.id).broken.contains_key(&desk.id));
        assert!(phone.read("state/health-state.toml").contains("d@200"), "the next line came");

        // The phone's record is lost: set aside, started again empty, rebuilt from the records.
        phone.write("state/health-state.toml", &format!("{}\"d@300\" = 310\n", phone.read("state/health-state.toml")));
        phone.exchange(&folder, &key, NOW + 4 * MINUTE);
        assert!(desk.exchange(&folder, &key, NOW + 5 * MINUTE).received > 0);
        assert!(desk.read("state/health-state.toml").contains("d@300"));
        std::fs::remove_file(phone.path("state/health-state.toml")).unwrap();
        rebuild(&phone.memory, &phone.id, &["state/health-state.toml"]).unwrap();
        // A dose marked meanwhile, in a new record holding only it.
        phone.write("state/health-state.toml", "[taken]\n\"d@400\" = 410\n");
        phone.exchange(&folder, &key, NOW + 6 * MINUTE);
        let back = phone.read("state/health-state.toml");
        assert!(back.contains("d@100") && back.contains("d@200") && back.contains("d@300") && back.contains("d@400"), "{back}");
        // Nothing taken out on the desk: every mark is still there, the new one too.
        desk.exchange(&folder, &key, NOW + 7 * MINUTE);
        let there = desk.read("state/health-state.toml");
        assert!(there.contains("d@100") && there.contains("d@200") && there.contains("d@300") && there.contains("d@400"), "{there}");
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn the_later_word_wins() {
        let base = scratch("later");
        let folder = base.join("shared");
        let key = quick_key(&folder, "a passphrase of some length").unwrap();
        let (a, b) = (Computer::new(&base, "a"), Computer::new(&base, "b"));
        a.write("config/safe-senders.txt", "friend@example.org\n");
        a.exchange(&folder, &key, NOW);
        b.exchange(&folder, &key, NOW + MINUTE);
        assert!(b.read("config/safe-senders.txt").contains("friend@example.org"));

        // Safe on one, then blocked later on the other: blocked everywhere, and safe nowhere.
        b.write("config/safe-senders.txt", "");
        b.write("config/blocked-senders.txt", "friend@example.org\n");
        b.exchange(&folder, &key, NOW + 2 * MINUTE);
        a.exchange(&folder, &key, NOW + 3 * MINUTE);
        assert!(!a.read("config/safe-senders.txt").contains("friend@example.org"));
        assert!(a.read("config/blocked-senders.txt").contains("friend@example.org"));

        // A list that cannot be read is left alone, and nothing of it is taken out elsewhere.
        a.write("state/quiet.toml", "work_until = 5\n");
        let sent = a.exchange(&folder, &key, NOW + 4 * MINUTE);
        let received = b.exchange(&folder, &key, NOW + 5 * MINUTE);
        assert!(b.read("state/quiet.toml").contains("work_until = 5"), "{sent:?} {received:?}");
        b.write("state/quiet.toml", "work_until = [ broken");
        b.exchange(&folder, &key, NOW + 6 * MINUTE);
        a.exchange(&folder, &key, NOW + 7 * MINUTE);
        assert!(a.read("state/quiet.toml").contains("work_until = 5"));
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn sealed_with_one_passphrase() {
        let base = scratch("seal");
        let folder = base.join("shared");
        let key = quick_key(&folder, "the right passphrase").unwrap();
        assert_eq!(quick_key(&folder, "the right passphrase"), Ok(key));
        assert_eq!(quick_key(&folder, "another passphrase"), Err(Refused::WrongPassphrase));

        // What travels says nothing of what it holds.
        let a = Computer::new(&base, "a");
        a.write("config/safe-senders.txt", "friend@example.org\n");
        a.exchange(&folder, &key, NOW);
        let file = std::fs::read_to_string(round_file(&folder, &a.id, 1)).unwrap();
        assert!(!file.contains("friend") && !file.contains("safe-senders"), "{file}");
        assert_eq!(others(&folder, "someone else").len(), 1);
        // A seal asking more than this computer can give is refused before it is tried.
        let text = std::fs::read_to_string(folder.join("seal.toml")).unwrap();
        std::fs::write(folder.join("seal.toml"), text.replace("memory_kib = 64", "memory_kib = 4294967295")).unwrap();
        assert!(matches!(quick_key(&folder, "the right passphrase"), Err(Refused::Other(_))));
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn records_stay_in_their_folders() {
        let roots = Roots { config: PathBuf::from("config"), data: PathBuf::from("data"), state: PathBuf::from("state") };
        let stores = stores(&Config::default(), &roots);
        assert!(locate(&stores, "data/drafts/a1.toml").is_some());
        for file in ["data/drafts/../x", "data/drafts/", "data/drafts//x", "data/drafts/a\\..\\..\\x", "data/drafts/C:x"] {
            assert!(locate(&stores, file).is_none(), "{file}");
        }
    }

    #[test]
    fn rounds_start_over_and_old_ones_go() {
        let base = scratch("rounds");
        let folder = base.join("shared");
        let key = quick_key(&folder, "a passphrase of some length").unwrap();
        let (a, b) = (Computer::new(&base, "a"), Computer::new(&base, "b"));
        a.write("config/safe-senders.txt", "friend@example.org\n");
        a.exchange(&folder, &key, NOW);
        b.exchange(&folder, &key, NOW + MINUTE);
        // A large file, changed until a full round opens (a megabyte appended), the rounds before it continued in between.
        let mut now = NOW + MINUTE;
        while Memory::load(&a.memory, &a.id).full_round <= 1 {
            now += MINUTE;
            a.write("data/drafts/2026-10-01.json", &format!("{{\"steps\": {now}, \"pad\": \"{}\"}}", "x".repeat(100_000)));
            a.exchange(&folder, &key, now);
        }
        assert!(round_file(&folder, &a.id, 1).exists(), "kept until b has read past it");
        // b reads past round 1.
        b.exchange(&folder, &key, now + MINUTE);
        assert!(b.read("data/drafts/2026-10-01.json").contains(&format!("\"steps\": {now}")));
        a.exchange(&folder, &key, now + 2 * MINUTE);
        assert!(!round_file(&folder, &a.id, 1).exists(), "read by everyone: removed");
        // A third computer joins later: round 2 alone holds the day.
        let c = Computer::new(&base, "c");
        c.exchange(&folder, &key, now + 3 * MINUTE);
        assert!(c.read("data/drafts/2026-10-01.json").contains(&format!("\"steps\": {now}")));
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn notes_travel_file_by_file_whatever_carries_them() {
        for how in [Carrying::Exact, Carrying::SizeOnly, Carrying::Late, Carrying::StaleCopies, Carrying::Placeholders] {
            let base = scratch(&format!("notes-{how:?}").to_lowercase());
            let (server, phone_folder) = (base.join("server").join("Sioul"), base.join("phone").join("Sioul"));
            let key = quick_key(&server, "four words make a passphrase").unwrap();
            let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
            let (desk_notes, phone_notes) = (base.join("desk-notes"), base.join("phone-notes"));
            put(&desk_notes, "lease.md", b"# Lease\nSigned on 2 October.\n");
            put(&desk_notes, "admin/taxes.md", b"# Taxes\nNotice received.\n");
            put(&desk_notes, "admin/scan.pdf", &noise(1_500_000, 1));
            // Made by tools, or carried by another part: they stay.
            for name in ["lease.md~", ".lease.md.swp", "lease (conflicted copy 2026-10-05 140533).md", "taxes.sync-conflict-20261005-140533-ABCDEFG.md", "~$letter.docx", "sioul-cases.toml", "sioul-projects.toml", "sioul-cases.toml.before-rename", "papers/passport.pdf"] {
                put(&desk_notes, name, b"stays home");
            }
            let mut carrier = Carrier::new(how);
            let run = |carrier: &mut Carrier, minutes: std::ops::Range<i64>| {
                for minute in minutes {
                    let now = NOW + minute * MINUTE;
                    desk.exchange_with(&server, &key, now, &desk_notes, &["notes"]);
                    carrier.carry(&server, &phone_folder);
                    phone.exchange_with(&phone_folder, &key, now + 30_000, &phone_notes, &["notes"]);
                }
            };
            run(&mut carrier, 0..20);
            let there = files_in(&phone_notes);
            assert_eq!(there.keys().map(String::as_str).collect::<Vec<_>>(), ["admin/scan.pdf", "admin/taxes.md", "lease.md"], "{how:?}");
            assert!(there["admin/scan.pdf"] == noise(1_500_000, 1), "{how:?}: the scan came whole");
            // The phone changes a note and writes another; the desk takes one out.
            put(&phone_notes, "lease.md", b"# Lease\nSigned on 2 October.\nKeys: two.\n");
            put(&phone_notes, "new.md", b"# New\n");
            std::fs::remove_file(desk_notes.join("admin/taxes.md")).unwrap();
            run(&mut carrier, 20..40);
            for notes in [&desk_notes, &phone_notes] {
                let files = files_in(notes);
                assert!(!files.contains_key("admin/taxes.md"), "{how:?}: {}", notes.display());
                assert_eq!(files.get("lease.md").map(Vec::as_slice), Some(&b"# Lease\nSigned on 2 October.\nKeys: two.\n"[..]), "{how:?}: {}", notes.display());
                assert_eq!(files.get("new.md").map(Vec::as_slice), Some(&b"# New\n"[..]), "{how:?}: {}", notes.display());
                assert!(copies_of(notes, "lease").is_empty(), "{how:?}: no conflict where there was none");
            }
            // Each content sealed once, apart; nothing of the notes readable in the folder.
            let sealed = std::fs::read_dir(server.join("blobs")).unwrap().filter_map(Result::ok).filter(|e| !e.file_name().to_string_lossy().starts_with('.')).count();
            assert_eq!(sealed, 5, "{how:?}: the lease twice, the taxes, the scan, the new note");
            let mut everything = Vec::new();
            list_files(&server, &server, &[], &mut everything);
            for (_, path) in everything {
                let bytes = std::fs::read(&path).unwrap();
                for secret in [&b"Signed on"[..], b"Taxes", b"Keys: two", b"stays home", b"lease.md"] {
                    assert!(!bytes.windows(secret.len()).any(|w| w == secret), "{how:?}: {} shows {}", path.display(), String::from_utf8_lossy(secret));
                }
            }
            let _ = std::fs::remove_dir_all(&base);
        }
    }

    #[test]
    fn a_note_changed_on_both_keeps_both_whatever_carries_them() {
        for how in [Carrying::Exact, Carrying::SizeOnly, Carrying::Late, Carrying::StaleCopies, Carrying::Placeholders] {
            let base = scratch(&format!("notes-both-{how:?}").to_lowercase());
            let (server, phone_folder) = (base.join("server").join("Sioul"), base.join("phone").join("Sioul"));
            let key = quick_key(&server, "four words make a passphrase").unwrap();
            let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
            let (desk_notes, phone_notes) = (base.join("desk-notes"), base.join("phone-notes"));
            put(&desk_notes, "lease.md", b"Rent: 620\n");
            put(&desk_notes, "taxes.md", b"Notice received.\n");
            let mut carrier = Carrier::new(how);
            let run = |carrier: &mut Carrier, minutes: std::ops::Range<i64>| {
                for minute in minutes {
                    let now = NOW + minute * MINUTE;
                    desk.exchange_with(&server, &key, now, &desk_notes, &["notes"]);
                    carrier.carry(&server, &phone_folder);
                    phone.exchange_with(&phone_folder, &key, now + 30_000, &phone_notes, &["notes"]);
                }
            };
            run(&mut carrier, 0..10);
            assert_eq!(files_in(&phone_notes).len(), 2, "{how:?}");
            // In the same minute: the lease changed on both; the taxes taken out on the desk, changed on the phone.
            put(&desk_notes, "lease.md", b"Rent: 640\n");
            put(&phone_notes, "lease.md", b"Rent: 620\nKeys: two\n");
            std::fs::remove_file(desk_notes.join("taxes.md")).unwrap();
            put(&phone_notes, "taxes.md", b"Notice received.\nPaid on 3 October.\n");
            run(&mut carrier, 10..40);
            for notes in [&desk_notes, &phone_notes] {
                let files = files_in(notes);
                assert_eq!(files.get("lease.md").map(Vec::as_slice), Some(&b"Rent: 620\nKeys: two\n"[..]), "{how:?}: {}", notes.display());
                assert_eq!(copies_of(notes, "lease"), [b"Rent: 640\n".to_vec()], "{how:?}: {}: {:?}", notes.display(), files.keys().collect::<Vec<_>>());
                assert_eq!(files.get("taxes.md").map(Vec::as_slice), Some(&b"Notice received.\nPaid on 3 October.\n"[..]), "{how:?}: {}", notes.display());
                assert_eq!(files.len(), 3, "{how:?}: {}: {:?}", notes.display(), files.keys().collect::<Vec<_>>());
            }
            let _ = std::fs::remove_dir_all(&base);
        }
    }

    #[test]
    fn a_big_folder_sends_only_what_changed() {
        let base = scratch("big-folder");
        let notes = base.join("notes");
        // Shared through a folder inside the notes folder, as Sioul may suggest: not carried as notes.
        let folder = notes.join("sioul-shared");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let desk = Computer::new(&base, "desk");
        for n in 0..300 {
            put(&notes, &format!("days/{n:03}.md"), format!("# Day {n}\n").as_bytes());
        }
        for n in 0..3 {
            put(&notes, &format!("scans/{n}.pdf"), &noise(1_500_000, n));
        }
        // Read after they changed, not in the same millisecond (such a file is read again, its time too coarse to trust).
        std::thread::sleep(std::time::Duration::from_millis(5));
        let blobs = || std::fs::read_dir(folder.join("blobs")).unwrap().count();
        assert_eq!(desk.exchange_with(&folder, &key, NOW, &notes, &["notes"]).sent, 303);
        assert_eq!(blobs(), 303);
        // Nothing changed: no file read again, nothing sent.
        crate::blobs::HASHED.with(|n| n.set(0));
        assert_eq!(desk.exchange_with(&folder, &key, NOW + MINUTE, &notes, &["notes"]).sent, 0);
        assert_eq!(crate::blobs::HASHED.with(std::cell::Cell::get), 0, "a file of the same size and time is not read");
        // One file touched (its time, not its content), one changed: both read, one sent, sealed alone.
        std::fs::File::options().write(true).open(notes.join("days/007.md")).unwrap().set_modified(std::time::SystemTime::now() - std::time::Duration::from_secs(60)).unwrap();
        put(&notes, "scans/1.pdf", &noise(1_500_000, 9));
        let outcome = desk.exchange_with(&folder, &key, NOW + 2 * MINUTE, &notes, &["notes"]);
        assert_eq!(outcome.sent, 1, "{outcome:?}");
        assert_eq!(crate::blobs::HASHED.with(std::cell::Cell::get), 2);
        assert_eq!(blobs(), 304);
        // Too big to travel: it stays, said; nothing else moves.
        std::fs::File::create(notes.join("scans/film.mp4")).unwrap().set_len(crate::blobs::LARGEST + 1).unwrap();
        let outcome = desk.exchange_with(&folder, &key, NOW + 3 * MINUTE, &notes, &["notes"]);
        assert!(outcome.problems.iter().any(|p| p == "share-too-big:files/notes/scans/film.mp4"), "{outcome:?}");
        assert_eq!(outcome.sent, 0);
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn a_note_changed_on_both_keeps_both() {
        for desk_later in [false, true] {
            let base = scratch(&format!("both-{desk_later}"));
            let folder = base.join("Sioul");
            let key = quick_key(&folder, "four words make a passphrase").unwrap();
            let (desk, laptop) = (Computer::new(&base, "desk"), Computer::new(&base, "laptop"));
            let (desk_notes, laptop_notes) = (base.join("desk-notes"), base.join("laptop-notes"));
            put(&desk_notes, "lease.md", b"Rent: 620\n");
            desk.exchange_with(&folder, &key, NOW, &desk_notes, &["notes"]);
            laptop.exchange_with(&folder, &key, NOW + MINUTE, &laptop_notes, &["notes"]);
            assert_eq!(std::fs::read(laptop_notes.join("lease.md")).unwrap(), b"Rent: 620\n");
            // Changed on both, apart; the one that exchanges later is the later word.
            put(&desk_notes, "lease.md", b"Rent: 640\n");
            put(&laptop_notes, "lease.md", b"Rent: 620\nKeys: two\n");
            let (first, second): (&Computer, &Computer) = if desk_later { (&laptop, &desk) } else { (&desk, &laptop) };
            let notes = |c: &Computer| if std::ptr::eq(c, &desk) { desk_notes.clone() } else { laptop_notes.clone() };
            let mut said = Vec::new();
            for minute in 2..10 {
                let (who, at) = if minute % 2 == 0 { (first, minute) } else { (second, minute) };
                said.extend(who.exchange_with(&folder, &key, NOW + at * MINUTE, &notes(who), &["notes"]).problems);
            }
            let (later, earlier): (&[u8], &[u8]) = if desk_later { (b"Rent: 640\n", b"Rent: 620\nKeys: two\n") } else { (b"Rent: 620\nKeys: two\n", b"Rent: 640\n") };
            for notes in [&desk_notes, &laptop_notes] {
                assert_eq!(std::fs::read(notes.join("lease.md")).unwrap(), later, "desk later: {desk_later}");
                assert_eq!(copies_of(notes, "lease"), [earlier.to_vec()], "desk later: {desk_later}: {:?}", files_in(notes).keys().collect::<Vec<_>>());
            }
            assert!(said.iter().any(|p| p.starts_with("share-conflict:lease (")), "{said:?}");
            // Settled: nothing more goes either way.
            assert_eq!(desk.exchange_with(&folder, &key, NOW + 10 * MINUTE, &desk_notes, &["notes"]).sent, 0);
            assert_eq!(laptop.exchange_with(&folder, &key, NOW + 11 * MINUTE, &laptop_notes, &["notes"]).sent, 0);
            let _ = std::fs::remove_dir_all(&base);
        }
    }

    #[test]
    fn a_part_switched_off_takes_nothing_out_and_sends_nothing() {
        let base = scratch("part-off");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let (desk_notes, phone_notes) = (base.join("desk-notes"), base.join("phone-notes"));
        for name in ["a", "b", "c", "d", "e", "f"] {
            put(&desk_notes, &format!("{name}.md"), format!("# {name}\n").as_bytes());
        }
        desk.exchange_with(&folder, &key, NOW, &desk_notes, &["notes"]);
        phone.exchange_with(&folder, &key, NOW + MINUTE, &phone_notes, &["notes"]);
        assert_eq!(files_in(&phone_notes).len(), 6);
        // Notes switched off on the phone, then changed there; the desk changes one meanwhile.
        phone.exchange_with(&folder, &key, NOW + 2 * MINUTE, &phone_notes, &[]);
        std::fs::remove_file(phone_notes.join("a.md")).unwrap();
        put(&phone_notes, "b.md", b"# b, changed on the phone while off\n");
        put(&phone_notes, "new.md", b"# new\n");
        put(&desk_notes, "c.md", b"# c, changed on the desk\n");
        desk.exchange_with(&folder, &key, NOW + 3 * MINUTE, &desk_notes, &["notes"]);
        assert_eq!(phone.exchange_with(&folder, &key, NOW + 4 * MINUTE, &phone_notes, &[]).sent, 0, "a part switched off sends nothing");
        desk.exchange_with(&folder, &key, NOW + 5 * MINUTE, &desk_notes, &["notes"]);
        let desk_files = files_in(&desk_notes);
        assert!(desk_files.contains_key("a.md") && desk_files["b.md"] == b"# b\n" && !desk_files.contains_key("new.md"), "nothing taken out, nothing came: {desk_files:?}");
        assert_eq!(std::fs::read(phone_notes.join("c.md")).unwrap(), b"# c\n", "nothing comes into a part switched off");
        // Switched on again: it joins as a new device. What the others hold comes
        // first, a note changed here meanwhile is kept beside, what only it holds goes.
        phone.exchange_with(&folder, &key, NOW + 6 * MINUTE, &phone_notes, &["notes"]);
        desk.exchange_with(&folder, &key, NOW + 7 * MINUTE, &desk_notes, &["notes"]);
        phone.exchange_with(&folder, &key, NOW + 8 * MINUTE, &phone_notes, &["notes"]);
        desk.exchange_with(&folder, &key, NOW + 9 * MINUTE, &desk_notes, &["notes"]);
        for notes in [&desk_notes, &phone_notes] {
            let files = files_in(notes);
            assert_eq!(files.get("a.md").map(Vec::as_slice), Some(&b"# a\n"[..]), "{}", notes.display());
            assert_eq!(files.get("b.md").map(Vec::as_slice), Some(&b"# b\n"[..]), "{}", notes.display());
            assert_eq!(files.get("c.md").map(Vec::as_slice), Some(&b"# c, changed on the desk\n"[..]), "{}", notes.display());
            assert_eq!(files.get("new.md").map(Vec::as_slice), Some(&b"# new\n"[..]), "{}", notes.display());
            assert_eq!(copies_of(notes, "b"), [b"# b, changed on the phone while off\n".to_vec()], "{}", notes.display());
        }
        let _ = std::fs::remove_dir_all(&base);
    }

    /// Item 8 of 9 October: on Unix, what the sharing writes is yours alone,
    /// as the calls' logs are: its files 0600, the folders it makes 0700 (the
    /// seal, the records, the sealed files, the notes and settings it brings
    /// in, the copies and versions it keeps). A file here already readable by
    /// others becomes yours alone the next time the sharing writes it; one it
    /// never writes keeps its mode: nothing sweeps your folders.
    #[cfg(unix)]
    #[test]
    fn what_the_sharing_writes_is_yours_alone() {
        use std::os::unix::fs::PermissionsExt;
        let mode = |path: &Path| std::fs::symlink_metadata(path).unwrap().permissions().mode() & 0o777;
        let set = |path: &Path, mode: u32| std::fs::set_permissions(path, std::fs::Permissions::from_mode(mode)).unwrap();
        let base = scratch("yours-alone");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, laptop) = (Computer::new(&base, "desk"), Computer::new(&base, "laptop"));
        let (desk_notes, laptop_notes) = (base.join("desk-notes"), base.join("laptop-notes"));
        put(&desk_notes, "admin/lease.md", b"Rent: 620\n");
        desk.write("config/config.toml", "language = \"fr\"\n");
        // The laptop's own files, as an editor leaves them (others may read
        // them): one the desk's version will replace, a setting the desk's
        // will join, and a note the sharing never writes here.
        put(&laptop_notes, "admin/lease.md", b"Rent: 600\n");
        put(&laptop_notes, "mine.md", b"Mine\n");
        laptop.write("config/config.toml", "theme = \"dark\"\n");
        for path in [laptop_notes.join("admin/lease.md"), laptop_notes.join("mine.md"), laptop.path("config/config.toml")] {
            set(&path, 0o644);
        }
        set(&laptop_notes.join("admin"), 0o755);
        // The laptop's lease from the day before: the desk's is the later word.
        std::fs::File::options().write(true).open(laptop_notes.join("admin/lease.md")).unwrap().set_modified(std::time::UNIX_EPOCH + std::time::Duration::from_millis((NOW - 24 * 60 * MINUTE) as u64)).unwrap();
        let mut now = NOW;
        for _ in 0..3 {
            now += MINUTE;
            desk.exchange_with(&folder, &key, now, &desk_notes, &["notes"]);
            now += MINUTE;
            laptop.exchange_with(&folder, &key, now, &laptop_notes, &["notes"]);
        }
        assert_eq!(std::fs::read(laptop_notes.join("admin/lease.md")).unwrap(), b"Rent: 620\n");
        assert!(laptop.read("config/config.toml").contains("language = \"fr\""), "{}", laptop.read("config/config.toml"));
        assert_eq!(copies_of(&laptop_notes.join("admin"), "lease").len(), 1, "the laptop's version kept beside");
        // Written by the sharing: yours alone, whatever they were.
        assert_eq!(mode(&laptop_notes.join("admin/lease.md")), 0o600);
        assert_eq!(mode(&laptop.path("config/config.toml")), 0o600);
        for (name, _) in files_in(&laptop_notes.join("admin")).into_iter().filter(|(n, _)| n.starts_with("lease (")) {
            assert_eq!(mode(&laptop_notes.join("admin").join(&name)), 0o600, "{name}");
        }
        assert_eq!(mode(&desk_notes.join("mine.md")), 0o600, "brought to the desk");
        // Never written here by the sharing: as they were.
        assert_eq!(mode(&laptop_notes.join("mine.md")), 0o644);
        assert_eq!(mode(&desk_notes.join("admin/lease.md")), 0o644);
        assert_eq!(mode(&laptop_notes.join("admin")), 0o755, "a folder there already keeps its mode");
        // Everything in the sharing folder, and the versions kept: files 0600, folders 0700.
        let history = crate::history::root(&laptop.memory);
        assert!(!crate::history::files(&history, "settings").is_empty(), "a version kept");
        for root in [folder.clone(), history.clone()] {
            let mut stack = vec![root];
            while let Some(dir) = stack.pop() {
                assert_eq!(mode(&dir), 0o700, "{}", dir.display());
                for entry in std::fs::read_dir(&dir).unwrap().map(Result::unwrap) {
                    let path = entry.path();
                    if path.is_dir() {
                        stack.push(path);
                    } else {
                        assert_eq!(mode(&path), 0o600, "{}", path.display());
                    }
                }
            }
        }
        // A record file from before this was so: yours alone at its next line.
        let rounds: Vec<PathBuf> = std::fs::read_dir(&folder).unwrap().map(|e| e.unwrap().path()).filter(|p| p.extension().is_some_and(|e| e == "jsonl") && p.to_string_lossy().contains(&desk.id)).collect();
        assert!(!rounds.is_empty(), "the desk's records");
        for round in &rounds {
            set(round, 0o644);
        }
        desk.write("config/config.toml", "language = \"en\"\n");
        desk.exchange_with(&folder, &key, now + MINUTE, &desk_notes, &["notes"]);
        let written: Vec<&PathBuf> = rounds.iter().filter(|r| mode(r) == 0o600).collect();
        assert_eq!(written.len(), 1, "the round written to, and it alone: {rounds:?}");
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn earlier_versions_are_kept_and_put_back() {
        let base = scratch("history");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, laptop) = (Computer::new(&base, "desk"), Computer::new(&base, "laptop"));
        let (desk_notes, laptop_notes) = (base.join("desk-notes"), base.join("laptop-notes"));
        let history = crate::history::root(&laptop.memory);
        let mut now = NOW;
        let both = |now: &mut i64| {
            *now += MINUTE;
            desk.exchange_with(&folder, &key, *now, &desk_notes, &["notes"]);
            *now += MINUTE;
            laptop.exchange_with(&folder, &key, *now, &laptop_notes, &["notes"])
        };
        // Three versions written on the desk, of one size and in one millisecond:
        // the laptop keeps the two it had before each came.
        desk.write("config/config.toml", "language = \"fr\"\n");
        for n in 1..=3 {
            put(&desk_notes, "lease.md", format!("version {n}\n").as_bytes());
            let at = std::time::UNIX_EPOCH + std::time::Duration::from_nanos(NOW as u64 * 1_000_000 + n * 100);
            std::fs::File::options().write(true).open(desk_notes.join("lease.md")).unwrap().set_modified(at).unwrap();
            both(&mut now);
        }
        desk.write("config/config.toml", "language = \"en\"\n");
        both(&mut now);
        assert_eq!(std::fs::read(laptop_notes.join("lease.md")).unwrap(), b"version 3\n");
        let kept = crate::history::versions(&history, "notes", "files/notes/lease.md");
        let texts: Vec<String> = kept.iter().map(|v| version_text(&history, "notes", "files/notes/lease.md", &v.stamp, &folder, &key)).collect();
        assert_eq!(texts, ["version 2\n", "version 1\n"], "the newest first");
        assert_eq!(crate::history::files(&history, "settings").iter().map(|(f, _)| f.as_str()).collect::<Vec<_>>(), ["config/config.toml"]);
        // Version 1 put back on the laptop: the one there now is kept too, and the next exchange sends it.
        let every = laptop.stores_with(&laptop_notes, &|_| true);
        put_back(&laptop.memory, Some((&folder, &key)), &every, "notes", "files/notes/lease.md", &kept[1].stamp, now).unwrap();
        assert_eq!(std::fs::read(laptop_notes.join("lease.md")).unwrap(), b"version 1\n");
        assert_eq!(crate::history::versions(&history, "notes", "files/notes/lease.md").len(), 3);
        // The setting as it was before the desk's last change, put back the same way.
        let setting = crate::history::versions(&history, "settings", "config/config.toml");
        put_back(&laptop.memory, Some((&folder, &key)), &every, "settings", "config/config.toml", &setting[0].stamp, now).unwrap();
        assert!(laptop.read("config/config.toml").contains("\"fr\""));
        // A file of one part is not put back as another's; nor a version never kept.
        assert!(put_back(&laptop.memory, Some((&folder, &key)), &every, "settings", "files/notes/lease.md", &kept[1].stamp, now).is_err());
        assert!(put_back(&laptop.memory, Some((&folder, &key)), &every, "notes", "files/notes/lease.md", "2020-01-01T00-00-00.000Z", now).is_err());
        now += MINUTE;
        assert!(laptop.exchange_with(&folder, &key, now, &laptop_notes, &["notes"]).sent >= 2);
        now += MINUTE;
        desk.exchange_with(&folder, &key, now, &desk_notes, &["notes"]);
        assert_eq!(std::fs::read(desk_notes.join("lease.md")).unwrap(), b"version 1\n", "put back on one, put back on all");
        assert!(copies_of(&desk_notes, "lease").is_empty(), "{:?}", files_in(&desk_notes).into_iter().map(|(n, b)| (n, String::from_utf8_lossy(&b).to_string())).collect::<Vec<_>>());
        assert!(desk.read("config/config.toml").contains("\"fr\""));
        // A note taken out on the desk (not its last: a folder emptied waits
        // for a word) goes on the laptop once gone a while, kept there, and can be put back.
        put(&desk_notes, "other.md", b"other\n");
        both(&mut now);
        std::fs::remove_file(desk_notes.join("lease.md")).unwrap();
        both(&mut now);
        assert!(laptop_notes.join("lease.md").exists(), "not before ten minutes");
        for _ in 0..6 {
            both(&mut now);
        }
        assert!(!laptop_notes.join("lease.md").exists());
        let kept = crate::history::versions(&history, "notes", "files/notes/lease.md");
        put_back(&laptop.memory, Some((&folder, &key)), &every, "notes", "files/notes/lease.md", &kept[0].stamp, now).unwrap();
        both(&mut now);
        both(&mut now);
        assert_eq!(std::fs::read(desk_notes.join("lease.md")).unwrap(), b"version 1\n");
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn a_damaged_blob_or_record_never_erases_the_file_here() {
        let base = scratch("damaged");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, laptop) = (Computer::new(&base, "desk"), Computer::new(&base, "laptop"));
        let (desk_notes, laptop_notes) = (base.join("desk-notes"), base.join("laptop-notes"));
        put(&desk_notes, "lease.md", b"version 1\n");
        desk.exchange_with(&folder, &key, NOW, &desk_notes, &["notes"]);
        laptop.exchange_with(&folder, &key, NOW + MINUTE, &laptop_notes, &["notes"]);
        // The next version's sealed file damaged on the way: said, the file here stays as it is.
        put(&desk_notes, "lease.md", b"version 2, longer\n");
        desk.exchange_with(&folder, &key, NOW + 2 * MINUTE, &desk_notes, &["notes"]);
        let sealed = crate::blobs::path(&folder, &key, &crate::blobs::hash_file(&desk_notes.join("lease.md")).unwrap().0);
        let mut bytes = std::fs::read(&sealed).unwrap();
        let middle = bytes.len() / 2;
        bytes[middle] ^= 0x20;
        std::fs::write(&sealed, &bytes).unwrap();
        for minute in [3, 4] {
            let outcome = laptop.exchange_with(&folder, &key, NOW + minute * MINUTE, &laptop_notes, &["notes"]);
            assert!(outcome.problems.iter().any(|p| p == "share-damaged:files/notes/lease.md") && outcome.pending == 1, "{outcome:?}");
            assert_eq!(std::fs::read(laptop_notes.join("lease.md")).unwrap(), b"version 1\n");
        }
        // Only a placeholder of the next (a file kept on demand): not there yet, nothing said, nothing lost.
        put(&desk_notes, "lease.md", b"version 3\n");
        desk.exchange_with(&folder, &key, NOW + 5 * MINUTE, &desk_notes, &["notes"]);
        let next = crate::blobs::path(&folder, &key, &crate::blobs::hash_file(&desk_notes.join("lease.md")).unwrap().0);
        let whole = std::fs::read(&next).unwrap();
        std::fs::write(&next, b"").unwrap();
        let outcome = laptop.exchange_with(&folder, &key, NOW + 6 * MINUTE, &laptop_notes, &["notes"]);
        assert!(outcome.problems.is_empty() && outcome.pending == 1, "{outcome:?}");
        assert_eq!(std::fs::read(laptop_notes.join("lease.md")).unwrap(), b"version 1\n");
        // A record that is not one, and a line that does not open: said, the file here stays.
        let last = written(&desk.memory, &desk.id).unwrap();
        let clock = ((NOW + 7 * MINUTE) as u64) << 16;
        let plain = serde_json::to_vec(&Change { k: "files/notes/lease.md#".into(), v: Some("not a reference".into()), b: String::new(), build: String::new(), f: 0 }).unwrap();
        let mut text = std::fs::read_to_string(round_file(&folder, &desk.id, last.0)).unwrap();
        text.push_str("{\"n\": 99, \"c\": 1, \"s\": \"broken\"}\n");
        text.push_str(&(serde_json::to_string(&Line { n: last.1 + 1, c: clock, s: seal(&key, &bound(&desk.id, last.0, last.1 + 1, clock), &plain) }).unwrap() + "\n"));
        std::fs::write(round_file(&folder, &desk.id, last.0), text).unwrap();
        let outcome = laptop.exchange_with(&folder, &key, NOW + 8 * MINUTE, &laptop_notes, &["notes"]);
        assert!(outcome.problems.iter().any(|p| p.starts_with("share-other-seal")) && outcome.problems.iter().any(|p| p == "share-damaged:files/notes/lease.md"), "{outcome:?}");
        assert_eq!(std::fs::read(laptop_notes.join("lease.md")).unwrap(), b"version 1\n");
        // The whole one comes at last, then a later change: written.
        std::fs::write(&next, &whole).unwrap();
        put(&desk_notes, "lease.md", b"version 4\n");
        desk.exchange_with(&folder, &key, NOW + 9 * MINUTE, &desk_notes, &["notes"]);
        laptop.exchange_with(&folder, &key, NOW + 10 * MINUTE, &laptop_notes, &["notes"]);
        assert_eq!(std::fs::read(laptop_notes.join("lease.md")).unwrap(), b"version 4\n");
        assert!(copies_of(&laptop_notes, "lease").is_empty());
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn a_notes_folder_found_empty_takes_nothing_out() {
        let base = scratch("notes-emptied");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, laptop) = (Computer::new(&base, "desk"), Computer::new(&base, "laptop"));
        let (desk_notes, laptop_notes) = (base.join("desk-notes"), base.join("laptop-notes"));
        for n in 0..6 {
            put(&desk_notes, &format!("note-{n}.md"), format!("# {n}\n").as_bytes());
        }
        desk.exchange_with(&folder, &key, NOW, &desk_notes, &["notes"]);
        laptop.exchange_with(&folder, &key, NOW + MINUTE, &laptop_notes, &["notes"]);
        // Every note gone at once here (a card not mounted, another program): said, nothing taken out there.
        for n in 0..6 {
            std::fs::remove_file(desk_notes.join(format!("note-{n}.md"))).unwrap();
        }
        let outcome = desk.exchange_with(&folder, &key, NOW + 2 * MINUTE, &desk_notes, &["notes"]);
        assert!(outcome.problems.iter().any(|p| p == "share-vanished:files/notes/:6") && outcome.sent == 0, "{outcome:?}");
        // Gone as a folder, the same.
        std::fs::remove_dir_all(&desk_notes).unwrap();
        assert_eq!(desk.exchange_with(&folder, &key, NOW + 3 * MINUTE, &desk_notes, &["notes"]).sent, 0);
        laptop.exchange_with(&folder, &key, NOW + 4 * MINUTE, &laptop_notes, &["notes"]);
        assert_eq!(files_in(&laptop_notes).len(), 6);
        // One taken out on purpose there goes, as ever, once gone a while; nothing is written here meanwhile.
        std::fs::remove_file(laptop_notes.join("note-0.md")).unwrap();
        put(&laptop_notes, "note-1.md", b"# 1, changed\n");
        laptop.exchange_with(&folder, &key, NOW + 5 * MINUTE, &laptop_notes, &["notes"]);
        laptop.exchange_with(&folder, &key, NOW + 16 * MINUTE, &laptop_notes, &["notes"]);
        assert!(desk.exchange_with(&folder, &key, NOW + 17 * MINUTE, &desk_notes, &["notes"]).pending > 0);
        assert!(!desk_notes.exists());
        // Notes switched off and on here: filled again from the others, as a new device's.
        desk.exchange_with(&folder, &key, NOW + 18 * MINUTE, &desk_notes, &[]);
        desk.exchange_with(&folder, &key, NOW + 19 * MINUTE, &desk_notes, &["notes"]);
        let files = files_in(&desk_notes);
        assert_eq!(files.keys().map(String::as_str).collect::<Vec<_>>(), ["note-1.md", "note-2.md", "note-3.md", "note-4.md", "note-5.md"]);
        assert_eq!(files["note-1.md"], b"# 1, changed\n");
        let _ = std::fs::remove_dir_all(&base);
    }

    /// A record of another device's, sealed: its file, as a sync app would bring it.
    pub(super) fn record_of(key: &[u8; 32], computer: &str, n: u64, clock: u64, change: &Change) -> String {
        let plain = serde_json::to_vec(change).unwrap();
        serde_json::to_string(&Line { n, c: clock, s: seal(key, &bound(computer, 1, n, clock), &plain) }).unwrap() + "\n"
    }

    pub(super) fn append_to(path: &Path, text: &str) {
        let mut file = std::fs::OpenOptions::new().create(true).append(true).open(path).unwrap();
        file.write_all(text.as_bytes()).unwrap();
    }

    pub(super) fn copy_dir(from: &Path, to: &Path) {
        for entry in std::fs::read_dir(from).unwrap().filter_map(Result::ok) {
            let target = to.join(entry.file_name());
            if entry.path().is_dir() {
                std::fs::create_dir_all(&target).unwrap();
                copy_dir(&entry.path(), &target);
            } else {
                std::fs::create_dir_all(to).unwrap();
                std::fs::copy(entry.path(), target).unwrap();
            }
        }
    }

    fn dated(path: &Path, at: std::time::SystemTime) {
        std::fs::File::options().write(true).open(path).unwrap().set_modified(at).unwrap();
    }

    // F1
    #[test]
    fn a_put_back_takes_out_nothing_added_since() {
        let base = scratch("put-back-entries");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let mut now = NOW;
        let both = |now: &mut i64| {
            *now += MINUTE;
            desk.exchange(&folder, &key, *now);
            *now += MINUTE;
            phone.exchange(&folder, &key, *now);
        };
        desk.write("state/health-state.toml", "[taken]\nd1 = 1\n");
        desk.write("config/config.toml", "language = \"fr\"\n");
        both(&mut now);
        // On the phone: a dose, then another, the language changed, an account added.
        phone.write("state/health-state.toml", "[taken]\nd1 = 1\nd2 = 2\n");
        both(&mut now);
        phone.write("state/health-state.toml", "[taken]\nd1 = 1\nd2 = 2\nd3 = 3\n");
        phone.write("config/config.toml", "language = \"en\"\n\n[[account]]\nid = \"new\"\nkind = \"imap\"\n");
        both(&mut now);
        both(&mut now);
        let history = crate::history::root(&desk.memory);
        let doses = crate::history::versions(&history, "health", "state/health-state.toml");
        assert_eq!(doses.len(), 2, "{doses:?}");
        let every = stores_of(&Config::default(), &desk.roots, &|_| true);
        // The doses' record as it was before the last dose came: said first, nothing taken out.
        let back = put_back_preview(&desk.memory, &every, "health", "state/health-state.toml", &doses[0].stamp).unwrap();
        assert_eq!(back, Back { whole: false, changed: 0, returning: 0, kept: 1 });
        put_back(&desk.memory, Some((&folder, &key)), &every, "health", "state/health-state.toml", &doses[0].stamp, now).unwrap();
        // The settings as they were: the language back, the account added since kept.
        let settings = crate::history::versions(&history, "settings", "config/config.toml");
        let back = put_back_preview(&desk.memory, &every, "settings", "config/config.toml", &settings[0].stamp).unwrap();
        assert_eq!(back, Back { whole: false, changed: 1, returning: 0, kept: 1 });
        put_back(&desk.memory, Some((&folder, &key)), &every, "settings", "config/config.toml", &settings[0].stamp, now).unwrap();
        both(&mut now);
        both(&mut now);
        for computer in [&desk, &phone] {
            let doses = computer.read("state/health-state.toml");
            assert!(["d1", "d2", "d3"].iter().all(|d| doses.contains(d)), "a dose marked after that version was taken out: {doses}");
            let config = computer.read("config/config.toml");
            assert!(config.contains("language = \"fr\"") && config.contains("id = \"new\""), "{config}");
        }
        let _ = std::fs::remove_dir_all(&base);
    }

    // F2
    #[test]
    fn a_quick_exchange_leaves_notes_for_later() {
        let base = scratch("quick");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let (dn, pn) = (base.join("desk-notes"), base.join("phone-notes"));
        put(&dn, "a.md", b"# a\n");
        desk.exchange_with(&folder, &key, NOW, &dn, &["notes"]);
        phone.exchange_with(&folder, &key, NOW + MINUTE, &pn, &["notes"]);
        // A dose and a note on the desk: the phone's alarm takes the dose, leaves the note.
        desk.write("state/health-state.toml", "[taken]\nd1 = 1\n");
        put(&dn, "a.md", b"# a, changed\n");
        desk.exchange_with(&folder, &key, NOW + 2 * MINUTE, &dn, &["notes"]);
        let stores = phone.stores_with(&pn, &|part| part == "notes");
        let quick = exchange(&Sharing { folder: &folder, computer: &phone.id, key: &key, memory: &phone.memory, files: false, hurry: None }, &stores, NOW + 3 * MINUTE).unwrap();
        assert!(phone.read("state/health-state.toml").contains("d1"));
        assert_eq!(std::fs::read(pn.join("a.md")).unwrap(), b"# a\n");
        assert_eq!(quick.pending, 1, "{quick:?}");
        // The next whole exchange brings it; nothing joins again (nothing goes out).
        let whole = phone.exchange_with(&folder, &key, NOW + 4 * MINUTE, &pn, &["notes"]);
        assert_eq!(std::fs::read(pn.join("a.md")).unwrap(), b"# a, changed\n");
        assert_eq!(whole.sent, 0, "{whole:?}");
        // Hurried while it runs: its notes wait where they are, the rest is done.
        put(&dn, "a.md", b"# a, again\n");
        desk.write("state/health-state.toml", "[taken]\nd1 = 1\nd2 = 2\n");
        desk.exchange_with(&folder, &key, NOW + 5 * MINUTE, &dn, &["notes"]);
        let hurry = std::sync::atomic::AtomicBool::new(true);
        exchange(&Sharing { folder: &folder, computer: &phone.id, key: &key, memory: &phone.memory, files: true, hurry: Some(&hurry) }, &stores, NOW + 6 * MINUTE).unwrap();
        assert!(phone.read("state/health-state.toml").contains("d2"));
        assert_eq!(std::fs::read(pn.join("a.md")).unwrap(), b"# a, changed\n");
        hurry.store(false, std::sync::atomic::Ordering::Relaxed);
        exchange(&Sharing { folder: &folder, computer: &phone.id, key: &key, memory: &phone.memory, files: true, hurry: Some(&hurry) }, &stores, NOW + 7 * MINUTE).unwrap();
        assert_eq!(std::fs::read(pn.join("a.md")).unwrap(), b"# a, again\n");
        let _ = std::fs::remove_dir_all(&base);
    }

    // F4
    #[test]
    fn notes_gone_at_once_wait_for_a_word() {
        let base = scratch("vanished");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, laptop) = (Computer::new(&base, "desk"), Computer::new(&base, "laptop"));
        let (dn, ln) = (base.join("desk-notes"), base.join("laptop-notes"));
        put(&dn, "today.md", b"# Today\n");
        for n in 0..20 {
            put(&dn, &format!("archive/{n}.md"), format!("# {n}\n").as_bytes());
        }
        desk.exchange_with(&folder, &key, NOW, &dn, &["notes"]);
        laptop.exchange_with(&folder, &key, NOW + MINUTE, &ln, &["notes"]);
        // A folder listing empty (a disk not mounted on its place): unknown, said, nothing taken out.
        std::fs::remove_dir_all(dn.join("archive")).unwrap();
        std::fs::create_dir(dn.join("archive")).unwrap();
        let outcome = desk.exchange_with(&folder, &key, NOW + 2 * MINUTE, &dn, &["notes"]);
        assert!(outcome.problems.iter().any(|p| p == "share-vanished:files/notes/archive/:20") && outcome.sent == 0, "{outcome:?}");
        laptop.exchange_with(&folder, &key, NOW + 3 * MINUTE, &ln, &["notes"]);
        assert_eq!(files_in(&ln).len(), 21);
        // Gone with its folder, many at once: held the same, ten minutes and more.
        std::fs::remove_dir(dn.join("archive")).unwrap();
        for minute in [4, 20] {
            let outcome = desk.exchange_with(&folder, &key, NOW + minute * MINUTE, &dn, &["notes"]);
            assert!(outcome.problems.iter().any(|p| p == "share-vanished:files/notes/:20") && outcome.sent == 0, "{outcome:?}");
        }
        laptop.exchange_with(&folder, &key, NOW + 21 * MINUTE, &ln, &["notes"]);
        assert_eq!(files_in(&ln).len(), 21);
        // A folder that cannot be read: unknown, nothing of it taken out.
        #[cfg(unix)]
        {
            use std::os::unix::fs::PermissionsExt;
            put(&dn, "locked/x.md", b"# x\n");
            desk.exchange_with(&folder, &key, NOW + 22 * MINUTE, &dn, &["notes"]);
            std::fs::set_permissions(dn.join("locked"), std::fs::Permissions::from_mode(0o000)).unwrap();
            if std::fs::read_dir(dn.join("locked")).is_err() {
                for minute in [23, 40] {
                    desk.exchange_with(&folder, &key, NOW + minute * MINUTE, &dn, &["notes"]);
                }
                laptop.exchange_with(&folder, &key, NOW + 41 * MINUTE, &ln, &["notes"]);
                assert!(ln.join("locked/x.md").exists());
            }
            std::fs::set_permissions(dn.join("locked"), std::fs::Permissions::from_mode(0o755)).unwrap();
        }
        // You say so: they go, everywhere.
        confirm_gone(&desk.memory, &desk.id, "files/notes/").unwrap();
        let outcome = desk.exchange_with(&folder, &key, NOW + 42 * MINUTE, &dn, &["notes"]);
        assert!(outcome.sent >= 20, "{outcome:?}");
        laptop.exchange_with(&folder, &key, NOW + 43 * MINUTE, &ln, &["notes"]);
        let left: Vec<String> = files_in(&ln).into_keys().collect();
        assert!(left.iter().all(|f| !f.starts_with("archive/")) && left.contains(&"today.md".to_string()), "{left:?}");
        assert!(!ln.join("archive").exists(), "its folder, left empty, goes too");
        let _ = std::fs::remove_dir_all(&base);
    }

    // F5 and F21
    #[test]
    fn no_room_holds_a_file_back_and_tries_again_later() {
        let base = scratch("no-room");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, laptop) = (Computer::new(&base, "desk"), Computer::new(&base, "laptop"));
        let (dn, ln) = (base.join("desk-notes"), base.join("laptop-notes"));
        put(&dn, "scan.pdf", &noise(100_000, 1));
        put(&dn, "other.md", b"other\n");
        desk.exchange_with(&folder, &key, NOW, &dn, &["notes"]);
        laptop.exchange_with(&folder, &key, NOW + MINUTE, &ln, &["notes"]);
        put(&dn, "scan.pdf", &noise(100_000, 2));
        desk.exchange_with(&folder, &key, NOW + 2 * MINUTE, &dn, &["notes"]);
        // No room on the laptop: said, the file there as it was, tried again after a while only.
        crate::disk::ROOM.with(|room| room.set(Some(1000)));
        let outcome = laptop.exchange_with(&folder, &key, NOW + 3 * MINUTE, &ln, &["notes"]);
        assert!(outcome.problems.iter().any(|p| p == "share-no-room:files/notes/scan.pdf") && outcome.pending == 1, "{outcome:?}");
        let outcome = laptop.exchange_with(&folder, &key, NOW + 3 * MINUTE + 30_000, &ln, &["notes"]);
        assert!(outcome.problems.is_empty(), "not opened again within the minute: {outcome:?}");
        assert_eq!(std::fs::read(ln.join("scan.pdf")).unwrap(), noise(100_000, 1));
        crate::disk::ROOM.with(|room| room.set(Some(u64::MAX)));
        laptop.exchange_with(&folder, &key, NOW + 5 * MINUTE, &ln, &["notes"]);
        assert_eq!(std::fs::read(ln.join("scan.pdf")).unwrap(), noise(100_000, 2));
        // What it held kept by reference (its content was sealed in the folder already), not copied.
        let kept = crate::history::versions(&crate::history::root(&laptop.memory), "notes", "files/notes/scan.pdf");
        assert!(kept.len() == 1 && kept[0].sealed.is_some(), "{kept:?}");
        assert_eq!(version_text_bytes(&crate::history::root(&laptop.memory), "notes", "files/notes/scan.pdf", &kept[0].stamp, &folder, &key), noise(100_000, 1));
        let _ = std::fs::remove_dir_all(&base);
    }

    fn version_text_bytes(history: &Path, part: &str, file: &str, stamp: &str, folder: &Path, key: &[u8; 32]) -> Vec<u8> {
        let Some(crate::history::Kept::Sealed { hash, .. }) = crate::history::version(history, part, file, stamp) else { panic!("{file}: not by reference") };
        let target = temporary(&history.join("opened"));
        crate::blobs::get(folder, key, &hash, &target).unwrap();
        let bytes = std::fs::read(&target).unwrap();
        std::fs::remove_file(target).unwrap();
        bytes
    }

    // F6
    #[test]
    fn huge_or_endless_files_in_the_folder_are_never_read_whole() {
        let base = scratch("huge");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, laptop) = (Computer::new(&base, "desk"), Computer::new(&base, "laptop"));
        desk.write("config/safe-senders.txt", "a@example.org\n");
        desk.exchange(&folder, &key, NOW);
        // From anyone who can write the folder: a line of 40 MB, then a record of a key holder's; notes to each other of 100 kB.
        let stranger = uuid::Uuid::new_v4().to_string();
        {
            let mut file = std::fs::File::create(round_file(&folder, &stranger, 1)).unwrap();
            let piece = vec![b'x'; 1 << 20];
            for _ in 0..40 {
                file.write_all(&piece).unwrap();
            }
            file.write_all(b"\n").unwrap();
        }
        let clock = ((NOW + MINUTE) as u64) << 16;
        append_to(&round_file(&folder, &stranger, 1), &record_of(&key, &stranger, 1, clock, &Change { k: "config/safe-senders.txt#b@example.org".into(), v: Some(String::new()), b: String::new(), build: String::new(), f: 0 }));
        std::fs::write(seen_path(&folder, &stranger), "x".repeat(100_000)).unwrap();
        let outcome = laptop.exchange(&folder, &key, NOW + 2 * MINUTE);
        assert!(outcome.problems.iter().any(|p| *p == format!("share-other-line:{stranger}")), "{outcome:?}");
        let safe = laptop.read("config/safe-senders.txt");
        assert!(safe.contains("a@example.org") && safe.contains("b@example.org"), "{safe}");
        assert!(others(&folder, &laptop.id).iter().any(|o| o.id == stranger && o.heard == 0), "its notes, too long, not read");
        // An own file that does not end a line is mended from its end, never read whole.
        let own = round_file(&folder, &desk.id, 1);
        let whole = std::fs::metadata(&own).unwrap().len();
        append_to(&own, "{\"n\": 99, \"c\": 1, \"s\": \"half");
        assert_eq!(unfinished(&own), Some(whole));
        desk.write("config/safe-senders.txt", "a@example.org\nc@example.org\n");
        desk.exchange(&folder, &key, NOW + 3 * MINUTE);
        assert!(std::fs::read_to_string(&own).unwrap().lines().all(|l| l.ends_with('}')));
        let _ = std::fs::remove_dir_all(&base);
    }

    // F7 and F8
    #[test]
    fn an_edit_made_while_receiving_is_never_lost() {
        let base = scratch("while-receiving");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, laptop) = (Computer::new(&base, "desk"), Computer::new(&base, "laptop"));
        let (dn, ln) = (base.join("desk-notes"), base.join("laptop-notes"));
        for name in ["a.md", "b.md", "lease.md"] {
            put(&dn, name, format!("{name}: one\n").as_bytes());
        }
        desk.exchange_with(&folder, &key, NOW, &dn, &["notes"]);
        laptop.exchange_with(&folder, &key, NOW + MINUTE, &ln, &["notes"]);
        for name in ["a.md", "b.md", "lease.md"] {
            put(&dn, name, format!("{name}: two, from the desk\n").as_bytes());
        }
        desk.exchange_with(&folder, &key, NOW + 2 * MINUTE, &dn, &["notes"]);
        // While the laptop writes them: the lease edited there just before its turn (an editor
        // saving), and a.md, written already, edited while b.md is written.
        let (lease, first) = (ln.join("lease.md"), ln.join("a.md"));
        BEFORE_WRITING.with(|hook| {
            *hook.borrow_mut() = Some(Box::new(move |path: &Path| {
                if path.ends_with("lease.md") {
                    std::fs::write(&lease, "lease.md: edited on the laptop\n").unwrap();
                }
                if path.ends_with("b.md") {
                    std::fs::write(&first, "a.md: edited on the laptop\n").unwrap();
                }
            }))
        });
        laptop.exchange_with(&folder, &key, NOW + 3 * MINUTE, &ln, &["notes"]);
        BEFORE_WRITING.with(|hook| *hook.borrow_mut() = None);
        assert_eq!(std::fs::read_to_string(ln.join("lease.md")).unwrap(), "lease.md: edited on the laptop\n", "not written over");
        for minute in 4..10 {
            if minute % 2 == 0 {
                laptop.exchange_with(&folder, &key, NOW + minute * MINUTE, &ln, &["notes"]);
            } else {
                desk.exchange_with(&folder, &key, NOW + minute * MINUTE, &dn, &["notes"]);
            }
        }
        // Both edits went out. The lease, edited before the desk's came, is
        // kept both ways; a.md, edited on top of the desk's, follows it.
        for notes in [&dn, &ln] {
            let all: Vec<String> = files_in(notes).into_values().map(|b| String::from_utf8(b).unwrap()).collect();
            for text in ["lease.md: edited on the laptop\n", "lease.md: two, from the desk\n", "a.md: edited on the laptop\n"] {
                assert!(all.iter().any(|t| t == text), "{}: {text:?} lost: {all:?}", notes.display());
            }
            assert_eq!(std::fs::read_to_string(notes.join("a.md")).unwrap(), "a.md: edited on the laptop\n");
        }
        let _ = std::fs::remove_dir_all(&base);
    }

    // F9
    #[test]
    fn a_part_switched_off_keeps_nothing_waiting() {
        let base = scratch("off-pending");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let off = stores_of(&Config::default(), &phone.roots, &|part| part != "drafts");
        for n in 0..20 {
            desk.write(&format!("data/drafts/{n}.eml"), &"x".repeat(200_000));
            desk.exchange(&folder, &key, NOW + 2 * n * MINUTE);
            exchange(&Sharing { folder: &folder, computer: &phone.id, key: &key, memory: &phone.memory, files: true, hurry: None }, &off, NOW + (2 * n + 1) * MINUTE).unwrap();
        }
        assert!(std::fs::metadata(&phone.memory).unwrap().len() < 200_000, "memory.json holds the drafts of a part switched off");
        // Switched on: it joins, and the drafts come.
        phone.exchange(&folder, &key, NOW + 41 * MINUTE);
        assert_eq!(phone.read("data/drafts/19.eml").len(), 200_000);
        let _ = std::fs::remove_dir_all(&base);
    }

    /// A device on an older Sioul still shares a watch's days and the memory
    /// of its offers (taken out on 8 October 2026): left aside here, never
    /// written, never kept waiting, never a problem; the rest of the
    /// exchange comes in, and the older device's files stay as they are.
    #[test]
    fn an_older_sioul_s_watch_is_left_aside() {
        let base = scratch("watch-older");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (older, desk) = (Computer::new(&base, "older"), Computer::new(&base, "desk"));
        // The older Sioul's stores: this version's, and the watch's as it shared them.
        let mut with_watch = stores(&Config::default(), &older.roots);
        with_watch.push(Store { name: "data/watch/".into(), path: older.roots.data.join("watch"), folder: true, shape: Shape::Whole, skip: &["imported.json"], part: "watch" });
        with_watch.push(Store { name: "state/watch-offers.json".into(), path: older.roots.state.join("watch-offers.json"), folder: false, shape: Shape::Whole, skip: &[], part: "watch" });
        let older_exchange = |now: i64| exchange(&Sharing { folder: &folder, computer: &older.id, key: &key, memory: &older.memory, files: true, hurry: None }, &with_watch, now).unwrap();
        older.write("data/watch/2026-10-07.json", "{\"steps\": 4200}");
        older.write("state/watch-offers.json", "{\"declined\": {}}");
        older.write("config/safe-senders.txt", "friend@example.org\n");
        let sent = older_exchange(NOW);
        assert!(sent.problems.is_empty() && sent.sent >= 3, "{sent:?}");
        for n in 1..=2 {
            let came = desk.exchange(&folder, &key, NOW + n * MINUTE);
            assert!(came.problems.is_empty() && came.pending == 0, "{came:?}");
        }
        assert_eq!(desk.read("config/safe-senders.txt"), "friend@example.org\n", "the rest came in");
        assert!(!desk.path("data/watch").exists() && !desk.path("state/watch-offers.json").exists(), "nothing of the watch written");
        // Its records named by their stores (the folders' own paths hold the test's name).
        let memory = std::fs::read_to_string(&desk.memory).unwrap();
        assert!(!memory.contains("data/watch/") && !memory.contains("watch-offers"), "nothing of the watch kept waiting");
        // A new day from the older device, and a change it receives: the exchanges go on both ways.
        older.write("data/watch/2026-10-08.json", "{\"steps\": 900}");
        older_exchange(NOW + 3 * MINUTE);
        desk.write("config/safe-senders.txt", "friend@example.org\nneighbour@example.org\n");
        let came = desk.exchange(&folder, &key, NOW + 4 * MINUTE);
        assert!(came.problems.is_empty() && came.pending == 0 && came.sent >= 1, "{came:?}");
        let back = older_exchange(NOW + 5 * MINUTE);
        assert!(back.problems.is_empty() && back.received >= 1, "{back:?}");
        assert_eq!(older.read("config/safe-senders.txt"), "friend@example.org\nneighbour@example.org\n");
        assert_eq!(older.read("data/watch/2026-10-07.json"), "{\"steps\": 4200}", "its own files as they were");
        assert!(!desk.path("data/watch").exists());
        let _ = std::fs::remove_dir_all(&base);
    }

    // F10
    #[cfg(unix)]
    #[test]
    fn nothing_is_written_through_a_link_nor_into_the_sharing_folder() {
        let base = scratch("through-link");
        let notes = base.join("desk-notes");
        // Shared through a folder inside the notes, as Sioul may suggest.
        let folder = notes.join("sioul-shared");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let desk = Computer::new(&base, "desk");
        let outside = base.join("outside");
        put(&notes, "lease.md", b"x\n");
        std::fs::create_dir_all(&outside).unwrap();
        std::os::unix::fs::symlink(&outside, notes.join("link")).unwrap();
        desk.exchange_with(&folder, &key, NOW, &notes, &["notes"]);
        // A key holder's records: one through the link, one into the sharing folder.
        let source = base.join("evil");
        std::fs::write(&source, b"[Desktop Entry]\nExec=sh -c id\n").unwrap();
        let (h, s) = crate::blobs::hash_file(&source).unwrap();
        crate::blobs::put(&folder, &key, &source, &h).unwrap();
        let other = uuid::Uuid::new_v4().to_string();
        let value = reference(&h, s, 0);
        let mut text = String::new();
        for (n, file) in [(1, "files/notes/link/evil.desktop#"), (2, "files/notes/sioul-shared/plain.md#")] {
            text += &record_of(&key, &other, n, ((NOW + MINUTE) as u64) << 16 | n, &Change { k: file.into(), v: Some(value.clone()), b: String::new(), build: String::new(), f: 0 });
        }
        std::fs::write(round_file(&folder, &other, 1), text).unwrap();
        let outcome = desk.exchange_with(&folder, &key, NOW + 2 * MINUTE, &notes, &["notes"]);
        assert!(!outside.join("evil.desktop").exists(), "written through the link");
        assert!(!folder.join("plain.md").exists(), "written in plain into the sharing folder");
        assert!(outcome.problems.iter().filter(|p| p.starts_with("share-refused:")).count() == 2, "{outcome:?}");
        let _ = std::fs::remove_dir_all(&base);
    }

    // F11
    #[test]
    fn a_content_used_again_is_never_lost_to_a_sweep() {
        let base = scratch("sweep-race");
        let (server, phone_folder) = (base.join("server").join("Sioul"), base.join("phone").join("Sioul"));
        let key = quick_key(&server, "four words make a passphrase").unwrap();
        let (desk, phone, laptop) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"), Computer::new(&base, "laptop"));
        let (dn, pn, ln) = (base.join("desk-notes"), base.join("phone-notes"), base.join("laptop-notes"));
        let day = 86_400_000;
        put(&dn, "a.md", b"template\n");
        put(&dn, "keep.md", b"keep\n");
        desk.exchange_with(&server, &key, NOW, &dn, &["notes"]);
        put(&dn, "a.md", b"changed\n");
        desk.exchange_with(&server, &key, NOW + MINUTE, &dn, &["notes"]);
        // The template's sealed file is old (written long ago).
        std::fs::write(base.join("template"), b"template\n").unwrap();
        let sealed = crate::blobs::path(&server, &key, &crate::blobs::hash_file(&base.join("template")).unwrap().0);
        dated(&sealed, std::time::SystemTime::now() - std::time::Duration::from_secs(100 * 86_400));
        copy_dir(&server, &phone_folder);
        // The phone holds the same content again: it finds it sealed, seals nothing, and its record goes.
        put(&pn, "b.md", b"template\n");
        phone.exchange_with(&phone_folder, &key, NOW + 91 * day, &pn, &["notes"]);
        // The desk, not hearing of it yet, sweeps it.
        desk.exchange_with(&server, &key, NOW + 91 * day + MINUTE, &dn, &["notes"]);
        assert!(!sealed.exists(), "swept, as unused for 90 days by what the desk knew");
        // The phone's sync app carries both ways: its records up, the sweep down.
        for entry in std::fs::read_dir(&phone_folder).unwrap().filter_map(Result::ok) {
            if entry.file_name().to_string_lossy().ends_with(".jsonl") {
                std::fs::copy(entry.path(), server.join(entry.file_name())).unwrap();
            }
        }
        let _ = std::fs::remove_file(phone_folder.join("blobs").join(sealed.file_name().unwrap()));
        laptop.exchange_with(&server, &key, NOW + 91 * day + 2 * MINUTE, &ln, &["notes"]);
        assert!(!ln.join("b.md").exists());
        // A day later, still missing: said.
        let outcome = laptop.exchange_with(&server, &key, NOW + 92 * day + 3 * MINUTE, &ln, &["notes"]);
        assert!(outcome.problems.iter().any(|p| p == "share-missing:files/notes/b.md"), "{outcome:?}");
        // The phone looks after its sealed files: gone, sealed again; it comes.
        phone.exchange_with(&phone_folder, &key, NOW + 92 * day + 4 * MINUTE, &pn, &["notes"]);
        assert!(phone_folder.join("blobs").join(sealed.file_name().unwrap()).exists());
        copy_dir(&phone_folder.join("blobs"), &server.join("blobs"));
        laptop.exchange_with(&server, &key, NOW + 92 * day + 5 * MINUTE, &ln, &["notes"]);
        assert_eq!(std::fs::read(ln.join("b.md")).ok().as_deref(), Some(&b"template\n"[..]));
        let _ = std::fs::remove_dir_all(&base);
    }

    // F12
    #[test]
    fn one_exchange_at_a_time() {
        let base = scratch("one-at-a-time");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let desk = Computer::new(&base, "desk");
        desk.write("config/safe-senders.txt", "a@example.org\n");
        // Another Sioul (or the command line) exchanging: a whole exchange does nothing, and says so.
        let running = exchange_lock(&desk.memory, true).unwrap();
        let outcome = desk.exchange(&folder, &key, NOW);
        assert_eq!((outcome.problems.as_slice(), outcome.sent), (&["share-busy".to_string()][..], 0));
        drop(running);
        assert_eq!(desk.exchange(&folder, &key, NOW + MINUTE).sent, 1);
        // Held a moment only (a program starting elsewhere in Sioul holds a copy
        // of the lock until it runs, a Mac's for milliseconds): waited for.
        let memory = desk.memory.clone();
        let (held, release) = std::sync::mpsc::channel();
        let holder = std::thread::spawn(move || {
            let running = exchange_lock(&memory, true).unwrap();
            held.send(()).unwrap();
            std::thread::sleep(std::time::Duration::from_millis(150));
            drop(running);
        });
        release.recv().unwrap();
        desk.write("config/safe-senders.txt", "a@example.org\nb@example.org\n");
        let outcome = desk.exchange(&folder, &key, NOW + 2 * MINUTE);
        assert_eq!((outcome.problems.len(), outcome.sent), (0, 1), "{outcome:?}");
        holder.join().unwrap();
        // Files being written never share a name.
        let path = folder.join("x.toml");
        let (one, two) = (temporary(&path), temporary(&path));
        assert!(one != two && one.file_name().unwrap().to_string_lossy().starts_with('.'));
        let _ = std::fs::remove_dir_all(&base);
    }

    // F14
    #[test]
    fn names_one_storage_takes_for_one_are_never_both_written() {
        // The decision, whatever the disk running this: a name another file
        // here or known has by its case, or by how an accent is written, is not its own.
        let known = |file: &str| (format!("{file}#"), Known { c: 1, w: "desk".into(), h: "h".into(), b: String::new() });
        let names = Names::new(&[known("files/notes/Lease.md"), known("files/notes/\u{e9}t\u{e9}.md")].into(), &Found::default());
        assert!(names.clash("files/notes/lease.md") && names.clash("files/notes/LEASE.md") && names.clash("files/notes/e\u{301}te\u{301}.md"));
        assert!(!names.clash("files/notes/Lease.md") && !names.clash("files/notes/\u{e9}t\u{e9}.md") && !names.clash("files/notes/other.md"));
        // Between two devices, with the names this disk can hold apart: Windows'
        // and a Mac's take "Lease.md" and "lease.md" for one file, a Mac's
        // "\u{e9}t\u{e9}" written two ways too; Linux's holds both.
        let base = scratch("case");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, laptop) = (Computer::new(&base, "desk"), Computer::new(&base, "laptop"));
        let (dn, ln) = (base.join("desk-notes"), base.join("laptop-notes"));
        let apart = |one: &str, other: &str| {
            let probe = base.join("probe");
            std::fs::create_dir_all(&probe).unwrap();
            std::fs::write(probe.join(one), b"").unwrap();
            let apart = !probe.join(other).exists();
            std::fs::remove_dir_all(&probe).unwrap();
            apart
        };
        put(&dn, "other.md", b"other\n");
        let mut pairs = 0;
        for (one, other) in [("Lease.md", "lease.md"), ("\u{e9}t\u{e9}.md", "e\u{301}te\u{301}.md")] {
            if apart(one, other) {
                put(&dn, one, b"one\n");
                put(&dn, other, b"other way\n");
                pairs += 1;
            }
        }
        desk.exchange_with(&folder, &key, NOW, &dn, &["notes"]);
        let outcome = laptop.exchange_with(&folder, &key, NOW + MINUTE, &ln, &["notes"]);
        assert_eq!(outcome.problems.iter().filter(|p| p.starts_with("share-name-clash:")).count(), pairs, "{outcome:?}");
        assert_eq!(files_in(&ln).len(), 1 + pairs);
        // What another part carries is never a note, whatever its case.
        let config = Config { notes_root: Some("/notes".into()), ..Config::default() };
        let every = stores_of(&config, &laptop.roots, &|_| true);
        assert!(locate(&every, "files/notes/Sioul-Cases.toml").is_none() && locate(&every, "files/notes/Sioul-Projects.toml").is_none() && locate(&every, "files/notes/Papers/id.pdf").is_none());
        assert_eq!(kept_by_windows("aux.md"), true);
        assert_eq!(kept_by_windows("auxiliary.md"), false);
        let _ = std::fs::remove_dir_all(&base);
    }

    // F15
    #[test]
    fn a_name_with_a_hash_travels() {
        let base = scratch("hash-name");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let (dn, pn) = (base.join("desk-notes"), base.join("phone-notes"));
        put(&dn, "Issue #12.md", b"# Issue 12\n");
        put(&dn, "#ideas.md", b"# Ideas\n");
        put(&dn, "papers/Facture #123.pdf", &noise(10_000, 3));
        desk.write("data/drafts/a#1.toml", "subject = \"Hash\"\n");
        for m in 0..3 {
            desk.exchange_with(&folder, &key, NOW + 2 * m * MINUTE, &dn, &["notes", "papers"]);
            phone.exchange_with(&folder, &key, NOW + (2 * m + 1) * MINUTE, &pn, &["notes", "papers"]);
        }
        let files = files_in(&pn);
        assert_eq!(files.get("Issue #12.md").map(Vec::as_slice), Some(&b"# Issue 12\n"[..]), "{:?}", files.keys().collect::<Vec<_>>());
        assert!(files.contains_key("#ideas.md") && files.get("papers/Facture #123.pdf") == Some(&noise(10_000, 3)));
        assert_eq!(phone.read("data/drafts/a#1.toml"), "subject = \"Hash\"\n");
        assert_eq!(file_of("files/papers/Facture #123.pdf#"), "files/papers/Facture #123.pdf");
        assert_eq!((file_of("config/safe-senders.txt#a#b@example.org"), entry_of("config/safe-senders.txt#a#b@example.org")), ("config/safe-senders.txt", "a#b@example.org"));
        let _ = std::fs::remove_dir_all(&base);
    }

    // F16
    #[test]
    fn an_old_copy_does_not_roll_the_others_back() {
        let base = scratch("old-copy");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, laptop) = (Computer::new(&base, "desk"), Computer::new(&base, "laptop"));
        let (dn, ln) = (base.join("desk-notes"), base.join("laptop-notes"));
        let old = std::time::UNIX_EPOCH + std::time::Duration::from_millis(NOW as u64);
        put(&dn, "lease.md", b"Rent: 620\n");
        put(&dn, "other.md", b"other\n");
        dated(&dn.join("lease.md"), old);
        desk.exchange_with(&folder, &key, NOW, &dn, &["notes"]);
        laptop.exchange_with(&folder, &key, NOW + MINUTE, &ln, &["notes"]);
        put(&ln, "lease.md", b"Rent: 640\n");
        laptop.exchange_with(&folder, &key, NOW + 86_400_000, &ln, &["notes"]);
        desk.exchange_with(&folder, &key, NOW + 86_400_000 + MINUTE, &dn, &["notes"]);
        // Restored from a backup: the old content, with its old time.
        put(&dn, "lease.md", b"Rent: 620\n");
        dated(&dn.join("lease.md"), old);
        let outcome = desk.exchange_with(&folder, &key, NOW + 86_400_000 + 2 * MINUTE, &dn, &["notes"]);
        assert!(outcome.problems.iter().any(|p| p.starts_with("share-older-copy:lease (conflict ")), "{outcome:?}");
        assert_eq!(std::fs::read(dn.join("lease.md")).unwrap(), b"Rent: 640\n", "the version last seen came back");
        desk.exchange_with(&folder, &key, NOW + 86_400_000 + 3 * MINUTE, &dn, &["notes"]);
        laptop.exchange_with(&folder, &key, NOW + 86_400_000 + 4 * MINUTE, &ln, &["notes"]);
        assert_eq!(std::fs::read(ln.join("lease.md")).unwrap(), b"Rent: 640\n");
        assert_eq!(copies_of(&ln, "lease"), [b"Rent: 620\n".to_vec()], "the older copy kept beside, everywhere");
        let _ = std::fs::remove_dir_all(&base);
    }

    // F22
    #[test]
    fn a_file_being_written_waits() {
        let base = scratch("settling");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, laptop) = (Computer::new(&base, "desk"), Computer::new(&base, "laptop"));
        let (dn, ln) = (base.join("desk-notes"), base.join("laptop-notes"));
        put(&dn, "keep.md", b"keep\n");
        dated(&dn.join("keep.md"), std::time::SystemTime::now() - std::time::Duration::from_secs(120));
        // Changed this very moment: read once it has settled.
        SETTLE.with(|settle| settle.set(60_000));
        put(&dn, "a.md", b"# a\n");
        assert_eq!(desk.exchange_with(&folder, &key, NOW, &dn, &["notes"]).sent, 1);
        dated(&dn.join("a.md"), std::time::SystemTime::now() - std::time::Duration::from_secs(120));
        assert_eq!(desk.exchange_with(&folder, &key, NOW + MINUTE, &dn, &["notes"]).sent, 1);
        SETTLE.with(|settle| settle.set(0));
        laptop.exchange_with(&folder, &key, NOW + 2 * MINUTE, &ln, &["notes"]);
        // Emptied in place (an editor writing it, a crash): held as it was for ten minutes.
        std::fs::write(dn.join("a.md"), b"").unwrap();
        assert_eq!(desk.exchange_with(&folder, &key, NOW + 3 * MINUTE, &dn, &["notes"]).sent, 0);
        laptop.exchange_with(&folder, &key, NOW + 4 * MINUTE, &ln, &["notes"]);
        assert_eq!(std::fs::read(ln.join("a.md")).unwrap(), b"# a\n");
        put(&dn, "a.md", b"# a, written\n");
        assert_eq!(desk.exchange_with(&folder, &key, NOW + 5 * MINUTE, &dn, &["notes"]).sent, 1);
        let _ = std::fs::remove_dir_all(&base);
    }

    // F23
    #[test]
    fn the_doses_never_read_the_notes_memory() {
        let base = scratch("memory-apart");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let desk = Computer::new(&base, "desk");
        let dn = base.join("desk-notes");
        for n in 0..50 {
            put(&dn, &format!("note-{n}.md"), format!("# {n}\n").as_bytes());
        }
        desk.write("state/health-state.toml", "[taken]\nd1 = 1\n");
        desk.exchange_with(&folder, &key, NOW, &dn, &["notes"]);
        let memory = std::fs::read_to_string(&desk.memory).unwrap();
        assert!(!memory.contains("files/notes/note-") && memory.contains("health-state"), "{memory}");
        assert!(std::fs::read_to_string(sealed_path(&desk.memory)).unwrap().contains("files/notes/note-7.md"));
        assert!(written(&desk.memory, &desk.id).is_some_and(|(_, n)| n > 50));
        // Its own file lost: notes and papers join again, nothing goes out as new, nothing copied beside.
        std::fs::remove_file(sealed_path(&desk.memory)).unwrap();
        let outcome = desk.exchange_with(&folder, &key, NOW + MINUTE, &dn, &["notes"]);
        assert_eq!(outcome.sent, 0, "{outcome:?}");
        assert_eq!(files_in(&dn).len(), 50);
        let _ = std::fs::remove_dir_all(&base);
    }

    // F24
    #[test]
    fn what_is_said_and_left_behind() {
        // Named alike in every language: one copy, not one per device.
        let at = NOW;
        assert_eq!(conflict_name("lease", at), conflict_name("lease", at));
        assert!(conflict_name("lease", at).starts_with("lease (conflict 20"));
        let base = scratch("left-behind");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let desk = Computer::new(&base, "desk");
        let dn = base.join("desk-notes");
        put(&dn, "lease.md", b"lease\n");
        // What a crash left half written, an hour old: cleaned; one being written: left.
        put(&dn, ".lease.md.1-1.sioul.tmp", b"half");
        dated(&dn.join(".lease.md.1-1.sioul.tmp"), std::time::SystemTime::now() - std::time::Duration::from_secs(7200));
        put(&dn, ".lease.md.1-2.sioul.tmp", b"being written");
        // A name that is not text, where the disk holds one (Linux's does; a Mac's refuses it, Windows' names are text).
        #[cfg(unix)]
        let latin = {
            use std::os::unix::ffi::OsStrExt;
            std::fs::write(dn.join(std::ffi::OsStr::from_bytes(b"caf\xe9.md")), b"latin-1").is_ok()
        };
        #[cfg(not(unix))]
        let latin = false;
        let outcome = desk.exchange_with(&folder, &key, NOW, &dn, &["notes"]);
        assert!(!dn.join(".lease.md.1-1.sioul.tmp").exists() && dn.join(".lease.md.1-2.sioul.tmp").exists());
        assert_eq!(outcome.problems.iter().any(|p| p.starts_with("share-not-text:files/notes/caf")), latin, "{outcome:?}");
        assert_eq!(outcome.sent, 1, "{outcome:?}");
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn each_device_chooses_its_parts() {
        let roots = Roots { config: PathBuf::from("config"), data: PathBuf::from("data"), state: PathBuf::from("state") };
        let config = Config { notes_root: Some("/notes".into()), ..Config::default() };
        let parts = |stores: &[Store]| stores.iter().map(|s| s.part).collect::<BTreeSet<_>>();
        // A device that never chose: what was shared before parts had switches.
        assert_eq!(parts(&stores(&config, &roots)), ["calls", "drafts", "health", "lists", "senders", "settings", "spam", "time"].into());
        let old = Config { share_projects: true, ..config.clone() };
        assert!(parts(&stores(&old, &roots)).contains("projects"), "projects as the old setting said");
        // Its own choices, kept in its own file, never in a shared one.
        let mut here = Here::default();
        here.parts.insert("notes".into(), true);
        here.parts.insert("health".into(), false);
        here.parts.insert("projects".into(), false);
        let chosen = stores_of(&old, &roots, &|part| here.shares(part, &old));
        assert!(chosen.iter().any(|s| s.name == "files/notes/") && !chosen.iter().any(|s| s.part == "health" || s.part == "projects"));
        let notes = chosen.iter().find(|s| s.name == "files/notes/").unwrap();
        assert!(["sioul-projects.toml", "sioul-cases.toml", "sioul-cases.toml.before-rename", "sioul-papers.toml", "papers"].iter().all(|n| notes.skip.contains(n)), "what other parts carry stays out of the notes");
        let back: Here = toml::from_str(&toml::to_string(&here).unwrap()).unwrap();
        assert_eq!(back.parts, here.parts);
        assert!(stores_of(&config, &roots, &|_| true).iter().all(|s| s.name != "state/share/here.toml"));
        // Written into the notes folder, never what tools make nor what another part carries.
        let every = stores_of(&config, &roots, &|_| true);
        assert!(locate(&every, "files/notes/admin/lease.md").is_some());
        for file in ["files/notes/.obsidian/app.json", "files/notes/lease.md~", "files/notes/sioul-cases.toml", "files/notes/sioul-projects.toml", "files/notes/papers/id.pdf", "files/notes/a (conflicted copy).md"] {
            assert!(locate(&every, file).is_none(), "{file}");
        }
        assert_eq!(locate(&every, "files/papers/id.pdf").map(|(s, _)| s.part), Some("papers"));
        assert_eq!(shown("files/notes/admin/lease.md"), "admin/lease.md");
        assert_eq!(shown("files/papers/id.pdf"), "papers/id.pdf");
        assert_eq!(shown("config/config.toml"), "config.toml");
    }

    /// The spam filter's table: from the computer that trained it to the
    /// others, sealed apart, in every exchange (a phone's background step's
    /// too); the good one it replaces kept beside; never the language model
    /// nor the corpus beside it.
    #[test]
    fn the_spam_table_travels_alone_in_every_exchange() {
        use sioul_core::spam::features::{FEATURES, N};
        use sioul_core::spam::table::{self, Table};
        let base = scratch("spam-table");
        let folder = base.join("folder");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let made = |bias: f32| {
            let mut made = Table {
                tokenizer: sioul_core::spam::tokenize::TOKENIZER,
                features: FEATURES,
                dim: 2,
                minn: 3,
                maxn: 6,
                bucket: 4,
                words: vec![(table::word_hash("lotteri"), 2.0)],
                buckets: vec![0.0; 4],
                weights: vec![0.0; N],
                means: vec![0.0; N],
                bias,
                text_mean: 0.0,
                platt_a: -1.0,
                platt_b: 0.0,
                meta: table::Meta { device: "desk".into(), ..table::Meta::default() },
            };
            made.sort();
            made
        };
        // Each table its own time: a file is known by its size and time.
        let trained = |bias: f32, second: u64| {
            let path = desk.path("data/spam/table.bin");
            made(bias).write(&path).unwrap();
            std::fs::File::options().write(true).open(&path).unwrap().set_modified(std::time::UNIX_EPOCH + std::time::Duration::from_secs(second)).unwrap();
        };
        // What a training leaves on the desk: the table, the language model, the corpus.
        trained(0.5, 1_789_990_000);
        desk.write("data/spam/language.bin", "the vocabulary in plain text: Jane, the lease, the lottery");
        desk.write("data/spam/corpus/home/INBOX.jsonl.gz", "Subject: the lease");
        // Quick exchanges only (a dose's alarm, a phone's background step): it travels all the same.
        let quick = |c: &Computer, now: i64| exchange(&Sharing { folder: &folder, computer: &c.id, key: &key, memory: &c.memory, files: false, hurry: None }, &stores(&Config::default(), &c.roots), now).unwrap();
        quick(&desk, NOW);
        let came = quick(&phone, NOW + MINUTE);
        assert!(came.written.contains(SPAM_TABLE), "{came:?}");
        assert_eq!(std::fs::read(phone.path("data/spam/table.bin")).unwrap(), std::fs::read(desk.path("data/spam/table.bin")).unwrap());
        assert!(!phone.path("data/spam/language.bin").exists() && !phone.path("data/spam/corpus").exists());
        assert!(!table::previous(&phone.path("data/spam/table.bin")).exists(), "nothing before the first");
        // Sealed: nothing of the table, nor of what is beside it, readable in the folder.
        let mut files = Vec::new();
        list_files(&folder, &folder, &[], &mut files);
        for (name, path) in &files {
            let bytes = std::fs::read(path).unwrap();
            for plain in [&b"SIOULSPM"[..], b"vocabulary", b"lottery"] {
                assert!(!bytes.windows(plain.len()).any(|w| w == plain), "{name}");
            }
        }
        // A new training: the phone takes it, the good one before kept beside.
        trained(1.5, 1_789_990_600);
        quick(&desk, NOW + 2 * MINUTE);
        assert!(quick(&phone, NOW + 3 * MINUTE).written.contains(SPAM_TABLE));
        let path = phone.path("data/spam/table.bin");
        assert_eq!((Table::read(&path).unwrap().bias, Table::read(&table::previous(&path)).unwrap().bias), (1.5, 0.5));
        // The language model and the corpus have no place in the sharing.
        let every = stores_of(&Config::default(), &desk.roots, &|_| true);
        for file in ["files/spam/language.bin", "files/spam/corpus/home/INBOX.jsonl.gz", "files/spam/", "data/spam/language.bin"] {
            assert!(locate(&every, file).is_none(), "{file}");
        }
        assert_eq!(locate(&every, SPAM_TABLE).map(|(s, p)| (s.part, p)), Some(("spam", desk.path("data/spam/table.bin"))));
        assert_eq!(shown(SPAM_TABLE), "spam/table.bin");
        let _ = std::fs::remove_dir_all(&base);
    }

    /// Item 11 of 9 October: the spam filter's tables a computer seals, about
    /// one a week, are not kept 90 days each: past the newest two, its own
    /// older ones leave the folder at once; another device's file stays. A
    /// phone that read none of them for a while takes the newest and asks
    /// for nothing older: a device reads the newest record of a file only,
    /// so their absence is never missed, today's Sioul or an older one.
    #[test]
    fn only_the_two_newest_spam_tables_stay_in_the_folder() {
        let base = scratch("spam-tables");
        let folder = base.join("folder");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let quick = |c: &Computer, now: i64| exchange(&Sharing { folder: &folder, computer: &c.id, key: &key, memory: &c.memory, files: false, hurry: None }, &stores(&Config::default(), &c.roots), now).unwrap();
        // Another device's sealed file: never this computer's to take out.
        let stranger = folder.join("blobs").join("0f".repeat(32));
        put(&folder, &format!("blobs/{}", "0f".repeat(32)), b"another device's");
        let tables = || std::fs::read_dir(folder.join("blobs")).unwrap().filter_map(Result::ok).filter(|e| !e.file_name().to_string_lossy().starts_with('.') && e.path() != stranger).count();
        // A training: a table of its own content, and its own time.
        let trained = |n: u64| {
            let path = desk.path("data/spam/table.bin");
            put(path.parent().unwrap(), "table.bin", &noise(4096, n as u32));
            std::fs::File::options().write(true).open(&path).unwrap().set_modified(std::time::UNIX_EPOCH + std::time::Duration::from_secs(1_789_990_000 + n * 600)).unwrap();
        };
        let mut now = NOW;
        for n in 1..=4 {
            trained(n);
            now += MINUTE;
            quick(&desk, now);
            now += MINUTE;
            let came = quick(&phone, now);
            assert!(came.problems.is_empty(), "{came:?}");
            assert_eq!(std::fs::read(phone.path("data/spam/table.bin")).unwrap(), noise(4096, n as u32));
            assert_eq!(tables(), n.min(2) as usize, "after training {n}");
        }
        assert_eq!(Memory::load_all(&desk.memory, &desk.id).sealed.tables.len(), 2);
        // The phone away for three trainings: back, it takes the newest, and nothing waits.
        for n in 5..=7 {
            trained(n);
            now += MINUTE;
            quick(&desk, now);
        }
        assert_eq!(tables(), 2);
        now += MINUTE;
        let came = quick(&phone, now);
        assert!(came.problems.is_empty() && came.pending == 0, "{came:?}");
        assert_eq!(std::fs::read(phone.path("data/spam/table.bin")).unwrap(), noise(4096, 7));
        let came = quick(&phone, now + 2 * DAY);
        assert!(came.problems.is_empty() && came.pending == 0, "nothing missing, a day on: {came:?}");
        assert!(stranger.exists(), "another device's file stays");
        let _ = std::fs::remove_dir_all(&base);
    }

    /// Each device writes its own label log; every device reads them all: a
    /// message said not spam on the phone is not spam on the desk (its
    /// `said_ham`), and what the phone's filter moved or flagged is known
    /// there, quick exchanges only. Sealed: no Message-ID readable in the folder.
    #[test]
    fn a_label_on_one_device_reaches_the_others() {
        use sioul_core::spam::labels::{self, Entry, Label, Moved, Source};
        let base = scratch("spam-labels");
        let folder = base.join("folder");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let quick = |c: &Computer, now: i64| exchange(&Sharing { folder: &folder, computer: &c.id, key: &key, memory: &c.memory, files: false, hurry: None }, &stores(&Config::default(), &c.roots), now).unwrap();
        let spam_state = |c: &Computer| c.roots.state.join("spam");
        // A message the desk's filter flagged, as the desk's Porch reads it.
        let mut card = sioul_core::card::Card::from_bytes(b"From: Prize <win@lottery.test>\r\nMessage-ID: <win-1@lottery.test>\r\nSubject: You won\r\n\r\nClaim it.\r\n").unwrap();
        card.account = Some("home".into());
        card.origin = Some(sioul_core::card::ImapOrigin { validity: 7, uid: 42 });
        assert!(!labels::said_ham_in(&labels::read_all_in(&spam_state(&desk)), &card));
        // "Not spam" on the phone; the phone's filter moved another message.
        let said = Entry { at: 1_791_360_000, account: "home".into(), folder: "INBOX".into(), uidvalidity: 7, uid: 42, message_id: Some("win-1@lottery.test".into()), label: Label::Ham, source: Source::NotSpam };
        labels::append_to(&labels::own_log(&spam_state(&phone), &phone.id), &said).unwrap();
        let moved = Moved { at: 1_791_360_100, account: "home".into(), folder: "INBOX".into(), uidvalidity: 7, uid: 43, message_id: Some("deal-2@shop.test".into()), class: sioul_core::spam::Class::Spam };
        labels::append_to(&labels::own_moved_log(&spam_state(&phone), &phone.id), &moved).unwrap();
        // And flagged a third where it is, as maybe spam: the training on the desk must know it.
        let flagged = Moved { at: 1_791_360_200, uid: 44, message_id: Some("flag-3@shop.test".into()), class: sioul_core::spam::Class::Unsure, ..moved.clone() };
        labels::append_to(&labels::own_flagged_log(&spam_state(&phone), &phone.id), &flagged).unwrap();
        quick(&phone, NOW);
        let came = quick(&desk, NOW + MINUTE);
        let theirs = format!("{SPAM_LABELS}{}.jsonl", phone.id);
        assert!(came.written.contains(SPAM_LABELS) && came.written.contains(SPAM_MOVED) && came.written.contains(SPAM_FLAGGED) && came.received == 3, "{came:?}");
        assert!(desk.roots.state.join("spam/labels").join(format!("{}.jsonl", phone.id)).exists(), "the phone's own file, beside the desk's");
        // On the desk: the phone's own file, read with the desk's own; the message not spam there too.
        assert!(labels::said_ham_in(&labels::read_all_in(&spam_state(&desk)), &card));
        assert_eq!(labels::read_moved_in(&spam_state(&desk)), vec![moved]);
        assert_eq!(labels::read_flagged_in(&spam_state(&desk)), vec![flagged]);
        // The desk says spam later, on its own log: the newest word wins on both devices.
        let later = Entry { at: 1_791_360_500, label: Label::Spam, source: Source::Junk, ..said.clone() };
        labels::append_to(&labels::own_log(&spam_state(&desk), &desk.id), &later).unwrap();
        quick(&desk, NOW + 2 * MINUTE);
        quick(&phone, NOW + 3 * MINUTE);
        for device in [&desk, &phone] {
            let all = labels::read_all_in(&spam_state(device));
            assert_eq!(all.len(), 2);
            assert!(!labels::said_ham_in(&all, &card));
        }
        // Each file has one writer: the phone's own log unchanged on the phone but for its own line.
        assert_eq!(labels::read_from::<Entry>(&labels::own_log(&spam_state(&phone), &phone.id)), vec![said]);
        // Sealed: nothing of them readable in the folder.
        let mut files = Vec::new();
        list_files(&folder, &folder, &[], &mut files);
        for (name, path) in &files {
            let bytes = std::fs::read(path).unwrap();
            for plain in [&b"win-1@lottery.test"[..], b"not-spam", b"deal-2", b"flag-3"] {
                assert!(!bytes.windows(plain.len()).any(|w| w == plain), "{name}");
            }
        }
        let every = stores_of(&Config::default(), &desk.roots, &|_| true);
        assert_eq!(locate(&every, &theirs).map(|(s, _)| s.part), Some("spam"));
        let _ = std::fs::remove_dir_all(&base);
    }

    /// A call a phone declined, as Java wrote it (fiction numbers only).
    fn declined(at: i64, key: &str) -> sioul_core::calls::Held {
        sioul_core::calls::Held { at, key: key.into(), number: key.into(), who: "stranger".into(), name: "Cabinet du Dr Martin".into(), column: "sleep".into(), why: "matrix".into(), ..sioul_core::calls::Held::default() }
    }

    /// The calls' folder of a device.
    fn calls_of(c: &Computer) -> PathBuf {
        c.roots.state.join(sioul_core::calls::FOLDER)
    }

    /// A phone copies Java's call into its own log; the desk hears of it,
    /// marks it seen, and the phone hears of that. Sealed in the folder,
    /// remembered beside `memory.json`, never kept as an earlier version or a
    /// first-share copy; with `files.json` lost, nothing goes out again.
    #[test]
    fn a_phone_s_calls_reach_the_desk_and_seen_comes_back() {
        use sioul_core::calls;
        let base = scratch("calls");
        let folder = base.join("folder");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let own = calls::own_file(&calls_of(&phone), calls::LOG, &phone.id);
        assert_eq!(calls::carry_into(&own, &[declined(NOW - 3_600_000, "+33199001234")], None, NOW).unwrap(), 1);
        phone.exchange(&folder, &key, NOW);
        let came = desk.exchange(&folder, &key, NOW + MINUTE);
        assert!(came.written.contains(CALLS_LOG), "{came:?}");
        let on_desk = calls::read_logs(&calls_of(&desk), NOW + MINUTE);
        assert_eq!(on_desk.iter().map(|h| (h.device.as_str(), h.key.as_str(), h.rang, h.name.as_str())).collect::<Vec<_>>(), [(phone.id.as_str(), "+33199001234", false, "Cabinet du Dr Martin")]);
        // Seen on the desk, in its own log: the phone hears of it.
        calls::mark_seen(&calls_of(&desk), &desk.id, &[on_desk[0].id()], NOW + 2 * MINUTE).unwrap();
        desk.exchange(&folder, &key, NOW + 3 * MINUTE);
        let came = phone.exchange(&folder, &key, NOW + 4 * MINUTE);
        assert!(came.written.contains(CALLS_SEEN), "{came:?}");
        assert!(calls::read_seen(&calls_of(&phone)).seen.contains(&on_desk[0].id()));
        // Each file has one writer: the phone never wrote a seen line, the desk no call.
        assert!(!calls::own_file(&calls_of(&phone), calls::SEEN_LOG, &phone.id).exists());
        assert!(!calls::own_file(&calls_of(&desk), calls::LOG, &desk.id).exists());
        // Sealed: nothing of them readable in the folder.
        let mut files = Vec::new();
        list_files(&folder, &folder, &[], &mut files);
        for (name, path) in &files {
            let bytes = std::fs::read(path).unwrap();
            for plain in [&b"199001234"[..], b"Cabinet", b"stranger"] {
                assert!(!bytes.windows(plain.len()).any(|w| w == plain), "{name}");
            }
        }
        let every = stores_of(&Config::default(), &desk.roots, &|_| true);
        assert_eq!(locate(&every, &format!("{CALLS_LOG}{}.jsonl", phone.id)).map(|(s, _)| s.part), Some("calls"));
        for c in [&desk, &phone] {
            // Remembered beside memory.json, never in it.
            let small = Memory::load(&c.memory, &c.id);
            assert!(small.entries.keys().chain(small.files.keys()).chain(small.pending.keys()).all(|k| !calls_store(k)), "memory.json stays small");
            assert!(Memory::load_all(&c.memory, &c.id).entries.keys().any(|k| calls_store(k)));
            // Neither an earlier version nor a first-share copy of a log of calls.
            let share = c.memory.parent().unwrap();
            let mut kept = Vec::new();
            list_files(share, share, &[], &mut kept);
            assert!(kept.iter().all(|(name, _)| !name.contains("calls")), "{kept:?}");
        }
        // files.json lost: the calls' stores join again, and nothing goes out again as new.
        std::fs::remove_file(sealed_path(&desk.memory)).unwrap();
        let again = desk.exchange(&folder, &key, NOW + 5 * MINUTE);
        assert_eq!(again.sent, 0, "{again:?}");
        assert_eq!(calls::read_logs(&calls_of(&desk), NOW + 5 * MINUTE).len(), 1);
        let _ = std::fs::remove_dir_all(&base);
    }

    /// Two phones and a desk: each phone's log its own, every device reading both.
    #[test]
    fn several_phones_each_keep_their_own_log() {
        use sioul_core::calls;
        let base = scratch("calls-phones");
        let folder = base.join("folder");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, a, b) = (Computer::new(&base, "desk"), Computer::new(&base, "phone-a"), Computer::new(&base, "phone-b"));
        calls::carry_into(&calls::own_file(&calls_of(&a), calls::LOG, &a.id), &[declined(NOW - 7_200_000, "+33199001234")], None, NOW).unwrap();
        calls::carry_into(&calls::own_file(&calls_of(&b), calls::LOG, &b.id), &[declined(NOW - 3_600_000, "+33465710042")], None, NOW).unwrap();
        for (n, c) in [&a, &b, &desk, &a, &b].iter().enumerate() {
            c.exchange(&folder, &key, NOW + n as i64 * MINUTE);
        }
        for c in [&desk, &a, &b] {
            let heard = calls::read_logs(&calls_of(c), NOW + 10 * MINUTE);
            assert_eq!(heard.iter().map(|h| (h.device.clone(), h.key.clone())).collect::<Vec<_>>(), [(a.id.clone(), "+33199001234".to_string()), (b.id.clone(), "+33465710042".to_string())]);
        }
        let _ = std::fs::remove_dir_all(&base);
    }

    /// An older Sioul knows neither of the calls' stores: their records wait,
    /// written nowhere, taken out nowhere; updated, it reads them.
    #[test]
    fn an_older_sioul_keeps_the_calls_waiting() {
        use sioul_core::calls;
        let base = scratch("calls-older");
        let folder = base.join("folder");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let own = calls::own_file(&calls_of(&phone), calls::LOG, &phone.id);
        calls::carry_into(&own, &[declined(NOW - 3_600_000, "+33199001234")], None, NOW).unwrap();
        phone.exchange(&folder, &key, NOW);
        // The desk's older Sioul: no store of calls, and none known.
        let older_stores = stores(&Config::default(), &desk.roots).into_iter().filter(|s| !calls_store(&s.name)).collect::<Vec<_>>();
        OLDER.with(|older| *older.borrow_mut() = vec![CALLS_LOG.to_string(), CALLS_SEEN.to_string()]);
        for n in 1..=3 {
            let outcome = exchange(&Sharing { folder: &folder, computer: &desk.id, key: &key, memory: &desk.memory, files: true, hurry: None }, &older_stores, NOW + n * MINUTE).unwrap();
            assert_eq!(outcome.pending, 1, "kept waiting: {outcome:?}");
        }
        assert!(!calls_of(&desk).exists(), "nothing written");
        phone.exchange(&folder, &key, NOW + 4 * MINUTE);
        assert_eq!(calls::read_held(&own).len(), 1, "nothing taken out");
        // Updated: it knows both stores, they join, and the call comes in.
        OLDER.with(|older| older.borrow_mut().clear());
        let came = desk.exchange(&folder, &key, NOW + 5 * MINUTE);
        assert!(came.written.contains(CALLS_LOG) && came.pending == 0, "{came:?}");
        assert_eq!(calls::read_logs(&calls_of(&desk), NOW + 5 * MINUTE).len(), 1);
        let _ = std::fs::remove_dir_all(&base);
    }

    /// Batch A (18 October 2026): your security keys as a computer read them
    /// (`data/pgp/cards/`) come to every device that knows the store; an
    /// older Sioul keeps them waiting, writes them nowhere, takes nothing
    /// out; updated, it reads them.
    #[test]
    fn an_older_sioul_keeps_your_security_keys_waiting() {
        let base = scratch("cards-older");
        let folder = base.join("folder");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let store = "data/pgp/cards/";
        let card_file = desk.roots.data.join("pgp").join(sioul_core::securitykey::SHARED_CARDS).join("0006-12345678.toml");
        std::fs::create_dir_all(card_file.parent().unwrap()).unwrap();
        std::fs::write(&card_file, "[card]\nident = \"0006:12345678\"\ncert = \"AB\"\n").unwrap();
        desk.exchange(&folder, &key, NOW);
        // The phone's older Sioul: no such store, none known.
        let older_stores = stores(&Config::default(), &phone.roots).into_iter().filter(|s| s.name != store).collect::<Vec<_>>();
        OLDER.with(|older| *older.borrow_mut() = vec![store.to_string()]);
        for n in 1..=2 {
            let outcome = exchange(&Sharing { folder: &folder, computer: &phone.id, key: &key, memory: &phone.memory, files: true, hurry: None }, &older_stores, NOW + n * MINUTE).unwrap();
            assert_eq!(outcome.pending, 1, "kept waiting: {outcome:?}");
        }
        assert!(!phone.roots.data.join("pgp").join("cards").exists(), "nothing written");
        desk.exchange(&folder, &key, NOW + 3 * MINUTE);
        assert!(card_file.exists(), "nothing taken out");
        // Updated: it knows the store, and the key's file comes in.
        OLDER.with(|older| older.borrow_mut().clear());
        let came = phone.exchange(&folder, &key, NOW + 4 * MINUTE);
        assert!(came.written.contains(store) && came.pending == 0, "{came:?}");
        assert_eq!(std::fs::read(phone.roots.data.join("pgp").join("cards").join("0006-12345678.toml")).unwrap(), std::fs::read(&card_file).unwrap());
        let _ = std::fs::remove_dir_all(&base);
    }

    /// The part switched off on the desk: nothing of it comes, nothing waits.
    #[test]
    fn the_calls_part_switched_off_receives_nothing_and_keeps_nothing_waiting() {
        use sioul_core::calls;
        let base = scratch("calls-off");
        let folder = base.join("folder");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        calls::carry_into(&calls::own_file(&calls_of(&phone), calls::LOG, &phone.id), &[declined(NOW - 3_600_000, "+33199001234")], None, NOW).unwrap();
        phone.exchange(&folder, &key, NOW);
        let off = stores_of(&Config::default(), &desk.roots, &|part| part != "calls" && shared_by_default(part, &Config::default()));
        let outcome = exchange(&Sharing { folder: &folder, computer: &desk.id, key: &key, memory: &desk.memory, files: true, hurry: None }, &off, NOW + MINUTE).unwrap();
        assert_eq!(outcome.pending, 0, "{outcome:?}");
        assert!(!calls_of(&desk).exists());
        // Switched on again, it joins and reads them then.
        let came = desk.exchange(&folder, &key, NOW + 2 * MINUTE);
        assert!(came.written.contains(CALLS_LOG), "{came:?}");
        let _ = std::fs::remove_dir_all(&base);
    }

    /// A month on, the phone takes its own line out: every device's copy loses it.
    #[test]
    fn a_trimmed_line_leaves_every_device() {
        use sioul_core::calls;
        let base = scratch("calls-trim");
        let folder = base.join("folder");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let own = calls::own_file(&calls_of(&phone), calls::LOG, &phone.id);
        calls::carry_into(&own, &[declined(NOW - 3_600_000, "+33199001234")], None, NOW).unwrap();
        phone.exchange(&folder, &key, NOW);
        desk.exchange(&folder, &key, NOW + MINUTE);
        assert_eq!(calls::read_held(&calls::own_file(&calls_of(&desk), calls::LOG, &phone.id)).len(), 1);
        let later = NOW + (calls::KEPT_DAYS + 1) * 86_400_000;
        assert_eq!(calls::trim_own(&calls_of(&phone), &phone.id, later).unwrap(), 1);
        phone.exchange(&folder, &key, later);
        desk.exchange(&folder, &key, later + MINUTE);
        assert!(calls::read_held(&calls::own_file(&calls_of(&desk), calls::LOG, &phone.id)).is_empty(), "gone from the desk's copy too");
        let _ = std::fs::remove_dir_all(&base);
    }

    /// A message a phone's notification brought (fiction numbers only).
    fn texted(at: i64) -> sioul_core::phonemsgs::Line {
        sioul_core::phonemsgs::Line {
            at,
            id: format!("{at}-0123456789abcdef"),
            app: "foundation.e.message".into(),
            label: "Message".into(),
            kind: "text".into(),
            name: "Cabinet du Dr Martin".into(),
            key: "+33199001234".into(),
            who: "neutral".into(),
            text: "Votre rendez-vous est déplacé à jeudi 10 h 30.".into(),
            shows: at,
            notice: sioul_core::replies::notice("foundation.e.message", "0|foundation.e.message|7|null|10123"),
            ..sioul_core::phonemsgs::Line::default()
        }
    }

    /// The phones' messages' folder of a device.
    fn messages_of(c: &Computer) -> PathBuf {
        c.roots.state.join(sioul_core::phonemsgs::FOLDER)
    }

    /// A phone's message reaches the desk, both with the part on: sealed and
    /// padded in the folder, remembered beside `memory.json`, never kept as an
    /// earlier version; Seen on the desk comes back to the phone.
    #[test]
    fn a_phone_s_messages_reach_the_desk_sealed_and_seen_comes_back() {
        use sioul_core::{calls, phonemsgs};
        let base = scratch("phone-messages");
        let (folder, notes) = (base.join("folder"), base.join("notes"));
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let on = [phonemsgs::PART];
        let own = calls::own_file(&messages_of(&phone), phonemsgs::LOG, &phone.id);
        assert_eq!(phonemsgs::carry_into(&own, &[texted(NOW - 3_600_000)], NOW).unwrap(), 1);
        assert!(std::fs::read_to_string(&own).unwrap().lines().all(|l| l.len() % phonemsgs::PAD_STEP == 0), "padded");
        phone.exchange_with(&folder, &key, NOW, &notes, &on);
        let came = desk.exchange_with(&folder, &key, NOW + MINUTE, &notes, &on);
        assert!(came.written.contains(PHONE_MESSAGES_LOG), "{came:?}");
        let on_desk = phonemsgs::read_logs(&messages_of(&desk), NOW + MINUTE);
        assert_eq!(on_desk.iter().map(|l| (l.device.as_str(), l.key.as_str(), l.text.as_str())).collect::<Vec<_>>(), [(phone.id.as_str(), "+33199001234", "Votre rendez-vous est déplacé à jeudi 10 h 30.")]);
        // Seen on the desk, in its own log: the phone hears of it.
        calls::mark_seen(&messages_of(&desk), &desk.id, &[on_desk[0].id.clone()], NOW + 2 * MINUTE).unwrap();
        desk.exchange_with(&folder, &key, NOW + 3 * MINUTE, &notes, &on);
        let came = phone.exchange_with(&folder, &key, NOW + 4 * MINUTE, &notes, &on);
        assert!(came.written.contains(PHONE_MESSAGES_SEEN), "{came:?}");
        assert!(calls::read_seen(&messages_of(&phone)).seen.contains(&on_desk[0].id));
        // What its notification offers a reply, from the phone's own live file: the desk reads it.
        let live = sioul_core::replies::Live { notice: on_desk[0].notice.clone(), app: "foundation.e.message".into(), reply: true, read: true, at: NOW + 4 * MINUTE, ..Default::default() };
        assert!(!live.notice.is_empty());
        assert!(sioul_core::replies::offer(&sioul_core::replies::live_file(&messages_of(&phone), &phone.id), &live).unwrap());
        phone.exchange_with(&folder, &key, NOW + 4 * MINUTE + 1_000, &notes, &on);
        let came = desk.exchange_with(&folder, &key, NOW + 4 * MINUTE + 2_000, &notes, &on);
        assert!(came.written.contains(PHONE_MESSAGES_LIVE), "{came:?}");
        let offered = sioul_core::replies::read_live(&messages_of(&desk), NOW + 5 * MINUTE);
        assert_eq!(offered.get(&(phone.id.clone(), live.notice.clone())).map(|l| (l.reply, l.read)), Some((true, true)));
        // Sealed: nothing of it readable in the folder.
        let mut files = Vec::new();
        list_files(&folder, &folder, &[], &mut files);
        for (name, path) in &files {
            let bytes = std::fs::read(path).unwrap();
            for plain in [&b"199001234"[..], b"Cabinet", b"rendez-vous", b"neutral", b"foundation.e.message", on_desk[0].notice.as_bytes()] {
                assert!(!bytes.windows(plain.len()).any(|w| w == plain), "{name}");
            }
        }
        let every = stores_of(&Config::default(), &desk.roots, &|_| true);
        assert_eq!(locate(&every, &format!("{PHONE_MESSAGES_LOG}{}.jsonl", phone.id)).map(|(s, _)| s.part), Some(phonemsgs::PART));
        for c in [&desk, &phone] {
            let small = Memory::load(&c.memory, &c.id);
            assert!(small.entries.keys().chain(small.files.keys()).chain(small.pending.keys()).all(|k| !calls_store(k)), "memory.json stays small");
            let share = c.memory.parent().unwrap();
            let mut kept = Vec::new();
            list_files(share, share, &[], &mut kept);
            assert!(kept.iter().all(|(name, _)| !name.contains("phone-messages")), "{kept:?}");
        }
        // files.json lost: nothing goes out again as new.
        std::fs::remove_file(sealed_path(&desk.memory)).unwrap();
        let again = desk.exchange_with(&folder, &key, NOW + 5 * MINUTE, &notes, &on);
        assert_eq!(again.sent, 0, "{again:?}");
        let _ = std::fs::remove_dir_all(&base);
    }

    /// A reply written on the desk to the phone's notification reaches the
    /// phone sealed, at rest and in the folder; the phone counts the desk,
    /// decides the request once (its ledger, whatever is read again), and its
    /// outcome comes back to the desk without the words.
    #[test]
    fn a_reply_written_on_the_desk_is_decided_once_and_its_outcome_comes_back() {
        use sioul_core::{calls, phonemsgs, replies, texts::Sealer};
        let base = scratch("replies");
        let (folder, notes, private) = (base.join("folder"), base.join("notes"), base.join("phone-private"));
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let seal = crate::textseal::ReplySeal::new(&key);
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let on = [phonemsgs::PART];
        // The phone's line the reply answers, in its own log.
        let line = texted(NOW - 3 * MINUTE);
        phonemsgs::carry_into(&calls::own_file(&messages_of(&phone), phonemsgs::LOG, &phone.id), std::slice::from_ref(&line), NOW).unwrap();
        // The listener relayed it: the replies' ledger's mark made then, before any request (`replies::mark_ledger`).
        replies::mark_ledger(&private, NOW).unwrap();
        phone.exchange_with(&folder, &key, NOW, &notes, &on);
        desk.exchange_with(&folder, &key, NOW + 1_000, &notes, &on);
        let ask = replies::Ask { key: "0123456789abcdef0123456789abcdef".into(), phone: phone.id.clone(), verb: "reply".into(), notice: line.notice.clone(), app: line.app.clone(), line: line.id.clone(), words: "J'arrive dans dix minutes.".into(), written: NOW + MINUTE, ..replies::Ask::default() };
        assert!(replies::write_ask(&messages_of(&desk), &desk.id, &ask, &seal).unwrap());
        desk.exchange_with(&folder, &key, NOW + MINUTE, &notes, &on);
        let came = phone.exchange_with(&folder, &key, NOW + 2 * MINUTE, &notes, &on);
        assert!(came.written.contains(PHONE_MESSAGES_ASK), "{came:?}");
        let (asks, _) = replies::read_asks(&[messages_of(&phone)], &seal);
        assert_eq!(asks.iter().map(|a| (a.key.as_str(), a.device.as_str(), a.words.as_str())).collect::<Vec<_>>(), [(ask.key.as_str(), desk.id.as_str(), "J'arrive dans dix minutes.")]);
        let counted = counting(&folder, &key, &phone.memory, &phone.id, NOW + 2 * MINUTE);
        assert!(counted.contains(&desk.id), "{counted:?}");
        let decide = |now: i64| {
            let ledger = replies::open_ledger(&private, now).unwrap();
            let lines = phonemsgs::read_file(&calls::own_file(&messages_of(&phone), phonemsgs::LOG, &phone.id));
            let (asks, cancelled) = replies::read_asks(&[messages_of(&phone)], &seal);
            let (unsent, went) = (replies::unsent(&private), replies::went_keys(&private));
            let judge = replies::Judge { here: &phone.id, now_ms: now, ledger: &ledger, lines: &lines, standing: &|d: &str| if counted.contains(d) { sioul_core::texts::Standing::Counted } else { sioul_core::texts::Standing::Gone }, cancelled: &cancelled, answers: &|_: &str| true, unsent: &unsent, went: &went };
            asks.iter().map(|a| replies::verdict(a, &judge)).collect::<Vec<_>>()
        };
        assert_eq!(decide(NOW + 2 * MINUTE), [replies::Verdict::Send]);
        sioul_core::texts::record(&private, &replies::claim_of(&ask, &line.talk, NOW + 2 * MINUTE)).unwrap();
        // The listener handed it: the phone's word, back to the desk.
        let own = calls::own_file(&messages_of(&phone), replies::OUTCOME, &phone.id);
        replies::say_outcomes(&own, &[replies::Outcome { key: ask.key.clone(), state: "handed".into(), at: NOW + 2 * MINUTE, ..replies::Outcome::default() }]).unwrap();
        phone.exchange_with(&folder, &key, NOW + 3 * MINUTE, &notes, &on);
        let came = desk.exchange_with(&folder, &key, NOW + 4 * MINUTE, &notes, &on);
        assert!(came.written.contains(PHONE_MESSAGES_OUTCOME), "{came:?}");
        let outcomes = replies::read_outcomes(&messages_of(&desk));
        assert_eq!(outcomes.iter().map(|o| (o.key.as_str(), o.state.as_str(), o.device.as_str())).collect::<Vec<_>>(), [(ask.key.as_str(), "handed", phone.id.as_str())]);
        // Sealed in the folder, and at rest on both devices.
        for root in [&folder, &desk.roots.state, &phone.roots.state] {
            let mut files = Vec::new();
            list_files(root, root, &[], &mut files);
            for (name, path) in &files {
                let bytes = std::fs::read(path).unwrap();
                assert!(!bytes.windows(b"dix minutes".len()).any(|w| w == b"dix minutes"), "{name}");
            }
        }
        assert!(seal.open(std::fs::read_to_string(calls::own_file(&messages_of(&phone), replies::ASK, &desk.id)).unwrap().lines().next().unwrap()).is_some());
        // The phone's files.json lost: the request read again, decided once.
        std::fs::remove_file(sealed_path(&phone.memory)).unwrap();
        phone.exchange_with(&folder, &key, NOW + 5 * MINUTE, &notes, &on);
        assert_eq!(decide(NOW + 5 * MINUTE), [replies::Verdict::Decided]);
        let _ = std::fs::remove_dir_all(&base);
    }

    /// Who may ask the phone (`counting`): a computer you forgot counts again
    /// only by a sealed fact newer than the forgetting, as `present` says (a
    /// record of its read here since, or an entry it wrote since); its plain
    /// notes written fresh in the folder, which anyone could write, change
    /// nothing. A forgotten computer still running Sioul counts again as soon
    /// as it shares anything: only a new passphrase cuts a device off.
    #[test]
    fn a_forgotten_computer_counts_again_only_by_a_sealed_fact() {
        let base = scratch("counting-forgotten");
        let folder = base.join("folder");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        desk.write("data/drafts/2026-10-01.json", "{\"steps\": 1}");
        desk.exchange(&folder, &key, NOW);
        phone.exchange(&folder, &key, NOW + MINUTE);
        assert!(counting(&folder, &key, &phone.memory, &phone.id, NOW + MINUTE).contains(&desk.id));
        forget_device(&folder, &key, &phone.memory, &phone.id, &desk.id).unwrap();
        assert!(!counting(&folder, &key, &phone.memory, &phone.id, NOW + 2 * MINUTE).contains(&desk.id), "forgotten");
        // Plain notes in its name, said fresh: no sealed fact.
        std::fs::write(seen_path(&folder, &desk.id), format!("at = {}\nround = 9\n", (NOW + 3 * MINUTE) / 1000)).unwrap();
        phone.exchange(&folder, &key, NOW + 3 * MINUTE);
        assert!(!counting(&folder, &key, &phone.memory, &phone.id, NOW + 3 * MINUTE).contains(&desk.id), "plain notes are no sealed fact");
        // A record of its, sealed, read here since: it counts again.
        desk.write("data/drafts/2026-10-02.json", "{\"steps\": 2}");
        desk.exchange(&folder, &key, NOW + 4 * MINUTE);
        phone.exchange(&folder, &key, NOW + 5 * MINUTE);
        assert!(counting(&folder, &key, &phone.memory, &phone.id, NOW + 5 * MINUTE).contains(&desk.id), "a sealed record newer than the forgetting");
        let _ = std::fs::remove_dir_all(&base);
    }

    /// Who may ask, in three (`asking`): counted; gone by a sealed fact (you
    /// forgot it); not known yet (no record of it here: a new computer whose
    /// first request comes before its records), which neither set holds.
    #[test]
    fn a_device_not_known_yet_is_neither_counted_nor_gone() {
        let base = scratch("asking");
        let folder = base.join("folder");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        phone.exchange(&folder, &key, NOW);
        let (counted, gone) = asking(&folder, &key, &phone.memory, &phone.id, NOW);
        assert!(!counted.contains(&desk.id) && !gone.contains(&desk.id), "no record of the desk yet");
        desk.write("data/drafts/2026-10-01.json", "{\"steps\": 1}");
        desk.exchange(&folder, &key, NOW + MINUTE);
        phone.exchange(&folder, &key, NOW + 2 * MINUTE);
        let (counted, gone) = asking(&folder, &key, &phone.memory, &phone.id, NOW + 2 * MINUTE);
        assert!(counted.contains(&desk.id) && !gone.contains(&desk.id));
        forget_device(&folder, &key, &phone.memory, &phone.id, &desk.id).unwrap();
        let (counted, gone) = asking(&folder, &key, &phone.memory, &phone.id, NOW + 3 * MINUTE);
        assert!(!counted.contains(&desk.id) && gone.contains(&desk.id), "forgotten: gone");
        let (counted, gone) = asking(&folder, &key, &phone.memory, &phone.id, NOW + 3 * MINUTE);
        assert!(!counted.contains("laptop-never-seen") && !gone.contains("laptop-never-seen"));
        let _ = std::fs::remove_dir_all(&base);
    }

    /// The part is off until turned on, on every device: a desk that never
    /// turned it on receives nothing and keeps nothing waiting; turned on, it
    /// reads them. A phone that never turned it on sends nothing.
    #[test]
    fn the_phone_messages_part_is_off_until_turned_on_and_off_receives_nothing() {
        use sioul_core::{calls, phonemsgs};
        let base = scratch("phone-messages-off");
        let (folder, notes) = (base.join("folder"), base.join("notes"));
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        assert!(!shared_by_default(phonemsgs::PART, &Config::default()));
        assert!(stores(&Config::default(), &desk.roots).iter().all(|s| s.part != phonemsgs::PART));
        phonemsgs::carry_into(&calls::own_file(&messages_of(&phone), phonemsgs::LOG, &phone.id), &[texted(NOW - 3_600_000)], NOW).unwrap();
        // The phone's part off: nothing of it leaves.
        phone.exchange(&folder, &key, NOW);
        desk.exchange_with(&folder, &key, NOW + MINUTE, &notes, &[phonemsgs::PART]);
        assert!(phonemsgs::read_logs(&messages_of(&desk), NOW + MINUTE).is_empty(), "the phone's part off");
        // The phone's on, the desk's off: nothing comes, nothing waits.
        phone.exchange_with(&folder, &key, NOW + 2 * MINUTE, &notes, &[phonemsgs::PART]);
        let outcome = desk.exchange(&folder, &key, NOW + 3 * MINUTE);
        assert_eq!(outcome.pending, 0, "{outcome:?}");
        assert!(!messages_of(&desk).join(phonemsgs::LOG).exists());
        // Turned on on the desk: it joins and reads it.
        let came = desk.exchange_with(&folder, &key, NOW + 4 * MINUTE, &notes, &[phonemsgs::PART]);
        assert!(came.written.contains(PHONE_MESSAGES_LOG), "{came:?}");
        assert_eq!(phonemsgs::read_logs(&messages_of(&desk), NOW + 4 * MINUTE).len(), 1);
        let _ = std::fs::remove_dir_all(&base);
    }

    /// A week on, the phone takes its own line out: every device's copy loses it.
    #[test]
    fn a_trimmed_line_of_phone_messages_leaves_every_device() {
        use sioul_core::{calls, phonemsgs};
        let base = scratch("phone-messages-trim");
        let (folder, notes) = (base.join("folder"), base.join("notes"));
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let on = [phonemsgs::PART];
        let own = calls::own_file(&messages_of(&phone), phonemsgs::LOG, &phone.id);
        phonemsgs::carry_into(&own, &[texted(NOW - 3_600_000)], NOW).unwrap();
        phone.exchange_with(&folder, &key, NOW, &notes, &on);
        desk.exchange_with(&folder, &key, NOW + MINUTE, &notes, &on);
        let theirs = calls::own_file(&messages_of(&desk), phonemsgs::LOG, &phone.id);
        assert_eq!(phonemsgs::read_file(&theirs).len(), 1);
        let later = NOW + phonemsgs::KEPT_DAYS * 86_400_000;
        assert_eq!(phonemsgs::trim_own(&messages_of(&phone), &phone.id, later).unwrap(), 1);
        phone.exchange_with(&folder, &key, later, &notes, &on);
        desk.exchange_with(&folder, &key, later + MINUTE, &notes, &on);
        assert!(phonemsgs::read_file(&theirs).is_empty(), "gone from the desk's copy too");
        let _ = std::fs::remove_dir_all(&base);
    }

    /// An older Sioul knows neither of the phones' messages' stores: their
    /// records wait, written nowhere; updated, it reads them.
    #[test]
    fn an_older_sioul_keeps_the_phone_s_messages_waiting() {
        use sioul_core::{calls, phonemsgs};
        let base = scratch("phone-messages-older");
        let (folder, notes) = (base.join("folder"), base.join("notes"));
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let on = [phonemsgs::PART];
        phonemsgs::carry_into(&calls::own_file(&messages_of(&phone), phonemsgs::LOG, &phone.id), &[texted(NOW - 3_600_000)], NOW).unwrap();
        phone.exchange_with(&folder, &key, NOW, &notes, &on);
        // The desk's older Sioul: no store of the phones' messages, and none known.
        let older_stores = desk.stores_with(&notes, &|part| part == phonemsgs::PART).into_iter().filter(|s| s.part != phonemsgs::PART).collect::<Vec<_>>();
        OLDER.with(|older| *older.borrow_mut() = vec![PHONE_MESSAGES_LOG.to_string(), PHONE_MESSAGES_SEEN.to_string()]);
        for n in 1..=2 {
            let outcome = exchange(&Sharing { folder: &folder, computer: &desk.id, key: &key, memory: &desk.memory, files: true, hurry: None }, &older_stores, NOW + n * MINUTE).unwrap();
            assert_eq!(outcome.pending, 1, "kept waiting: {outcome:?}");
        }
        assert!(!messages_of(&desk).exists(), "nothing written");
        OLDER.with(|older| older.borrow_mut().clear());
        let came = desk.exchange_with(&folder, &key, NOW + 3 * MINUTE, &notes, &on);
        assert!(came.written.contains(PHONE_MESSAGES_LOG) && came.pending == 0, "{came:?}");
        let _ = std::fs::remove_dir_all(&base);
    }

    // ---------------------------------------------------------------- texts (SMS phase b)

    /// The texts' folder of a device (in its data folder).
    fn texts_of(c: &Computer) -> PathBuf {
        c.roots.data.join(sioul_core::texts::FOLDER)
    }

    /// A text a computer asks the phone to send (fiction numbers only).
    fn to_send(key: &str, phone: &str, written: i64) -> sioul_core::texts::Request {
        sioul_core::texts::Request { key: key.into(), phone: phone.into(), to: "01 99 00 12 34".into(), body: "J'arrive dans dix minutes.".into(), sub: -1, written, ..sioul_core::texts::Request::default() }
    }

    /// The phone's step as the app takes it: every request read, decided,
    /// claimed in the ledger before it is "sent", its outcome written.
    fn phone_step(phone: &Computer, ledger: &Path, seal: &crate::textseal::TextSeal, now: i64) -> Vec<String> {
        use sioul_core::texts;
        let book = texts::Ledger::open(ledger, now).unwrap();
        let mut sent = Vec::new();
        for r in texts::read_requests(&texts_of(phone), seal) {
            if texts::verdict(&r, &phone.id, now, &book, None, &|_| texts::Standing::Counted) == texts::Verdict::Send {
                texts::record(ledger, &texts::Claim { key: r.key.clone(), at: now, state: "claimed".into(), ..texts::Claim::default() }).unwrap();
                let outcome = texts::Outcome { key: r.key.clone(), state: "sent".into(), at: now, row: "sms-412".into(), ..texts::Outcome::default() };
                texts::append(&texts::own_file(&texts_of(phone), texts::OUTCOME, &phone.id), &[outcome], seal, None).unwrap();
                sent.push(r.key);
            }
        }
        sent
    }

    /// A text written on the desk reaches the phone, which sends it once and
    /// says so; the desk hears it. Sealed in the folder and at rest on each
    /// device, remembered beside `memory.json`; read again after `files.json`
    /// is lost, it is never sent twice.
    #[test]
    fn a_text_written_on_the_desk_is_sent_once_by_the_phone_and_its_outcome_comes_back() {
        use sioul_core::texts::{self, Sealer};
        let base = scratch("texts");
        let (folder, notes, ledger) = (base.join("folder"), base.join("notes"), base.join("phone-private"));
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let seal = crate::textseal::TextSeal::new(&key);
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let on = [texts::PART];
        texts::Ledger::open(&ledger, NOW - MINUTE).unwrap();
        let request = to_send("0123456789abcdef0123456789abcdef", &phone.id, NOW);
        texts::write_request(&texts_of(&desk), &desk.id, &request, &seal).unwrap();
        desk.exchange_with(&folder, &key, NOW, &notes, &on);
        let came = phone.exchange_with(&folder, &key, NOW + MINUTE, &notes, &on);
        assert!(came.written.contains(TEXTS_SEND), "{came:?}");
        assert_eq!(phone_step(&phone, &ledger, &seal, NOW + MINUTE), [request.key.clone()]);
        phone.exchange_with(&folder, &key, NOW + 2 * MINUTE, &notes, &on);
        let came = desk.exchange_with(&folder, &key, NOW + 3 * MINUTE, &notes, &on);
        assert!(came.written.contains(TEXTS_OUTCOME), "{came:?}");
        let outcomes = texts::read_outcomes(&texts_of(&desk), &seal);
        assert_eq!(texts::state_of(&request.key, &outcomes).map(|o| o.state.as_str()), Some("sent"));
        // Sealed in the folder, and at rest on both devices.
        for root in [&folder, &desk.roots.data, &phone.roots.data] {
            let mut files = Vec::new();
            list_files(root, root, &[], &mut files);
            for (name, path) in &files {
                let bytes = std::fs::read(path).unwrap();
                for plain in [&b"199001234"[..], b"dix minutes", b"sms-412"] {
                    assert!(!bytes.windows(plain.len()).any(|w| w == plain), "{name}");
                }
            }
        }
        assert!(seal.open(std::fs::read_to_string(texts::own_file(&texts_of(&phone), texts::SEND, &desk.id)).unwrap().lines().next().unwrap()).is_some());
        for c in [&desk, &phone] {
            let small = Memory::load(&c.memory, &c.id);
            assert!(small.entries.keys().chain(small.files.keys()).all(|k| !calls_store(k)), "memory.json stays small");
        }
        // The phone's files.json lost: the request read again, never sent again.
        std::fs::remove_file(sealed_path(&phone.memory)).unwrap();
        phone.exchange_with(&folder, &key, NOW + 4 * MINUTE, &notes, &on);
        assert!(phone_step(&phone, &ledger, &seal, NOW + 4 * MINUTE).is_empty());
        let _ = std::fs::remove_dir_all(&base);
    }

    /// The part is off until turned on: nothing of the texts travels from a
    /// device that never turned it on, and a desk with it off receives nothing.
    #[test]
    fn the_texts_part_is_off_until_turned_on() {
        use sioul_core::texts;
        assert!(!shared_by_default(texts::PART, &Config::default()));
        let base = scratch("texts-off");
        let (folder, notes) = (base.join("folder"), base.join("notes"));
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let seal = crate::textseal::TextSeal::new(&key);
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        assert!(stores(&Config::default(), &desk.roots).iter().all(|s| s.part != texts::PART));
        let text = texts::Text { id: "sms-1".into(), at: NOW - MINUTE, direction: "in".into(), with: vec!["+33199001234".into()], body: "Bonjour".into(), ..texts::Text::default() };
        texts::append(&texts::own_file(&texts_of(&phone), texts::LOG, &phone.id), &[text], &seal, None).unwrap();
        phone.exchange_with(&folder, &key, NOW, &notes, &[texts::PART]);
        let outcome = desk.exchange(&folder, &key, NOW + MINUTE);
        assert_eq!(outcome.pending, 0, "{outcome:?}");
        assert!(!texts_of(&desk).exists());
        let came = desk.exchange_with(&folder, &key, NOW + 2 * MINUTE, &notes, &[texts::PART]);
        assert!(came.written.contains(TEXTS_LOG), "{came:?}");
        assert_eq!(texts::read_logs(&texts_of(&desk), &seal).len(), 1);
        let _ = std::fs::remove_dir_all(&base);
    }

    /// The archive only grows: a year on, nothing is trimmed by age; a text
    /// deleted on the phone gets a line of its own, and every device keeps
    /// the text, marked.
    #[test]
    fn the_texts_archive_only_grows_and_a_deletion_is_marked_everywhere() {
        use sioul_core::texts;
        let base = scratch("texts-archive");
        let (folder, notes) = (base.join("folder"), base.join("notes"));
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let seal = crate::textseal::TextSeal::new(&key);
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let on = [texts::PART];
        let own = texts::own_file(&texts_of(&phone), texts::LOG, &phone.id);
        let id = |t: &texts::Text| t.line_id();
        let text = texts::Text { id: "sms-1".into(), at: NOW - 3 * 365 * 86_400_000, direction: "in".into(), with: vec!["+33199001234".into()], body: "Bonjour".into(), ..texts::Text::default() };
        texts::append(&own, std::slice::from_ref(&text), &seal, Some(&id)).unwrap();
        phone.exchange_with(&folder, &key, NOW, &notes, &on);
        desk.exchange_with(&folder, &key, NOW + MINUTE, &notes, &on);
        let later = NOW + 400 * 86_400_000;
        assert_eq!(texts::trim_own(&texts_of(&phone), &phone.id, &seal, later).unwrap() + texts::trim_others(&texts_of(&desk), &desk.id, &seal, later).unwrap(), 0);
        texts::append(&own, &[texts::Text { deleted: later, body: String::new(), ..text }], &seal, Some(&id)).unwrap();
        phone.exchange_with(&folder, &key, later, &notes, &on);
        desk.exchange_with(&folder, &key, later + MINUTE, &notes, &on);
        let kept = texts::read_logs(&texts_of(&desk), &seal);
        assert_eq!(kept.iter().map(|t| (t.body.as_str(), t.deleted > 0)).collect::<Vec<_>>(), [("Bonjour", true)]);
        let _ = std::fs::remove_dir_all(&base);
    }

    /// The first import of a whole history goes a batch at a time (500 texts
    /// and their media each step); every exchange in between still carries
    /// the dose marked and do-not-disturb pressed just before it, and the
    /// media go as blobs, never in the records.
    #[test]
    fn the_first_texts_build_s_records_are_passed_over() {
        // texts: its stores were in the state folder; left aside, never kept waiting, and written nowhere.
        let key = |folder: &str| format!("{folder}phone.jsonl#a line");
        assert!(retired(&key("state/texts/log/")));
        assert!(!retired(&key(TEXTS_LOG)));
    }

    /// A computer holding ten thousand texts (the owner's, 8 October 2026:
    /// 9,833 and a 25 MB `files.json` rewritten at each exchange): an idle
    /// exchange writes nothing of its memory; what it keeps of them is measured.
    #[test]
    fn an_idle_exchange_writes_nothing_with_ten_thousand_texts() {
        use sioul_core::texts;
        let base = scratch("texts-idle");
        let (folder, notes) = (base.join("folder"), base.join("notes"));
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let seal = crate::textseal::TextSeal::new(&key);
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let on = [texts::PART];
        let own = texts::own_file(&texts_of(&phone), texts::LOG, &phone.id);
        for batch in 0..20 {
            let lines: Vec<texts::Text> = (0..texts::BATCH)
                .map(|i| {
                    let n = batch * texts::BATCH + i;
                    texts::Text { id: format!("sms-{n}"), at: NOW - 400 * 86_400_000 + n as i64 * MINUTE, direction: "in".into(), with: vec!["+33199001234".into()], body: format!("Message {n}, about as long as a text usually is, give or take."), ..texts::Text::default() }
                })
                .collect();
            texts::append(&own, &lines, &seal, None).unwrap();
        }
        // The desk's own sealed file too (its spam filter's table): its time
        // of use was set at every exchange, and the 25 MB file written again.
        desk.write("data/spam/table.bin", "a table of the desk's training");
        phone.exchange_with(&folder, &key, NOW, &notes, &on);
        desk.exchange_with(&folder, &key, NOW + MINUTE, &notes, &on);
        desk.exchange_with(&folder, &key, NOW + 2 * MINUTE, &notes, &on);
        assert!(!Memory::load_all(&desk.memory, &desk.id).sealed.mine.is_empty(), "the desk sealed its table");
        let sealed = sealed_path(&desk.memory);
        let (size, memory_size) = (std::fs::metadata(&sealed).unwrap().len(), std::fs::metadata(&desk.memory).unwrap().len());
        let stamp = |p: &Path| std::fs::metadata(p).unwrap().modified().unwrap();
        let before = stamp(&sealed);
        std::thread::sleep(std::time::Duration::from_millis(20));
        // Half an hour without a change: the sealed files looked for, the history tidied, nothing of it written.
        for minute in 3..33 {
            desk.exchange_with(&folder, &key, NOW + minute * MINUTE, &notes, &on);
        }
        eprintln!("ten thousand texts: files.json {size} bytes, memory.json {memory_size} bytes; the phone's log {} bytes", std::fs::metadata(&own).unwrap().len());
        assert_eq!(stamp(&sealed), before, "files.json rewritten by idle exchanges");
        assert!(std::fs::metadata(&desk.memory).unwrap().len() < 64 << 10, "memory.json stays small");
        assert!(size < 2 * std::fs::metadata(&own).unwrap().len(), "the texts' lines not kept twice: {size}");
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn a_first_import_goes_in_batches_and_never_holds_back_the_doses() {
        use sioul_core::texts;
        let base = scratch("texts-import");
        let (folder, notes) = (base.join("folder"), base.join("notes"));
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let seal = crate::textseal::TextSeal::new(&key);
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let on = [texts::PART];
        let own = texts::own_file(&texts_of(&phone), texts::LOG, &phone.id);
        let picture = vec![7u8; 512 * 1024];
        let source = base.join("picture.bin");
        std::fs::write(&source, &picture).unwrap();
        let (hash, size) = crate::blobs::hash_file(&source).unwrap();
        for batch in 0..6 {
            let now = NOW + batch * 10 * MINUTE;
            // A dose taken and do-not-disturb pressed on the phone, then the import's next step.
            phone.write("state/health-state.toml", &format!("[taken]\n\"dose@{batch}\" = {}\n", now / 1000));
            phone.write("state/do-not-disturb.toml", &format!("[device.{}]\npressed = {now}\n", phone.id));
            let lines: Vec<texts::Text> = (0..texts::BATCH)
                .map(|i| {
                    let n = batch as usize * texts::BATCH + i;
                    let mut text = texts::Text { id: format!("sms-{n}"), at: NOW - 400 * 86_400_000 + n as i64 * MINUTE, direction: "in".into(), with: vec!["+33199001234".into()], body: format!("Message {n}"), ..texts::Text::default() };
                    if i == 0 {
                        text.parts = vec![texts::Part { seq: 0, ct: "image/png".into(), size, hash: hash.clone(), state: "here".into(), ..texts::Part::default() }];
                    }
                    text
                })
                .collect();
            crate::blobs::put(&folder, &key, &source, &hash).unwrap();
            texts::append(&own, &lines, &seal, None).unwrap();
            let sent = phone.exchange_with(&folder, &key, now, &notes, &on);
            assert!(sent.sent <= texts::BATCH + 10, "a batch at a time: {sent:?}");
            desk.exchange_with(&folder, &key, now + MINUTE, &notes, &on);
            // On time: the dose and the press of this very step are on the desk.
            assert!(desk.read("state/health-state.toml").contains(&format!("dose@{batch}")), "batch {batch}");
            assert!(desk.read("state/do-not-disturb.toml").contains(&now.to_string()), "batch {batch}");
            assert_eq!(texts::read_logs(&texts_of(&desk), &seal).len(), (batch as usize + 1) * texts::BATCH);
        }
        // The media: a blob in the folder, never in the records.
        let mut files = Vec::new();
        list_files(&folder, &folder, &[], &mut files);
        let records: u64 = files.iter().filter(|(name, _)| !name.starts_with("blobs")).filter_map(|(_, p)| std::fs::metadata(p).ok()).map(|m| m.len()).sum();
        assert!(records < 6 * texts::BATCH as u64 * 2048, "the records hold lines, not media: {records} bytes");
        let target = base.join("fetched.bin");
        crate::blobs::get(&folder, &key, &hash, &target).unwrap();
        assert_eq!(std::fs::read(&target).unwrap(), picture);
        let _ = std::fs::remove_dir_all(&base);
    }

    #[test]
    fn toml_entries_and_back() {
        let rules = &CONFIG_RULES;
        let text = "# mine\nlanguage = \"fr\" # kept\ncase_store = \"~/Notes\"\n\n[quiet]\npersonal = [\"joy\", \"family\"]\n\n[[account]]\nid = \"a\"\nmaildir = \"/x\"\n";
        let entries = toml_entries(text, rules).unwrap();
        let names: Vec<&str> = entries.iter().map(|(k, _)| k.as_str()).collect();
        assert!(names.contains(&"language") && names.contains(&"quiet\u{1f}personal") && names.contains(&"account\u{1f}\u{1e}a"), "{names:?}");
        assert!(!names.iter().any(|n| n.starts_with("case_store")));
        // Writing keeps the rest of the file as written.
        let account = entries.iter().find(|(k, _)| k.starts_with("account")).unwrap().1.replace("id = \"a\"", "id = \"a\"\nmuted = true");
        let new = toml_write(text, rules, &[("language", Some("v = \"en\"\n")), ("account\u{1f}\u{1e}a", Some(&account)), ("quiet\u{1f}work", Some("v = [\"client\"]\n"))], false).unwrap();
        assert!(new.starts_with("# mine\nlanguage = \"en\""), "{new}");
        assert!(new.contains("muted = true") && new.contains("maildir = \"/x\""), "{new}");
        assert!(new.contains("work = [\"client\"]"), "{new}");
        // A list of words, one at a time.
        let money = "ignored = [\"a\", \"b\"]\n";
        let new = toml_write(money, &MONEY_RULES, &[("ignored\u{1f}\u{1e}v = \"a\"\n", None), ("ignored\u{1f}\u{1e}v = \"c\"\n", Some("v = \"c\"\n"))], false).unwrap();
        assert_eq!(new, "ignored = [\"b\", \"c\"]\n");
    }

    /// A medicine's takes and their own amounts, its generic name and its
    /// strength travel with it, one entry by
    /// its id (docs/health.md, "Kept as"): written into the file of a device
    /// whose copy has no amounts (an older Sioul's), they arrive whole, and the
    /// times every dose falls due at are the same.
    #[test]
    fn a_medicines_takes_travel_whole() {
        let new = "[[medicine]]\nid = \"iron\"\nname = \"Iron\"\ndose = \"08:00 · 1 tablet, 20:00 · 2 tablets\"\ngeneric = \"ferrous sulfate\"\nstrength = \"80 mg\"\nsince = 2026-09-01\n\n[medicine.schedule]\nevery = \"day\"\ntimes = [\"08:00\", \"20:00\"]\n\n[medicine.schedule.amounts]\n\"08:00\" = \"1 tablet\"\n\"20:00\" = \"2 tablets\"\n";
        let entries = toml_entries(new, &HEALTH_RULES).unwrap();
        assert_eq!(entries.len(), 1, "one entry for the medicine, its takes in it: {entries:?}");
        let (entry, value) = &entries[0];
        assert!(entry.starts_with("medicine") && value.contains("2 tablets"), "{entry} {value}");
        let old = "[[medicine]]\nid = \"iron\"\nname = \"Iron\"\ndose = \"1 tablet\"\n\n[medicine.schedule]\nevery = \"day\"\ntimes = [\"08:00\", \"20:00\"]\n";
        let written = toml_write(old, &HEALTH_RULES, &[(entry.as_str(), Some(value.as_str()))], false).unwrap();
        let health: sioul_core::health::Health = toml::from_str(&written).unwrap();
        let takes: Vec<(String, String)> = health.medicines[0].takes().into_iter().map(|t| (t.time, t.amount)).collect();
        assert_eq!(takes, [("08:00".to_string(), "1 tablet".to_string()), ("20:00".to_string(), "2 tablets".to_string())]);
        // Its generic name, strength and first day too.
        assert_eq!((health.medicines[0].generic.as_str(), health.medicines[0].strength.as_str(), health.medicines[0].since.map(|d| d.to_string())), ("ferrous sulfate", "80 mg", Some("2026-09-01".to_string())));
        let before: sioul_core::health::Health = toml::from_str(old).unwrap();
        let day = |h: &sioul_core::health::Health| {
            let start: jiff::Zoned = "2026-10-08T00:00[Europe/Paris]".parse().unwrap();
            let end: jiff::Zoned = "2026-10-09T00:00[Europe/Paris]".parse().unwrap();
            h.doses(&start, &end).into_iter().map(|d| (d.key, d.dose)).collect::<Vec<_>>()
        };
        let (now, then) = (day(&health), day(&before));
        assert_eq!(now.iter().map(|d| &d.0).collect::<Vec<_>>(), then.iter().map(|d| &d.0).collect::<Vec<_>>(), "the same doses, the same keys");
        assert_eq!(now.iter().map(|d| d.1.as_str()).collect::<Vec<_>>(), ["1 tablet", "2 tablets"]);
    }

    /// Do-not-disturb on every device (docs/do-not-disturb.md): each device's
    /// table of the switch travels whole and is never written by another; the
    /// list of people travels a person at a time; a Sioul that knows neither
    /// file shares the rest and takes nothing of them out.
    #[test]
    fn do_not_disturb_travels_each_device_its_table_and_the_list_a_person_at_a_time() {
        use sioul_core::everywhere::{People, Person, Switch, change_own, change_people};
        let base = scratch("dnd");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let switch = |c: &Computer| c.roots.state.join(sioul_core::everywhere::SWITCH_FILE);
        let people = |c: &Computer| c.roots.config.join(sioul_core::everywhere::PEOPLE_FILE);
        // The desk turns it on; each adds someone to the list, before hearing of the other.
        change_own(&switch(&desk), &desk.id, |s| {
            s.press(&desk.id, true, 0, NOW);
            true
        })
        .unwrap();
        change_people(&people(&phone), |p| {
            p.add(Person { name: "Alice".into(), phones: vec!["+262639981234".into()], ..Person::default() }, None);
        })
        .unwrap();
        change_people(&people(&desk), |p| {
            p.add(Person { name: "Bob".into(), emails: vec!["bob@example.org".into()], ..Person::default() }, None);
        })
        .unwrap();
        desk.exchange(&folder, &key, NOW + MINUTE);
        phone.exchange(&folder, &key, NOW + 2 * MINUTE);
        desk.exchange(&folder, &key, NOW + 3 * MINUTE);
        let heard = Switch::read(&switch(&phone)).unwrap();
        let latest = heard.latest().unwrap();
        assert!(latest.on && latest.from == desk.id, "{heard:?}");
        for c in [&desk, &phone] {
            let names: Vec<String> = People::read(&people(c)).unwrap().people.into_iter().map(|p| p.name).collect();
            assert!(names.contains(&"Alice".to_string()) && names.contains(&"Bob".to_string()), "{names:?}");
        }
        // The phone turns it off, having heard the desk: its own table only.
        change_own(&switch(&phone), &phone.id, |s| {
            s.press(&phone.id, false, 0, NOW + 4 * MINUTE);
            true
        })
        .unwrap();
        phone.exchange(&folder, &key, NOW + 5 * MINUTE);
        desk.exchange(&folder, &key, NOW + 6 * MINUTE);
        let seen = Switch::read(&switch(&desk)).unwrap();
        assert!(!seen.latest().unwrap().on, "{seen:?}");
        assert!(seen.device[&desk.id].on, "the desk's own table as it wrote it");
        // Someone taken off on the desk: gone on the phone too.
        let bob = People::read(&people(&desk)).unwrap().people.into_iter().find(|p| p.name == "Bob").unwrap().id;
        change_people(&people(&desk), |p| {
            p.remove(&bob);
        })
        .unwrap();
        desk.exchange(&folder, &key, NOW + 7 * MINUTE);
        phone.exchange(&folder, &key, NOW + 8 * MINUTE);
        assert_eq!(People::read(&people(&phone)).unwrap().people.iter().map(|p| p.name.as_str()).collect::<Vec<_>>(), ["Alice"]);
        // A Sioul that knows neither file (an older one): writes neither, takes nothing out.
        let old = Computer::new(&base, "old");
        let older: Vec<Store> = stores(&Config::default(), &old.roots).into_iter().filter(|s| !s.name.contains("do-not-disturb") && !s.name.contains("dnd-people")).collect();
        exchange(&Sharing { folder: &folder, computer: &old.id, key: &key, memory: &old.memory, files: true, hurry: None }, &older, NOW + 9 * MINUTE).unwrap();
        assert!(!switch(&old).exists() && !people(&old).exists());
        desk.exchange(&folder, &key, NOW + 10 * MINUTE);
        assert_eq!(People::read(&people(&desk)).unwrap().people.len(), 1);
        assert_eq!(Switch::read(&switch(&desk)).unwrap().device.len(), 2);
        let _ = std::fs::remove_dir_all(&base);
    }

    /// A computer's table written as Sioul quits there (its inhibition ended
    /// with it) travels, and the phone reads it as closed, never silenced.
    #[test]
    fn a_computers_table_written_as_sioul_quits_reaches_the_phone_as_closed() {
        use sioul_core::everywhere::{Follows, Switch, change_own, others};
        let base = scratch("dnd-closed");
        let folder = base.join("Sioul");
        let key = quick_key(&folder, "four words make a passphrase").unwrap();
        let (desk, phone) = (Computer::new(&base, "desk"), Computer::new(&base, "phone"));
        let switch = |c: &Computer| c.roots.state.join(sioul_core::everywhere::SWITCH_FILE);
        // The phone turns do-not-disturb on; the desk silences itself, says so, then Sioul quits there.
        change_own(&switch(&phone), &phone.id, |s| {
            s.press(&phone.id, true, 0, NOW);
            true
        })
        .unwrap();
        phone.exchange(&folder, &key, NOW + MINUTE);
        desk.exchange(&folder, &key, NOW + 2 * MINUTE);
        change_own(&switch(&desk), &desk.id, |s| {
            let own = s.device.entry(desk.id.clone()).or_default();
            (own.kind, own.why, own.silenced, own.at) = ("computer".into(), "manual".into(), true, NOW + 2 * MINUTE);
            true
        })
        .unwrap();
        desk.exchange(&folder, &key, NOW + 3 * MINUTE);
        phone.exchange(&folder, &key, NOW + 4 * MINUTE);
        let read = |at: i64| {
            let s = Switch::read(&switch(&phone)).unwrap();
            others(&s, &phone.id, &[(desk.id.clone(), at / 1000)], at / 1000, NOW, &|_| true)
        };
        assert_eq!(read(NOW + 4 * MINUTE), vec![(desk.id.clone(), Follows::Silenced)]);
        // Sioul quits on the desk (the window closed, SIGTERM): its table as it then holds, sent.
        change_own(&switch(&desk), &desk.id, |s| {
            let own = s.device.get_mut(&desk.id).unwrap();
            own.closing(false);
            own.at = NOW + 5 * MINUTE;
            true
        })
        .unwrap();
        desk.exchange(&folder, &key, NOW + 5 * MINUTE);
        phone.exchange(&folder, &key, NOW + 6 * MINUTE);
        assert_eq!(read(NOW + 6 * MINUTE), vec![(desk.id.clone(), Follows::Closed)]);
        let table = &Switch::read(&switch(&phone)).unwrap().device[&desk.id];
        assert!(table.closed && !table.silenced, "{table:?}");
        let _ = std::fs::remove_dir_all(&base);
    }
}

#[cfg(test)]
#[path = "share_format_tests.rs"]
mod format_tests;

#[cfg(test)]
#[path = "share_switch_tests.rs"]
mod switch_tests;

#[cfg(test)]
#[path = "share_switch_more_tests.rs"]
mod switch_more_tests;

#[cfg(test)]
#[path = "share_switch_third_tests.rs"]
mod switch_third_tests;

#[cfg(test)]
#[path = "share_quiet_tests.rs"]
mod quiet_tests;

#[cfg(test)]
#[path = "share_idle_bench.rs"]
mod idle_bench;

#[cfg(test)]
#[path = "share_correctness_tests.rs"]
mod correctness_tests;

#[cfg(test)]
#[path = "share_storage_tests.rs"]
mod storage_tests;

#[cfg(test)]
#[path = "share_rounds_tests.rs"]
mod rounds_tests;

#[cfg(test)]
#[path = "share_gc_tests.rs"]
mod gc_tests;

#[cfg(test)]
#[path = "share_drafts_tests.rs"]
mod drafts_tests;

#[cfg(test)]
mod probe {
    /// What a copy of real folders holds, in counts: `SIOUL_SHARE_PROBE=<dir with config, data, state>`.
    #[test]
    #[ignore]
    fn probe() {
        let Some(base) = std::env::var_os("SIOUL_SHARE_PROBE").map(std::path::PathBuf::from) else { return };
        let roots = super::Roots { config: base.join("config"), data: base.join("data"), state: base.join("state") };
        let config: sioul_core::config::Config = std::fs::read_to_string(roots.config.join("config.toml")).ok().and_then(|t| toml::from_str(&t).ok()).unwrap_or_default();
        let stores = super::stores(&config, &roots);
        let look = super::Look { reads: &|_| true, hurry: &|| false, confirmed: &Default::default(), clock: super::clock_ms(), changing: &Default::default() };
        let found = super::gather(&stores, &Default::default(), &look);
        for store in &stores {
            let count = found.hashes.keys().filter(|k| super::file_of(k).starts_with(store.name.as_str()) && (store.folder || super::file_of(k) == store.name)).count();
            println!("{:32} {count}", store.name);
        }
        println!("unknown: {:?}", found.unknown);
    }
}