@heyquilt/seam 0.27.0 → 0.131.0

package/lib/quilts/block.js

@@ -3,14 +3,29 @@
 // plus the edits made in it since; it is rebuilt from the server, never repaired. Its record is
 // .seam/block.json: the quilt, the square, the paths, `at`, the head it last saw, and a
 // manifest of what was written (blob, mode, size, mtime) so status needs no server call.
+import { builtinIgnored } from './ignored.js'
 import fs from 'node:fs'
+import os from 'node:os'
 import path from 'node:path'
 import ignore from 'ignore'
 import { blobId, cleanPrefix, under, cmpPath, cleanCommit, commitBytes, commitId } from './records.js'
 import { unified, isText } from './textdiff.js'
+import { materialiseSealed } from './sealed.js'
+import { scanFiles } from './secrets.js'
+import { idHasher } from './hash.js'
+import { CDC_THRESHOLD } from './fastcdc.js'
+import { TreeReader, decodeNode, EMPTY_TREE } from './tree.js'
+import { globMatcher } from './claims.js'
+import { theCas } from './cas.js'
+
+/** How much of a large file is read at a time (10, streaming the cut). */
+export const READ_PIECE = 1024 * 1024
+/** A diff reads files whole; one over this is named, not diffed. */
+const DIFF_MAX = 64 * 1024 * 1024
 
 /** A block folder's own folder (seam's, not the Quilt app's .quilt). */
 export const BLOCK_DIR = '.seam'
+export const POINTER_FILE = '.quilt-pointer'
 export const BLOCK_FILE = path.join(BLOCK_DIR, 'block.json')
 const ALWAYS_IGNORED = ['.git', BLOCK_DIR, 'node_modules']
 
@@ -29,12 +44,37 @@ export function findBlock (start = process.cwd()) {
 export function saveBlock (dir, block) {
   fs.mkdirSync(path.join(dir, BLOCK_DIR), { recursive: true })
   const f = path.join(dir, BLOCK_FILE)
-  fs.writeFileSync(f + '.tmp', JSON.stringify(block, null, 1))
+  const { _codec: _, ...kept } = block
+  fs.writeFileSync(f + '.tmp', JSON.stringify(kept, null, 1))
   fs.renameSync(f + '.tmp', f)
 }
 
+/**
+ * The full stack at the block's commit (10), as `seam stack` answers it, for block.json.stack, so a
+ * deploy script reads the migration level from the folder it builds. Null from a server without it.
+ */
+async function stackOf (client, quilt, commit) {
+  if (!commit || !client.stack) return null
+  return (await client.stack(quilt, `c:${commit}`).catch(() => null))?.stack || null
+}
+
+function setStack (block, stack) {
+  if (stack && Object.keys(stack).length) block.stack = stack
+  else delete block.stack
+}
+
 const inBlock = (block, p) => block.paths.some((x) => under(p, x))
 
+/**
+ * How a block names its files' contents: plain BLAKE3 ids, or, in a sealed quilt (11.11), the
+ * keyed ids of the codec the command attached as `block._codec` (sealed.js codecFor).
+ */
+function idsOf (block) {
+  if (!block.sealed) return blobId
+  if (!block._codec) throw new Error('This block is in a sealed quilt and this computer holds no key for it.')
+  return block._codec.idOf
+}
+
 /** The folders that hold committed files: they are walked even when a .gitignore names them. */
 function trackedDirs (block) {
   const out = new Set()
@@ -42,9 +82,16 @@ function trackedDirs (block) {
   return out
 }
 
-/** Reads `rel`/.gitignore into the stack of rules in force there (deepest last). */
+/**
+ * Reads `rel`/.gitignore, then `rel`/.seamignore (personal, never committed, so it wins in its
+ * folder), into the stack of rules in force there (deepest last).
+ */
 function rulesIn (dir, rel, stack) {
-  try { return [...stack, { base: rel, ig: ignore().add(fs.readFileSync(path.join(dir, rel, '.gitignore'), 'utf8')) }] } catch { return stack }
+  const out = [...stack]
+  for (const name of ['.gitignore', '.seamignore']) {
+    try { out.push({ base: rel, ig: ignore().add(fs.readFileSync(path.join(dir, rel, name), 'utf8')) }) } catch {}
+  }
+  return out
 }
 
 /** As git decides: the deepest .gitignore with a rule for the path wins (a `!` rule re-includes). */
@@ -76,9 +123,18 @@ function scan (dir, block) {
       const n = r.normalize('NFC')
       const isDir = d.isDirectory()
       if (ALWAYS.ignores(isDir ? r + '/' : r)) continue
-      if (!(isDir ? dirs.has(n) : block.files[n]) && ignoredBy(stack, r, isDir)) continue
+      // Seam's built-ins (.env …, ignored.js) and the .gitignore/.seamignore rules leave out only
+      // what nobody committed: a committed .env from an imported repo keeps working.
+      if (!(isDir ? dirs.has(n) : block.files[n]) && (builtinIgnored(isDir ? r + '/' : r) || ignoredBy(stack, r, isDir))) continue
       // A submodule's folder stands for its gitlink entry: what is inside belongs to the submodule.
       if (isDir && block.files[n]?.mode === 'gitlink') { out.set(n, { abs: path.join(dir, r), gitlink: true }); continue }
+      // A pointer to another quilt (02 mode `quilt`) is a folder holding one file, .quilt-pointer:
+      // the folder stands for the entry, and the file's bytes are the pointer record.
+      if (isDir && block.files[n]?.mode === 'quilt') {
+        const abs = path.join(dir, r, POINTER_FILE)
+        try { out.set(n, { abs, stat: fs.lstatSync(abs), pointer: true }) } catch {}
+        continue
+      }
       if (isDir) { if (block.paths.some((x) => under(r, x) || under(x, r))) walk(r, rulesIn(dir, r, stack)); continue }
       if (!(d.isFile() || d.isSymbolicLink()) || !inBlock(block, r)) continue
       const abs = path.join(dir, r)
@@ -89,7 +145,20 @@ function scan (dir, block) {
   return out
 }
 
-function readFileEntry (abs, stat) {
+/** A file's blob id read a piece at a time, never whole (10, streaming the cut). */
+export function streamedBlobId (abs, piece = READ_PIECE) {
+  const h = idHasher('blob')
+  const buf = Buffer.allocUnsafe(piece)
+  const fd = fs.openSync(abs, 'r')
+  try { for (let n; (n = fs.readSync(fd, buf, 0, buf.length, null)) > 0;) h.update(buf.subarray(0, n)) } finally { fs.closeSync(fd) }
+  return { id: h.digest(), size: h.size }
+}
+
+/** A change's bytes whole (live sharing, which sends files in JSON): read from disk for a streamed one. */
+export const bytesOf = (c) => c.bytes || (c.abs ? fs.readFileSync(c.abs) : null)
+
+function readFileEntry (abs, stat, pointer) {
+  if (pointer) return { bytes: fs.readFileSync(abs), mode: 'quilt' }
   if (stat.isSymbolicLink()) return { bytes: Buffer.from(fs.readlinkSync(abs)), mode: 'symlink' }
   return { bytes: fs.readFileSync(abs), mode: (stat.mode & 0o111) && process.platform !== 'win32' ? 'exec' : 'file' }
 }
@@ -98,19 +167,53 @@ function readFileEntry (abs, stat) {
  * What changed in the folder since `at`: [{ path, status: 'added' | 'modified' | 'deleted',
  * blob?, mode?, bytes? }]. A conflicted file still carrying its term's marker is unchanged.
  */
+/**
+ * The live-work patch for the named paths of a block folder (05 "Live work", PATCH /live): each
+ * changed file under them is a put or a delete, and every other file under them (back as the
+ * block's head has it) is `clean`, so it leaves the square's live work. Names the head it was made on.
+ */
+export function livePatch (dir, block, paths) {
+  const only = paths.map((p) => cleanPrefix(path.relative(dir, path.resolve(p)).split(path.sep).join('/')))
+  const changed = localChanges(dir, block, { paths })
+  const seen = new Set(changed.map((c) => c.path))
+  const changes = changed.map((c) => c.status === 'deleted' ? { path: c.path, op: 'delete' } : { path: c.path, op: 'put', content: bytesOf(c).toString('base64'), mode: c.mode })
+  // A named path that is not a change and not tracked is `clean` only when it is gone from disk (it
+  // may have been shared as added); one still there is ignored or a folder, and is not sent.
+  const clean = new Set(only.filter((p) => p && !seen.has(p) && !Object.keys(block.files).some((f) => f !== p && under(f, p)) && (block.files[p] || !fs.existsSync(path.join(dir, p)))))
+  for (const f of Object.keys(block.files)) if (!seen.has(f) && only.some((x) => under(f, x))) clean.add(f)
+  for (const p of [...clean].sort(cmpPath)) changes.push({ path: p, op: 'clean' })
+  return { ...(block.head ? { head: block.head } : {}), changes }
+}
+
 export function localChanges (dir, block, { paths = [] } = {}) {
   const only = paths.map((p) => cleanPrefix(path.relative(dir, path.resolve(p)).split(path.sep).join('/')))
   const wanted = (p) => !only.length || only.some((x) => under(p, x))
   const files = scan(dir, block)
+  const idOf = idsOf(block)
+  // A record is trusted by size and time only for a file older than the block's own file: one
+  // changed in the same timestamp tick it was recorded in can match both (git's "racily clean").
+  let savedMs = Infinity
+  try { savedMs = fs.statSync(path.join(dir, BLOCK_FILE)).mtimeMs } catch {}
   const out = []
-  for (const [p, { abs, stat, gitlink }] of files) {
+  for (const [p, { abs, stat, gitlink, pointer }] of files) {
     if (!wanted(p) || gitlink) continue
     const known = block.files[p]
-    if (known && known.size === stat.size && known.mtimeMs === stat.mtimeMs) continue
-    const { bytes, mode } = readFileEntry(abs, stat)
-    const id = blobId(bytes)
+    if (known && known.size === stat.size && known.mtimeMs === stat.mtimeMs && stat.mtimeMs < savedMs) continue
+    // A large plain file (10, streaming the cut) is hashed a piece at a time and never held: the
+    // upload reads it again from disk as it cuts it. A conflicted or sealed one is read whole as before.
+    if (!pointer && stat.isFile() && stat.size > CDC_THRESHOLD && !block.sealed && !known?.term) {
+      const mode = (stat.mode & 0o111) && process.platform !== 'win32' ? 'exec' : 'file'
+      const { id, size } = streamedBlobId(abs)
+      if (known && known.blob === id && known.mode === mode) continue
+      out.push({ path: p, status: known ? 'modified' : 'added', blob: id, mode, size, abs, open: () => fs.createReadStream(abs, { highWaterMark: READ_PIECE }) })
+      continue
+    }
+    const { bytes, mode } = readFileEntry(abs, stat, pointer)
+    const id = idOf(bytes)
     if (known && known.blob === id && known.mode === mode) continue
     if (known && known.term && bytes.includes(Buffer.from(`quilt-conflict ${known.term.slice(0, 12)}`))) continue
+    // A redacted blob is checked out as its tombstone (service.js), which names the blob it stands for.
+    if (known && known.blob && bytes.length < 200 && new RegExp(`^<redacted: blob ${known.blob.slice(0, 12)} at seq \\d+>\n$`).test(bytes.toString('utf8'))) continue
     out.push({ path: p, status: known ? 'modified' : 'added', blob: id, mode, size: bytes.length, bytes })
   }
   for (const p of Object.keys(block.files)) if (!files.has(p) && wanted(p)) out.push({ path: p, status: 'deleted' })
@@ -120,32 +223,157 @@ export function localChanges (dir, block, { paths = [] } = {}) {
 /** Writes one tree entry to the folder and returns its manifest record. */
 async function writeEntry (dir, e, content) {
   const abs = path.join(dir, ...e.path.split('/'))
+  // A streamed file lands in .seam/tmp first, so a read that fails leaves the folder as it was.
+  const tmp = content && content.fetch ? await streamToTmp(dir, e, content.fetch) : null
   fs.mkdirSync(path.dirname(abs), { recursive: true })
   try { fs.rmSync(abs, { force: true }) } catch {}
+  // An entry that was a quilt pointer leaves its folder: take it away before a file takes the path.
+  if (e.mode !== 'quilt') try { fs.rmSync(path.join(abs, POINTER_FILE), { force: true }); fs.rmdirSync(abs) } catch {}
   // A git submodule is an empty folder, as git leaves one it has not cloned.
   if (e.mode === 'gitlink') { fs.mkdirSync(abs, { recursive: true }); return { blob: e.blob, mode: 'gitlink', size: e.size, mtimeMs: 0 } }
-  if (e.mode === 'symlink') fs.symlinkSync(content.toString('utf8'), abs)
-  else fs.writeFileSync(abs, content, { mode: e.mode === 'exec' ? 0o755 : 0o644 })
+  if (e.mode === 'quilt') {
+    fs.mkdirSync(abs, { recursive: true })
+    fs.writeFileSync(path.join(abs, POINTER_FILE), content, { mode: 0o644 })
+    const st = fs.lstatSync(path.join(abs, POINTER_FILE))
+    return { blob: e.blob, mode: 'quilt', size: st.size, mtimeMs: st.mtimeMs }
+  }
+  if (tmp) fs.renameSync(tmp, abs)
+  else if (e.mode === 'symlink') fs.symlinkSync(content.toString('utf8'), abs)
+  // A path its line keeps for people is read-only in an agent's block (11.5), so its editor refuses first.
+  else fs.writeFileSync(abs, content, { mode: (e.mode === 'exec' ? 0o755 : 0o644) & (e.read_only ? 0o555 : 0o777) })
   const st = fs.lstatSync(abs)
   return { blob: e.mode === 'conflict' ? null : e.blob, mode: e.mode, size: st.size, mtimeMs: st.mtimeMs, ...(e.term ? { term: e.term } : {}) }
 }
 
+/**
+ * A large file written as it streams from the server (10, streaming the cut): into a file under
+ * .seam/tmp, its id hashed as the bytes pass; answers that file's path once it matches (a
+ * redacted or damaged file's tombstone, which the server marks, is kept as it is).
+ */
+async function streamToTmp (dir, e, fetchIt) {
+  const tmpDir = path.join(dir, BLOCK_DIR, 'tmp')
+  fs.mkdirSync(tmpDir, { recursive: true })
+  const tmp = path.join(tmpDir, `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`)
+  const out = fs.createWriteStream(tmp, { mode: (e.mode === 'exec' ? 0o755 : 0o644) & (e.read_only ? 0o555 : 0o777) })
+  const done = new Promise((resolve, reject) => { out.on('finish', resolve); out.on('error', reject) })
+  done.catch(() => {})
+  try {
+    const r = await fetchIt()
+    const h = idHasher('blob')
+    for await (const piece of r.body) {
+      h.update(piece)
+      if (!out.write(piece)) await new Promise((resolve) => { const go = () => { out.off('drain', go); out.off('close', go); resolve() }; out.on('drain', go); out.on('close', go) })
+    }
+    out.end()
+    await done
+    if (!r.stone && h.digest() !== e.blob) throw new Error(`${e.path}: the bytes the server sent do not match its id ${String(e.blob).slice(0, 12)}`)
+    return tmp
+  } catch (err) {
+    out.destroy()
+    fs.rmSync(tmp, { force: true })
+    throw err
+  }
+}
+
+/** One want-list; a 429 (fetch_rate, 04) waits its retry_after and asks again, up to five times. */
+export async function wantList (client, quilt, ids, rev) {
+  for (let tries = 1; ; tries++) {
+    try { return await (client.wantBlobs ? client.wantBlobs(quilt, ids, rev) : client.blobs(quilt, ids.map((x) => x.id || x), rev)) } catch (err) {
+      if (err.status !== 429 || tries >= 5) throw err
+      await new Promise((resolve) => setTimeout(resolve, Math.min(30, Number(err.retry_after) || 1) * 1000))
+    }
+  }
+}
+
+/**
+ * A commit's entries under `prefixes`, as GET /tree gives them (04 rule 8): where the server
+ * answers the root alone (`nodes=1`), the nodes are fetched by want-list, a level at a time,
+ * and kept in the machine cache (cas.js), so a later move asks only for the nodes that changed.
+ * Anywhere else (an older server, reads limited by path) the server's listing is used.
+ */
+export async function listTree (client, quilt, rev, prefixes, dir) {
+  const t = await client.tree(quilt, rev, prefixes, { nodes: true })
+  if (!t.nodes || !client.want) return t
+  const cas = theCas()
+  const nodes = new Map()
+  const cached = (id) => cas.get('tree', id)
+  let frontier = t.root === EMPTY_TREE ? [] : [t.root]
+  while (frontier.length) {
+    const need = []
+    for (const id of frontier) { const b = cached(id); if (b) nodes.set(id, b); else need.push(id) }
+    for (let i = 0; i < need.length; i += 1000) {
+      const r = await client.want(quilt, need.slice(i, i + 1000).map((id) => ({ id, kind: 'tree' })), t.commit || rev)
+      if (r.missing.length || r.later.length) return client.tree(quilt, rev, prefixes)
+      for (const [id, o] of r.objects) { nodes.set(id, o.bytes); cas.put('tree', id, o.bytes) }
+    }
+    const next = []
+    for (const id of frontier) { const n = decodeNode(nodes.get(id)); if (n.level > 0) for (const e of n.entries) if (!nodes.has(e.child)) next.push(e.child) }
+    frontier = [...new Set(next)]
+  }
+  // A filtered snapshot's list-only entries (04 rule 6) are listed as /tree lists them: no id to fetch.
+  const entries = (await new TreeReader(async (id) => nodes.get(id)).list(t.root, prefixes)).map((e) => e.mode === 'unreadable' ? { path: e.path, size: e.size, unreadable: true } : e)
+  const isHuman = t.human_only?.length ? ((ms) => (p) => ms.some((m) => m(p)))(t.human_only.map(globMatcher)) : null
+  return { commit: t.commit, root: t.root, ...(t.ticket ? { ticket: t.ticket } : {}), entries: isHuman ? entries.map((e) => isHuman(e.path) ? { ...e, read_only: true } : e) : entries }
+}
+
+/** A sealed blob's plaintext; one that does not match its keyed id is reported to the server (11.11), then refused. */
+async function openSealed (client, quilt, codec, id, bytes) {
+  try { return codec.open(id, bytes) } catch (err) {
+    if (err.code === 'id_mismatch' && client.reportMismatch) await client.reportMismatch(quilt, id).catch(() => {})
+    throw err
+  }
+}
+
 /** Fetches blobs by id in batches (want-only, decision 31). */
-async function fetchBlobs (client, quilt, ids) {
+async function fetchBlobs (client, quilt, ids, rev, codec, ticket = null) {
   const out = new Map()
-  const list = [...new Set(ids)]
+  // With a ticket (04 rule 7), each file is asked for with its path and the ticket; an expired or
+  // refused ticket falls back to plain ids.
+  const ask = (slice) => ticket ? slice.map((id) => ticket.pathOf.has(id) ? { id, path: ticket.pathOf.get(id), ticket: ticket.ticket } : id) : slice
+  // A plain quilt's files come from the machine cache where it has them (a sealed one's ids are keyed: never cached).
+  const cas = codec ? null : theCas()
+  const list = [...new Set(ids)].filter((id) => { const b = cas?.get('blob', id); if (b) out.set(id, b); return !b })
   for (let i = 0; i < list.length; i += 200) {
-    const { blobs } = await client.blobs(quilt, list.slice(i, i + 200))
-    for (const [id, b64] of Object.entries(blobs)) out.set(id, Buffer.from(b64, 'base64'))
+    const slice = list.slice(i, i + 200)
+    let got
+    try { got = await wantList(client, quilt, ask(slice), rev) } catch (err) {
+      if (!ticket || (err.code !== 'ticket_expired' && err.code !== 'bad_ticket')) throw err
+      ticket = null
+      got = await wantList(client, quilt, slice, rev)
+    }
+    const { blobs, redacted = {} } = got
+    // A sealed quilt's blobs are opened here (a redaction's tombstone is plain text).
+    for (const [id, b64] of Object.entries(blobs)) {
+      const b = codec && !redacted[id] ? await openSealed(client, quilt, codec, id, Buffer.from(b64, 'base64')) : Buffer.from(b64, 'base64')
+      out.set(id, b)
+      if (cas && !redacted[id]) cas.put('blob', id, b)
+    }
   }
   return out
 }
 
-async function contentsFor (client, quilt, rev, entries) {
-  const blobs = await fetchBlobs(client, quilt, entries.filter((e) => e.blob).map((e) => e.blob))
+// A large plain file is fetched as a stream and written as it comes (10), not in a want-list.
+const streams = (client, codec, e) => !codec && !!client.catRaw && !!e.blob && (e.mode === 'file' || e.mode === 'exec') && (e.size || 0) > CDC_THRESHOLD
+
+/**
+ * TODO 0.8: the markers a conflicted file is written with in a folder. SEAM_CONFLICT_STYLE=git
+ * gives git's (<<<<<<< ||||||| ======= >>>>>>>); anything else, Seam's diff style (the default).
+ */
+export const conflictStyle = () => (String(process.env.SEAM_CONFLICT_STYLE || '').toLowerCase() === 'git' ? 'git' : 'diff')
+
+async function contentsFor (client, quilt, rev, entries, codec = null, ticket = null) {
+  const wanted = entries.filter((e) => e.blob && !streams(client, codec, e))
+  const blobs = await fetchBlobs(client, quilt, wanted.map((e) => e.blob), rev, codec, ticket ? { ticket, pathOf: new Map(wanted.map((e) => [e.blob, e.path])) } : null)
   const get = async (e) => {
+    if (streams(client, codec, e)) return { fetch: () => client.catRaw(quilt, rev, e.path) }
     if (e.mode !== 'conflict') return blobs.get(e.blob)
-    const r = await client.cat(quilt, rev, e.path, { format: 'diff' })
+    // git's markers hold two sides: a conflict of three or more is written in the diff style.
+    const style = conflictStyle()
+    const r = await client.cat(quilt, rev, e.path, { format: style }).catch((err) => {
+      if (style === 'git' && (err.code === 'too_many_sides' || /too_many_sides/.test(String(err.message)))) return client.cat(quilt, rev, e.path, { format: 'diff' })
+      throw err
+    })
+    if (r.sealed) return materialiseSealed(r.term_record, r.term, async (id) => (await fetchBlobs(client, quilt, [id], rev, codec)).get(id))
     return Buffer.from(r.content, 'base64')
   }
   return get
@@ -155,19 +383,54 @@ async function contentsFor (client, quilt, rev, entries) {
  * Checks out `rev` (a square's head, or any revision) under `paths` into `dir` as a new block.
  * Refuses a folder that already holds files, unless it is this block's own folder.
  */
-export async function checkout (client, { quilt, square = null, rev, paths = [''], dir, api }) {
+/**
+ * The server block row for a folder on a square (04, 05): live when the caller may write there,
+ * else read-only at the square's tip. Its id goes in block.json; a server without block routes
+ * (or any refusal) leaves the folder without one, and the folder works the same.
+ */
+/** Touches the folder's block row (its last_seen); one the server closed (seven days unseen) is opened again on the same square and paths. */
+async function keepRow (client, block) {
+  if (block.block_id && !(await client.touchBlock?.(block.quilt, block.block_id).then(() => true, () => false))) delete block.block_id
+  if (!block.block_id && block.square) { const id = await openRow(client, block.quilt, block.square, block.paths); if (id) block.block_id = id }
+}
+
+/** keepRow for a folder, saving block.json when the row changed: { block_id, reopened }. */
+export async function touchFolder (client, dir, block) {
+  const before = block.block_id || null
+  await keepRow(client, block)
+  if ((block.block_id || null) !== before) saveBlock(dir, block)
+  return { block_id: block.block_id || null, reopened: !!(block.block_id && block.block_id !== before) }
+}
+
+async function openRow (client, quilt, squareId, paths) {
+  if (!client.openBlock || !squareId) return null
+  const o = { square: squareId, machine: os.hostname(), mode: 'sparse', paths }
+  try { return (await client.openBlock(quilt, o)).id || null } catch (err) {
+    if (err.code !== 'not_holder' && err.status !== 403) return null
+    try { return (await client.openBlock(quilt, { ...o, read_only: true })).id || null } catch { return null }
+  }
+}
+
+export async function checkout (client, { quilt, square = null, squareRow = null, rev, paths = [''], dir, api, codec = null }) {
   const prefixes = (paths.length ? paths : ['']).map(cleanPrefix)
   fs.mkdirSync(dir, { recursive: true })
   const existing = fs.readdirSync(dir).filter((n) => n !== BLOCK_DIR)
   if (existing.length) throw new Error(`${dir} is not empty; check out into an empty folder (or switch an existing block with quilt checkout inside it)`)
-  const sq = square ? await client.square(quilt, square) : null
+  // squareRow: the square as the caller already has it (seam square open --dir), saving a request.
+  const sq = square ? (squareRow && squareRow.id === square ? squareRow : await client.square(quilt, square)) : null
   const at = sq ? (sq.head || sq.base) : rev || 'main'
-  const t = await client.tree(quilt, at || 'main', prefixes)
-  const get = await contentsFor(client, quilt, at || 'main', t.entries)
+  const t = await listTree(client, quilt, at || 'main', prefixes, dir)
+  // A path the quilt's protections let this caller list but not read (11.2) is not checked out.
+  t.entries = t.entries.filter((e) => !e.unreadable)
+  const get = await contentsFor(client, quilt, at || 'main', t.entries, codec, t.ticket)
   const files = {}
   for (const e of t.entries) files[e.path] = await writeEntry(dir, e, await get(e))
-  const block = { api, quilt, square: sq ? sq.id : null, square_short: sq ? sq.short : null, line: sq ? sq.line : (rev || 'main'), paths: prefixes, at: t.commit, head: sq ? sq.head : null, files }
+  const block = { api, quilt, square: sq ? sq.id : null, square_short: sq ? sq.short : null, line: sq ? sq.line : (rev || 'main'), paths: prefixes, at: t.commit, head: sq ? sq.head : null, ...(sq ? { task_id: sq.task_id || null } : {}), ...(codec ? { sealed: true } : {}), files }
+  const blockId = sq ? await openRow(client, quilt, sq.id, prefixes) : null
+  if (blockId) block.block_id = blockId
+  setStack(block, await stackOf(client, quilt, t.commit))
   saveBlock(dir, block)
+  if (codec) block._codec = codec
   return { block, files: t.entries.length }
 }
 
@@ -175,45 +438,159 @@ export async function checkout (client, { quilt, square = null, rev, paths = [''
  * Moves the folder from `block.at` to commit `to`, file by file: paths changed on the server
  * are rewritten; a path changed both here and there is left as it is here and reported.
  */
-export async function syncTo (client, dir, block, to, { square } = {}) {
+export async function syncTo (client, dir, block, to, { square, afterWrite } = {}) {
   const local = new Map(localChanges(dir, block).map((c) => [c.path, c]))
   const d = await client.diff(block.quilt, { from: block.at ? `c:${block.at}` : undefined, to: to ? `c:${to}` : 'main', paths: block.paths, format: 'names' })
-  const t = d.files.length ? await client.tree(block.quilt, to ? `c:${to}` : 'main', block.paths) : { entries: [] }
-  const byPath = new Map(t.entries.map((e) => [e.path, e]))
-  const get = await contentsFor(client, block.quilt, to ? `c:${to}` : 'main', d.files.map((f) => byPath.get(f.path)).filter(Boolean))
+  const t = d.files.length ? await listTree(client, block.quilt, to ? `c:${to}` : 'main', block.paths, dir) : { entries: [] }
+  const byPath = new Map(t.entries.filter((e) => !e.unreadable).map((e) => [e.path, e]))
+  const get = await contentsFor(client, block.quilt, to ? `c:${to}` : 'main', d.files.map((f) => byPath.get(f.path)).filter(Boolean), block._codec, t.ticket)
   const kept = []
   let written = 0
+  // The plan goes to the journal first (05 "Rebuilt, never repaired"), so a move that dies part
+  // way is finished by rebuild instead of leaving the server's files looking like the holder's edits.
+  const journal = openJournal(dir, {
+    op: 'move', from: block.at || null, to, rev: to ? `c:${to}` : 'main',
+    ...(square ? { square: { id: square.id, short: square.short, head: square.head, line: square.line } } : {}),
+    writes: d.files.filter((f) => !local.has(f.path) && byPath.get(f.path)).map((f) => { const e = byPath.get(f.path); return { path: e.path, blob: e.blob, mode: e.mode, size: e.size, ...(e.term ? { term: e.term } : {}), ...(e.read_only ? { read_only: true } : {}), old: block.files[f.path] || null } }),
+    removes: d.files.filter((f) => !local.has(f.path) && !byPath.get(f.path)).map((f) => ({ path: f.path, old: block.files[f.path] || null }))
+  })
   for (const f of d.files) {
     if (local.has(f.path)) { kept.push(f.path); continue }
     const e = byPath.get(f.path)
     if (!e) {
-      const abs = path.join(dir, ...f.path.split('/'))
-      if (block.files[f.path]?.mode === 'gitlink') { try { fs.rmdirSync(abs) } catch {} } else fs.rmSync(abs, { force: true })
-      delete block.files[f.path]; written++; continue
+      removeEntry(dir, f.path, block.files[f.path]?.mode)
+      delete block.files[f.path]; written++
+    } else {
+      block.files[f.path] = await writeEntry(dir, e, await get(e))
+      written++
     }
-    block.files[f.path] = await writeEntry(dir, e, await get(e))
-    written++
+    journal.done(f.path)
+    afterWrite?.(f.path)
   }
   block.at = to
-  if (square) { block.square = square.id; block.square_short = square.short; block.head = square.head; block.line = square.line }
+  const moved = square && square.id !== block.square
+  if (square) { block.square = square.id; block.square_short = square.short; block.head = square.head; block.line = square.line; if ('task_id' in square) block.task_id = square.task_id || null }
+  // The server's block row follows the folder: touched on a move, reopened on another square.
+  if (moved && block.block_id) { await client.closeBlock?.(block.quilt, block.block_id).catch(() => {}); delete block.block_id }
+  await keepRow(client, block)
+  setStack(block, await stackOf(client, block.quilt, to))
   saveBlock(dir, block)
+  journal.close()
   return { written, kept }
 }
 
+/** The write journal of a block folder: one plan line, then one `{ done }` line per path. */
+export const JOURNAL_FILE = path.join(BLOCK_DIR, 'journal')
+
+function openJournal (dir, plan) {
+  const f = path.join(dir, JOURNAL_FILE)
+  fs.mkdirSync(path.dirname(f), { recursive: true })
+  const fd = fs.openSync(f, 'w')
+  const put = (o) => { fs.writeSync(fd, JSON.stringify(o) + '\n'); fs.fsyncSync(fd) }
+  put({ ...plan, started: new Date().toISOString() })
+  let open = true
+  return {
+    done: (p) => put({ done: p }),
+    close: () => { if (!open) return; open = false; fs.closeSync(fd); fs.rmSync(f, { force: true }) }
+  }
+}
+
+function readJournal (dir) {
+  let text
+  try { text = fs.readFileSync(path.join(dir, JOURNAL_FILE), 'utf8') } catch { return null }
+  const lines = []
+  // A line cut off by the crash is the last one: what came before it stands.
+  for (const l of text.split('\n')) { if (!l) continue; try { lines.push(JSON.parse(l)) } catch { break } }
+  if (!lines.length || !lines[0].op) return null
+  return { plan: lines[0], done: new Set(lines.slice(1).map((l) => l.done).filter(Boolean)) }
+}
+
+/** The blob id and mode of what is at `p` on disk now (null when nothing is). */
+function onDisk (dir, block, p) {
+  const abs = absOf(dir, p)
+  let stat
+  try { stat = fs.lstatSync(abs) } catch { return null }
+  if (stat.isDirectory()) {
+    try { const st = fs.lstatSync(path.join(abs, POINTER_FILE)); return { ...readFileEntry(path.join(abs, POINTER_FILE), st, true), stat: st } } catch { return { mode: 'dir', stat } }
+  }
+  if (stat.isFile() && stat.size > CDC_THRESHOLD && !block.sealed) return { id: streamedBlobId(abs).id, mode: (stat.mode & 0o111) && process.platform !== 'win32' ? 'exec' : 'file', stat }
+  const { bytes, mode } = readFileEntry(abs, stat, false)
+  return { id: idsOf(block)(bytes), mode, stat }
+}
+
+/**
+ * block.rebuild (05): finishes a move the journal shows unfinished. A planned path whose file is
+ * the plan's is recorded; one still as before (or gone) is written now; one that is neither is
+ * the holder's edit and is kept. Then block.json takes the move's commit and the journal goes.
+ * On a healthy block it writes nothing. Answers { finished, written, removed, kept, changes }.
+ */
+export async function rebuild (client, dir, block) {
+  const j = readJournal(dir)
+  if (!j) return { finished: false, written: [], removed: [], kept: [], changes: localChanges(dir, block).length }
+  const { plan, done } = j
+  const same = (cur, rec) => !!(cur && rec && rec.blob && cur.id === rec.blob && cur.mode === rec.mode)
+  const written = []
+  const removed = []
+  const kept = []
+  const toWrite = []
+  for (const w of plan.writes || []) {
+    const cur = onDisk(dir, block, w.path)
+    if (same(cur, w)) { block.files[w.path] = { blob: w.blob, mode: w.mode, size: cur.stat.size, mtimeMs: cur.stat.mtimeMs, ...(w.term ? { term: w.term } : {}) }; continue }
+    if (done.has(w.path) && w.mode === 'conflict' && cur) { const st = cur.stat; block.files[w.path] = { blob: null, mode: 'conflict', size: st.size, mtimeMs: st.mtimeMs, term: w.term }; continue }
+    if (!done.has(w.path) && (!cur || same(cur, w.old))) { toWrite.push(w); continue }
+    // Written and edited since, or edited before it was written: the holder's. Its record is the
+    // one the folder now stands on, so the edit shows against the new commit.
+    kept.push(w.path)
+    if (done.has(w.path)) block.files[w.path] = { blob: w.blob, mode: w.mode, size: w.size, mtimeMs: 0 }
+  }
+  if (toWrite.length) {
+    const get = await contentsFor(client, block.quilt, plan.rev, toWrite, block._codec)
+    for (const w of toWrite) { block.files[w.path] = await writeEntry(dir, w, await get(w)); written.push(w.path) }
+  }
+  for (const r of plan.removes || []) {
+    const cur = onDisk(dir, block, r.path)
+    if (!cur) { delete block.files[r.path]; if (!done.has(r.path)) removed.push(r.path); continue }
+    if (!done.has(r.path) && same(cur, r.old)) { removeEntry(dir, r.path, r.old?.mode); pruneEmpty(dir, r.path); delete block.files[r.path]; removed.push(r.path); continue }
+    kept.push(r.path)
+  }
+  block.at = plan.to
+  if (plan.square) { block.square = plan.square.id; block.square_short = plan.square.short; block.head = plan.square.head; block.line = plan.square.line }
+  saveBlock(dir, block)
+  fs.rmSync(path.join(dir, JOURNAL_FILE), { force: true })
+  return { finished: true, to: plan.to, written, removed, kept: kept.sort(cmpPath), changes: localChanges(dir, block).length }
+}
+
 /** status: the folder's changes, and the square as the server sees it. */
 export async function status (client, dir, block) {
-  const changes = localChanges(dir, block).map(({ bytes, ...c }) => c)
+  const changes = localChanges(dir, block).map(({ bytes, open, abs, ...c }) => c)
   const square = block.square ? await client.square(block.quilt, block.square) : null
   const conflicted = Object.entries(block.files).filter(([, f]) => f.term).map(([p]) => p)
-  return { dir, quilt: block.quilt, square, paths: block.paths, at: block.at, changes, conflicted, stale: !!(square && square.head !== block.head) }
+  return { dir, quilt: block.quilt, square, line: block.line, on_line: isLineCheckout(block), paths: block.paths, at: block.at, changes, conflicted, stale: !!(square && square.state === 'open' && square.head !== block.head), ...(square && square.state && square.state !== 'open' ? { square_closed: square.state } : {}) }
+}
+
+/**
+ * A sealed quilt's secret scan (11.11, 11.9): the server holds only ciphertext, so this computer
+ * scans the plaintext it is about to seal. Advisory: the findings join the answer's warnings
+ * (marked local) and never refuse; one named in allow is quiet.
+ */
+function withLocalScan (block, changes, allow, r) {
+  if (!block.sealed) return r
+  const found = scanFiles(changes.filter((c) => c.bytes)).findings.filter((f) => !allow.includes(f.id))
+  if (!found.length) return r
+  return { ...r, warnings: [...(r.warnings || []), ...found.map(({ what: _, allowable: __, ...f }) => ({ ...f, local: true }))] }
 }
 
 /** commit: uploads the changed files' blobs (have?, then a pack) and seals them as a commit. */
-export async function commitFolder (client, dir, block, { message, paths = [] }) {
-  if (!block.square) throw new Error('This folder is a read-only checkout of a line; open a square (quilt square open) to commit.')
+export async function commitFolder (client, dir, block, { message, paths = [], allow = [] }) {
+  if (!block.square && !isLineCheckout(block)) throw new Error('This folder holds one revision, not a line; open a square (seam square open) to commit.')
   const changes = localChanges(dir, block, { paths })
   if (!changes.length) return { nothing: true }
-  const blobs = changes.filter((c) => c.bytes).map((c) => ({ kind: 'blob', id: c.blob, bytes: c.bytes }))
+  // A clone (a checkout of a line): the first commit opens a square by itself, titled by the
+  // message and based on the commit the folder holds, so it undoes nothing main gained since.
+  const opened = block.square ? null : await openForCommit(client, dir, block, message)
+  // In a sealed quilt the server gets each file sealed; its size there is the sealed size.
+  for (const c of changes) if (c.bytes && block.sealed) c.stored = block._codec.seal(c.bytes)
+  const blobs = changes.filter((c) => c.bytes || c.open).map((c) => c.open ? { kind: 'blob', id: c.blob, size: c.size, open: c.open } : { kind: 'blob', id: c.blob, bytes: c.stored || c.bytes })
   const list = changes.map((c) => c.status === 'deleted' ? { path: c.path, op: 'delete' } : { path: c.path, op: 'put', blob: c.blob, mode: c.mode })
   // 03: the commit record is built here and travels in the pack with its blobs, so the commit
   // request names it by id. The server refuses a record that is not exactly what it would write
@@ -221,20 +598,21 @@ export async function commitFolder (client, dir, block, { message, paths = [] })
   let r
   try {
     if (!block.author || !block.quilt_id) { const info = await client.quilt(block.quilt); block.author = info.you; block.quilt_id = info.id }
-    const sq = await client.square(block.quilt, block.square)
+    // The folder knows its square's base (block.at until its first commit) and task: no request.
+    const sq = block.task_id !== undefined && (block.head || block.at) ? { id: block.square, base: block.at, task_id: block.task_id } : await client.square(block.quilt, block.square)
     const { on_behalf_of: onBehalf, ...author } = block.author
     const record = cleanCommit({
       quilt_id: block.quilt_id, square_id: sq.id, parents: [block.head || sq.base].filter(Boolean), author,
       ...(onBehalf ? { on_behalf_of: onBehalf } : {}), ...(sq.task_id ? { task_id: sq.task_id } : {}),
       message: message || '', authored_at: Date.now(),
-      changes: list.map((c) => c.op === 'delete' ? c : { ...c, mode: c.mode || 'file', size: changes.find((x) => x.path === c.path).bytes.length })
+      changes: list.map((c) => c.op === 'delete' ? c : { ...c, mode: c.mode || 'file', size: (({ stored, bytes, size }) => (stored || bytes)?.length ?? size)(changes.find((x) => x.path === c.path)) })
     })
     const id = commitId(record)
     await client.upload(block.quilt, [...blobs, { kind: 'commit', id, bytes: commitBytes(record) }])
-    r = await client.commit(block.quilt, block.square, { expect_head: block.head, commit: id })
+    r = await client.commit(block.quilt, block.square, { expect_head: block.head, commit: id, ...(allow.length ? { allow_findings: allow } : {}) })
   } catch (err) {
-    if (err.code !== 'record_mismatch') throw err
-    r = await client.commit(block.quilt, block.square, { expect_head: block.head, message, changes: list })
+    if (err.code !== 'record_mismatch' || block.sealed) throw err
+    r = await client.commit(block.quilt, block.square, { expect_head: block.head, message, changes: list, ...(allow.length ? { allow_findings: allow } : {}) })
   }
   for (const c of changes) {
     if (c.status === 'deleted') { delete block.files[c.path]; continue }
@@ -244,17 +622,72 @@ export async function commitFolder (client, dir, block, { message, paths = [] })
   block.at = r.square.head
   block.head = r.square.head
   saveBlock(dir, block)
-  return r
+  const out = withLocalScan(block, changes, allow, r)
+  if (opened) out.opened = opened
+  return out
+}
+
+/** A folder on a line (seam clone, seam checkout main, or after seam merge), not on one fixed revision. */
+export function isLineCheckout (block) {
+  return !block.square && !!block.line && !/^(c:|sq:|patch:)|[~^@]/.test(block.line) && !/^[0-9a-f]{12,}$/.test(block.line)
+}
+
+async function openForCommit (client, dir, block, message) {
+  const sq = await client.openSquare(block.quilt, { title: String(message || 'untitled').split('\n')[0].slice(0, 200), line: block.line, ...(block.at ? { base: `c:${block.at}` } : {}) })
+  block.square = sq.id
+  block.square_short = sq.short
+  block.head = sq.head || null
+  block.task_id = sq.task_id || null
+  const blockId = await openRow(client, block.quilt, sq.id, block.paths || [''])
+  if (blockId) block.block_id = blockId
+  saveBlock(dir, block)
+  return { id: sq.id, short: sq.short, title: sq.title, line: sq.line }
+}
+
+/**
+ * seam pull: a line checkout moves to the line's tip (uncommitted edits stay; a path changed both
+ * here and there keeps this folder's version and is reported); a square folder rebases the square
+ * onto its line and moves there.
+ */
+export async function pull (client, dir, block) {
+  if (block.square) {
+    // The square was merged (or abandoned) from elsewhere: the folder goes to its line's tip.
+    const sq = await client.square(block.quilt, block.square)
+    if (sq.state && sq.state !== 'open') {
+      const short = block.square_short || block.square
+      const tip = (await client.show(block.quilt, sq.line, { format: 'none' })).commit.id
+      const s = await toLineTip(client, dir, block, sq.line, tip)
+      return { left: { square: short, state: sq.state }, line: sq.line, at: tip, written: s.written, kept: s.kept }
+    }
+    const r = await client.rebase(block.quilt, block.square, { expect_head: block.head })
+    if (r.noop) return { rebased: false, noop: true, square: r.square }
+    const s = await syncTo(client, dir, block, r.square.head || r.square.base, { square: r.square })
+    return { rebased: true, square: r.square, result: r, written: s.written, kept: s.kept }
+  }
+  if (!isLineCheckout(block)) throw new Error('This folder holds one revision, not a line: seam checkout <line or square> moves it.')
+  const to = (await client.show(block.quilt, block.line, { format: 'none' })).commit.id
+  const from = block.at
+  if (to === from) return { noop: true, line: block.line, at: to }
+  const s = await syncTo(client, dir, block, to)
+  return { line: block.line, from, at: to, written: s.written, kept: s.kept }
+}
+
+/** After a merge: the folder leaves the merged square and stands on the line's new tip. */
+export async function toLineTip (client, dir, block, line, tip) {
+  // The row closes first, so the move does not touch a row about to go.
+  if (block.block_id) { await client.closeBlock?.(block.quilt, block.block_id).catch(() => {}); delete block.block_id }
+  Object.assign(block, { square: null, square_short: null, head: null, task_id: null, line })
+  return syncTo(client, dir, block, tip)
 }
 
 /** Amends the square's last commit with the folder's changes (paths: only these) and, if given, a new message. */
-export async function amendFolder (client, dir, block, { message, paths = [] }) {
+export async function amendFolder (client, dir, block, { message, paths = [], allow = [] }) {
   if (!block.square) throw new Error('This folder is a read-only checkout of a line; there is no commit of yours to amend.')
   const changes = localChanges(dir, block, { paths })
-  const blobs = changes.filter((c) => c.bytes).map((c) => ({ kind: 'blob', id: c.blob, bytes: c.bytes }))
+  const blobs = changes.filter((c) => c.bytes || c.open).map((c) => c.open ? { kind: 'blob', id: c.blob, size: c.size, open: c.open } : { kind: 'blob', id: c.blob, bytes: block.sealed ? block._codec.seal(c.bytes) : c.bytes })
   if (blobs.length) await client.upload(block.quilt, blobs)
   const list = changes.map((c) => c.status === 'deleted' ? { path: c.path, op: 'delete' } : { path: c.path, op: 'put', blob: c.blob, mode: c.mode || 'file' })
-  const r = await client.amend(block.quilt, block.square, { expect_head: block.head, ...(message ? { message } : {}), changes: list })
+  const r = await client.amend(block.quilt, block.square, { expect_head: block.head, ...(message ? { message } : {}), changes: list, ...(allow.length ? { allow_findings: allow } : {}) })
   for (const c of changes) {
     if (c.status === 'deleted') { delete block.files[c.path]; continue }
     const st = fs.lstatSync(path.join(dir, ...c.path.split('/')))
@@ -263,25 +696,33 @@ export async function amendFolder (client, dir, block, { message, paths = [] })
   block.at = r.square.head
   block.head = r.square.head
   saveBlock(dir, block)
-  return r
+  return withLocalScan(block, changes, allow, r)
 }
 
 /** The folder's changes as a unified diff against `at` (diff with no revision, in a block). */
 export async function localDiff (client, dir, block, { paths = [] } = {}) {
   const changes = localChanges(dir, block, { paths })
-  const olds = await fetchBlobs(client, block.quilt, changes.map((c) => block.files[c.path]?.blob).filter(Boolean))
+  // A file over DIFF_MAX on either side is named, not diffed: a diff reads both sides whole.
+  const tooBig = (c) => (c.size || 0) > DIFF_MAX || (block.files[c.path]?.size || 0) > DIFF_MAX
+  const olds = await fetchBlobs(client, block.quilt, changes.filter((c) => !tooBig(c)).map((c) => block.files[c.path]?.blob).filter(Boolean), undefined, block._codec)
   const out = []
   for (const c of changes) {
+    if (tooBig(c)) { out.push(`Large file ${c.path} ${c.status}\n`); continue }
     const before = block.files[c.path]?.blob ? olds.get(block.files[c.path].blob) : null
-    const after = c.bytes || null
+    const after = bytesOf(c) || null
     if (!isText(before) || !isText(after)) { out.push(`Binary file ${c.path} ${c.status}\n`); continue }
     out.push(unified(c.path, before ? before.toString('utf8') : null, after ? after.toString('utf8') : null))
   }
-  return { changes: changes.map(({ bytes, ...c }) => c), text: out.join('') }
+  return { changes: changes.map(({ bytes, open, abs, ...c }) => c), text: out.join('') }
 }
 
 const absOf = (dir, p) => path.join(dir, ...p.split('/'))
-const removeEntry = (dir, p, mode) => { const abs = absOf(dir, p); if (mode === 'gitlink') { try { fs.rmdirSync(abs) } catch {} } else fs.rmSync(abs, { force: true }) }
+function removeEntry (dir, p, mode) {
+  const abs = absOf(dir, p)
+  if (mode === 'gitlink') { try { fs.rmdirSync(abs) } catch {} return }
+  if (mode === 'quilt') { fs.rmSync(path.join(abs, POINTER_FILE), { force: true }); try { fs.rmdirSync(abs) } catch {} return }
+  fs.rmSync(abs, { force: true })
+}
 
 /** Takes away the folders a removed file leaves empty, up to the block folder. */
 function pruneEmpty (dir, p) {
@@ -298,7 +739,7 @@ export async function restore (client, dir, block, { paths }) {
   if (!paths?.length) throw new Error('Which files? seam restore <paths> (. for everything here)')
   const changes = localChanges(dir, block, { paths }).filter((c) => c.status !== 'added')
   const entries = changes.map((c) => ({ path: c.path, ...block.files[c.path] }))
-  const get = await contentsFor(client, block.quilt, `c:${block.at}`, entries)
+  const get = await contentsFor(client, block.quilt, `c:${block.at}`, entries, block._codec)
   for (const e of entries) block.files[e.path] = { ...await writeEntry(dir, e, await get(e)), ...(e.term ? { term: e.term } : {}) }
   saveBlock(dir, block)
   return { restored: entries.map((e) => e.path) }
@@ -315,14 +756,15 @@ export async function reset (client, dir, block, { rev } = {}) {
     const r = await restore(client, dir, block, { paths: [dir] })
     return { rev: block.at, written: r.restored.length, removed: 0, changes: 0 }
   }
-  const t = await client.tree(block.quilt, rev, block.paths)
+  const t = await listTree(client, block.quilt, rev, block.paths, dir)
+  t.entries = t.entries.filter((e) => !e.unreadable)
   const local = new Map(localChanges(dir, block).map((c) => [c.path, c]))
   const want = new Map(t.entries.map((e) => [e.path, e]))
   const toWrite = t.entries.filter((e) => {
     const known = block.files[e.path]
     return local.has(e.path) || !known || known.blob !== e.blob || known.mode !== e.mode || (e.term || null) !== (known.term || null)
   })
-  const get = await contentsFor(client, block.quilt, rev, toWrite)
+  const get = await contentsFor(client, block.quilt, rev, toWrite, block._codec, t.ticket)
   let removed = 0
   for (const e of toWrite) {
     const rec = await writeEntry(dir, e, await get(e))