heyquilt 0.3.122 → 0.3.138

package/src/server.js

@@ -26,7 +26,7 @@ import { WebSocketServer } from 'ws'
 import * as Y from 'yjs'
 import { handleAgentMcp, handleHostedMcp, watchFeatures } from './relay-mcp.js'
 import { dropCheckpoints } from './relay-turn-sync.js'
-import { UpdateCheck } from './update-check.js'
+import { UpdateCheck, needsUpdateWords, withUpdateSteps } from './update-check.js'
 import {
   MSG_SYNC, MSG_AWARENESS, MSG_QUERY_AWARENESS, MSG_AUTH, MSG_CLAIM, MSG_CLAIMS, MAX_SHARED_FILE_BYTES,
   MSG_ACCESS, MSG_ADMIN, MSG_MEMBERS, MSG_PASS, MSG_BRANCH, MSG_BRANCHES,
@@ -35,10 +35,17 @@ import {
   ROOM_DOC, syncHeader,
   syncStep1Message, updateMessage, awarenessMessage, bytesMessage, jsonMessage
 } from './protocol.js'
-import { isLiveKey, liveRequest, liveKey, liveMaps } from './source-live/live-square.js'
+import { isLiveKey, liveRequest, liveKey, liveMaps, liveHead, overlay, seal, entryId, startHead } from './source-live/live-square.js'
+import { conflictsAhead, commitAhead, staleAhead, standHead, moveLive, lateEdits, sideReader, HOLDER_WAIT_MS } from './source-live/bring-in.js'
+import { blobId } from '@heyquilt/seam/lib/quilts/records.js'
 import { planSessionQuilt, quiltPlanRefusal, describeQuiltPlan, fileHash } from './session-quilt.js'
-import { makeQuiltWithoutHistory } from './session-migrate.js'
-import { LAYOUT_QUILT, treeIds, overlayFor, writeOverlay, checkOverlay } from './session-layout3.js'
+import { makeQuiltWithoutHistory, termsFor } from './session-migrate.js'
+import { forceAtMs, forcedAction } from './force-date.js'
+import { githubRepoOf, installationFor, remoteStage, mainGuarded, rulesetSteps, installSteps, stepsError } from './quilt-remote.js'
+import { syncStoppedWords } from './ui/force-words.js'
+import { historyQuilt, linkedHistory } from './quilt-history.js'
+import { MAX_DIFF_CHARS } from './history.js'
+import { LAYOUT_QUILT, copiedHead, treeIds, treeModes, branchFiles, binariesToUpload, bringsNew, forwardIntoLive, applyChecked, foldBack, writeFold, overlayFor, checkOverlay, copyIntoLive, carryLive, takeGitMeta, restoreGitMeta, squareBase, shareWithPeople, changedGitIds, dropOldCopies, boxOntoHead, writeIntoLive } from './session-layout3.js'
 import { readMerges } from './merges.js'
 import { readTasks, updateTask } from './tasks.js'
 import { addComment } from './task-comments.js'
@@ -63,7 +70,7 @@ import { noteCloudAi, cloudAiWaker } from './relay-ai-vm.js'
 import { normalizeHosted, hostedIn, newHosted } from './hosted-agents.js'
 import { ChatArchive } from './chat-archive.js'
 import { asksRelay, relayAnswer, mergedBranches } from './relay-ask.js'
-import { DIFF, markDiff, isDiff, hasEntry, cutOf, notePresent, removePath, gitOf, cachedTree, baseOf, ensureCommit } from './branch-view.js'
+import { DIFF, markDiff, isDiff, hasEntry, cutOf, notePresent, removePath, gitOf, cachedTree, baseOf, ensureCommit, mirrorFor } from './branch-view.js'
 import { inactiveBranches, mergedByAncestry, mergedByPull, samePatches, deleteOnGithub, pruneNotice, ARCHIVE_KEEP_MS, ANCESTRY_EVERY_MS } from './relay-prune.js'
 import { githubReader } from './relay-upstream.js'
 import { RELAY_BY, isRelay } from './branches.js'
@@ -83,6 +90,8 @@ import { clashAction, noteMergeChecks } from './relay-clash.js'
 import { AGENT_COMMITS } from './github-commit.js'
 import { repoMoves } from './relay-repo-moves.js'
 import { UPSTREAM_CHECK_MS, SYNC_EVERY_MS, SYNC_EVERY_GIT_MS, upstreamsOf, noteFolders, applyRepoMove, relayEntry, relayLooks, dueBranches, checkBranch, folderOn, connectedOn, hostedOn, validToken, folderAble, catcherAble, noteHolds, connectedAs, describeRelayCheck, loadBranch, parseRepo, configureGithubBudget, CLASH_IDLE_MS, noteConnection } from './relay-upstream.js'
+import { nowSummary } from './now-summary.js'
+import { squareShort } from '@heyquilt/seam/lib/quilts/errors.js'
 
 const ROOM_RE = /^[A-Za-z0-9_-]{1,64}$/
 const MAX_NAME = 64
@@ -120,6 +129,17 @@ const CLOUD_AI_GONE_MS = 5 * 60 * 1000
 const BRANCH_SEEN_SAVE_MS = 60 * 60 * 1000
 // A message to the relay older than this when it reaches the relay gets no answer (answerRelay).
 const RELAY_ASK_MS = 10 * 60 * 1000
+// The app's reads of a linked quilt (quiltRead): how long a reply waits on Seam before it says
+// "still working" (under the app's 10 s request timeout), how long an answer is kept, and how
+// many lines of a file a blame sends.
+const QUILT_READ_WAIT_MS = 8000
+const QUILT_READ_KEEP_MS = 60 * 1000
+const QUILT_BLAME_MAX_LINES = 20000
+/** A file's path as Seam names it (forward slashes, no leading ./ or /), or '' when it is not one. */
+const quiltFilePath = (p) => {
+  const s = typeof p === 'string' ? p.replace(/\\/g, '/').replace(/^(\.\/|\/)+/, '') : ''
+  return s && s.length <= 1000 && !s.split('/').includes('..') && !CONTROL_CHARS.test(s) ? s : ''
+}
 const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..')
 const LOGO = path.join(ROOT, 'assets', 'logo.svg')
 const hash = (s) => crypto.createHash('sha256').update(String(s)).digest()
@@ -222,6 +242,12 @@ function loadedFor (stack) {
   return frames.slice(0, 2).map((l) => l.replace(/\(?file:\/\/\/?[^)]*\/src\//, '(').replace(/:\d+\)?$/, ')')).join(' < ') || 'unknown'
 }
 
+// Seam (16, "How a session becomes a quilt"): a room's layout migration runs under a lease of its
+// own, so two relay machines never move one room at once. Its holder is one attempt (`qm-<id>`),
+// listed here while it runs.
+const MIGRATION_LEASE = 'qm-'
+const migrating = new Set()
+
 class Room {
   constructor (name, dataDir, cfg, log) {
     this.name = name
@@ -273,6 +299,7 @@ class Room {
     })
     // A room saved before branch documents: its one document becomes the default branch's.
     this.migrateLegacy()
+    this.recoverQuiltMove()
     this.pruneBranches(Date.now(), { quiet: true }) // at load; the sweep says it in chat
     this.awareness = new awarenessProtocol.Awareness(this.doc)
     this.awareness.setLocalState(null)
@@ -353,7 +380,7 @@ class Room {
         if (this.cloudAiWaker) this.cloudAiWaker.personActive(this, origin).catch(() => {}) // their cloud AI wakes while they work
       }
       const msg = updateMessage(update)
-      for (const ws of this.conns.keys()) if (ws !== origin) send(ws, msg)
+      for (const ws of this.conns.keys()) if (ws !== origin && !ws.roomless) send(ws, msg)
       this.bytes += update.length
       if (!this.full && this.bytes > cfg.maxRoomBytes) {
         this.full = true
@@ -370,7 +397,7 @@ class Room {
         for (const id of removed) ids.delete(id)
       }
       const msg = awarenessMessage(this.awareness, changed)
-      for (const ws of this.conns.keys()) send(ws, msg)
+      for (const ws of this.conns.keys()) if (!ws.roomless) send(ws, msg)
       // Which upstream each branch follows, and where its folders are (relay-upstream.js).
       if (origin && this.conns.has(origin)) this.noteUpstreams()
     })
@@ -988,7 +1015,11 @@ class Room {
   onBranch (ws, rel) {
     const e = ws.branch ? this.store.get(ws.branch) : null
     // A diff branch leaves its unchanged files to git: a path it hasn't deleted counts as on it.
-    return !!e && (hasEntry(e, rel) || (isDiff(e) && !e.gone.has(rel)))
+    if (e && (hasEntry(e, rel) || (isDiff(e) && !e.gone.has(rel)))) return true
+    // At layout 3 the branch's work is in its square: a file new there (live-block.js) is on it too.
+    const lk = this.meta.layout === LAYOUT_QUILT && ws.branch && this.meta.quilt && (this.meta.quilt.live || {})[ws.branch]
+    const sq = isLiveKey(lk) ? this.store.load(lk) : null
+    return !!sq && (sq.files.has(rel) || sq.blobs.has(rel))
   }
 
   /** Whether a new branch here may be a diff one: the relay keeps a git mirror of the session's GitHub repository. */
@@ -1509,7 +1540,8 @@ class Room {
   checkUpstreams ({ force = false, keys = null } = {}) {
     // A look asked for (force) waits for one under way, then has its own: the one under way may not include its branches.
     if (this.upstreamRun) return force ? this.upstreamRun.catch(() => {}).then(() => this.checkUpstreams({ force, keys })) : this.upstreamRun
-    if (!this.exists || this.ended || this.destroyed || this.meta.layout !== 2) return Promise.resolve([])
+    this.checkForcedDate()
+    if (!this.exists || this.ended || this.destroyed || this.meta.layout !== 2 || this.meta.syncStopped) return Promise.resolve([])
     this.noteConnections({ keys }) // the connections, about once an hour per branch, with the relay's own looks
     const now = Date.now()
     // With the mirror on: about every minute (git ls-remote, no API quota); webhooks in between (addendum 16.13).
@@ -1824,11 +1856,53 @@ class Room {
   /**
    * What every branch-list message carries: the list and, once the session is a quilt (behind
    * QUILT_SOURCE_URL), its link { id, slug, squares: { branch: square id } } so each member's
-   * app and agents can use Seam (plans/quilt-source-control/16).
+   * app and agents can use Seam (Seam's plans/quilt-source-control/16); at layout 3 also `atTip`,
+   * the branches whose squares the move started at main's tip for want of their own commit.
    */
   branchesFields () {
-    const q = this.meta.quilt_id && process.env.QUILT_SOURCE_URL ? { id: this.meta.quilt_id, slug: (this.meta.quilt || {}).slug || '', squares: (this.meta.quilt || {}).squares || {}, ...((this.meta.quilt || {}).at ? { at: this.meta.quilt.at } : {}), ...(this.meta.layout === LAYOUT_QUILT ? { layout: LAYOUT_QUILT, live: this.meta.quilt.live || {}, ...(this.meta.quilt.adoption ? { adoption: this.meta.quilt.adoption } : {}) } : {}) } : null
-    return { branches: this.branchList(), ...(q ? { quilt: q } : {}) }
+    const q = this.meta.quilt_id && process.env.QUILT_SOURCE_URL ? { id: this.meta.quilt_id, slug: (this.meta.quilt || {}).slug || '', squares: (this.meta.quilt || {}).squares || {}, ...((this.meta.quilt || {}).at ? { at: this.meta.quilt.at } : {}), ...((this.meta.quilt || {}).history ? { history: true } : {}), ...(this.meta.layout === LAYOUT_QUILT ? { layout: LAYOUT_QUILT, live: this.meta.quilt.live || {}, ...(this.meta.quilt.adoption ? { adoption: this.meta.quilt.adoption } : {}), read: this.readTokenState(), ...((this.meta.quilt.basedAtTip || []).length ? { atTip: this.meta.quilt.basedAtTip.map((b) => b.from) } : {}) } : {}) } : null
+    // 16 step 1: the quilt an import of the session's git remote fills while git is still the
+    // authority. Its own field, so nothing that treats the session as a quilt (session-seam.js) moves.
+    const sh = !q && this.meta.quiltShadow && process.env.QUILT_SOURCE_URL ? { id: this.meta.quiltShadow.id, slug: this.meta.quiltShadow.slug || '' } : null
+    // The forced date (16 flag 9, force-date.js): when it is, live sync stopped, or the owner's app is to make the session a quilt now.
+    const at = process.env.QUILT_SOURCE_URL ? forceAtMs() : null
+    const act = this.meta.layout === LAYOUT_QUILT ? null : forcedAction({ at, layout: this.meta.layout, remote: this.hasGitRemote(), stopped: !!this.meta.syncStopped })
+    const force = this.meta.syncStopped ? { stopped: { at: this.meta.syncStopped.at, why: syncStoppedWords(this.meta.syncStopped.at) } } : at != null && this.meta.layout !== LAYOUT_QUILT ? { at: new Date(at).toISOString(), remote: this.hasGitRemote(), ...(act === 'migrate' ? { migrate: true } : {}) } : null
+    // "Make this a quilt" on a session with a git remote, while Seam imports it (quiltMakeWithRemote).
+    const imp = !q && !sh && this.meta.quiltImport && process.env.QUILT_SOURCE_URL ? { slug: this.meta.quiltImport.slug || '', repo: this.meta.quiltImport.repo || '' } : null
+    return { branches: this.branchList(), ...(q ? { quilt: q } : {}), ...(sh ? { shadow: sh } : {}), ...(imp ? { importing: imp } : {}), ...(this.movingNow ? { moving: this.movingNow } : {}), ...(force ? { force } : {}) }
+  }
+
+  /** Whether the session has a git remote (16: a room with an upstream): it becomes a quilt only with its history. */
+  hasGitRemote () { return Object.keys(this.meta.upstreams || {}).length > 0 }
+
+  /**
+   * The forced date (16 flag 9): from QUILT_SOURCE_FORCE_AT on, a session with a git remote that is not
+   * a quilt in its squares has its live file sync stopped, for good (meta.syncStopped): its branch
+   * documents stay as they were at the date, the relay neither takes a member's file edits nor brings
+   * GitHub in or pushes, and every member hears it in plain words. Chat, tasks, the feed and the audit
+   * trail carry on. Nothing in git is touched. A session with no git remote is left to its owner's
+   * next open (branchesFields `force.migrate`): only the owner's sign-in can make it a quilt.
+   */
+  checkForcedDate (now = Date.now()) {
+    if (this.meta.syncStopped || this.meta.layout === LAYOUT_QUILT || this.quiltMoving || !this.exists || this.ended || this.destroyed) return false
+    if (!process.env.QUILT_SOURCE_URL) return false
+    if (forcedAction({ at: forceAtMs(), now, layout: this.meta.layout, remote: this.hasGitRemote() }) !== 'stop') return false
+    const at = new Date(forceAtMs()).toISOString()
+    this.meta.syncStopped = { at, since: new Date(now).toISOString() }
+    this.saveMeta()
+    this.log(`[${this.name}] the forced date (${at}) passed with a git remote and no cut-over: live file sync stopped`)
+    try { this.postChat({ by: 'Quilt', text: syncStoppedWords(at), kind: 'note' }) } catch {}
+    this.broadcastBranches()
+    return true
+  }
+
+  /** A member's write to a branch document after live sync stopped: not kept, and they hear why (at most once a minute a connection). */
+  refusedSyncStopped (ws) {
+    const now = Date.now()
+    if (ws.syncStoppedToldAt && now - ws.syncStoppedToldAt < READ_ONLY_TELL_MS) return
+    ws.syncStoppedToldAt = now
+    send(ws, jsonMessage(MSG_BRANCHES, { ...this.branchesFields() }))
   }
 
   broadcastBranches () {
@@ -2037,7 +2111,7 @@ class Room {
    * app asks before it clears its folder for a switch).
    */
   branchRequest (ws, req) {
-    // Seam, behind QUILT_SOURCE_URL (plans/quilt-source-control/16): what making this session a
+    // Seam, behind QUILT_SOURCE_URL (Seam's plans/quilt-source-control/16): what making this session a
     // quilt would do, read only. The owner's (or, in a session without one, any editor's).
     if (req.op === 'quilt-plan') {
       if (!process.env.QUILT_SOURCE_URL) throw new Error('Seam is not on for this relay, so a session cannot become a quilt here yet')
@@ -2046,13 +2120,17 @@ class Room {
     const key = String(req.branch ?? '')
     if (!validBranchKey(key)) throw new Error(`"${key.slice(0, 60)}" isn't a branch name`)
     if (req.op === 'join') {
-      // At layout 3 the only documents members join are squares' live documents (quiltSwitch).
+      this.checkForcedDate()
+      // At layout 3 the documents members write are squares' live documents (quiltSwitch). An app
+      // whose folder follows its square in place (quilt-folders) still joins its branch's kept
+      // document, read-only, so it knows the folder's branch and goes back to it with quiltUnswitch.
       const square = this.meta.layout === LAYOUT_QUILT && isLiveKey(key)
-      if (!square) this.assertMigrated()
+      const kept = this.meta.layout === LAYOUT_QUILT && !square && (ws.features || []).includes('quilt-folders') && !!this.meta.branches[this.resolveKey(key)]
+      if (!square && !kept) this.assertMigrated()
       // An app from before branch documents names the branch the old document was; else the first real branch takes ∅.
       let adopted = false
-      if (!square && validBranchKey(String(req.adopt || ''))) adopted = this.adoptDefault(String(req.adopt))
-      if (!square) adopted = this.adoptDefault(key) || adopted
+      if (!square && !kept && validBranchKey(String(req.adopt || ''))) adopted = this.adoptDefault(String(req.adopt))
+      if (!square && !kept) adopted = this.adoptDefault(key) || adopted
       const k = this.resolveKey(key)
       const created = !this.meta.branches[k]
       if (created) {
@@ -2102,6 +2180,16 @@ class Room {
       if (!covers(Y.encodeStateVector(e.doc), want)) throw new Error(`not all of your changes on ${key} have reached the relay yet`)
       return { ok: true, branch: k }
     }
+    // What the relay holds of the app's branch: its state vector, and its deletions (an update with
+    // nothing past the vector). At layout 3 the app's own edits past them are ones the read-only
+    // document refused, and its folder keeps them (Session.unsentPaths).
+    if (req.op === 'state') {
+      const k = this.resolveKey(key)
+      const e = k === ws.branch ? this.store.get(k) : null
+      if (!e) throw new Error(`you are not on ${key}`)
+      const sv = Y.encodeStateVector(e.doc)
+      return { ok: true, branch: k, sv: Buffer.from(sv).toString('base64'), deleted: Buffer.from(Y.encodeStateAsUpdate(e.doc, sv)).toString('base64') }
+    }
     if (req.op === 'remove') {
       const a = this.access.get(ws)
       if (!a || (this.controlled && !a.owner)) throw new Error('only the session owner can remove a branch')
@@ -2113,8 +2201,8 @@ class Room {
       this.removeBranch(k)
       return { ok: true, branch: k, listChanged: true }
     }
-    // Quilt source control (src/source-live/live-square.js), behind QUILT_SOURCE: a square's live document's own ops.
-    if ((req.op === 'seal' || req.op === 'start') && isLiveKey(key) && process.env.QUILT_SOURCE) {
+    // Quilt source control (src/source-live/live-square.js), behind QUILT_SOURCE, and always once the room is at layout 3: a square's live document's own ops.
+    if ((req.op === 'seal' || req.op === 'start') && isLiveKey(key) && (process.env.QUILT_SOURCE || this.meta.layout === LAYOUT_QUILT)) {
       const k = this.resolveKey(key)
       const e = k === ws.branch ? this.store.get(k) : null
       if (!e) throw new Error(`you are not on ${key}`)
@@ -2151,7 +2239,7 @@ class Room {
     for (const r of this.commitRequests.values()) {
       if (!r || r.state !== 'open') continue
       const sq = squares[r.branch || this.defaultKey]
-      const text = `Please get this into history: ${(r.files || []).join(', ')}${sq ? ` (square sq:${sq.slice(0, 8)})` : ''}. ${r.by || 'Someone'} asked for a commit ("${String(r.message || '').slice(0, 200)}") before the session became a quilt: commit it in Seam.`
+      const text = `Please get this into history: ${(r.files || []).join(', ')}${sq ? ` (square ${squareShort(sq)})` : ''}. ${r.by || 'Someone'} asked for a commit ("${String(r.message || '').slice(0, 200)}") before the session became a quilt: commit it in Seam.`
       if (r.task && tasks.some((t) => t.id === r.task.id)) addComment(this.doc, this.taskComments, tasks, { taskId: r.task.id, by: 'Quilt', text }, 'quilt-migrate')
       else this.postChat({ by: 'Quilt', text, kind: 'note' })
     }
@@ -2167,15 +2255,287 @@ class Room {
     if (!api) return answer({ ok: false, error: 'Seam is not on for this relay, so a session cannot become a quilt here yet' })
     if (!req.token || typeof req.token !== 'string') return answer({ ok: false, error: 'sign in to Seam first: making a session a quilt is done as its owner' })
     const seam = (this.seamClient || quiltClient)({ api, token: req.token })
+    if (req.op === 'quilt-shadow') {
+      return this.quiltShadowLink(this.access.get(ws), seam, req.quilt ?? null).then((r) => answer({ ok: true, ...r }), (err) => answer({ ok: false, error: err.message }))
+    }
+    if (req.op === 'quilt-unswitch') {
+      return this.quiltUnswitch(this.access.get(ws), seam, { carried: req.carried || [] }).then((r) => answer({ ok: true, ...r }), (err) => answer({ ok: false, error: err.message, ...(err.open ? { open: err.open } : {}) }))
+    }
     if (req.op === 'quilt-switch') {
       return this.quiltSwitch(this.access.get(ws), seam).then((r) => answer({ ok: true, ...r }), (err) => answer({ ok: false, error: err.message }))
     }
+    if (req.op === 'quilt-make') {
+      return this.quiltMake(this.access.get(ws), seam).then((r) => answer({ ok: true, quilt: r }), (err) => answer({ ok: false, error: err.message, ...(err.quilt_id ? { quilt_id: err.quilt_id } : {}), ...(err.steps ? { steps: err.steps } : {}) }))
+    }
+    if (req.op === 'quilt-next') {
+      return this.quiltNext(this.access.get(ws), seam, req.branch).then((r) => answer({ ok: true, ...r }), (err) => answer({ ok: false, error: err.message }))
+    }
+    if (req.op === 'quilt-open') {
+      return this.quiltOpen(this.access.get(ws), seam, req.branch ?? ws.branch).then((r) => answer({ ok: true, ...r }), (err) => answer({ ok: false, error: err.message }))
+    }
+    if (req.op === 'quilt-catch-up') {
+      // An app that asks to bring main in follows a square whose base moves (0.3.133 on): its folder is no reason to wait (outdatedOn).
+      if (!this.movesApps) this.movesApps = new Set()
+      this.movesApps.add(appOf(ws, this.names.get(ws)))
+      return this.quiltCatchUp(this.access.get(ws), seam, req.branch ?? ws.branch, { by: this.names.get(ws) || '' }).then((r) => answer({ ok: true, ...r }), (err) => answer({ ok: false, error: err.message }))
+    }
     this.quiltMigrate(this.access.get(ws), seam).then(
       (r) => answer({ ok: true, quilt: r }),
       (err) => answer({ ok: false, error: err.message, ...(err.quilt_id ? { quilt_id: err.quilt_id } : {}) })
     )
   }
 
+  /**
+   * 16 step 1 ("Shadow"), behind QUILT_SOURCE_URL: links the session to the quilt an import of its
+   * git remote fills (`quilt`, its slug or id; null unlinks), as the owner with `seam` acting as
+   * them. Nothing else changes: the session stays git-mode, agents keep their git path, and the
+   * link only lets quilt_history (and the app) read the quilt's log. A read-only quilt token is
+   * made for the room (`meta.quiltShadow.read`), so hosted agents read the log without anyone's
+   * sign-in; making it needs admin on the quilt, which is how the owner proves the quilt is theirs.
+   * The with-history migration (quiltMigrate) later turns this link into the session's quilt.
+   */
+  async quiltShadowLink (a, seam, quilt) {
+    const no = quiltPlanRefusal({ controlled: this.controlled, access: a })
+    if (no) throw new Error(no.replace('see what making it a quilt would do', 'link it to a quilt'))
+    if (this.meta.quilt_id) {
+      const slug = (this.meta.quilt && this.meta.quilt.slug) || ''
+      if (!quilt || (quilt !== this.meta.quilt_id && quilt !== slug && !String(quilt).endsWith(`/${slug}`))) throw new Error(`this session is already the quilt ${slug || this.meta.quilt_id}`)
+      // Linking the session to its own quilt again makes the room's read token new when it is gone, ending or refused.
+      const r = await this.freshReadToken(seam, this.meta.quilt_id, this.meta.quilt.read)
+      if (r.renewed || this.meta.quilt.readRefusedAt) this.takeReadToken(r.read)
+      return { shadow: { id: this.meta.quilt_id, slug }, read: { renewed: r.renewed, ...(r.read.expires_at ? { until: new Date(r.read.expires_at).toISOString() } : {}) } }
+    }
+    if (this.quiltMoving) throw new Error('this session is already being made a quilt')
+    const was = this.meta.quiltShadow || null
+    if (quilt === null || quilt === '') {
+      if (!was) return { shadow: null }
+      if (was.read && was.read.id && seam.revokeToken) await seam.revokeToken(was.id, was.read.id).catch(() => {})
+      delete this.meta.quiltShadow
+      this.saveMeta()
+      this.broadcastBranches()
+      return { shadow: null, was: { id: was.id, slug: was.slug } }
+    }
+    if (typeof quilt !== 'string' || quilt.length > 200) throw new Error('name the quilt to link (its slug or id)')
+    this.quiltMoving = true
+    try {
+      const info = await seam.quilt(quilt)
+      if (!info || !info.id) throw new Error(`Seam has no quilt ${quilt}`)
+      if (!(info.lines || []).some((l) => l && l.name === 'main' && l.tip)) throw new Error(`${info.slug || quilt} has nothing on main yet: import the session's git remote into it first (seam import git ... --follow)`)
+      let read
+      try {
+        const t = await seam.createToken(info.id, { name: `Quilt session ${this.name}`.slice(0, 100), level: 'read', expires_in_days: 365 })
+        read = { token: t.token, id: t.id, ...(t.expires_at ? { expires_at: t.expires_at } : {}) }
+      } catch (err) {
+        throw new Error(err.status === 403 ? `only an admin of ${info.slug || quilt} can link a session to it` : `Seam did not make a read token for the session: ${err.message}`)
+      }
+      if (was && was.read && was.read.id && was.id !== info.id && seam.revokeToken) await seam.revokeToken(was.id, was.read.id).catch(() => {})
+      this.meta.quiltShadow = { id: info.id, slug: info.slug || '', at: new Date().toISOString(), by: (a && (a.sub || a.key || a.name)) || '', read }
+      this.saveMeta()
+      this.broadcastBranches()
+      return { shadow: { id: info.id, slug: info.slug || '' } }
+    } finally {
+      this.quiltMoving = false
+    }
+  }
+
+  /** A Seam client with the room's read token (shadow link or quilt), or null when it has none. */
+  quiltReadClient () {
+    const api = process.env.QUILT_SOURCE_URL
+    const read = this.meta.quilt_id ? (this.meta.quilt || {}).read : (this.meta.quiltShadow || {}).read
+    if (!api || !read || !read.token) return null
+    if (read.expires_at && read.expires_at <= Date.now()) return null
+    // No retries: Seam down falls back to the session's own record at once, with why.
+    return (this.seamClient || quiltClient)({ api, token: read.token, retry: false })
+  }
+
+  /**
+   * The room's read token for quilt `q` (`read`, the one it has), as an admin `seam` checks it at a
+   * move: kept while it has more than READ_TOKEN_RENEW_MS left and (`probe`) Seam still takes it;
+   * else a new one is made and the old one revoked, so every member's folder can read its square.
+   * { read, renewed: false | 'missing' | 'expiring' | 'refused' }; throws when Seam makes none.
+   */
+  async freshReadToken (seam, q, read, { probe = true } = {}) {
+    let why = !read || !read.token ? 'missing' : read.expires_at && read.expires_at - Date.now() < READ_TOKEN_RENEW_MS ? 'expiring' : ''
+    if (!why && probe) {
+      try { await (this.seamClient || quiltClient)({ api: process.env.QUILT_SOURCE_URL, token: read.token, retry: false }).quilt(q) } catch (err) {
+        // Seam answers a token it no longer takes with 401, or 404 for a quilt it can't see (revoked).
+        if (err.status === 401 || err.status === 403 || err.status === 404) why = 'refused'
+      }
+    }
+    if (!why) return { read, renewed: false }
+    let t
+    try { t = await seam.createToken(q, { name: `Quilt session ${this.name}`.slice(0, 100), level: 'read', expires_in_days: 365 }) } catch (err) {
+      throw new Error(`the session's read token for its quilt is ${why === 'missing' ? 'missing' : why === 'expiring' ? 'about to end' : 'no longer taken by Seam'}, and Seam did not make a new one${err.status === 403 ? ' (only an admin of the quilt can)' : `: ${err.message}`}`)
+    }
+    if (read && read.id && seam.revokeToken) await seam.revokeToken(q, read.id).catch(() => {})
+    return { read: { token: t.token, id: t.id, ...(t.expires_at ? { expires_at: t.expires_at } : {}) }, renewed: why }
+  }
+
+  /**
+   * What apps hear of the room's read token at layout 3 (never the token): when it ends, and
+   * `renew` once it is missing, ends within READ_TOKEN_RENEW_MS or Seam refused it. The owner's app
+   * renews it then, as the owner (Session.renewReadToken): the relay holds no credential that can.
+   * Only an admin of the quilt makes a quilt token; the relay has the read token itself (read only)
+   * and its accounts-API secret (not a Seam sign-in), and keeping the owner's sign-in on the relay
+   * would let anyone with its disk act as them.
+   */
+  readTokenState () {
+    const read = (this.meta.quilt || {}).read
+    const ends = read && read.expires_at ? Number(read.expires_at) : null
+    const renew = !read || !read.token || !!this.meta.quilt.readRefusedAt || (ends !== null && ends - Date.now() < READ_TOKEN_RENEW_MS)
+    return { ...(ends ? { ends } : {}), ...(renew ? { renew: true } : {}) }
+  }
+
+  /** The room's read token is `read` from now on (made again by freshReadToken): kept, and apps hear it needs nothing. */
+  takeReadToken (read) {
+    this.meta.quilt.read = read
+    delete this.meta.quilt.readRefusedAt
+    this.saveMeta()
+    this.broadcastBranches()
+  }
+
+  /** Seam refused the room's read token (or it is gone): apps hear it, so the owner's renews it at once. */
+  readTokenRefused () {
+    if (!this.meta.quilt || this.meta.quilt.readRefusedAt) return
+    this.meta.quilt.readRefusedAt = Date.now()
+    this.saveMeta()
+    this.broadcastBranches()
+  }
+
+  /** The words for a room whose read token is gone or refused: what its owner does about it. */
+  noReadToken () {
+    const name = (this.meta.quilt && this.meta.quilt.slug) || this.meta.quilt_id || 'its quilt'
+    return `the session's read token for ${name} is missing or has ended: its owner makes a new one with quilt session migrate --shadow ${name}`
+  }
+
+  /**
+   * One read of the room's quilt for a member's block (live-block.js): `call` square, tree, blobs
+   * or diff, always of this room's own quilt, with the room's read token. Only at layout 3.
+   */
+  async quiltBlockRead ({ call, square, rev, paths, ids, from, to, file, format } = {}) {
+    if (this.meta.layout !== LAYOUT_QUILT || !this.meta.quilt_id) throw new Error('this session\'s files are not in squares')
+    const seam = this.quiltReadClient()
+    if (!seam) { this.readTokenRefused(); throw new Error(this.noReadToken()) }
+    const q = this.meta.quilt_id
+    const list = (x, n) => Array.isArray(x) ? x.slice(0, n).map(String) : undefined
+    const read = async () => {
+      if (call === 'square') return { square: await seam.square(q, String(square || '')) }
+      if (call === 'tree') return { tree: await seam.tree(q, String(rev || ''), list(paths, 100)) }
+      if (call === 'blobs') {
+        const want = (list(ids, 200) || []).filter((x) => /^[0-9a-f]{64}$/.test(x))
+        return { blobs: want.length ? (await seam.blobs(q, want)).blobs : {} }
+      }
+      if (call === 'diff') return { diff: await seam.diff(q, { from: String(from || ''), to: String(to || ''), paths: list(paths, 100), format: 'names' }) }
+      // A conflicted file has no bytes of its own: a folder writes it with its markers (live-block.js headFile).
+      if (call === 'cat') return { cat: await seam.cat(q, String(rev || ''), String(file || ''), { format: format === 'git' ? 'git' : 'diff' }) }
+      throw new Error('unknown read of the quilt')
+    }
+    // A token Seam no longer takes (revoked): 401, or a quilt it can't see; said with what the owner does.
+    try { return await read() } catch (err) {
+      if (err.status === 401 || (err.status === 404 && /no such quilt/i.test(String(err.message)))) { this.readTokenRefused(); throw new Error(this.noReadToken()) }
+      throw err
+    }
+  }
+
+  /** The quilt this room's chronology reads (quilt-history.js historyQuilt) and a client to read it with. */
+  quiltHistoryLink () {
+    const quilt = historyQuilt(this.meta)
+    return quilt ? { quilt, seam: this.quiltReadClient() } : null
+  }
+
+  /** The quilt's log for `query` (path, by, since, task, limit, with_diff), as chronology entries; null when the room has no link. */
+  async quiltLog (query = {}) {
+    const link = this.quiltHistoryLink()
+    if (!link) return { ok: true, quilt: null, entries: [] }
+    const r = await linkedHistory({ seam: link.seam, quilt: link.quilt, entries: [], query: { path: query.path || '', by: query.by, since: typeof query.since === 'number' ? query.since : undefined, task: query.task, limit: Math.min(Number(query.limit) || 30, 200), withDiff: !!query.with_diff } })
+    return { ok: true, quilt: link.quilt, entries: r.list, ...(r.note ? { note: r.note } : {}) }
+  }
+
+  /**
+   * One read of the room's quilt for the app (blame, search, a patch), with the room's read token:
+   * one request to Seam per `key` at a time, its answer kept a minute. Answers within `wait` ms,
+   * else { working: true } and the app asks again: a first blame of a file is worked out by Seam
+   * (202 "deriving"), which the client waits on at Seam's own pace. { quilt: null } when not linked.
+   */
+  quiltRead (key, read, { wait = this.quiltReadWaitMs ?? QUILT_READ_WAIT_MS } = {}) {
+    const link = this.quiltHistoryLink()
+    if (!link) return Promise.resolve({ ok: true, quilt: null })
+    if (!link.seam) return Promise.resolve({ ok: false, error: `the session has no read token for ${link.quilt.slug || link.quilt.id}: link it again` })
+    const reads = this.quiltReads || (this.quiltReads = new Map())
+    for (const [k, r] of reads) if (r.done && Date.now() - r.done > QUILT_READ_KEEP_MS) reads.delete(k)
+    const k = `${link.quilt.id}\0${key}`
+    let r = reads.get(k)
+    if (!r) {
+      r = { done: 0, answer: null }
+      r.promise = read(link.seam, link.quilt.id)
+        .then((v) => ({ ok: true, quilt: link.quilt, ...v }), (err) => ({ ok: false, error: `Seam: ${String(err.message || err).slice(0, 300)}` }))
+        .then((ans) => { r.answer = ans; r.done = Date.now(); if (!ans.ok && reads.get(k) === r) reads.delete(k); return ans })
+      reads.set(k, r)
+      if (reads.size > 64) reads.delete(reads.keys().next().value)
+    }
+    if (r.done) return Promise.resolve(r.answer)
+    return Promise.race([r.promise, new Promise((resolve) => { const t = setTimeout(() => resolve({ ok: true, quilt: link.quilt, working: true }), wait); t.unref?.() })])
+  }
+
+  /**
+   * Who wrote each line of `path` on main, from Seam's blame: { blame: { commit, who: [{ commit,
+   * short, by, at, patch }], lines: [[text, index in who or -1]] } }, or { missing: true } when the
+   * file is not on main (all of it is live work).
+   */
+  quiltBlame (p) {
+    const file = quiltFilePath(p)
+    if (!file) return Promise.reject(new Error('name a file'))
+    return this.quiltRead(`blame\0${file}`, async (seam, q) => {
+      let b
+      try { b = await seam.blame(q, 'main', file) } catch (err) { if (err.status === 404) return { missing: true }; throw err }
+      const who = []
+      const at = new Map()
+      const lines = (b.lines || []).slice(0, QUILT_BLAME_MAX_LINES).map((l) => {
+        if (!l.commit) return [String(l.text ?? ''), -1]
+        if (!at.has(l.commit)) { at.set(l.commit, who.length); who.push({ commit: l.commit, short: l.short || l.commit.slice(0, 12), by: String(l.author || ''), at: Number(l.at) || 0, ...(l.patch && l.patch.patch_no != null ? { patch: l.patch.patch_no } : {}) }) }
+        return [String(l.text ?? ''), at.get(l.commit)]
+      })
+      return { blame: { commit: b.commit || null, who, lines } }
+    })
+  }
+
+  /** Code search over main (Seam's /search): { search: { commit, counts, more, hits: [{ path, line, text, symbol }] } }. */
+  quiltSearch (text) {
+    const q = typeof text === 'string' ? text.trim() : ''
+    if (!q || q.length > 300) return Promise.reject(new Error('search for some text (300 characters at most)'))
+    return this.quiltRead(`search\0${q}`, async (seam, id) => {
+      const r = await seam.searchCode(id, { q, rev: 'main', limit: 100 })
+      const hits = ((r && r.results) || []).filter((x) => x && typeof x.path === 'string').map((x) => ({
+        path: x.path,
+        ...(x.line ? { line: Number(x.line) } : {}),
+        ...(x.kind === 'content' ? { text: String(x.text || '').slice(0, 500) } : {}),
+        ...(x.kind === 'symbol' && x.symbol ? { symbol: `${x.symbol.kind || ''} ${x.symbol.name || ''}`.trim() } : {})
+      }))
+      return { search: { commit: (r && r.commit) || null, counts: (r && r.counts) || { files: 0, matches: 0 }, more: !!(r && (r.cursor || r.more)), hits } }
+    })
+  }
+
+  /** One patch (a commit of the log) for a file's History: { patch: { commit, files: [{ path, added, removed }], diff } }, the diff of `path` only. */
+  quiltShow (commit, p) {
+    if (typeof commit !== 'string' || !/^[0-9a-f]{12,64}$/.test(commit)) return Promise.reject(new Error('name a commit'))
+    const file = quiltFilePath(p)
+    return this.quiltRead(`show\0${commit}\0${file}`, async (seam, id) => {
+      const s = await seam.show(id, commit, { format: 'unified' })
+      const files = ((s && s.diff && s.diff.files) || []).map((f) => {
+        let added = 0
+        let removed = 0
+        for (const l of String(f.patch || '').split('\n')) {
+          if (l.startsWith('+') && !l.startsWith('+++')) added++
+          else if (l.startsWith('-') && !l.startsWith('---')) removed++
+        }
+        return { path: String(f.path || ''), added, removed, ...(f.binary ? { binary: true } : {}), patch: String(f.patch || '') }
+      })
+      const mine = files.find((f) => f.path === file)
+      const diff = mine ? mine.patch.split('\n').filter((l) => !l.startsWith('--- ') && !l.startsWith('+++ ')).join('\n') : ''
+      return { patch: { commit, files: files.map(({ patch, ...f }) => f), diff: diff.length > MAX_DIFF_CHARS ? `${diff.slice(0, MAX_DIFF_CHARS)}\n… (diff truncated)` : diff } }
+    })
+  }
+
   /** The dry run of making this session a quilt, for someone with access `a` (session-quilt.js). */
   quiltPlan (a, tip = null) {
     const no = quiltPlanRefusal({ controlled: this.controlled, access: a })
@@ -2216,7 +2576,7 @@ class Room {
   }
 
   /**
-   * Makes this session a quilt (plans/quilt-source-control/16, "Without history"), behind
+   * Makes this session a quilt (Seam's plans/quilt-source-control/16, "Without history"), behind
    * QUILT_SOURCE_URL: the owner's (as quiltPlan), with `seam` a Seam client acting as them.
    * The room is linked (`meta.quilt_id`, `meta.quilt`) only when every step worked, so a
    * failure leaves it a git-mode session as before. A room with a git remote goes with history
@@ -2227,17 +2587,18 @@ class Room {
     if (no) throw new Error(no.replace('see what making it a quilt would do', 'make it a quilt'))
     this.assertMigrated()
     if (this.meta.quilt_id) throw new Error(`this session is already the quilt ${(this.meta.quilt && this.meta.quilt.slug) || this.meta.quilt_id}`)
-    if (Object.keys(this.meta.upstreams || {}).length) throw new Error('this session has a git remote: it becomes a quilt with its history, by importing the remote and cutting over (docs/seam-cutover.md)')
-    if (this.quiltMoving) throw new Error('this session is already being made a quilt')
-    this.quiltMoving = true
-    try {
+    if (this.meta.quiltShadow) return this.quiltMigrateWithHistory(a, seam, { date })
+    if (Object.keys(this.meta.upstreams || {}).length) throw new Error('this session has a git remote: it becomes a quilt with its history. Import the remote into a quilt with follow, link the session to it (quilt session migrate --shadow <quilt>), cut the import over, then migrate (docs/seam-cutover.md in the Seam repository)')
+    return this.withMigrationLease(async () => {
+      // Texts and small binaries (base64 in the document) go into the quilt; large files in storage are left out.
       const texts = (key) => {
         const e = this.store.load(key)
-        const files = {}; const big = []
-        if (!e) return { files, big, merges: [] }
+        const files = {}; const binaries = {}; const big = []; const modes = {}
+        if (!e) return { files, binaries, modes, big, merges: [] }
         for (const [p, t] of e.files) files[p] = t.toString()
-        for (const [p, x] of e.blobs) if (x && !(p in files)) big.push(p)
-        return { files, big, merges: e.doc ? readMerges(e.doc.getMap('merges')) : [] }
+        for (const [p, x] of e.blobs) if (x && !(p in files)) { if (typeof x.data === 'string') binaries[p] = x.data; else big.push(p) }
+        if (e.modes) for (const [p, m] of e.modes) if (m === 'x') modes[p] = 'x'
+        return { files, binaries, modes, big, merges: e.doc ? readMerges(e.doc.getMap('merges')) : [] }
       }
       const def = texts(this.defaultKey)
       const leftOut = new Set(def.big)
@@ -2246,23 +2607,269 @@ class Room {
         if (key === this.defaultKey || isLiveKey(key)) continue
         const t = texts(key)
         for (const p of t.big) leftOut.add(`${key}:${p}`)
-        branches.push({ key, files: t.files, merges: t.merges })
+        branches.push({ key, files: t.files, binaries: t.binaries, merges: t.merges })
       }
-      const r = await makeQuiltWithoutHistory({ seam, room: this.name, defaultFiles: def.files, defaultMerges: def.merges, branches, leftOut: [...leftOut], date })
+      const r = await makeQuiltWithoutHistory({ seam, room: this.name, defaultFiles: def.files, defaultBinaries: def.binaries, defaultModes: def.modes, defaultMerges: def.merges, branches, leftOut: [...leftOut], date })
       this.meta.quilt_id = r.quilt_id
       this.meta.quilt = { slug: r.slug, patch: r.patch, squares: Object.fromEntries(r.squares.map((s) => [s.from, s.id])), at: new Date(date).toISOString(), by: (a && (a.sub || a.key || a.name)) || '' }
       // Open merges now live in Seam as conflict terms; the ones with no text to carry are named.
       if (r.terms.length || r.merges_left.length) this.meta.quilt.merges = { terms: r.terms, left: r.merges_left }
       this.meta.quilt.tasks = this.quiltTasks(this.meta.quilt.squares)
       this.quiltCommitRequests(this.meta.quilt.squares)
+      // A read token for the room, so hosted agents' quilt_history reads the quilt's log (best effort: without it they read the session's own record).
+      if (seam.createToken) {
+        try { const t = await seam.createToken(r.quilt_id, { name: `Quilt session ${this.name}`.slice(0, 100), level: 'read', expires_in_days: 365 }); if (t && t.token) this.meta.quilt.read = { token: t.token, id: t.id, ...(t.expires_at ? { expires_at: t.expires_at } : {}) } } catch {}
+      }
       this.saveMeta()
       this.broadcastBranches()
       return { ...r, tasks: this.meta.quilt.tasks }
+    }, seam)
+  }
+
+  /**
+   * What a move into squares made so far, saved as it goes (`meta.quiltMove`): the squares it opened
+   * in Seam, the claims it moved there, and the square documents it made here. A relay that stops
+   * part way (a deploy, a crash) finds it at load (recoverQuiltMove); done or undone, it goes.
+   */
+  startQuiltMove (quilt) {
+    this.meta.quiltMove = { quilt, at: Date.now(), opened: [], claimed: [], made: [], ...(this.migrationLease ? { lease: this.migrationLease } : {}) }
+    this.saveMeta()
+    return this.meta.quiltMove
+  }
+
+  endQuiltMove () {
+    if (!this.meta.quiltMove) return
+    delete this.meta.quiltMove
+    this.saveMeta()
+  }
+
+  /**
+   * At load: a move that never finished (layout 3 is written last, with the record's removal) is
+   * undone here. The square documents it made leave, and what it opened in Seam is kept in
+   * `meta.quiltLeftOver` for the owner's next move to abandon (only the owner's sign-in can). The
+   * branch documents were never touched, so the session is as it was before the move.
+   */
+  recoverQuiltMove () {
+    const mv = this.meta.quiltMove
+    if (!mv) return
+    delete this.meta.quiltMove
+    if (this.meta.layout !== LAYOUT_QUILT) {
+      const live = new Set(Object.values((this.meta.quilt && this.meta.quilt.live) || {}))
+      for (const lk of mv.made || []) if (isLiveKey(lk) && !live.has(lk) && this.meta.branches[lk]) this.removeBranch(lk, { save: false })
+      const left = this.meta.quiltLeftOver || { quilt: mv.quilt, squares: [], claims: [] }
+      if (left.quilt === mv.quilt) {
+        left.squares = [...new Set([...left.squares, ...(mv.opened || [])])]
+        left.claims = [...left.claims, ...(mv.claimed || [])]
+        if (mv.lease) left.lease = mv.lease
+        this.meta.quiltLeftOver = left
+      }
+      this.log(`[${this.name}] a move into squares stopped part way (the relay stopped): undone, the session is as it was; ${(mv.opened || []).length} square(s) it opened are abandoned at the next move`)
+    }
+    this.saveMeta()
+  }
+
+  /** What a stopped move opened in Seam (recoverQuiltMove) is let go of, as the owner moving the session now. */
+  async letGoOfStoppedMove (seam) {
+    const left = this.meta.quiltLeftOver
+    if (!left) return
+    for (const c of left.claims || []) if (seam.unclaim) await seam.unclaim(left.quilt, c.square, c.id).catch(() => {})
+    for (const id of left.squares || []) if (seam.abandon) await seam.abandon(left.quilt, id, { reason: 'a move of the session into the quilt stopped part way' }).catch(() => {})
+    delete this.meta.quiltLeftOver
+    this.saveMeta()
+  }
+
+  /**
+   * A move goes on only while the room is still this machine's: the cluster can hand it to another
+   * machine (or the relay can stop) while the move waits on Seam, and this copy saves nothing after
+   * that. Throws, so the move undoes what it made in Seam itself; the other machine undoes the rest
+   * from the move's record (recoverQuiltMove).
+   */
+  stillHere () {
+    if (this.released || this.ended) throw new Error('the session left this relay machine during the move; move it again')
+    if (this.moveLeaseLost) throw new Error('another relay machine took this session\'s move lease during the move; move it again')
+  }
+
+  /**
+   * Which git blob ids each of `paths` had in the default branch's history (the relay's git mirror,
+   * up to the commit the session last knew main at): Map path -> Set, or null when the mirror can't
+   * say (no git sync on this relay, no mirror, the commit out of reach).
+   */
+  /**
+   * Main's earlier versions of `file` from the history of `rev` in Seam (the move's square head), with
+   * the head's own text (`headId`): { head, versions } for boxOntoHead, or null when they can't be read.
+   */
+  async versionsOnLine (seam, q, rev, file, headId) {
+    if (!seam.log || !seam.blobs) return null
+    const log = await seam.log(q, { rev, paths: [file], limit: 50 })
+    const ids = new Set([headId])
+    for (const c of (log && log.commits) || []) {
+      if (!c || !c.id) continue
+      const t = await seam.tree(q, c.id, [file])
+      for (const e of (t && t.entries) || []) if (e.path === file && e.blob) ids.add(e.blob)
+    }
+    const { blobs } = await seam.blobs(q, [...ids])
+    const text = (id) => blobs && blobs[id] ? Buffer.from(blobs[id], 'base64').toString('utf8') : null
+    const head = text(headId)
+    return head === null ? null : { head, versions: [...ids].map(text).filter((x) => typeof x === 'string') }
+  }
+
+  async mainHistoryOf (paths) {
+    if (!paths.length) return new Map()
+    const up = (this.meta.upstreams || {})[this.defaultKey]
+    if (!up || !/^[0-9a-f]{40,64}$/.test(String(up.sha || '')) || !this.mirrors || !this.cfg.gitSync) return null
+    let m = null
+    try { m = await mirrorFor(this, this.defaultKey) } catch {}
+    if (!m || !(await ensureCommit(m.dir, up.sha, { token: m.token }))) return null
+    const out = new Map()
+    for (let i = 0; i < paths.length; i += 500) {
+      const r = await runGit(m.dir, ['log', '--format=', '--raw', '--no-abbrev', '--no-renames', '--root', '-m', up.sha, '--', ...paths.slice(i, i + 500)])
+      if (!r.ok) return null
+      for (const line of r.out.split('\n')) {
+        const x = /^:\d+ \d+ ([0-9a-f]{40,64}) ([0-9a-f]{40,64}) \w+\t(.+)$/.exec(line)
+        if (!x) continue
+        if (!out.has(x[3])) out.set(x[3], new Set())
+        out.get(x[3]).add(x[1]).add(x[2])
+      }
+    }
+    return out
+  }
+
+  /**
+   * One layout move of this room at a time, here and on every relay machine (a lease per room,
+   * relay-lease.js). With `seam` (the owner's), what a move stopped part way left in Seam
+   * (recoverQuiltMove) is let go of first.
+   */
+  async withMigrationLease (fn, seam = null, kind = 'in') {
+    if (this.quiltMoving) throw new Error('this session is already being moved')
+    this.quiltMoving = true
+    let done
+    this.quiltMoved = new Promise((resolve) => { done = resolve })
+    const keeper = this.leases
+    const lease = keeper ? { repo: `relay.quilt/layout3/${crypto.createHash('sha256').update(this.name).digest('hex').slice(0, 40)}`, branch: 'migrate', room: `${MIGRATION_LEASE}${crypto.randomBytes(8).toString('hex')}` } : null
+    let renew = null
+    try {
+      if (lease) {
+        migrating.add(lease.room)
+        let got = await keeper.ensure(lease)
+        // The lease of a move that stopped with its relay (recoverQuiltMove): this relay lets go of it
+        // when it still holds it, else it lapses within LEASE_TTL_MS of its last renewal.
+        const stopped = this.meta.quiltLeftOver && this.meta.quiltLeftOver.lease
+        if (!got.ok && stopped && got.room === stopped && await keeper.release({ ...lease, room: stopped })) got = await keeper.ensure(lease)
+        if (!got.ok && stopped && got.room === stopped) throw new Error('a move of this session stopped part way when the relay restarted, and still holds its lease for up to two minutes; try again then')
+        if (!got.ok) throw new Error(got.error ? `the relay could not take this session's migration lease (${got.error}); try again` : 'another relay machine is moving this session right now; try again in a few minutes')
+        this.migrationLease = lease.room
+        // The move keeps its own lease while it runs (minutes for a big session), whether or not this
+        // relay renews live-sync leases; a lease it loses (another machine took it) stops it (stillHere).
+        renew = setInterval(() => {
+          keeper.ensure(lease).then((r) => { if (!r.ok && !r.error) this.moveLeaseLost = true }, () => {})
+        }, this.cfg.leaseHeartbeatMs || LEASE_HEARTBEAT_MS)
+        renew.unref?.()
+      }
+      // Every member hears the move is running (branchesFields `moving`): the app says so while it lasts.
+      this.movingNow = { kind, since: Date.now() }
+      this.broadcastBranches()
+      if (seam) await this.letGoOfStoppedMove(seam)
+      return await fn()
     } finally {
+      clearInterval(renew)
+      if (this.movingNow) { this.movingNow = null; if (!this.destroyed) this.broadcastBranches() }
+      if (lease) { migrating.delete(lease.room); await keeper.release(lease).catch(() => {}) }
+      this.moveLeaseLost = false
+      this.migrationLease = null
       this.quiltMoving = false
+      done()
     }
   }
 
+  /**
+   * 16 "With history", in the cut-over sitting: a session with a git remote becomes the quilt its
+   * import filled (the shadow link, quiltShadowLink), no new quilt. Only once the import is cut
+   * over (main no longer frozen for the follow), because from now on Seam, not git, is the
+   * authority. Each other branch document becomes a square based at its ref's imported commit
+   * (`git:<sha>`), a detached `@sha` document at that commit, else at main's tip; open merges
+   * become conflict terms in their square's first commit; then the layout-3 switch runs in the
+   * same lease (the default document's difference from the imported tip is the adoption square).
+   * If the switch fails, the link is undone too: the session is a git-mode session that shadows
+   * the quilt, as before.
+   */
+  async quiltMigrateWithHistory (a, seam, { date = new Date() } = {}) {
+    // After the forced date stopped live sync, the branch documents are older than git: an adoption square made from
+    // them would put back what the team committed since. Refused until the cut-over that skips them is built (NOT-DONE.md).
+    if (this.meta.syncStopped) throw new Error(`live sync stopped on ${String(this.meta.syncStopped.at).slice(0, 10)}, so this session's branches are older than its git remote: moving it into its quilt with them would undo work committed since. That move is not built yet`)
+    return this.withMigrationLease(async () => {
+      const sh = this.meta.quiltShadow
+      if (!sh) throw new Error('this session is no longer linked to a quilt')
+      const info = await seam.quilt(sh.id)
+      const main = ((info && info.lines) || []).find((l) => l && l.name === 'main')
+      if (!main || !main.tip) throw new Error(`${sh.slug || sh.id} has nothing on main: import the session's git remote into it first`)
+      if (main.frozen) throw new Error(`${sh.slug || sh.id}'s main is still frozen for the import's follow: cut the import over first (seam import cutover), then migrate`)
+      const tip = { no: Number(main.patch_count) || null, commit: main.tip }
+      // Every folder reads its square with the room's read token: checked (made again if need be) before anything moves.
+      const rt = await this.freshReadToken(seam, sh.id, sh.read)
+      const squares = []; const based = []; const terms = []; const mergesLeft = []
+      // A failed move leaves no squares behind in the quilt: the ones it opened are abandoned.
+      const abandonAll = async () => { for (const x of squares) if (seam.abandon) await seam.abandon(sh.id, x.id, { reason: 'the session\'s move into the quilt was undone' }).catch(() => {}) }
+      const move = this.startQuiltMove(sh.id)
+      try {
+        for (const key of Object.keys(this.meta.branches || {})) {
+          if (key === this.defaultKey || isLiveKey(key)) continue
+          const want = squareBase(key, this.meta)
+          // No commit names where the branch starts (the relay never fetched it from git): main's tip, said in the answer.
+          if (!want) based.push({ from: key, wanted: '', why: 'unfetched' })
+          let s
+          try { s = await seam.openSquare(sh.id, { title: String(key).slice(0, 200), ...(want ? { base: want } : {}) }) } catch (err) {
+            // Seam has no commit for that sha, or has it inside a square (a branch git merged into
+            // main, imported as the merged square's own commit): main's tip, which holds it.
+            const inSquare = /square's own commit, not a patch/.test(String(err && err.message))
+            if (!want || (err.status !== 404 && !inSquare)) throw err
+            s = await seam.openSquare(sh.id, { title: String(key).slice(0, 200) })
+            based.push({ from: key, wanted: want, ...(inSquare ? { why: 'merged' } : {}) })
+          }
+          squares.push({ from: key, id: s.id })
+          move.opened.push(s.id)
+          this.stillHere()
+          this.saveMeta()
+          const e = this.store.load(key)
+          const files = {}
+          if (e) for (const [p, t] of e.files) files[p] = t.toString()
+          const t = termsFor(e && e.doc ? readMerges(e.doc.getMap('merges')) : [], files, { square: s.id, patchSquare: null, patch: tip })
+          for (const m of t.left) mergesLeft.push({ from: key, path: m.path, id: m.id })
+          if (t.terms.length) {
+            await seam.commit(sh.id, s.id, { expect_head: null, message: `Open merges from session ${this.name}: ${t.terms.map((x) => x.path).join(', ')}`.slice(0, 2000), changes: t.terms })
+            this.stillHere()
+            for (const x of t.terms) terms.push({ from: key, path: x.path, square: s.id })
+          }
+        }
+      } catch (err) {
+        await abandonAll()
+        if (rt.renewed && this.meta.quiltShadow) this.meta.quiltShadow.read = rt.read
+        this.endQuiltMove()
+        throw err
+      }
+      const by = (a && (a.sub || a.key || a.name)) || ''
+      // The room takes the quilt only as layout 3 is written (quiltSwitchNow): until then it is the
+      // shadowing git-mode session it was, for its members, its agents, and a relay that stops.
+      const quilt = { slug: sh.slug || info.slug || '', patch: tip, squares: Object.fromEntries(squares.map((x) => [x.from, x.id])), at: new Date(date).toISOString(), by, history: true, shadow: { ...sh, read: rt.read }, read: rt.read }
+      if (terms.length || mergesLeft.length) quilt.merges = { terms, left: mergesLeft }
+      if (based.length) quilt.basedAtTip = based
+      let switched
+      try {
+        switched = await this.quiltSwitchNow(a, seam, { date, into: { id: sh.id, quilt } })
+      } catch (err) {
+        await abandonAll()
+        // Still the shadowing session, with the read token as it is now (an old one was revoked for it).
+        if (rt.renewed && this.meta.quiltShadow) { this.meta.quiltShadow.read = rt.read; this.saveMeta() }
+        this.endQuiltMove()
+        throw err
+      }
+      const tasks = this.meta.quilt.tasks = this.quiltTasks(this.meta.quilt.squares)
+      this.quiltCommitRequests(this.meta.quilt.squares)
+      this.saveMeta()
+      this.broadcastBranches()
+      return { quilt_id: sh.id, slug: this.meta.quilt.slug, patch: tip, squares, terms, merges_left: mergesLeft, left_out: [], history: true, based_at_tip: based, tasks, ...(rt.renewed ? { read_token: rt.renewed } : {}), ...switched }
+    }, seam)
+  }
+
   /**
    * The layout-3 switch (16, "How a session becomes a quilt"), after quiltMigrate linked the
    * quilt: each branch document is copied into its square's live document on the relay
@@ -2278,84 +2885,799 @@ class Room {
     if (no) throw new Error(no.replace('see what making it a quilt would do', 'move its files into its squares'))
     if (this.meta.layout === LAYOUT_QUILT) throw new Error('this session\'s files are already in its squares')
     this.assertMigrated()
-    const q = this.meta.quilt_id
-    if (!q || !this.meta.quilt) throw new Error('this session is not a quilt yet: make it one first (quilt session migrate)')
-    if (this.quiltMoving) throw new Error('this session is already being moved')
-    this.quiltMoving = true
+    if (!this.meta.quilt_id || !this.meta.quilt) throw new Error('this session is not a quilt yet: make it one first (quilt session migrate)')
+    return this.withMigrationLease(async () => {
+      const rt = await this.freshReadToken(seam, this.meta.quilt_id, this.meta.quilt.read)
+      if (rt.renewed) { this.meta.quilt.read = rt.read; this.saveMeta() }
+      return { ...await this.quiltSwitchNow(a, seam, { date }), ...(rt.renewed ? { read_token: rt.renewed } : {}) }
+    }, seam)
+  }
+
+  /**
+   * "Make this a quilt" (Seam's plans/quilt-source-control/16, flag 9): the owner's one step, from the
+   * app's button, `quilt session migrate`, quilt_migrate_session or POST /v1/sessions/:room/migrate.
+   * A room with no git remote becomes a quilt without history and its files go into its squares
+   * (layout 3) in the same go; a room linked to the quilt its remote's import fills moves with history
+   * (quiltMigrateWithHistory switches itself); a room already a quilt at layout 2 only switches. A
+   * switch that fails leaves the room the layout-2 quilt it just became, every branch document as it
+   * was (nobody's work moves until every copy is checked): the next click only switches.
+   */
+  async quiltMake (a, seam, { date = new Date() } = {}) {
+    if (this.meta.layout === LAYOUT_QUILT) throw new Error(`this session is already the quilt ${(this.meta.quilt && this.meta.quilt.slug) || this.meta.quilt_id}`)
+    if (!this.meta.quilt_id && (this.hasGitRemote() || this.meta.quiltShadow || this.meta.quiltImport)) return this.quiltMakeWithRemote(a, seam, { date })
+    let quilt = null
+    if (!this.meta.quilt_id) {
+      quilt = await this.quiltMigrate(a, seam, { date })
+      if (this.meta.layout === LAYOUT_QUILT) return { ...quilt, layout: LAYOUT_QUILT }
+    } else {
+      const Q = this.meta.quilt || {}
+      quilt = { quilt_id: this.meta.quilt_id, slug: Q.slug || '', patch: Q.patch || null, squares: Object.entries(Q.squares || {}).map(([from, id]) => ({ from, id })), terms: [], merges_left: [], left_out: [], tasks: Q.tasks || {} }
+    }
+    try {
+      return { ...quilt, ...await this.quiltSwitch(a, seam, { date }) }
+    } catch (err) {
+      const e = new Error(`${err.message}. The session is the quilt ${quilt.slug} now, with its files still on its branches: make it a quilt again to move them into its squares`)
+      e.quilt_id = quilt.quilt_id
+      throw e
+    }
+  }
+
+  /**
+   * "Make this a quilt" on a session with a git remote (quilt-remote.js): each click takes the next
+   * step from where the session stands. Nothing moves in git but what Seam's own export pushes after
+   * the cut-over, and the room stays a git-mode session until the move with history, which is
+   * quiltMigrateWithHistory (its own checks undo it, back to layout 2, if it fails). What only the
+   * repository's GitHub owner can do (install Seam's app, add the ruleset) is said as plain steps.
+   */
+  async quiltMakeWithRemote (a, seam, { date = new Date() } = {}) {
+    const no = quiltPlanRefusal({ controlled: this.controlled, access: a })
+    if (no) throw new Error(no.replace('see what making it a quilt would do', 'make it a quilt'))
+    const repo = (this.meta.quiltImport && this.meta.quiltImport.repo) || githubRepoOf(this.meta.upstreams, this.defaultKey)
+    const stage = remoteStage(this.meta)
+    if (stage === 'import') {
+      if (!repo) throw new Error('this session\'s git remote is not on GitHub, so Seam cannot import it from here: import it with follow yourself (seam import git <url> --into <slug> --follow), then link the session to it (quilt session migrate --shadow <slug>) and click Make this a quilt again')
+      const gh = seam.github ? await seam.github() : null
+      if (!gh || gh.configured === false) throw new Error('Seam has no GitHub app set up, so it cannot import this session\'s repository yet')
+      const inst = installationFor(gh, repo)
+      if (!inst) throw stepsError(`Seam can't read ${repo} for you yet. To let it:`, installSteps(repo, gh.app && gh.app.install_url))
+      if (this.quiltMoving) throw new Error('this session is already being moved')
+      let r
+      const name = repo.split('/')[1].toLowerCase().replace(/[^a-z0-9-]/g, '-').replace(/^-+|-+$/g, '').slice(0, 40) || 'repo'
+      try { r = await seam.importGithub({ installation_id: inst.id, repo, follow: true, slug: name }) } catch (err) {
+        if (err.status !== 409) throw new Error(`Seam did not start importing ${repo}: ${err.message}`)
+        r = await seam.importGithub({ installation_id: inst.id, repo, follow: true, slug: `${name}-${this.name.toLowerCase().replace(/[^a-z0-9-]/g, '-')}`.slice(0, 60) })
+      }
+      this.meta.quiltImport = { id: r.id, slug: r.slug || '', repo, installation: inst.id, at: new Date(date).toISOString(), by: (a && (a.sub || a.key || a.name)) || '' }
+      this.saveMeta()
+      this.broadcastBranches()
+      return { stage: 'importing', import: { id: r.id, slug: r.slug || '', repo, state: r.state || 'reading' }, text: `Seam is importing ${repo} into the quilt ${r.slug || ''} and follows it from now on. Your git remote, clones and CI keep working as they are. Click Make this a quilt again once the import follows (a large repository takes a while).` }
+    }
+    if (stage === 'link') {
+      const imp = this.meta.quiltImport
+      const st = await seam.importStatus(imp.id)
+      if (st.state === 'failed') {
+        // A failed import is no use to the session: forgotten here, so the next click starts again.
+        delete this.meta.quiltImport; this.saveMeta(); this.broadcastBranches()
+        throw new Error(`Seam's import of ${imp.repo} failed (${st.error || 'no reason given'}). Click Make this a quilt again to start it over.`)
+      }
+      if (st.state !== 'following') return { stage: 'importing', import: { id: imp.id, slug: imp.slug, repo: imp.repo, state: st.state, commits: st.commits || 0 }, text: `Seam is still importing ${imp.repo} (${st.state}${st.commits ? `, ${st.commits} commits so far` : ''}). Click again in a while.` }
+      await this.quiltShadowLink(a, seam, imp.id)
+      return { stage: 'ready', import: { id: imp.id, slug: imp.slug, repo: imp.repo, state: st.state }, steps: rulesetSteps(imp.repo), text: [`Seam follows ${imp.repo} now, and this session reads its history from the quilt ${imp.slug}. Git stays the authority until you move the session in.`, `Before the move, only Seam may push to main on GitHub. ${imp.repo}'s GitHub owner does this once:`, ...rulesetSteps(imp.repo).map((x, i) => `${i + 1}. ${x}`)].join('\n') }
+    }
+    // The cut-over sitting (16 step 3): only after main takes pushes from Seam's export alone.
+    const id = (this.meta.quiltImport && this.meta.quiltImport.id) || this.meta.quiltShadow.id
+    const st = await seam.importStatus(id).catch((err) => { if (err.status === 404) return null; throw err })
+    if (st && st.state === 'following') {
+      if (repo) {
+        const rules = await this.githubRulesOf(repo, 'main')
+        if (rules === null) throw stepsError(`Quilt could not read ${repo}'s rules for main on GitHub, so it can't tell whether only Seam may push there. Check with the repository's GitHub owner:`, rulesetSteps(repo))
+        if (!mainGuarded(rules)) throw stepsError(`Anyone can still push to main on ${repo}, so a push could land after the move and Seam's export would stop. ${repo}'s GitHub owner does this first:`, rulesetSteps(repo))
+      }
+      try { await seam.cutover(id, {}) } catch (err) {
+        if (err.code === 'remote_moved' || /remote_moved|the remote's/.test(String(err.message))) throw new Error(`Someone pushed to ${repo || 'the remote'} since Seam last looked (${err.message}). Wait for the last pushes and CI to finish, then click Move into Seam now again.`)
+        throw new Error(`Seam did not cut the import over: ${err.message}`)
+      }
+    } else if (st && st.state !== 'done') throw new Error(`Seam's import is ${st.state}, not following: ${st.error || 'see seam import status'}`)
+    const moved = await this.quiltMigrateWithHistory(a, seam, { date })
+    if (this.meta.quiltImport) { delete this.meta.quiltImport; this.saveMeta() }
+    return { ...moved, cut_over: true }
+  }
+
+  /**
+   * GitHub's rules for `branch` of `repo` (owner/name): an array, or null when GitHub could not be
+   * asked. Read with Quilt's GitHub App through a member's connection, else without a token (public).
+   */
+  async githubRulesOf (repo, branch) {
+    if (this.githubRules) return this.githubRules(repo, branch)
+    const cred = await appCredentials(this, repo, { access: 'read' }).catch(() => ({}))
+    const f = this.githubFetch || globalThis.fetch
+    try {
+      const res = await f(`https://api.github.com/repos/${repo}/rules/branches/${encodeURIComponent(branch)}`, { headers: { accept: 'application/vnd.github+json', 'user-agent': 'quilt-relay', ...(cred && cred.token ? { authorization: `Bearer ${cred.token}` } : {}) } })
+      if (!res.ok) return null
+      const rules = await res.json()
+      return Array.isArray(rules) ? rules : null
+    } catch { return null }
+  }
+
+  /**
+   * quiltSwitch's work, inside the room's migration lease. `into` ({ id, quilt }): the quilt the
+   * room becomes as layout 3 is written (the move with history), else the room's own.
+   */
+  async quiltSwitchNow (a, seam, { date = new Date(), into = null } = {}) {
+    const q = into ? into.id : this.meta.quilt_id
+    const Q = into ? into.quilt : this.meta.quilt
+    const move = this.meta.quiltMove || this.startQuiltMove(q)
     const made = []
+    const claimed = []
+    const unwatch = []
+    let adoption = null
     const by = (a && (a.name || a.sub || a.key)) || ''
     try {
-      const texts = (key) => {
+      // A branch's files over its square's head (branchFiles): binaries, and what the session never synced, are not deletions.
+      // A square that starts at main's tip for want of the branch's commit keeps main's files the branch never had.
+      const atTip = new Set((Q.basedAtTip || []).map((b) => b.from))
+      const texts = (key, tree) => {
         const e = this.store.load(key)
-        const files = {}
-        if (e) for (const [p, t] of e.files) files[p] = t.toString()
-        return files
+        return e ? branchFiles(e.doc, tree, { diff: isDiff(e), unheld: atTip.has(key) }) : {}
       }
-      const held = (from) => new Set(((this.meta.quilt.merges && this.meta.quilt.merges.terms) || []).filter((t) => t.from === from).map((t) => t.path))
+      // ...nor does a full document there carry the branch's older copies of main's files (git's history of main says which).
+      const mainsOld = async (key, files, head) => {
+        const e = this.store.load(key)
+        if (!atTip.has(key) || !e || isDiff(e)) return files
+        const history = await this.mainHistoryOf([...changedGitIds(files, head).keys()])
+        return history ? dropOldCopies(files, head, history) : files
+      }
+      // Members keep writing their branch documents until layout 3 is written: an edit from now on
+      // (before its files are read, or after) marks its branch, so the copy is made again from what
+      // it holds then and checked with no wait between (the catch-up below). Watched from before any
+      // read: an edit between a read and the copy once failed the check and undid the move.
+      const edits = new Map()
+      const watch = (key) => {
+        if (edits.has(key)) return edits.get(key)
+        const flag = { edited: false }
+        edits.set(key, flag)
+        const e = this.store.load(key)
+        if (e && e.doc) { const mark = () => { flag.edited = true }; e.doc.on('update', mark); unwatch.push(() => e.doc.off('update', mark)) }
+        return flag
+      }
+      for (const key of [this.defaultKey, ...Object.keys(Q.squares || {})]) if (this.meta.branches[key] && !isLiveKey(key)) watch(key)
+      const held = (from) => new Set(((Q.merges && Q.merges.terms) || []).filter((t) => t.from === from).map((t) => t.path))
       const without = (o, skip) => Object.fromEntries(Object.entries(o).filter(([p]) => !skip.has(p)))
       const plan = []
-      for (const [key, sq] of Object.entries(this.meta.quilt.squares || {})) {
+      for (const [key, sq] of Object.entries(Q.squares || {})) {
         if (key === this.defaultKey || !this.meta.branches[key] || isLiveKey(key)) continue
         const s = await seam.square(q, sq)
         const head = s.head || s.base || null
         const skip = held(key)
-        plan.push({ key, sq, head, files: without(texts(key), skip), tree: without(head ? treeIds(await seam.tree(q, head)) : {}, skip) })
+        const t = head ? await seam.tree(q, head) : null
+        plan.push({ key, sq, head, skip, answer: t, flag: watch(key), files: without(await mainsOld(key, texts(key, t), treeIds(t)), skip), tree: without(treeIds(t), skip), modes: treeModes(t) })
       }
-      const def = texts(this.defaultKey)
-      const main = this.meta.quilt.patch ? treeIds(await seam.tree(q, this.meta.quilt.patch.commit)) : {}
+      const mainTree = Q.patch ? await seam.tree(q, Q.patch.commit) : null
+      const main = treeIds(mainTree)
+      const def = texts(this.defaultKey, mainTree)
       const adopt = overlayFor(def, main)
-      let adoption = null
-      if (Object.keys(adopt.puts).length || adopt.gone.length) {
+      // The default branch's claims need a square too (16's claims row): the adoption square, opened even when the document equals main.
+      const defaultClaims = Object.values(this.meta.claims || {}).some((c) => (this.branchOf(c) || this.defaultKey) === this.defaultKey)
+      // So does a large file in the session's storage that main lacks: the folders that have it put it there.
+      const defaultLarge = [...this.store.load(this.defaultKey).blobs].some(([p, x]) => x && typeof x.data !== 'string' && !x.blob && !main[p])
+      if (Object.keys(adopt.puts).length || adopt.gone.length || defaultClaims || defaultLarge) {
         const s = await seam.openSquare(q, { title: `Uncommitted work from ${this.name}`.slice(0, 200) })
         adoption = s.id
-        plan.push({ key: this.defaultKey, sq: s.id, head: (this.meta.quilt.patch && this.meta.quilt.patch.commit) || null, files: def, tree: main })
+        move.opened.push(s.id)
+        this.stillHere()
+        this.saveMeta()
+        plan.push({ key: this.defaultKey, sq: s.id, head: (Q.patch && Q.patch.commit) || null, skip: new Set(), answer: mainTree, flag: watch(this.defaultKey), files: def, tree: main, modes: treeModes(mainTree) })
+      }
+      // A boxed file (a member's unfinished work the session held while every other folder kept git's
+      // copy) is the box holder's whole file, on the main they had: only its change goes onto the head.
+      const rebased = []
+      const boxesOnto = (p) => {
+        const out = {}
+        for (const [file, v] of Object.entries(p.boxes || {})) {
+          const t = typeof p.files[file] === 'string' ? boxOntoHead(p.files[file], v.head, v.versions) : null
+          if (t !== null) { out[file] = t; p.files[file] = t }
+        }
+        return out
       }
+      for (const p of plan) {
+        p.boxes = {}
+        for (const c of Object.values(this.meta.claims || {})) {
+          const file = c && c.box && (this.branchOf(c) || this.defaultKey) === p.key ? String(c.pattern || '') : ''
+          if (!file || /[*?[]/.test(file) || typeof p.files[file] !== 'string' || !p.head || !p.tree[file] || p.tree[file] === blobId(Buffer.from(p.files[file]))) continue
+          const v = await this.versionsOnLine(seam, q, p.head, file, p.tree[file]).catch(() => null)
+          if (v) p.boxes[file] = v
+        }
+        p.boxTexts = boxesOnto(p)
+        for (const file of Object.keys(p.boxTexts)) rebased.push({ branch: p.key, path: file })
+      }
+      if (rebased.length) this.log(`[${this.name}] the move puts ${rebased.length} boxed file(s) onto main's newer copy as their change only: ${rebased.map((x) => x.path).slice(0, 10).join(', ')}`)
+      // A small binary a branch changed goes to Seam first: its live entry names the blob.
+      const uploaded = new Set()
+      const upload = async (p) => {
+        const up = binariesToUpload(p.files, p.tree).filter((b) => !uploaded.has(b.id))
+        if (up.length) await seam.upload(q, up)
+        for (const b of up) uploaded.add(b.id)
+        return up.length
+      }
+      for (const p of plan) await upload(p)
+      this.stillHere()
       for (const p of plan) {
         const lk = liveKey(p.sq)
-        if (this.meta.branches[lk] && this.store.load(lk) && liveMaps(this.store.load(lk).doc).live.size) throw new Error(`square ${p.sq.slice(0, 8)} already has a live document on the relay`)
-        this.noteBranch(lk, { by })
+        if (this.meta.branches[lk] && this.store.load(lk) && liveMaps(this.store.load(lk).doc).live.size) throw new Error(`square ${squareShort(p.sq)} already has a live document on the relay`)
         made.push(lk)
-        writeOverlay(this.store.load(lk).doc, overlayFor(p.files, p.tree), p.head, by)
+        move.made.push(lk)
+        this.noteBranch(lk, { by })
+        // A copy of the branch's Y.Doc, so the edit history inside it survives (16), made an overlay over the square's head.
+        const from = this.store.load(p.key)
+        copyIntoLive(this.store.load(lk).doc, from.doc, { files: p.files, head: p.tree, modes: p.modes, commit: p.head, by, skip: p.skip })
+        writeIntoLive(this.store.load(lk).doc, p.boxTexts, p.tree, p.head)
       }
-      for (const p of plan) {
+      const check = (p) => {
         const bad = checkOverlay(this.store.load(liveKey(p.sq)).doc, p.files, p.tree)
         if (bad) throw new Error(`the check after copying ${p.key === this.defaultKey ? 'the default branch' : p.key} failed: ${bad}`)
       }
-      this.meta.quilt.live = Object.fromEntries(plan.map((p) => [p.key, liveKey(p.sq)]))
-      if (adoption) this.meta.quilt.adoption = adoption
-      this.meta.quilt.layoutAt = new Date(date).toISOString()
+      // A branch edited since its files were read is copied and checked again in the catch-up below.
+      for (const p of plan) if (!p.flag.edited) check(p)
+      // Claims move to Seam's claims, on the square made from their branch (16's claims row).
+      const squareOf = Object.fromEntries(plan.map((p) => [p.key, p.sq]))
+      const claimsLeft = []
+      // Claims made while the claims move (or the move waits on Seam) move too: until a look finds none new.
+      const seen = new Set()
+      for (let round = 0; round < MOVE_CATCH_UP_ROUNDS; round++) {
+        const fresh = Object.entries(this.meta.claims || {}).filter(([k]) => !seen.has(k))
+        if (!fresh.length) break
+        for (const [k, c] of fresh) {
+          seen.add(k)
+          const sq = squareOf[this.branchOf(c) || this.defaultKey]
+          if (!sq) { claimsLeft.push({ pattern: c.pattern, branch: this.branchOf(c) || this.defaultKey, by: c.by || '', why: 'no square' }); continue }
+          try {
+            // Seam makes a claim only as its caller (the mover), so the note says whose it was, and the
+            // record keeps them: that person (or the owner) lets go of it from Quilt (quilt-claims).
+            const r = await seam.claim(q, sq, { pattern: c.pattern, note: `${c.by || 'someone'}'s claim from the session${c.note ? `: ${c.note}` : ''}`.slice(0, 280) })
+            claimed.push({ square: sq, id: r && r.id, pattern: c.pattern, by: c.by || '', ...(c.byId ? { byId: c.byId } : {}) })
+            move.claimed.push({ square: sq, id: (r && r.id) || c.pattern })
+          } catch (err) { claimsLeft.push({ pattern: c.pattern, branch: this.branchOf(c) || this.defaultKey, by: c.by || '', why: err.message }) }
+          this.stillHere()
+          this.saveMeta()
+        }
+      }
+      // The post-run check (16, "Dry run and check"): every claim moved names an open square.
+      if (claimed.length) {
+        const now = await seam.claims(q)
+        for (const c of claimed) {
+          const row = (now || []).find((x) => x && (x.id === c.id || (x.square_id === c.square && x.pattern === c.pattern)))
+          if (!row) throw new Error(`the claim on ${c.pattern} is not in the quilt after moving it`)
+          const s = await seam.square(q, c.square)
+          if (!s || s.state !== 'open') throw new Error(`the claim on ${c.pattern} names square ${squareShort(c.square)}, which is ${s ? s.state : 'gone'}`)
+        }
+      }
+      // Every person in the session writes in every square, not only the holder who moved it, so their AIs (working for them) commit there too.
+      const people = [...Object.entries(this.meta.members || {}).map(([key, m]) => ({ key, role: m && m.role })), ...(this.meta.ownerSub ? [{ key: this.meta.ownerSub, role: 'editor' }] : [])]
+      const notShared = []
+      if (seam.share) {
+        for (const p of plan) {
+          try { for (const x of await shareWithPeople(seam, q, p.sq, people)) notShared.push({ square: p.sq, ...x }) } catch (err) { notShared.push({ square: p.sq, member: '', why: String(err.message || err).slice(0, 200) }) }
+        }
+      }
+      this.stillHere()
+      // Edits that reached a branch document while the move waited on Seam go into its square too,
+      // copied again and checked with no wait between the last copy and layout 3 (a new binary is
+      // uploaded first, then the branches are looked at again).
+      for (let round = 0; ; round++) {
+        // `stale`: read again but not copied yet (a binary had to go to Seam first, or another edit came).
+        const edited = plan.filter((p) => p.flag.edited || p.stale)
+        if (!edited.length) break
+        if (round >= MOVE_CATCH_UP_ROUNDS) throw new Error('edits kept arriving while the session moved; try again when it is quieter')
+        let waited = 0
+        for (const p of edited) { p.flag.edited = false; p.stale = true; p.files = without(await mainsOld(p.key, texts(p.key, p.answer), treeIds(p.answer)), p.skip); p.boxTexts = boxesOnto(p); waited += await upload(p) }
+        this.stillHere()
+        // Copied only from files read since the branch's last edit: an edit during the reads looks again.
+        if (waited || edited.some((p) => p.flag.edited)) continue
+        for (const p of edited) {
+          copyIntoLive(this.store.load(liveKey(p.sq)).doc, this.store.load(p.key).doc, { files: p.files, head: p.tree, modes: p.modes, commit: p.head, by, skip: p.skip })
+          writeIntoLive(this.store.load(liveKey(p.sq)).doc, p.boxTexts, p.tree, p.head)
+          check(p)
+          p.stale = false
+        }
+      }
+      Q.live = Object.fromEntries(plan.map((p) => [p.key, liveKey(p.sq)]))
+      // Large files in the session's storage that git's head lacks: the relay can't read their bytes,
+      // so they are not in the squares yet; each folder that has them puts them in when it follows.
+      const large = []
+      for (const p of plan) {
+        for (const [path, x] of this.store.load(p.key).blobs) if (x && typeof x.data !== 'string' && !x.blob && !p.tree[path] && !p.skip.has(path)) large.push({ branch: p.key, path, size: Number(x.size) || 0 })
+      }
+      if (large.length) Q.large = large
+      if (adoption) Q.adoption = adoption
+      if (claimed.length || claimsLeft.length) Q.claims = { moved: claimed, left: claimsLeft }
+      Q.layoutAt = new Date(date).toISOString()
+      // Git's bookkeeping leaves the room (16: dropped), kept for a rollback.
+      Q.kept = takeGitMeta(this.meta)
+      if (into) { this.meta.quilt_id = into.id; this.meta.quilt = Q; delete this.meta.quiltShadow }
+      delete this.meta.quiltMove
       this.meta.layout = LAYOUT_QUILT // last
       this.saveMeta()
       for (const ws of [...this.conns.keys(), ...this.pending.keys()]) {
-        if (!ws.hosted && !this.supported(ws)) { ws.endReason = 'needs_update'; ws.close(CLOSE_NEEDS_UPDATE, NEEDS_UPDATE) }
+        if (!ws.hosted && !this.supported(ws)) { ws.endReason = 'needs_update'; ws.close(CLOSE_NEEDS_UPDATE, this.needsUpdate()) }
       }
       this.broadcastBranches()
-      return { layout: LAYOUT_QUILT, live: this.meta.quilt.live, adoption }
+      return { layout: LAYOUT_QUILT, live: Q.live, adoption, claims: { moved: claimed.length, left: claimsLeft }, ...(rebased.length ? { rebased } : {}), ...(large.length ? { large } : {}), ...(notShared.length ? { not_shared: notShared } : {}) }
     } catch (err) {
+      for (const c of claimed) if (seam.unclaim) await seam.unclaim(q, c.square, c.id || c.pattern).catch(() => {})
+      if (adoption && seam.abandon) await seam.abandon(q, adoption, { reason: 'the session\'s move into its squares was undone' }).catch(() => {})
       for (const lk of made) this.removeBranch(lk)
       if (made.length) this.broadcastBranches()
+      if (!into) this.endQuiltMove()
       throw new Error(`Migration undone: ${err.message}. The session stays as it was.`)
     } finally {
-      this.quiltMoving = false
+      for (const off of unwatch) off()
+    }
+  }
+
+  /**
+   * A branch's square merged, and Seam never changes a merged square again: the branch moves to a
+   * new square on the same line, opened as the member asking (`seam` acting as them) and shared
+   * with the merged one's holder and people writers, and its live document carries on from the old
+   * one (carryLive: what the merge has leaves, later work stays), so every folder on the branch
+   * keeps working. Any editor may ask; a square still open is left as it is. One move at a time.
+   */
+  async quiltNext (a, seam, branch) {
+    // A move running now (going back, say) settles first: a branch moves on from where it leaves the session.
+    if (this.quiltMoving && this.quiltMoved) await this.quiltMoved
+    if (this.meta.layout !== LAYOUT_QUILT) throw new Error('this session\'s files are not in squares')
+    if (!a || a.role === 'viewer') throw new Error('only someone who may change files moves a branch to its next square')
+    const key = String(branch || '')
+    const run = async () => {
+      if (this.meta.layout !== LAYOUT_QUILT) throw new Error('this session\'s files are not in squares')
+      const q = this.meta.quilt_id
+      // A read token gone or about to end is made again by whoever moves on, when Seam lets them (an admin).
+      const rt = await this.freshReadToken(seam, q, this.meta.quilt.read, { probe: false }).catch(() => null)
+      if (rt && rt.renewed) this.takeReadToken(rt.read)
+      const lk = (this.meta.quilt.live || {})[key]
+      if (!isLiveKey(lk)) throw new Error(`${key || 'that branch'} has no square in this session`)
+      const old = lk.slice(liveKey('').length)
+      const s = await seam.square(q, old)
+      if (!s || s.state === 'open' || s.state === 'merging') return { square: old, moved: false }
+      const n = await seam.openSquare(q, { title: String(s.title || `Work in ${this.name}`).replace(/^(Follow-up: )+/, '').slice(0, 200), line: (s.merged && s.merged.line) || s.line || 'main' })
+      for (const m of new Set([s.holder, ...(s.writers || [])])) {
+        if (m && m !== n.holder && String(m).startsWith('person:') && seam.share) await seam.share(q, n.id, { member: m }).catch(() => {})
+      }
+      const head = n.base || n.head || null
+      let tree = {}
+      try { if (head) tree = treeIds(await seam.tree(q, head)) } catch (err) { await this.abandonOpened(seam, q, n.id); throw err }
+      // Going back started while this waited on Seam (quiltUnswitch waits for it): the square it opened goes.
+      if (this.meta.layout !== LAYOUT_QUILT || this.quiltMoving) { await this.abandonOpened(seam, q, n.id); throw new Error('the session is going back to its branches') }
+      const nk = liveKey(n.id)
+      const by = (a && (a.name || a.sub || a.key)) || ''
+      this.noteBranch(nk, { by })
+      carryLive(this.store.load(nk).doc, this.store.load(lk).doc, { head: tree, commit: head, by })
+      this.meta.quilt.live = { ...this.meta.quilt.live, [key]: nk }
+      // A folder still on the old square for a moment (it has not heard yet) keeps typing there: its edits go on to this one (handle, movedOnTo).
+      this.meta.quilt.next = Object.fromEntries([...Object.entries(this.meta.quilt.next || {}), [lk, nk]].slice(-MOVED_ON_KEPT))
+      this.saveMeta()
+      this.broadcastBranches()
+      return { square: n.id, moved: true, from: old }
+    }
+    if (!this.quiltNexts) this.quiltNexts = new Map()
+    const was = this.quiltNexts.get(key) || Promise.resolve()
+    const p = was.catch(() => {}).then(run)
+    this.quiltNexts.set(key, p)
+    try { return await p } finally { if (this.quiltNexts.get(key) === p) this.quiltNexts.delete(key) }
+  }
+
+  /**
+   * Bringing main in (source-live/bring-in.js): a member's app asks, as that member (`seam`), each time
+   * it checks its folder's square (session-follow.js catchUp). When main moved past the square's base,
+   * the square takes main's new patches: Seam rebases its commits, and its live document moves onto the
+   * new head with each file it changed combined three ways. Seam's server never moves a square by
+   * itself (06): one of its members does, the holder first, and a writer once the holder's app has not
+   * asked for a while (offline). One at a time per branch, with its moves (quiltNext). Answers
+   * { square, behind, conflicted?, waiting?, brought? }.
+   */
+  async quiltCatchUp (a, seam, branch, { by = '' } = {}) {
+    if (this.meta.layout !== LAYOUT_QUILT) throw new Error('this session\'s files are not in squares')
+    const key = String(branch || '')
+    const lk = (this.meta.quilt.live || {})[key]
+    if (!isLiveKey(lk)) throw new Error(`${key || 'that branch'} has no square in this session`)
+    const id = lk.slice(liveKey('').length)
+    const q = this.meta.quilt_id
+    const sq = await seam.square(q, id)
+    const answer = (more = {}) => ({ square: id, behind: (sq && sq.behind_by) || 0, ...(sq && sq.conflicted_paths ? { conflicted: sq.conflicted_paths } : {}), ...more })
+    const e = this.store.load(lk)
+    if (!sq || sq.state !== 'open' || !e) return answer({ behind: 0 })
+    if (!this.catchUps) this.catchUps = new Map()
+    if (!sq.behind_by && liveHead(e.doc) === (sq.head || sq.base)) { this.catchUps.delete(id); return answer() }
+    if (!a || a.role === 'viewer') return answer()
+    let st = this.catchUps.get(id)
+    if (!st) this.catchUps.set(id, (st = { since: Date.now() }))
+    const me = await seam.quilt(q).then((x) => (x && x.you && x.you.member_id) || null, () => null)
+    const holder = !!me && me === sq.holder
+    const wait = this.catchUpWaitMs ?? HOLDER_WAIT_MS
+    if (holder) st.holderAt = Date.now()
+    else if (Date.now() - st.since < wait || (st.holderAt && Date.now() - st.holderAt < wait)) return answer({ waiting: sq.holder_name || sq.holder || 'its holder' })
+    const run = () => this.bringMainIn(seam, q, key, lk, st, by)
+    if (!this.quiltNexts) this.quiltNexts = new Map()
+    const was = this.quiltNexts.get(key) || Promise.resolve()
+    const p = was.catch(() => {}).then(run)
+    this.quiltNexts.set(key, p)
+    try { return await p } catch (err) {
+      // The holder's app could not (its Seam sign-in, say): a writer's goes next time it asks.
+      if (holder) st.holderAt = 0
+      throw err
+    } finally { if (this.quiltNexts.get(key) === p) this.quiltNexts.delete(key) }
+  }
+
+  /**
+   * The folders on square `lk` too old to follow its base moving (a Quilt before 0.3.133: it never
+   * re-projected, nor said which head an edit was made on, so it would write the old base's files back
+   * into the square): their people's names. A folder is known to follow a moving base by `quilt-moves`
+   * (protocol.js), or by its app having asked to bring main in (0.3.133 and 0.3.134 do, every minute).
+   */
+  outdatedOn (lk) {
+    const out = new Set()
+    for (const ws of this.conns.keys()) {
+      if (ws.branch !== lk || (ws.features || []).includes('quilt-moves')) continue
+      const name = this.names.get(ws) || ''
+      if (this.movesApps && this.movesApps.has(appOf(ws, name))) continue
+      out.add(name || 'someone')
+    }
+    return [...out].sort()
+  }
+
+  /** quiltCatchUp's work, its turn come: the square read again, its live conflicts committed first, Seam's rebase, the live move. */
+  async bringMainIn (seam, q, key, lk, st, by) {
+    if (this.meta.layout !== LAYOUT_QUILT || (this.meta.quilt.live || {})[key] !== lk || this.quiltMoving) return { square: lk.slice(liveKey('').length), behind: 0 }
+    const id = lk.slice(liveKey('').length)
+    const sq = await seam.square(q, id)
+    if (!sq || sq.state !== 'open') return { square: id, behind: 0 }
+    // Main waits while a folder on the square can't follow its base moving: it would put the old base's
+    // copies back as its edits (2026-11-01). It comes in once that app is updated, or leaves the square.
+    const outdated = sq.behind_by ? this.outdatedOn(lk) : []
+    if (outdated.length) return { square: id, behind: sq.behind_by, outdated }
+    const doc = this.store.load(lk).doc
+    const done = (more = {}) => ({ square: id, behind: 0, ...more })
+    // The live document is not on the square's head (a commit's seal on its way, or lost with a relay
+    // restart): given a moment, it moves onto it, combined, as after a rebase.
+    if (liveHead(doc) !== (sq.head || sq.base)) {
+      st.stale = st.stale || Date.now()
+      if (Date.now() - st.stale < (this.catchUpWaitMs ?? HOLDER_WAIT_MS) / 5) return { square: id, behind: sq.behind_by || 0, waiting: 'a commit' }
+      await this.moveSquareLive(seam, q, lk, doc, { prev: liveHead(doc), head: sq.head || sq.base, base: !sq.head, by })
+      st.stale = 0
+    }
+    if (!sq.behind_by) { this.catchUps.delete(id); return done() }
+    // An older copy of main's file in the live work is nobody's edit: main's stands, never a "conflict" with main.
+    const stale = await staleAhead(seam, q, sq, doc, sq.line || 'main').catch((err) => { this.log(`[${this.name}] could not look for older copies of main's files in square ${squareShort(id)}: ${err.message}`); return [] })
+    if (stale.length) {
+      standHead(doc, stale, liveHead(doc))
+      this.log(`[${this.name}] square ${squareShort(id)}: ${stale.length} live file(s) were older copies of main's, not edits; main's stand (${stale.slice(0, 5).join(', ')}${stale.length > 5 ? ', …' : ''})`)
+    }
+    const ahead = await conflictsAhead(seam, q, sq, doc, sq.line || 'main')
+    const head = ahead.length ? await commitAhead(seam, q, sq, doc, ahead, by) : sq.head
+    const r = await seam.rebase(q, id, { expect_head: head || null })
+    if (r.noop || !r.square) { this.catchUps.delete(id); return done() }
+    const to = r.square.head || r.square.base
+    const terms = [...new Set([...(r.terms || []).map((t) => t.path), ...ahead])]
+    const m = await this.moveSquareLive(seam, q, lk, doc, { prev: head || sq.base, head: to, base: !r.square.head, by, brought: { patches: sq.behind_by, conflicts: terms, ...(stale.length ? { stale: stale.slice(0, 50) } : {}) } })
+    this.catchUps.delete(id)
+    this.log(`[${this.name}] brought ${sq.behind_by} patch(es) of ${sq.line || 'main'} into square ${squareShort(id)} as ${by || 'a member'}${m.combined.length ? `, combining ${m.combined.length} live file(s)` : ''}${terms.length ? `; ${terms.length} conflict(s) kept in the square` : ''}`)
+    return done({ brought: { patches: sq.behind_by, combined: m.combined, conflicts: [...new Set([...terms, ...m.conflicts])], ...(stale.length ? { stale: stale.slice(0, 50) } : {}) }, ...(r.square.conflicted_paths ? { conflicted: r.square.conflicted_paths } : {}) })
+  }
+
+  /** A square's live document moved onto `head` (bring-in.js moveLive), late edits made on the old head combined after (lateEdits). */
+  async moveSquareLive (reader, q, lk, doc, opts) {
+    const r = await moveLive(reader, q, doc, opts)
+    if (!this.lateMoves) this.lateMoves = new Map()
+    if (this.lateMoves.has(lk)) this.lateMoves.get(lk)()
+    this.lateMoves.set(lk, lateEdits(doc, { from: opts.prev, to: opts.head, read: sideReader(this.quiltReadClient() || reader, q) }))
+    return r
+  }
+
+  /**
+   * A folder's live block asks (live-block.js moveTo): Seam moved its square's head itself (seam_rebase,
+   * a settled conflict, a merge that kept its conflict), and the live document follows, its files
+   * combined with what the move changed, read with the room's read token.
+   */
+  async liveMove (ws, req) {
+    const key = this.resolveKey(String(req.branch || ''))
+    if (!isLiveKey(key) || !(process.env.QUILT_SOURCE || this.meta.layout === LAYOUT_QUILT)) throw new Error('only a square\'s live document moves')
+    const e = key === ws.branch ? this.store.get(key) : null
+    if (!e) throw new Error(`you are not on ${req.branch}`)
+    const a = this.access.get(ws)
+    if (!a || a.role === 'viewer') throw new Error('only someone who may change files moves a square\'s live work')
+    const head = String(req.head || '')
+    if (!/^[0-9a-f]{64}$/.test(head)) throw new Error('move needs the square\'s new head')
+    const prev = liveHead(e.doc)
+    if (req.prev && req.prev !== prev) throw new Error(`the square's live head is ${String(prev || 'not set').slice(0, 12)}, not ${String(req.prev).slice(0, 12)}: read it again`)
+    if (prev === head) return { head, moved: false }
+    const by = this.names.get(ws) || ''
+    // Squares in a session that is not a quilt (QUILT_SOURCE alone) have no read token to read the move with: the live work moves as it is.
+    if (this.meta.layout !== LAYOUT_QUILT) { seal(e.doc, { prev, head, by }); if (req.base) liveMaps(e.doc).live.set('head', { commit: head, by, ts: Date.now(), base: true }); return { head, moved: true } }
+    const reader = this.quiltReadClient()
+    if (!reader) { this.readTokenRefused(); throw new Error(this.noReadToken()) }
+    const r = await this.moveSquareLive(reader, this.meta.quilt_id, key, e.doc, { prev, head, base: !!req.base, by })
+    return { head, moved: true, combined: r.combined, conflicts: r.conflicts }
+  }
+
+  /** A square a branch move opened that the session no longer wants (it went back meanwhile), abandoned in Seam. */
+  async abandonOpened (seam, q, id) {
+    if (seam.abandon) await seam.abandon(q, id, { reason: 'the session went back to its branches while it opened' }).catch(() => {})
+  }
+
+  /**
+   * A branch with no square at layout 3 (the default branch when it equalled main's tip and held no
+   * claim, so the move opened no adoption square; a branch made after a quilt was made without
+   * history; a branch checked out in git after the move, which the relay has no copy of): its folders' writes reach only its read-only document, so the first member who writes
+   * there asks for one (`quilt-open`, the app's readOnly answer). It is opened as that member (its
+   * holder), at the commit the branch document is of (the move's base for it: its ref's imported
+   * commit, else the quilt's patch at the move, never main's tip now, which would undo what merged
+   * since), the branch document copied into its live document and checked as the move does, and
+   * every folder on the branch follows it; the asker's refused edits go in as theirs.
+   */
+  async quiltOpen (a, seam, branch) {
+    if (this.meta.layout !== LAYOUT_QUILT) throw new Error('this session\'s files are not in squares')
+    if (!a || a.role === 'viewer') throw new Error('only someone who may change files opens a square for a branch')
+    if (this.quiltMoving && this.quiltMoved) await this.quiltMoved
+    if (this.meta.layout !== LAYOUT_QUILT) throw new Error('this session\'s files are not in squares')
+    const key = this.resolveKey(String(branch || ''))
+    if (!key || isLiveKey(key) || !validBranchKey(key)) throw new Error(`"${String(key).slice(0, 60)}" isn't a branch name`)
+    const run = async () => {
+      if (this.meta.layout !== LAYOUT_QUILT) throw new Error('this session\'s files are not in squares')
+      const Q = this.meta.quilt
+      const q = this.meta.quilt_id
+      const rt = await this.freshReadToken(seam, q, Q.read, { probe: false }).catch(() => null)
+      if (rt && rt.renewed) this.takeReadToken(rt.read)
+      if ((Q.live || {})[key]) return { square: Q.live[key].slice(liveKey('').length), opened: false }
+      // A branch the relay has no copy of (checked out in git after the move): a square at main's tip
+      // with nothing in it, held by the asker; their app takes the folder in as it is (folderWins).
+      if (!this.meta.branches[key]) {
+        const s = await seam.openSquare(q, { title: `${key} in ${this.name}`.slice(0, 200) })
+        if (this.meta.layout !== LAYOUT_QUILT || this.quiltMoving) { await this.abandonOpened(seam, q, s.id); throw new Error('the session is going back to its branches') }
+        const by = (a && (a.name || a.sub || a.key)) || ''
+        const lk = liveKey(s.id)
+        this.noteBranch(lk, { by })
+        startHead(this.store.load(lk).doc, s.head || s.base, by)
+        Q.live = { ...Q.live, [key]: lk }
+        Q.opened = [...(Q.opened || []), { from: key, id: s.id, by, at: new Date().toISOString(), fresh: true }]
+        this.saveMeta()
+        this.broadcastBranches()
+        this.log(`[${this.name}] opened square ${squareShort(s.id)} at main's tip for ${key}, a branch the session had no copy of (asked by ${by || 'a member'})`)
+        return { square: s.id, opened: true, fresh: true }
+      }
+      const want = squareBase(key, { ...this.meta, ...(Q.kept || {}) }) || (Q.patch && Q.patch.commit) || null
+      let s
+      try { s = await seam.openSquare(q, { title: (key === this.defaultKey ? `Work on ${key} in ${this.name}` : String(key)).slice(0, 200), ...(want ? { base: want } : {}) }) } catch (err) {
+        if (!want || err.status !== 404) throw err
+        s = await seam.openSquare(q, { title: String(key).slice(0, 200), ...(Q.patch && Q.patch.commit && want !== Q.patch.commit ? { base: Q.patch.commit } : {}) })
+      }
+      const head = s.head || s.base || null
+      const by = (a && (a.name || a.sub || a.key)) || ''
+      const lk = liveKey(s.id)
+      try {
+        const t = head ? await seam.tree(q, head) : null
+        const e = this.store.load(key)
+        const files = branchFiles(e.doc, t, { diff: isDiff(e) })
+        const tree = treeIds(t)
+        const up = binariesToUpload(files, tree)
+        if (up.length) await seam.upload(q, up)
+        if (this.meta.layout !== LAYOUT_QUILT || this.quiltMoving) throw new Error('the session is going back to its branches')
+        this.noteBranch(lk, { by })
+        copyIntoLive(this.store.load(lk).doc, e.doc, { files, head: tree, modes: treeModes(t), commit: head, by })
+        const bad = checkOverlay(this.store.load(lk).doc, files, tree)
+        if (bad) throw new Error(`the check after copying ${key} failed: ${bad}`)
+      } catch (err) {
+        if (this.meta.branches[lk]) this.removeBranch(lk)
+        if (seam.abandon) await seam.abandon(q, s.id, { reason: 'opening it for the branch failed' }).catch(() => {})
+        throw err
+      }
+      Q.live = { ...Q.live, [key]: lk }
+      Q.opened = [...(Q.opened || []), { from: key, id: s.id, by, at: new Date().toISOString() }]
+      this.saveMeta()
+      this.broadcastBranches()
+      this.log(`[${this.name}] opened square ${squareShort(s.id)} for ${key}, which had none (asked by ${by || 'a member'})`)
+      return { square: s.id, opened: true }
     }
+    // One square per branch: an ask while one opens waits for it, and finds it open.
+    if (!this.quiltNexts) this.quiltNexts = new Map()
+    const was = this.quiltNexts.get(key) || Promise.resolve()
+    const p = was.catch(() => {}).then(run)
+    this.quiltNexts.set(key, p)
+    try { return await p } finally { if (this.quiltNexts.get(key) === p) this.quiltNexts.delete(key) }
   }
 
-  /** Back to layout 2 from the kept branch documents (16's rollback before R3). The squares' live documents stay. */
-  quiltUnswitch (a) {
+  /**
+   * Back to layout 2 from the kept branch documents (16's rollback before R3). The squares' live
+   * documents stay. Refused while the quilt has open squares (16: export never includes squares),
+   * unless each is named in `carried` (its work carried over by hand, `seam diff | git apply`);
+   * merged and abandoned squares are no longer open. Git's bookkeeping comes back, and a session
+   * that became its import's quilt (with history) is a git-mode session shadowing it again, so its
+   * git-mode sync resumes and agents have their git path back.
+   */
+  async quiltUnswitch (a, seam, { carried = [] } = {}) {
     const no = quiltPlanRefusal({ controlled: this.controlled, access: a })
     if (no) throw new Error(no.replace('see what making it a quilt would do', 'move it back to branches'))
     if (this.meta.layout !== LAYOUT_QUILT) throw new Error('this session\'s files are not in squares')
-    this.meta.layout = 2
-    this.meta.quilt.unswitchedAt = new Date().toISOString()
-    this.saveMeta()
-    this.broadcastBranches()
-    return { layout: 2 }
+    if (!seam) throw new Error('sign in to Seam first: going back reads the quilt\'s open squares as its owner')
+    return this.withMigrationLease(async () => {
+      // A branch moving on to its next square, or opening one, finishes first: it sees the move and lets go of what it opened.
+      await Promise.allSettled([...(this.quiltNexts || new Map()).values()])
+      const q = this.meta.quilt_id
+      // Squares carried at an earlier rollback (a session that went back and moved again) stay carried.
+      const before = (this.meta.quilt.shadow && this.meta.quilt.shadow.rolledBack && this.meta.quilt.shadow.rolledBack.carried) || []
+      const was = new Set([...before, ...(this.meta.quilt.carried || []), ...(Array.isArray(carried) ? carried.map(String) : [])])
+      const open = ((await seam.squares(q, { state: 'open' })) || []).filter((s) => s && s.state !== 'merged' && s.state !== 'abandoned')
+      // A square is named by its id, or as Seam names it (the end of its id, sq:<8 or more>), or by a
+      // start of it (8 or more), when that names no other open square: squares opened together share their first 8.
+      const bare = (id) => String(id).replace(/-/g, '').toLowerCase()
+      const fits = (id, x) => { const y = bare(x); return y.length >= 8 && (bare(id).endsWith(y) || bare(id).startsWith(y)) }
+      const names = (s) => was.has(s.id) || [...was].some((x) => fits(s.id, x) && open.filter((o) => fits(o.id, x)).length === 1)
+      this.stillHere()
+      const left = open.filter((s) => !names(s))
+      if (left.length) {
+        throw Object.assign(new Error(`${left.length} square${left.length === 1 ? ' is' : 's are'} still open in ${this.meta.quilt.slug || q}: ${left.slice(0, 10).map((s) => `${squareShort(s.id)} "${String(s.title || '').slice(0, 60)}"`).join(', ')}${left.length > 10 ? ', …' : ''}. Merge or abandon each, or carry its work over by hand (seam diff <square> | git apply) and name it as carried.`), { open: left.map((s) => ({ id: s.id, title: s.title || '' })) })
+      }
+      this.meta.quilt.carried = [...was]
+      // A square no folder follows now (its folders are offline, or gone for good: a replaced cloud
+      // AI machine) would keep its work only on the relay: it is committed in the square, which stays
+      // readable in Seam, and copied into its branch document (foldSquareBack). A square a folder
+      // follows comes back through that folder (Session.leaveSquare).
+      const kept = []
+      for (const [key, lk] of Object.entries(this.meta.quilt.live || {})) {
+        const on = this.store.get(lk)
+        if (on && on.conns.size) continue
+        const r = await this.foldSquareBack(seam, q, key, lk).catch((err) => ({ branch: key, square: lk.slice(liveKey('').length), error: err.message }))
+        this.stillHere()
+        if (r && (r.error || r.copied.length || r.left.length || r.uncommitted)) kept.push(r)
+      }
+      // Nobody follows a carried square any more (its work is back in the branches): it is abandoned, so its claims let go.
+      for (const s of open) if (seam.abandon) await seam.abandon(q, s.id, { reason: 'carried back to the session\'s branches (quilt session migrate --back)' }).catch(() => {})
+      restoreGitMeta(this.meta, this.meta.quilt.kept)
+      delete this.meta.quilt.kept
+      this.meta.layout = 2
+      this.meta.quilt.unswitchedAt = new Date().toISOString()
+      let shadow = null
+      if (this.meta.quilt.history && this.meta.quilt.shadow) {
+        shadow = this.meta.quilt.shadow
+        this.meta.quiltShadow = { ...shadow, rolledBack: { at: this.meta.quilt.unswitchedAt, squares: this.meta.quilt.squares, adoption: this.meta.quilt.adoption || null, carried: this.meta.quilt.carried } }
+        delete this.meta.quilt_id
+        delete this.meta.quilt
+      }
+      this.saveMeta()
+      this.broadcastBranches()
+      return { layout: 2, ...(shadow ? { shadow: { id: shadow.id, slug: shadow.slug || '' } } : {}), ...(kept.length ? { kept, quilt: { slug: (shadow && shadow.slug) || (this.meta.quilt && this.meta.quilt.slug) || '', id: q } } : {}) }
+    }, seam, 'back')
+  }
+
+  /**
+   * A square's work, at going back, when no folder follows it: its live work committed in the square
+   * as the owner (`seam`), so all of it is in Seam and readable after the square is abandoned; then
+   * what changed in the square since its base and its branch document lacks written there
+   * (foldBack, writeFold).
+   * { branch, square, commit, copied: [path], left: [{ path, why }], uncommitted? } or null.
+   */
+  async foldSquareBack (seam, q, key, lk) {
+    const sq = lk.slice(liveKey('').length)
+    const live = this.store.load(lk)
+    const e = this.store.load(key)
+    if (!live || !e) return null
+    const out = { branch: key, square: sq }
+    let head = liveHead(live.doc)
+    const row = await seam.square(q, sq)
+    const list = overlay(live.doc)
+    if (list.length) {
+      try {
+        const uploads = list.filter((x) => x.bytes).map((x) => ({ kind: 'blob', id: blobId(x.bytes), bytes: x.bytes }))
+        if (uploads.length) await seam.upload(q, uploads)
+        const changes = list.map((x) => x.op === 'delete' ? { path: x.path, op: 'delete' } : { path: x.path, op: 'put', blob: entryId(x), mode: x.mode })
+        const r = await seam.commit(q, sq, { expect_head: (row && row.head) || null, message: `Work left in this square when session ${this.name} went back to its branches`, changes })
+        seal(live.doc, { prev: head, head: r.square.head, sealed: Object.fromEntries(list.map((x) => [x.path, entryId(x)])), by: 'Quilt' })
+        head = r.square.head
+      } catch (err) { out.uncommitted = String(err.message || err).slice(0, 300) }
+    }
+    out.commit = head
+    const tree = head ? await seam.tree(q, head) : null
+    const square = {}
+    for (const t of (tree && tree.entries) || []) square[t.path] = t.term ? { term: t.term } : { blob: t.blob || null, mode: t.mode }
+    const bytes = {}
+    // Not committed: the live work goes over the head as it is.
+    if (out.uncommitted) for (const x of overlay(live.doc)) { if (x.op === 'delete') delete square[x.path]; else { square[x.path] = { blob: entryId(x), mode: x.mode }; if (x.bytes) bytes[entryId(x)] = x.bytes } }
+    // The branch document over the square's base: what the session never syncs (links, ignored and
+    // stored files) reads as it was there, so only what changed in the square since is looked at.
+    const base = row && row.base ? (row.base === head ? tree : await seam.tree(q, row.base)) : tree
+    const fold = foldBack(square, branchFiles(e.doc, base, { diff: isDiff(e) }))
+    const need = [...new Set(fold.put.map((x) => x.blob))].filter((id) => id && !bytes[id])
+    const fetch = async (ids) => { for (const [id, b64] of Object.entries((await seam.blobs(q, ids)).blobs || {})) bytes[id] = Buffer.from(b64, 'base64') }
+    for (let i = 0; i < need.length; i += 100) {
+      const ids = need.slice(i, i + 100)
+      // One too large to read whole (413) is left, named; the others come one by one.
+      try { await fetch(ids) } catch (err) { if (err.status !== 413) throw err; for (const id of ids) await fetch([id]).catch((x) => { if (x.status !== 413) throw x }) }
+    }
+    const w = writeFold(e, fold, bytes, 'Quilt')
+    if (w.done.length) this.log(`[${this.name}] going back: copied ${w.done.length} file(s) of square ${squareShort(sq)}, which no folder follows, into ${key}`)
+    return { ...out, copied: w.done, left: [...fold.skip, ...w.left] }
   }
 
+  /**
+   * A write to a branch document at layout 3 reached the relay: it is not kept. Its member hears
+   * so (MSG_BRANCHES `readOnly`, at most once a minute a connection), with where the work goes now.
+   */
+  refusedReadOnly (ws, key, { binaries = [], moved = false } = {}) {
+    const now = Date.now()
+    if (!binaries.length && ws.readOnlyToldAt && now - ws.readOnlyToldAt < READ_ONLY_TELL_MS) return
+    ws.readOnlyToldAt = now
+    const q = this.meta.quilt || {}
+    const live = (q.live || {})[key]
+    const name = q.slug || this.meta.quilt_id || ''
+    const branch = key === this.defaultKey ? 'the main branch' : key
+    const movedOn = live && moved ? `This session is the quilt ${name} now: what your app wrote to ${branch}'s old copy did not go into its square ${squareShort(live.replace(/^quilt\//, ''))}, which has moved on since. Your edits stay in your folder, and go in when it follows the square.` : ''
+    const why = movedOn || (live
+      ? `This session is the quilt ${name} now: ${binaries.slice(0, 5).join(', ')} did not reach ${branch}'s square ${squareShort(live.replace(/^quilt\//, ''))} from the old copy; your folder takes ${binaries.length === 1 ? 'it' : 'them'} in when it follows the square.`
+      : `This session is the quilt ${name} now, and ${branch} has no square yet: your edits are kept, and your app opens a square for it that your folder follows, with them.`)
+    this.log(`[${this.name}] ${live && moved ? 'did not forward a write (the square moved on since its copy) to the square of' : live ? 'could not forward binaries to the square of' : 'kept a write to'} ${key}, which ${live ? 'has one' : 'has no square'}, from ${this.names.get(ws) || 'someone'}`)
+    send(ws, jsonMessage(MSG_BRANCHES, { ...this.branchesFields(), readOnly: { branch: key, ...(live ? { square: live.replace(/^quilt\//, '') } : { noSquare: true }), why } }))
+  }
+
+  /**
+   * The live document of the square a branch moved on to from square `key` (quiltNext), the last of
+   * a chain of moves, or null. Each was carried from the one before with its whole history
+   * (carryLive), so an update to an old one applies to it as it is.
+   */
+  movedOnTo (key) {
+    const next = this.meta.layout === LAYOUT_QUILT && this.meta.quilt && this.meta.quilt.next
+    if (!next || !isLiveKey(key) || !next[key]) return null
+    let to = key
+    for (let i = 0; i < MOVED_ON_KEPT && next[to]; i++) to = next[to]
+    return to === key ? null : this.store.load(to).doc
+  }
+
+  /**
+   * Which files `ws` may change in a late write the relay applies to a square's live document itself
+   * (forwardToSquare, movedOnTo), where the guard (checkChange) never looks: none for a viewer,
+   * only those inside their folders for a member limited to folders (session-access.js mayChange).
+   */
+  forwardRule (ws) {
+    const a = this.access.get(ws)
+    return (p) => this.mayWrite(a, p)
+  }
+
+  /**
+   * A write to `key`'s kept document at layout 3, from an app that has not heard of its square yet:
+   * it goes into the square's live document (forwardIntoLive). A file it deleted is gone from the
+   * square when the square's head has it (read through the room's read token).
+   */
+  forwardToSquare (ws, key, lk, update) {
+    if (this.branchFull(lk)) { this.refusedReadOnly(ws, key, { binaries: ['your edits'] }); return }
+    const e = this.store.load(lk)
+    if (!e) return
+    // Only while the square is still on the head its copy of the branch document was made over: once it
+    // moved (main brought in, a commit, a rebase), the branch document's files are an older base's, and
+    // a folder writing there (an app back with a stale folder) would put its older copies in as edits and
+    // its missing files in as deletions (2026-11-01: 43 of them, from a folder at main:984). Not forwarded:
+    // the folder's own block takes in what is its own when it follows the square (live-block.js adopt).
+    if (copiedHead(e.doc) !== liveHead(e.doc)) { this.refusedReadOnly(ws, key, { moved: true }); return }
+    const r = forwardIntoLive(e.doc, update, { may: this.forwardRule(ws) })
+    if (r.refused.length) { this.log(`[${this.name}] did not take a write to ${r.refused.slice(0, 5).join(', ')} from ${this.names.get(ws) || 'someone'} into a square: not theirs to change`); return }
+    this.log(`[${this.name}] a write to ${key} from ${this.names.get(ws) || 'someone'} went into its square ${squareShort(lk.slice(liveKey('').length))}`)
+    if (r.binaries.length) this.refusedReadOnly(ws, key, { binaries: r.binaries })
+    if (!r.deleted.length) return
+    const head = liveHead(e.doc)
+    if (!head) return
+    this.quiltBlockRead({ call: 'tree', rev: head, paths: r.deleted }).then(({ tree }) => {
+      const m = liveMaps(e.doc)
+      const have = new Set(((tree && tree.entries) || []).map((x) => x.path))
+      e.doc.transact(() => {
+        for (const p of r.deleted) if (have.has(p) && !m.files.has(p) && !m.blobs.has(p)) { m.clean.delete(p); m.gone.set(p, { by: this.names.get(ws) || '', ts: Date.now() }) }
+      }, 'relay-quilt')
+    }, (err) => this.log(`[${this.name}] could not read ${squareShort(lk.slice(liveKey('').length))}'s head to delete ${r.deleted.join(', ')}: ${err.message}`))
+  }
+
+  /** What an app this session can't take is told: why, and what to do (a WebSocket close reason, 123 bytes at most). */
+  needsUpdate () { return this.meta.layout === LAYOUT_QUILT ? NEEDS_UPDATE_QUILT : NEEDS_UPDATE }
+
   /** Can this connection's app handle the session as it is now? */
   supported (ws) {
     const f = ws.features || []
-    if (this.meta.layout === LAYOUT_QUILT && !f.includes('quilts')) return false
+    // At layout 3 an app's folder must follow its square (quilt-folders): 0.3.125 sent `quilts` but kept writing the read-only branch documents.
+    if (this.meta.layout === LAYOUT_QUILT && !(f.includes('quilts') && f.includes('quilt-folders'))) return false
     return !this.meta.largeFiles || f.includes('large-files')
   }
 
@@ -2367,7 +3689,7 @@ class Room {
     if (this.meta.largeFiles) return
     this.meta.largeFiles = true
     for (const ws of [...this.conns.keys(), ...this.pending.keys()]) {
-      if (!ws.hosted && !this.supported(ws)) { ws.endReason = 'needs_update'; ws.close(CLOSE_NEEDS_UPDATE, NEEDS_UPDATE) }
+      if (!ws.hosted && !this.supported(ws)) { ws.endReason = 'needs_update'; ws.close(CLOSE_NEEDS_UPDATE, this.needsUpdate()) }
     }
   }
 
@@ -2981,6 +4303,18 @@ class Room {
     const at = (p) => this.claimKey(branch, p)
     const onBranch = branch === this.defaultKey ? {} : { branch }
     if (req.op === 'touch') return { ok: true } // an AI session is at work: its claims' idle time starts again
+    // At layout 3 claims are Seam's, let go of in Seam by the member themselves (Session.releaseInSeam).
+    // The ones the move made hold as the mover, so the relay says whose each was (`mine`: this
+    // member's) and whether they are the owner. 'quilt-released' forgets the ones let go of.
+    if (req.op === 'quilt-claims' || req.op === 'quilt-released') {
+      const moved = (this.meta.layout === LAYOUT_QUILT && this.meta.quilt && this.meta.quilt.claims && this.meta.quilt.claims.moved) || []
+      const minePlus = (c) => mine({ by: c.by, byId: c.byId })
+      if (req.op === 'quilt-claims') return { ok: true, moved: moved.map((c) => ({ id: c.id, square: c.square, pattern: c.pattern, by: c.by, mine: minePlus(c) })), owner: !!who.owner }
+      const ids = new Set([].concat(req.ids || []).map(String))
+      const keep = moved.filter((c) => !(ids.has(String(c.id)) && (minePlus(c) || who.owner)))
+      if (keep.length !== moved.length) { this.meta.quilt.claims.moved = keep; this.saveMeta() }
+      return { ok: true, forgot: moved.length - keep.length }
+    }
     if (req.op === 'claim') {
       if (!pattern) throw new Error('pattern required')
       if (pattern.length > MAX_PATTERN) throw new Error('pattern too long')
@@ -3149,6 +4483,8 @@ class Room {
     let joined = false
     let waiting = false
     ws.meter = this.meter
+    // The computer's key: an app's own connection and its folder's block share it (appOf).
+    ws.appKey = publicKey || ''
     ws.on('message', (data) => {
       const buf = new Uint8Array(data)
       this.meter.in(buf.length)
@@ -3177,7 +4513,7 @@ class Room {
       // Its messages are the relay's own (relay-ask.js): nobody may write as it.
       if (isRelay(name)) return ws.close(CLOSE_NAME_TAKEN, `"${RELAY_BY}" is the relay's own name; pick another name`)
       // The session may have started storing files while this app signed in.
-      if (!this.supported(ws)) return ws.close(CLOSE_NEEDS_UPDATE, NEEDS_UPDATE)
+      if (!this.supported(ws)) return ws.close(CLOSE_NEEDS_UPDATE, this.needsUpdate())
       // With sign-in on, names come from accounts and can't be taken, so they aren't bound to keys.
       if (!account) {
         // Re-check: someone else may have taken the name while we waited.
@@ -3209,8 +4545,9 @@ class Room {
   enter (ws, a) {
     this.setAccess(ws, a)
     this.noteTurns(ws, a)
-    // Presence: an account's visit starts once it's let in (never while it waits for the owner).
-    if (ws.pass && this.presence && !ws.visit) {
+    // Presence: an account's visit starts once it's let in (never while it waits for the owner). A folder's
+    // live block (its second connection, on its square's live document: quilt-block) is part of the app's visit, not one of its own.
+    if (ws.pass && this.presence && !ws.visit && !(ws.features || []).includes('quilt-block')) {
       ws.visit = this.presence.visitStart({ room: this.name, account: `${ws.pass.kind}:${ws.pass.sub}`, name: a.name, owner: !!a.owner, via: 'app', tool: ws.tool || '' })
       // The accounts API learns who owns a session from this report, and only the owner may
       // give people access there: tell it now rather than within the minute.
@@ -3233,10 +4570,12 @@ class Room {
   join (ws, name) {
     this.conns.set(ws, new Set())
     this.names.set(ws, name)
-    send(ws, syncStep1Message(this.doc))
+    // A folder's live block (quilt-block) syncs its square's live document only: its app's own connection has the room's.
+    ws.roomless = (ws.features || []).includes('quilt-block')
+    if (!ws.roomless) send(ws, syncStep1Message(this.doc))
     send(ws, jsonMessage(MSG_BRANCHES, { ...this.branchesFields() }))
     const states = [...this.awareness.getStates().keys()]
-    if (states.length) send(ws, awarenessMessage(this.awareness, states))
+    if (states.length && !ws.roomless) send(ws, awarenessMessage(this.awareness, states))
     send(ws, jsonMessage(MSG_CLAIMS, { claims: this.claimList(ws.branch) }))
     this.touch()
   }
@@ -3299,6 +4638,9 @@ class Room {
     if (type === MSG_SYNC) {
       const docId = decoding.readVarString(dec)
       let doc = this.doc
+      // A folder's live block (quilt-block) touches its square only: it may read the room's document
+      // (its connection's sync asks), never write chat, tasks or activity there (it has no visit of its own).
+      if (docId === ROOM_DOC && ws.roomless && decoding.peekVarUint(dec) !== syncProtocol.messageYjsSyncStep1) return
       if (docId !== ROOM_DOC) {
         // A connection syncs the room's document and the one branch it joined, nothing else.
         // An edit it sent for the branch it just left, still in flight when the join landed
@@ -3310,8 +4652,20 @@ class Room {
         // A branch over its size limit takes nothing new; the room and every other branch carry
         // on, and nobody is disconnected for it (its members hear it in the branch list).
         if (!this.unsavable && this.branchFull(k) && decoding.peekVarUint(dec) !== syncProtocol.messageYjsSyncStep1) return
-        // At layout 3 the branch documents are kept read-only: the work is in the squares (quiltSwitch).
-        if (this.meta.layout === LAYOUT_QUILT && !isLiveKey(k) && decoding.peekVarUint(dec) !== syncProtocol.messageYjsSyncStep1) return
+        // Live sync stopped at the forced date (checkForcedDate): the branch documents stay as they were then. Read, never written.
+        if (this.meta.syncStopped && !isLiveKey(k) && decoding.peekVarUint(dec) !== syncProtocol.messageYjsSyncStep1) { this.refusedSyncStopped(ws); return }
+        // At layout 3 the work is in the squares (quiltSwitch); the branch documents are what going
+        // back returns to. A write that still reaches one (an app that has not heard of its square
+        // yet, or one back with edits made offline) goes into the branch's square, and stays in the
+        // document too, so it is there on going back and every app's copy of it agrees with the
+        // relay's. A branch with no square keeps it, and its member is told, so their app opens one
+        // (quiltOpen copies the document, with it). Never dropped.
+        if (this.meta.layout === LAYOUT_QUILT && !isLiveKey(k) && decoding.peekVarUint(dec) !== syncProtocol.messageYjsSyncStep1) {
+          let update = null
+          try { const d = decoding.clone(dec); decoding.readVarUint(d); update = decoding.readVarUint8Array(d) } catch {}
+          const live = (this.meta.quilt && this.meta.quilt.live || {})[k]
+          if (update && bringsNew(doc, update)) { if (live) this.forwardToSquare(ws, k, live, update); else this.refusedReadOnly(ws, k) }
+        }
       }
       if (docId === ROOM_DOC ? this.full : this.unsavable) {
         // Over quota: still answer "what do you have?" so people can read, but refuse new data.
@@ -3323,16 +4677,54 @@ class Room {
       }
       const enc = syncHeader(docId)
       const header = encoding.length(enc)
-      syncProtocol.readSyncMessage(dec, enc, doc, ws)
+      // A square its branch moved on from (quiltNext): what still reaches it goes on to the square the branch is on now.
+      const onto = docId === ROOM_DOC ? null : this.movedOnTo(this.resolveKey(docId))
+      const took = []
+      const take = (u) => took.push(u)
+      if (onto) doc.on('update', take)
+      try { syncProtocol.readSyncMessage(dec, enc, doc, ws) } finally { if (onto) doc.off('update', take) }
+      for (const u of took) applyChecked(onto, u, this.forwardRule(ws), 'relay-quilt')
       if (encoding.length(enc) > header) send(ws, encoding.toUint8Array(enc))
     } else if (type === MSG_BRANCH) {
       let req = {}
       let reply
       try {
         req = JSON.parse(decoding.readVarString(dec))
-        if (req.op === 'quilt-migrate' || req.op === 'quilt-switch') { this.quiltMigrateRequest(ws, req); return }
-        if (req.op === 'quilt-unswitch') reply = { id: req.id, op: req.op, ok: true, ...this.quiltUnswitch(this.access.get(ws)) }
-        else reply = { id: req.id, op: req.op, ...this.branchRequest(ws, req) }
+        if (req.op === 'quilt-migrate' || req.op === 'quilt-make' || req.op === 'quilt-switch' || req.op === 'quilt-shadow' || req.op === 'quilt-unswitch' || req.op === 'quilt-next' || req.op === 'quilt-open' || req.op === 'quilt-catch-up') { this.quiltMigrateRequest(ws, req); return }
+        // A folder's live block whose square's head Seam moved (seam_rebase, a settled conflict): its live document follows, combined (bring-in.js moveLive).
+        if (req.op === 'live-move') {
+          const answer = (fields) => send(ws, jsonMessage(MSG_BRANCHES, { ...this.branchesFields(), reply: { id: req.id, op: req.op, ...fields } }))
+          this.liveMove(ws, req).then((r) => answer({ ok: true, ...r }), (err) => answer({ ok: false, error: err.message }))
+          return
+        }
+        // quilt_history from a folder with no Seam sign-in of its own: the quilt's log, read with the
+        // room's read token (quiltReadClient). Any member may: the log is the session's own code.
+        if (req.op === 'quilt-log') {
+          const answer = (fields) => send(ws, jsonMessage(MSG_BRANCHES, { ...this.branchesFields(), reply: { id: req.id, op: req.op, ...fields } }))
+          this.quiltLog(req.query && typeof req.query === 'object' ? req.query : {}).then(answer, (err) => answer({ ok: false, error: err.message }))
+          return
+        }
+        // A member's folder that follows its square in place (session-follow.js) reads the square
+        // through the relay with the same room read token, so no member needs Seam set up to follow.
+        if (req.op === 'quilt-block') {
+          const answer = (fields) => send(ws, jsonMessage(MSG_BRANCHES, { ...this.branchesFields(), reply: { id: req.id, op: req.op, ...fields } }))
+          const a = this.access.get(ws)
+          if (!a || (a.state && a.state !== 'approved')) return answer({ ok: false, error: 'not in this session' })
+          // A slow or failed read is on the relay's log: a folder waiting to follow its square says only that it waits.
+          const t0 = Date.now()
+          this.quiltBlockRead(req).then((r) => { if (Date.now() - t0 > 5000) this.log(`[${this.name}] quilt-block ${req.call} took ${Date.now() - t0} ms`); answer({ ok: true, ...r }) }, (err) => { this.log(`[${this.name}] quilt-block ${req.call} failed after ${Date.now() - t0} ms: ${err.status ? `${err.status} ` : ''}${err.message}`); answer({ ok: false, error: err.message }) })
+          return
+        }
+        // The app's History, Blame and search of a file in a linked session: the same room read token.
+        if (req.op === 'quilt-blame' || req.op === 'quilt-search' || req.op === 'quilt-show') {
+          const answer = (fields) => send(ws, jsonMessage(MSG_BRANCHES, { ...this.branchesFields(), reply: { id: req.id, op: req.op, ...fields } }))
+          const a = this.access.get(ws)
+          if (!a || (a.state && a.state !== 'approved')) return answer({ ok: false, error: 'not in this session' })
+          const read = req.op === 'quilt-blame' ? this.quiltBlame(req.path) : req.op === 'quilt-search' ? this.quiltSearch(req.q) : this.quiltShow(req.commit, req.path)
+          read.then(answer, (err) => answer({ ok: false, error: err.message }))
+          return
+        }
+        reply = { id: req.id, op: req.op, ...this.branchRequest(ws, req) }
       } catch (err) {
         reply = { id: req.id, op: req.op, ok: false, error: err.message }
       }
@@ -4285,6 +5677,23 @@ export function startServer ({ port = 4321, host = '0.0.0.0', dataDir = null, lo
         json(200, { ok: true, id: msg.id })
       })
     }
+    // The website dashboard's summary of now (now-summary.js), for the accounts API (GET /v1/me/now):
+    // { account, rooms } → what is going on for that person in each of those sessions loaded here. A room
+    // that isn't loaded has nobody in it, so it is left out; nothing is loaded just to answer.
+    if (url.pathname === '/now' && req.method === 'POST') {
+      if (!fromApi(req)) return json(401, { error: 'only the accounts API may ask this' })
+      return readJson(req, 8 * 1024, (err, b) => {
+        const account = !err && b && typeof b.account === 'string' ? b.account : ''
+        if (!/^person:[A-Za-z0-9_-]{1,64}$/.test(account) || !Array.isArray(b.rooms)) return json(400, { error: 'give the account and its rooms' })
+        const sessions = []
+        for (const name of b.rooms.slice(0, 60)) {
+          const room = typeof name === 'string' && ROOM_RE.test(name) ? rooms.get(name) : null
+          if (!room || !room.exists) continue
+          try { const one = nowSummary(room, account, { detail: b.detail === true && b.rooms.length === 1 }); if (one) sessions.push(one) } catch (e) { log(`now: ${name}: ${e.message}`) }
+        }
+        json(200, { sessions })
+      })
+    }
     // Someone connected GitHub (the API's callback): every session they are in checks its repository again now.
     if (url.pathname === '/github/connected' && req.method === 'POST') {
       const auth = String(req.headers.authorization || '').replace(/^Bearer\s+/i, '')
@@ -4325,14 +5734,20 @@ export function startServer ({ port = 4321, host = '0.0.0.0', dataDir = null, lo
             return json(200, { ok: true, plan, text: describeQuiltPlan(plan) })
           } catch (e) { return json(409, { error: e.message }) }
         }
-        if (b.step === 'unswitch') {
-          try { return json(200, { ok: true, ...room.quiltUnswitch(access) }) } catch (e) { return json(409, { error: e.message }) }
-        }
         if (!b.token || typeof b.token !== 'string') return json(400, { error: 'sign in to Seam first: making a session a quilt is done as its owner' })
         const seam = (room.seamClient || quiltClient)({ api, token: b.token })
+        if (b.step === 'unswitch') {
+          return room.quiltUnswitch(access, seam, { carried: Array.isArray(b.carried) ? b.carried.slice(0, 200) : [] }).then((r) => json(200, { ok: true, ...r }), (e) => json(409, { error: e.message, ...(e.open ? { open: e.open } : {}) }))
+        }
         if (b.step === 'switch') {
           return room.quiltSwitch(access, seam).then((r) => json(200, { ok: true, ...r }), (e) => json(409, { error: e.message }))
         }
+        if (b.step === 'make') {
+          return room.quiltMake(access, seam).then((quilt) => json(200, { ok: true, quilt }), (e) => json(409, { error: e.message, ...(e.quilt_id ? { quilt_id: e.quilt_id } : {}), ...(e.steps ? { steps: e.steps } : {}) }))
+        }
+        if (b.step === 'shadow') {
+          return room.quiltShadowLink(access, seam, b.quilt ?? null).then((r) => json(200, { ok: true, ...r }), (e) => json(409, { error: e.message }))
+        }
         room.quiltMigrate(access, seam).then(
           (quilt) => json(200, { ok: true, quilt }),
           (e) => json(409, { error: e.message, ...(e.quilt_id ? { quilt_id: e.quilt_id } : {}) })
@@ -4661,12 +6076,12 @@ export function startServer ({ port = 4321, host = '0.0.0.0', dataDir = null, lo
     // People and agents come from different id spaces, so the kind is part of who they are.
     const account = pass ? `${pass.kind}:${pass.sub}` : ''
     // Checked before the room is touched: a room's creator is recorded by this key (see authorize).
-    if (!publicKey) return reject(socket, 400, 'This relay needs a newer quilt; please update')
+    if (!publicKey) return reject(socket, 400, withUpdateSteps(NEEDS_UPDATE, { ascii: true }))
     const key = parsePublicKey(publicKey)
     if (!person || person.length > MAX_NAME || !key) return reject(socket, 400, 'Bad name or identity key')
     // Every session keeps its files in branch documents: an app that can't sync them is told to update.
     const features = String(url.searchParams.get('features') || '').split(',')
-    if (!features.includes('branches')) return reject(socket, 400, NEEDS_UPDATE)
+    if (!features.includes('branches')) return reject(socket, 400, withUpdateSteps(NEEDS_UPDATE, { ascii: true }))
     if (roomEnded(name)) return reject(socket, 410, ENDED_MESSAGE)
     const ip = clientIp(req)
     const starter = pass ? account : ip
@@ -4682,9 +6097,10 @@ export function startServer ({ port = 4321, host = '0.0.0.0', dataDir = null, lo
       return reject(socket, auth === 'need-key' ? 403 : 401, auth === 'need-key' ? 'Relay key required to create rooms' : 'Wrong room secret')
     }
     // Checked after the secret, so only members learn what the session needs.
-    if ((room.meta.largeFiles && !features.includes('large-files')) || (room.meta.layout === LAYOUT_QUILT && !features.includes('quilts'))) {
+    const noQuilt = room.meta.layout === LAYOUT_QUILT && !(features.includes('quilts') && features.includes('quilt-folders'))
+    if ((room.meta.largeFiles && !features.includes('large-files')) || noQuilt) {
       if (!room.conns.size && room.onEmpty) room.onEmpty() // don't keep it in memory for nobody
-      return reject(socket, 400, NEEDS_UPDATE)
+      return reject(socket, 400, withUpdateSteps(noQuilt ? NEEDS_UPDATE_QUILT : NEEDS_UPDATE, { ascii: true }))
     }
     if (!pass && !room.keyMatches(person, publicKey)) return reject(socket, 403, nameTaken(person))
     wss.handleUpgrade(req, socket, head, (ws) => {
@@ -4782,7 +6198,8 @@ export function startServer ({ port = 4321, host = '0.0.0.0', dataDir = null, lo
   upstreamTicker?.unref()
   // Live-sync leases renewed, and let go of for sessions that ended or sat idle for a day (relay-lease.js).
   const leaseTicker = cfg.gitSync ? setInterval(() => {
-    leases.tick({ ended: (name) => { const r = rooms.get(name); return !!(r && r.ended) } }).then((lost) => {
+    // A migration's lease (Room.withMigrationLease) is let go of once no migration here holds it (after a crash, at the next tick).
+    leases.tick({ ended: (name) => { if (name.startsWith(MIGRATION_LEASE)) return !migrating.has(name); const r = rooms.get(name); return !!(r && r.ended) } }).then((lost) => {
       for (const l of lost) { const r = rooms.get(l.room); if (r && !r.ended) { r.log(`[${r.name}] lost the live-sync lease of ${l.branch} to ${l.to || 'nobody (lapsed)'}`); r.broadcastBranches() } }
     }).catch((err) => log(`lease tick: ${err.message}`))
   }, cfg.leaseHeartbeatMs || LEASE_HEARTBEAT_MS) : null
@@ -4974,11 +6391,25 @@ function receiveBlob (req, file, limit, done) {
 const TOO_BIG = 'Session over the size limit'
 const UNREADABLE = "This session's data can't be read on the relay right now"
 const ENDED_MESSAGE = 'The owner ended this session'
-const NEEDS_UPDATE = 'This session needs a newer version of Quilt. Update Quilt, then join again.'
+const NEEDS_UPDATE = needsUpdateWords()
+// How many of a branch's moves to its next square the relay remembers, to send a late edit on (movedOnTo).
+const MOVED_ON_KEPT = 50
+// A session whose code is in Seam (layout 3) takes apps whose folders follow their squares (quilt-folders, 0.3.127).
+// Only what to do: an AI told the session "moved into Seam" took Seam for a way to join it.
+const NEEDS_UPDATE_QUILT = needsUpdateWords('0.3.127')
+// How many times a move copies again the branches edited while it waited on Seam before it gives up (quiltSwitchNow).
+const MOVE_CATCH_UP_ROUNDS = 5
+// How often a member is told again that a write to a read-only branch document was not kept (refusedReadOnly).
+const READ_ONLY_TELL_MS = 60 * 1000
+// A room's read token with less than this left is made again at a move, or when a branch moves on to its next square (Room.freshReadToken).
+const READ_TOKEN_RENEW_MS = 30 * 86400e3
 const SIGN_IN = 'Update Quilt and sign in to continue'
 const NOT_LET_IN = "The session owner hasn't let you in yet."
 const PASS_EXPIRED = 'Your sign-in expired. Reconnecting.'
 
+/** One app on one computer, as its connections say (an app's own and its folder's block share both). */
+const appOf = (ws, name) => `${ws.appKey || ''}\n${name || ''}`
+
 function reject (socket, code, message) {
   socket.write(`HTTP/1.1 ${code} ${message}\r\nConnection: close\r\n\r\n`)
   socket.destroy()