heyquilt 0.3.138 → 0.3.140

package/src/relay-sync.js

@@ -1,795 +0,0 @@
-// GitHub → session, through the relay's git mirror (relay-git.js). A push on GitHub (a webhook,
-// or the relay's own look) is fetched into the mirror and merged into the session's branch
-// document file by file: base, the commit the session's content is measured from; theirs, the
-// new head; ours, the session's content now. Every file lands at once: where both sides changed
-// the same lines Quilt combines them itself, the newer edit keeping those lines (upstream.js
-// combine; relay-clash.js tells whoever's lines lost). Only a file a member holds (or one the
-// relay can't read) is held aside with its own base and theirs (so a later head never
-// reinterprets it against another ancestor), and merged the same way once they let go. The session
-// is the master node: every folder and agent gets the merged files from here, and a folder
-// follows the relay's commit with git instead of pulling (session.js). Never a history merge;
-// nothing is written to GitHub here.
-import * as Y from 'yjs'
-import { noteMerged, upstreamCommits, memberForAuthor, tellAutoMerge, storeBlob, noteResolved, closeOldClash, lostLines } from './relay-clash.js'
-import { upstreamsOf, closeLanded, ignoreOf, parseRepo, catcherAble, RELAY_ORIGIN } from './relay-upstream.js'
-import { docKey, isDiff, FOLLOWS_GIT, removePath, notePresent, ownPaths, gitRuleFiles } from './branch-view.js'
-import { syncStateOf, runGit, GitFailed, authEnv } from './relay-git.js'
-import { planCatchUp, publishedOf, combine } from './upstream.js'
-import { unionMatcher } from './merge3.js'
-import { applyTextDiff } from './textdiff.js'
-import { looksBinary, sha1 } from './fsutil.js'
-import { LARGE_FILE_BYTES, MAX_TEXT_BYTES, isIgnored, isSafeRelPath } from './pathrules.js'
-import { HistoryLog } from './history.js'
-import { RELAY_BY, isRelay } from './branches.js'
-import { DEFAULT_KEY } from './branchdocs.js'
-
-/** With no webhook heard on a branch for this long, the relay asks GitHub for its head itself (git ls-remote: one cheap request, no API quota)… */
-export const BACKSTOP_MS = 60 * 1000
-/** …and as often while anyone is on the branch: a missed webhook is made up for within about a minute (addendum 16.13). */
-export const ACTIVE_BACKSTOP_MS = 60 * 1000
-
-const plural = (k, w) => `${k} ${w}${k === 1 ? '' : 's'}`
-const SHA = /^[0-9a-f]{40,64}$/
-
-/** The paths that differ between two commits: Map path -> A, M or D (a type change counts as M; a rename as D plus A). */
-export async function changedPaths (dir, base, head) {
-  const r = await runGit(dir, ['diff-tree', '-r', '-z', '--no-renames', '--name-status', base, head])
-  if (!r.ok) throw new GitFailed(`comparing ${base.slice(0, 7)} and ${head.slice(0, 7)}`, r.err)
-  const parts = r.out.split('\0')
-  const out = new Map()
-  for (let i = 0; i + 1 < parts.length; i += 2) {
-    const st = parts[i][0]
-    const rel = parts[i + 1]
-    if (!st || !rel) continue
-    out.set(rel, st === 'A' ? 'A' : st === 'D' ? 'D' : 'M')
-  }
-  return out
-}
-
-/**
- * The bytes of `paths` at commit `sha` in the mirror: Map path -> Buffer, or null when the commit
- * has no such file. One `git cat-file --batch` for all of them.
- */
-export async function filesAt (dir, sha, paths) {
-  const out = new Map()
-  if (!paths.length) return out
-  const r = await runGit(dir, ['cat-file', '--batch'], { input: paths.map((p) => `${sha}:${p}\n`).join(''), buffer: true })
-  if (!r.ok) throw new GitFailed(`reading files at ${sha.slice(0, 7)}`, r.err)
-  let buf = r.out
-  let at = 0
-  for (const rel of paths) {
-    const nl = buf.indexOf(0x0a, at)
-    if (nl < 0) break
-    const line = buf.subarray(at, nl).toString('utf8')
-    at = nl + 1
-    if (/ missing$/.test(line) || / ambiguous$/.test(line)) { out.set(rel, null); continue }
-    const size = Number(line.split(' ')[2])
-    out.set(rel, Buffer.from(buf.subarray(at, at + size)))
-    at += size + 1 // the newline after the bytes
-  }
-  return out
-}
-
-/** How many commits `head` has that `base` hasn't. */
-async function countBetween (dir, base, head) {
-  const r = await runGit(dir, ['rev-list', '--count', `${base}..${head}`])
-  const n = Number((r.out || '').trim())
-  return Number.isFinite(n) ? n : 0
-}
-
-/** The remote's head for `branch`, asked with git ls-remote (one cheap request, no objects): { sha } or { sha: null } when the branch isn't there. */
-export async function remoteHead (dir, branch, { token = null } = {}) {
-  const r = await runGit(dir, ['ls-remote', '--heads', 'origin', `refs/heads/${branch}`], { env: authEnv(token) })
-  if (!r.ok) throw new GitFailed(`asking for ${branch}`, r.err)
-  const line = r.out.split('\n').find((l) => l.endsWith(`\trefs/heads/${branch}`))
-  return { sha: line ? line.split('\t')[0] : null }
-}
-
-const isAncestor = async (dir, a, b) => (await runGit(dir, ['merge-base', '--is-ancestor', a, b])).ok
-const hasCommit = async (dir, sha) => (await runGit(dir, ['cat-file', '-e', `${sha}^{commit}`])).ok
-
-/** A file's bytes as the branch document keys them: text, "bin:<sha1>" (its bytes in `bins`), undefined when too large, null when absent. */
-function keyOf (buf, rel, { bins, tooLarge }) {
-  if (buf === null || buf === undefined) return null
-  if (buf.length > MAX_TEXT_BYTES) { tooLarge.add(rel); return undefined }
-  if (looksBinary(buf)) {
-    if (buf.length > LARGE_FILE_BYTES) { tooLarge.add(rel); return undefined }
-    const k = `bin:${sha1(buf)}`
-    bins.set(k, buf)
-    return k
-  }
-  return buf.toString('utf8')
-}
-
-/**
- * Keeps `shas` (and nothing else) under refs/quilt/keep/<room>/<key>/ in the mirror, so git's
- * housekeeping never drops a base the session still measures from, or a held file's ancestors.
- */
-export async function keepRefs (dir, room, key, { base, others = [] }) {
-  const prefix = `refs/quilt/keep/${room}/${key}/`
-  const want = new Map()
-  if (base) want.set(`${prefix}base`, base)
-  for (const sha of others) if (sha && sha !== base) want.set(`${prefix}${sha.slice(0, 12)}`, sha)
-  const have = (await runGit(dir, ['for-each-ref', '--format=%(refname) %(objectname)', prefix])).out.split('\n').filter(Boolean).map((l) => l.split(' '))
-  for (const [ref, sha] of have) if (want.get(ref) !== sha) await runGit(dir, ['update-ref', '-d', ref])
-  for (const [ref, sha] of want) await runGit(dir, ['update-ref', ref, sha])
-}
-
-/**
- * One look at session branch `key` through the mirror (the caller checked relayLooks). Fetches the
- * branch, and when the head moved on from the sync state's base, merges every changed file into
- * the branch document, combining what both sides changed (the newer edit keeps the lines both
- * changed: GitHub's commit time against the session's last edit of the file); files a member
- * holds are held with their own base and theirs, and merged once they let go. Returns what
- * happened: { state, ... } (for tests and the log). Never throws.
- */
-export async function bringInBranch (room, key, { log = () => {}, now = () => Date.now(), inQueue = false } = {}) {
-  const recs = upstreamsOf(room)
-  let rec = recs[key]
-  if (!rec || !rec.repo || !rec.ref) return { state: 'unknown' }
-  const state = syncStateOf(room, key)
-  // The commit a folder said the session's files are at: taken on its word until GitHub confirms it (an ancestor of its head) below.
-  if (!state.base && rec.sha) { state.base = rec.sha; state.baseFromFolder = true }
-  if (!state.base) return { state: 'unknown' }
-  const started = now()
-  rec.checkedAt = started
-  // A member's presence replaces the record (noteFolders) at any time: what matters is that it still names the same repository and branch.
-  const { repo: repo0, ref: ref0 } = rec
-  const current = () => { const r = recs[key]; if (r && r.repo === repo0 && r.ref === ref0) { rec = r; rec.checkedAt = started; return true } return false }
-  const said = (problem) => {
-    if (problem && rec.problem !== problem) log(`[${room.name}] ${key}: ${problem}`)
-    if (problem) rec.problem = problem; else delete rec.problem
-  }
-  const done = (out) => { if (!room.destroyed) { room.saveMeta(); room.broadcastBranches() } return out }
-  const repo = parseRepo(`https://${rec.repo}`)
-  if (!repo || !repo.github) { said(`the relay only brings in commits from GitHub, and ${rec.repo.split('/')[0]} isn't GitHub: a member's folder on ${key} brings them in`); return done({ state: 'not-github' }) }
-  const mirrors = room.mirrors
-  let dir, head, token
-  try {
-    token = await room.gitToken(repo)
-    dir = (await mirrors.ensure(repo, { url: room.gitRemoteUrl(repo) })).dir
-  } catch (err) { said(`the relay couldn't open its mirror of ${rec.repo} (${String(err.message).slice(0, 120)})`); return done({ state: 'error' }) }
-  // `inQueue`: the caller already holds the branch's queue (outbound, bringing the remote in before its push).
-  const queue = inQueue ? (r, b, fn) => fn() : mirrors.queue
-  // After every look: files the session changed that GitHub's commit now has exactly as the session
-  // does (someone committed and pushed them) aren't uncommitted any more.
-  const run = (r, b, fn) => queue(r, b, async () => {
-    const out = await fn()
-    try { if (dir && await dropCommitted(room, key, state, dir) && !room.destroyed) { room.saveMeta(); room.broadcastBranches() } } catch (err) { log(`[${room.name}] ${key}: could not compare the uncommitted files with GitHub: ${err.message}`) }
-    return out
-  })
-  return run(repo.slug, rec.ref, async () => {
-    if (state.op) { const { recoverOp } = await import('./relay-outbound.js'); await recoverOp(room, key, { dir, token }) }
-    let base = state.base
-    let probe = null
-    try {
-      // The head first, cheaply: when it hasn't moved and nothing is held, there is nothing to fetch.
-      const r = await remoteHead(dir, rec.ref, { token })
-      if (r.sha === base && !state.held.length) { head = base; probe = 'ls-remote' } else head = (await mirrors.fetch(dir, rec.ref, { token })).sha
-    } catch (err) {
-      if (err.kind === 'auth') { said(token ? `the relay's GitHub credentials can't read ${rec.repo}: ask the session owner to connect a GitHub account that can` : `the relay can't read ${rec.repo}: ask the session owner to connect GitHub`); return done({ state: token ? 'token-refused' : 'private' }) }
-      if (err.kind === 'missing') { said(`${rec.repo} isn't on GitHub (renamed, removed, or Quilt isn't installed on it)`); return done({ state: 'missing' }) }
-      said(`the relay couldn't reach GitHub for ${rec.name} (${String(err.message).slice(0, 120)}); it tries again later`)
-      return done({ state: 'error', unreachable: true })
-    }
-    current()
-    delete rec.backoffMs; delete rec.backoffUntil
-    rec.head = head
-    if (!head) {
-      // A branch cut in the session and not pushed yet: it starts on GitHub with its first commit (relay-outbound.js).
-      if (!state.pushed && rec.cutFrom) { said(null); return done({ state: 'not-yet' }) }
-      if (key !== (room.resolveKey ? room.resolveKey(DEFAULT_KEY) : DEFAULT_KEY) && key !== room.defaultKey) {
-        rec.gone = started
-        said(`${rec.name} isn't on GitHub any more (deleted after its merge?): nothing more comes in; the branch stays in the session as it is`)
-        return done({ state: 'gone' })
-      }
-      said(`${rec.name} isn't on GitHub (not pushed yet?): the relay waits for it`)
-      return done({ state: 'not-on-github' })
-    }
-    if (room.ended || room.destroyed || !room.meta.branches[key] || !current() || state.base !== base) return done({ state: 'moved-on' })
-    // A folder in step with the session said its files are at a newer commit of GitHub's (relay-upstream.js noteFolders):
-    // an older app's folder brought it in itself, or a pull was shared from a folder. The base follows that commit, so
-    // nothing it brought is measured again, and commits go on top of it.
-    if (rec.sha && rec.sha !== base && head !== base && await hasCommit(dir, rec.sha) && await isAncestor(dir, base, rec.sha) && await isAncestor(dir, rec.sha, head)) {
-      log(`[${room.name}] ${key}: the session is at ${rec.sha.slice(0, 7)}, as a folder there says (it brought those commits in); measuring from it`)
-      state.base = base = rec.sha
-      delete state.baseFromFolder
-    }
-    const e = room.branchDoc(key)
-    const bins = new Map()
-    const tooLarge = new Set()
-    const disk = (rel) => docKey(e, rel)
-    let landed = 0
-    let released = []
-    // Held files first, each against its own base and theirs: a claim let go of (and an older relay's clash) merged.
-    try {
-      const r = await settleHeld(room, key, { e, state, rec, dir, disk, bins, tooLarge, now: started, log })
-      landed += r.landed; released = r.released
-    } catch (err) { log(`[${room.name}] ${key}: could not look at the held files: ${err.message}`) }
-    // A diff branch (branch-view.js): its entries that started from an older commit than the base take what the commits since changed.
-    if (isDiff(e)) {
-      try { landed += await liftEntries(room, key, { e, dir, base, now: started, log }) } catch (err) { log(`[${room.name}] ${key}: could not bring the session's files up to ${base.slice(0, 7)}: ${err.message}`) }
-    }
-    // An older app's folder on the branch brings GitHub's new commits in itself (relay-upstream.js catcherAble):
-    // bringing them in here too would share them twice. Held files are the relay's own (above); nothing else is
-    // written, and that folder's word moves the base once it has them.
-    const catcher = head !== base ? catcherAble(room, key) : null
-    if (catcher) { said(null); return done({ state: 'folder-brings', head, by: catcher, landed, released }) }
-    if (head === base) {
-      // The session is at GitHub's head: the record that folders follow (session.js memberAt) says so too.
-      if (rec.sha !== head) { rec.sha = head; rec.relayHead = head }
-      await keepRefs(dir, room.name, key, { base, others: keptObjects(state) })
-      if (!state.held.some((h) => h.why === 'claimed' || h.why === 'unread')) { said(null); closeLanded(room, key, rec, `Brought in at ${head.slice(0, 7)}: the session on ${key} is at ${rec.name} ${head.slice(0, 7)}.`) }
-      return done({ state: 'up-to-date', head, landed, released, ...(probe ? { probe } : {}) })
-    }
-    // A folder's commit that isn't on GitHub (not pushed, or dropped) is never what the session is measured from: the
-    // commit of GitHub's that folder was on (rec.tip, from the same report) is, when GitHub's head descends from it, so
-    // what GitHub has since still comes in. Following the head without it would leave GitHub's changes out of the session.
-    const onTip = async () => {
-      const tip = rec.tip
-      if (!tip || tip === base || !(await hasCommit(dir, tip)) || !(await isAncestor(dir, tip, head))) return false
-      log(`[${room.name}] ${key}: ${base.slice(0, 7)} (a folder's commit) isn't on ${rec.name}; measuring from ${tip.slice(0, 7)}, the commit of GitHub's that folder was on`)
-      state.base = base = tip; delete state.baseFromFolder
-      return true
-    }
-    if (!(await hasCommit(dir, base)) && !(await onTip())) {
-      // The recorded commit was never on GitHub (a folder's local commit, dropped since): follow the head, bringing nothing in from a commit nobody has.
-      state.base = head; rec.sha = head; delete rec.relayHead; rec.recoveredAt = started
-      await keepRefs(dir, room.name, key, { base: head })
-      log(`[${room.name}] ${key}: ${base.slice(0, 7)} (the commit the session's files were measured from) isn't on GitHub; following ${rec.name} at ${head.slice(0, 7)} now`)
-      said(null)
-      return done({ state: 'recovered', head })
-    }
-    // A base taken on a folder's word that GitHub's head doesn't descend from was never GitHub's (a folder's local
-    // commit, not pushed yet): it is no rewrite. The session follows GitHub's head, bringing nothing in from it.
-    if (state.baseFromFolder) {
-      if (!(await isAncestor(dir, base, head)) && !(await onTip())) {
-        state.base = head; rec.sha = head; delete rec.relayHead; delete state.baseFromFolder
-        await keepRefs(dir, room.name, key, { base: head, others: keptObjects(state) })
-        log(`[${room.name}] ${key}: ${base.slice(0, 7)} (a folder's commit) isn't on ${rec.name}; following it at ${head.slice(0, 7)}`)
-        said(null)
-        return done({ state: 'recovered', head })
-      }
-      delete state.baseFromFolder
-    }
-    // §5.3: a head that doesn't descend from the base is a rewrite (a force-push). The same 3-way merge, against the base
-    // the mirror kept, moves the session's uncommitted work onto the new history; what was pushed before and undone on
-    // GitHub follows GitHub. The session's work is then pushed on top of the new head as a normal commit (relay-outbound.js).
-    const rewritten = !(await isAncestor(dir, base, head))
-    let changes, baseMap, theirs, behind
-    try {
-      behind = await countBetween(dir, base, head)
-      const all = await changedPaths(dir, base, head)
-      const extra = []
-      for (const rel of ['.quiltignore', ...[...all.keys()].filter((p) => /(^|\/)\.(quilt|cowove)ignore$/.test(p))]) {
-        const f = (await filesAt(dir, head, [rel])).get(rel)
-        if (f && f.length <= 64 * 1024) extra.push([rel, f.toString('utf8')])
-      }
-      // A diff branch leaves its unchanged ignore files to git: the commit's are the ones that count.
-      if (isDiff(e)) extra.push(...await gitRuleFiles(dir, head, e, IGNORE_FILE))
-      const ig = ignoreOf(e, extra)
-      // A diff branch's files the session never changed follow git (branch-view.js): the commits bring them with no write.
-      changes = new Map([...all].filter(([rel]) => isSafeRelPath(rel) && !isIgnored(ig, rel) && disk(rel) !== FOLLOWS_GIT))
-      const paths = [...changes.keys()]
-      const atBase = await filesAt(dir, base, paths.filter((p) => changes.get(p) !== 'A'))
-      const atHead = await filesAt(dir, head, paths.filter((p) => changes.get(p) !== 'D'))
-      baseMap = new Map(paths.map((rel) => [rel, changes.get(rel) === 'A' ? null : keyOf(atBase.get(rel), rel, { bins, tooLarge })]))
-      theirs = new Map(paths.map((rel) => [rel, changes.get(rel) === 'D' ? null : keyOf(atHead.get(rel), rel, { bins, tooLarge })]))
-    } catch (err) {
-      said(`the relay couldn't read ${rec.name}'s changes (${String(err.message).slice(0, 120)}); it tries again later`)
-      return done({ state: 'error', head })
-    }
-    if (room.ended || room.destroyed || !room.meta.branches[key] || !current() || state.base !== base) return done({ state: 'moved-on' })
-    // A held file that changed again on GitHub keeps its base and takes the newest head as theirs.
-    for (const h of state.held) {
-      if (!changes.has(h.path)) continue
-      h.theirs = head; h.head = head; changes.delete(h.path)
-    }
-    const heldPaths = new Set(state.held.map((h) => h.path))
-    const published = publishedOf(room.doc)
-    const why = (c) => tooLarge.has(c.path) ? { ...c, why: `too large for the relay to bring in (binaries over ${LARGE_FILE_BYTES / 1024} KB, text over ${MAX_TEXT_BYTES / 1024 / 1024} MB): a member's folder brings it in` } : c
-    // Files both sides changed: who changed each last, on each side, settles which edit is the newer (combine).
-    const union = await unionFor(e, dir, head)
-    const tops = new Map()
-    const parties = new Map()
-    for (const rel of changes.keys()) {
-      const b = baseMap.get(rel); const o = disk(rel); const t = theirs.get(rel)
-      if (b === undefined || o === undefined || t === undefined || o === b || o === t || t === b) continue
-      tops.set(rel, (await upstreamCommits(dir, base, head, rel))[0] || null)
-      parties.set(rel, sessionPartyOf(e, rel))
-    }
-    if (room.ended || room.destroyed || !room.meta.branches[key] || !current() || state.base !== base) return done({ state: 'moved-on' })
-    // A commit's time is in whole seconds: it counts as made at the end of its second, so a commit
-    // and an edit in the same second go to the commit.
-    const oursNewer = (rel) => ((parties.get(rel) || {}).ts || 0) > ((tops.get(rel) || {}).ts || 0) + 999
-    let plan = planCatchUp({ changes, base: baseMap, theirs, disk, published, oursNewer, union })
-    // Only files the relay couldn't read are left: held (never overwritten with the session's copy), and everything else lands.
-    const unread = plan.conflicts.map(why)
-    if (unread.length) {
-      plan = planCatchUp({ changes: new Map([...changes].filter(([rel]) => !unread.some((c) => c.path === rel))), base: baseMap, theirs, disk, published, oursNewer, union })
-      for (const c of unread) if (!heldPaths.has(c.path)) state.held.push({ path: c.path, why: 'unread', base, theirs: head, head, since: started })
-    }
-    // Planned against the session's content as it is now: a file edited before the writes is held and merged on the next look (below).
-    const captured = new Map([...plan.writes.keys(), ...plan.merged.map((m) => m.path)].map((rel) => [rel, disk(rel)]))
-    // A file someone holds is never written under them: held with its own base and theirs until they let go (Room.noteClaimsChanged looks again).
-    const claimed = []
-    for (const rel of plan.writes.keys()) {
-      const c = room.claimFor ? room.claimFor(rel, key) : null
-      if (c) claimed.push({ rel, by: c.by, pattern: c.pattern })
-    }
-    for (const { rel, by, pattern } of claimed) {
-      plan.writes.delete(rel)
-      if (!heldPaths.has(rel)) {
-        state.held.push({ path: rel, why: 'claimed', by, base, theirs: head, head, since: started })
-        // Named as the claim is (a folder or glob claim covers the file), so the release they run lets go of it.
-        if (room.postChat) room.postChat({ by: RELAY_BY, to: by, kind: 'nudge', text: `${rel} changed on GitHub (${head.slice(0, 7)}) while you hold it${pattern && pattern !== rel ? ` (your claim on ${pattern})` : ''}: the change comes in, merged with yours, when you let go of it (quilt release ${pattern || rel}). Nothing of yours is overwritten.` })
-      }
-      rec.waitingOn = { path: rel, by, pattern }
-    }
-    if (!claimed.length) delete rec.waitingOn
-    // The session's version of a file whose lines lost is kept in the mirror too (a binary's history has no bytes), for RESOLVED_KEEP_MS.
-    const gh = (rel) => { const top = tops.get(rel); return top ? { name: top.name, email: top.email, ts: top.ts, sha: top.sha, subject: top.subject, member: memberForAuthor(room, top) } : null }
-    const merges = plan.merged.filter((m) => !claimed.some((c) => c.rel === m.path))
-    for (const m of merges) {
-      if (!m.lost.some((l) => l.side === 'ours')) continue
-      const buf = sessionBuf(e, m.path)
-      m.oursBlob = buf ? await storeBlob(dir, buf).catch(() => null) : null
-    }
-    crashPoint(room, 'merge')
-    // Addendum 16.1: each write was planned against the session's content as it was then. A file edited since (the awaits above
-    // let edits in) is not overwritten: it is held against its base and theirs, and merged with the newer edit on the next look.
-    const raced = new Set()
-    for (const rel of [...plan.writes.keys()]) {
-      if (disk(rel) === captured.get(rel)) continue
-      raced.add(rel)
-      plan.writes.delete(rel)
-      if (!state.held.some((h) => h.path === rel)) state.held.push({ path: rel, why: 'raced', base, theirs: head, head, since: started })
-    }
-    const landedMerges = merges.filter((m) => !raced.has(m.path))
-    // Files both sides changed, merged on the way in: on record with both parties, so failing checks after the push tell them (relay-clash.js).
-    for (const m of landedMerges) noteMerged(room, key, m.path, { session: parties.get(m.path) || null, github: gh(m.path) }, { now: started })
-    const written = applyWrites(room, e, plan.writes, { bins, now: started, base: head })
-    // A diff branch: every entry that was measured from the old base is measured from the new one now (what the commits changed is in it).
-    if (isDiff(e)) moveFileBases(e, base, head)
-    // Whoever's lines lost is told (a direct message for the session's, the activity log for GitHub's); the losing version is kept.
-    for (const m of landedMerges) {
-      if (m.oursBlob) noteResolved(room, key, { path: m.path, kind: 'auto', base, theirs: head, oursBlob: m.oursBlob, how: `merged by Quilt: ${rec.name}'s newer edit kept`, at: started })
-      tellAutoMerge(room, key, { path: m.path, lost: m.lost, deleted: m.deleted || null, session: parties.get(m.path) || null, github: gh(m.path), upstream: rec.name, head, now: started })
-    }
-    landed += written
-    // The files that are now GitHub's version exactly are marked so (the Files tree, quilt_sync_status), until
-    // someone edits them in the session (server.js wireBranch).
-    await markFromGithub(e, dir, base, head, plan.writes, theirs).catch((err) => log(`[${room.name}] ${key}: could not mark the files from GitHub: ${err.message}`))
-    // Addendum 16.9: the session's files reach the disk before the base says they are in.
-    if (written && room.store && room.store.save) room.store.save(e)
-    crashPoint(room, 'save')
-    state.base = head
-    if (state.protected && state.protected.head && !(await isAncestor(dir, head, state.protected.head))) {
-      // The target moved past the live branch's start. Only its pull request merging finishes the live branch (a merge
-      // commit that took the live head says so here; a squash or rebase, GitHub's pull request): outbound looks with its
-      // next run (relay-outbound.js liveFate). Other work merged into the target leaves the pull request as it is.
-      if (state.protected.merged || (await isAncestor(dir, state.protected.head, head))) {
-        if (!state.protected.merged) state.protected.merged = { at: started }
-        rec.problem = `${rec.ref} is protected: the live pull request is merged; commits go through a new one (opened with the next commit)`
-      }
-      if (room.outbound && room.outbound.schedule) room.outbound.schedule(key)
-    }
-    rec.sha = head
-    rec.relayHead = head
-    if (behind || written) rec.brought = { count: behind, files: written, at: started, head }
-    await keepRefs(dir, room.name, key, { base: head, others: keptObjects(state) })
-    if (rewritten) {
-      // The session's own work on the new history: pending, so the next batch pushes it on top of the new head.
-      for (const rel of changes.keys()) if (!heldPaths.has(rel) && disk(rel) !== undefined && disk(rel) !== (theirs.has(rel) ? theirs.get(rel) : null)) state.pending[rel] = started
-      if (room.outbound && Object.keys(state.pending).length) room.outbound.schedule(key)
-    }
-    const detail = rewritten ? `${rec.name.split('/')[0] || 'origin'} rewrote ${rec.ref} (force-push); your uncommitted work was moved onto it · ${plural(written, 'file')}` : `${plural(behind, 'commit')} from ${rec.name} · ${plural(written, 'file')}`
-    if (rewritten && room.postChat) room.postChat({ by: RELAY_BY, text: `${rec.name} was rewritten on GitHub (a force-push to ${head.slice(0, 7)}): the session follows it, and your uncommitted work on ${key} was moved onto the new history${Object.keys(state.pending).length ? ' and goes on top of it with the next commit' : ''}.`, kind: 'commit' })
-    room.doc.transact(() => {
-      room.activity.push([{ by: RELAY_BY, path: '', kind: 'brought', detail, branch: key, ts: started }])
-      if (room.activity.length > 300) room.activity.delete(0, room.activity.length - 300)
-    }, RELAY_ORIGIN)
-    const combined = landedMerges.filter((m) => m.lost.length || m.deleted)
-    log(`[${room.name}] ${key}: ${RELAY_BY} brought in ${detail} (${base.slice(0, 7)}..${head.slice(0, 7)})${combined.length ? `; combined ${combined.map((m) => `${m.path} (${m.deleted ? 'kept the edit over a deletion' : `the ${m.oursNewer ? 'session\'s' : 'GitHub\'s'} newer lines kept`})`).join(', ')}` : ''}${state.held.length ? `; held: ${state.held.map((h) => `${h.path} (${h.why})`).join(', ')}` : ''}`)
-    const unreadHeld = state.held.filter((h) => h.why === 'unread')
-    if (claimed.length) {
-      said(`${claimed[0].by} holds ${claimed[0].rel}: the relay brings ${rec.name}'s change to it in once they let go of it (quilt_release, or quilt_handoff); everything else is in`)
-    } else if (unreadHeld.length) {
-      said(`${unreadHeld.map((h) => h.path).slice(0, 4).join(', ')}${unreadHeld.length > 4 ? ' and more' : ''}: too large for the relay to read, so a member's folder brings ${unreadHeld.length === 1 ? 'it' : 'them'} in; everything else is in`)
-    } else {
-      said(null)
-      closeLanded(room, key, rec, `Brought in at ${head.slice(0, 7)}: ${RELAY_BY} merged ${plural(behind, 'commit')} from ${rec.name} into ${key}${released.length ? `, keeping the merged ${released.join(', ')}` : ''}.`)
-    }
-    return done({ state: 'brought', head, count: behind, files: written, held: state.held.map((h) => ({ path: h.path, why: h.why })), released, merged: landedMerges.map((m) => ({ path: m.path, lost: m.lost.length ? m.lost[0].side : null, ...(m.deleted ? { deleted: m.deleted } : {}) })) })
-  })
-}
-
-/** What the mirror keeps for a branch besides its base: every held file's base and theirs, its ours blob, and the same for clashes settled within RESOLVED_KEEP_MS (relay-clash.js), for recovery and undo. */
-export function keptObjects (state) {
-  const out = []
-  for (const h of state.held || []) out.push(h.base, h.theirs, h.oursBlob, h.candidate && h.candidate.blob)
-  for (const h of state.held || []) out.push(h.baseBlob, h.otherBlob)
-  for (const r of state.resolved || []) out.push(r.base, r.theirs, r.oursBlob, r.candidateBlob, r.otherBlob, r.baseBlob)
-  return [...new Set(out.filter((x) => typeof x === 'string' && /^[0-9a-f]{40}$/.test(x)))]
-}
-
-/** The member who last changed `rel` on the branch (not the relay, not a pull), by time. */
-function sessionPartyOf (e, rel) {
-  let best = null
-  for (const h of e.doc.getArray('history').toArray()) if (h && h.path === rel && !h.pulled && !h.seed && h.by && !isRelay(h.by) && (!best || (h.ts || 0) >= best.ts)) best = { name: h.by, ts: h.ts || 0 }
-  return best
-}
-
-/**
- * Drops from `state.pending` the files whose session content is the same as at the session's base
- * commit on GitHub (a person committed and pushed them with git): they aren't uncommitted any more.
- * So are files git now ignores and GitHub's commit doesn't have (a .gitignore that came in with
- * git, say): no commit would take them, and only one of the relay's own used to drop them.
- * Returns how many were dropped. Nothing while a commit of the relay's own is under way, or for a held file.
- */
-export async function dropCommitted (room, key, state, dir) {
-  const paths = Object.keys(state.pending || {})
-  if (!paths.length || !state.base || state.op || !room.branchDoc) return 0
-  const e = room.branchDoc(key)
-  if (!e) return 0
-  const held = new Set((state.held || []).map((h) => h.path))
-  const at = await filesAt(dir, state.base, paths.filter((rel) => !held.has(rel)))
-  const opts = { bins: new Map(), tooLarge: new Set() }
-  let n = 0
-  const untracked = []
-  for (const [rel, buf] of at) {
-    if (buf === null) untracked.push(rel)
-    const mine = docKey(e, rel)
-    const theirs = keyOf(buf, rel, opts)
-    // FOLLOWS_GIT: a diff branch leaves it to git, so it is as the commit has it.
-    if (mine !== FOLLOWS_GIT && (mine === undefined || theirs === undefined || mine !== theirs)) continue
-    delete state.pending[rel]
-    n++
-  }
-  // git's rule: a file the commit tracks is committed even when a .gitignore matches it, so only untracked ones.
-  const left = untracked.filter((rel) => state.pending[rel])
-  if (left.length) {
-    const { ignoredPaths } = await import('./relay-outbound.js')
-    for (const rel of await ignoredPaths(dir, e, left, state.base)) { delete state.pending[rel]; n++ }
-  }
-  return n
-}
-
-/**
- * The newest PENDING_FILES of the paths changed in the session since its last commit: { path, at, by? },
- * `by` the member who last changed it (from the branch's history, when the branch is loaded).
- */
-export const PENDING_FILES = 20
-export function pendingFilesOf (e, pending) {
-  const list = Object.entries(pending || {}).sort((a, b) => (b[1] || 0) - (a[1] || 0) || (a[0] < b[0] ? -1 : 1)).slice(0, PENDING_FILES)
-  const want = new Set(list.map(([p]) => p))
-  const last = new Map()
-  if (e) for (const h of e.doc.getArray('history').toArray()) {
-    if (!h || !want.has(h.path) || h.pulled || h.seed || !h.by || isRelay(h.by)) continue
-    const was = last.get(h.path)
-    if (!was || (h.ts || 0) >= was.ts) last.set(h.path, { by: h.by, ts: h.ts || 0 })
-  }
-  return list.map(([path, at]) => ({ path, at: at || 0, ...(last.has(path) ? { by: last.get(path).by } : {}) }))
-}
-
-/** The merge=union matcher from the repository's .gitattributes files: the session's copy, else the commit's. */
-async function unionFor (e, dir, head) {
-  const texts = []
-  for (const [rel, t] of e.files) if (rel === '.gitattributes' || rel.endsWith('/.gitattributes')) texts.push([rel.includes('/') ? rel.slice(0, rel.lastIndexOf('/')) : '', t.toString()])
-  if (!texts.length && head) { const f = (await filesAt(dir, head, ['.gitattributes'])).get('.gitattributes'); if (f) texts.push(['', f.toString('utf8')]) }
-  return unionMatcher(texts)
-}
-
-/** The newest commit in base..head that touched each of `paths`: path -> { sha, by, at, subject }, in one git log. */
-async function lastCommits (dir, base, head, paths) {
-  const want = new Set(paths)
-  const out = new Map()
-  if (!want.size) return out
-  const r = await runGit(dir, ['log', '--format=%x1e%H%x1f%an%x1f%at%x1f%s', '--name-only', '--no-renames', `${base}..${head}`])
-  if (!r.ok) return out
-  for (const chunk of r.out.split('\x1e')) {
-    const [meta, ...names] = chunk.split('\n')
-    const [sha, by, at, subject] = (meta || '').split('\x1f')
-    if (!/^[0-9a-f]{40}$/.test(sha || '')) continue
-    for (const rel of names) if (want.has(rel) && !out.has(rel)) out.set(rel, { sha, by: (by || '').slice(0, 100), at: Number(at) * 1000 || 0, subject: (subject || '').slice(0, 200) })
-  }
-  return out
-}
-
-/**
- * Marks the files a look brought in as GitHub's version exactly (branch document map `fromGithub`: path ->
- * { sha, by, at, subject }, the commit that last changed it, and came: when it came into the session); a file
- * merged with the session's work, or deleted, is not. The mark goes when the file is next edited in the session (server.js wireBranch).
- */
-export async function markFromGithub (e, dir, base, head, writes, theirs) {
-  const pure = [...writes].filter(([rel, k]) => k !== null && k === theirs.get(rel)).map(([rel]) => rel)
-  const commits = await lastCommits(dir, base, head, pure)
-  const map = e.doc.getMap('fromGithub')
-  const came = Date.now()
-  e.doc.transact(() => {
-    for (const [rel, k] of writes) {
-      const c = commits.get(rel)
-      // Marked again for the same commit (a folder's bring-in after the relay's own): it came in when it first did.
-      const was = map.get(rel)
-      if (k !== null && k === theirs.get(rel) && c) map.set(rel, { ...c, came: was && was.sha === c.sha && was.came ? was.came : came })
-      else if (map.has(rel)) map.delete(rel)
-    }
-  }, RELAY_ORIGIN)
-}
-
-/**
- * A folder brought GitHub's commits `from`..`to` into branch `key` itself (an app older than 0.3.65, or a
- * pull it shared): the files of those commits that the session now holds exactly as GitHub has them are
- * marked as from GitHub, as the relay's own bring-in marks them. Runs in the branch's queue; never throws.
- */
-export async function markFolderBrought (room, key, from, to, { log = () => {} } = {}) {
-  try {
-    const rec = upstreamsOf(room)[key]
-    const e = room.store && room.store.get ? room.store.get(key) : null
-    if (!rec || !rec.repo || !rec.ref || !e || !room.mirrors) return
-    const repo = parseRepo(`https://${rec.repo}`)
-    if (!repo || !repo.github) return
-    const token = await room.gitToken(repo)
-    const dir = (await room.mirrors.ensure(repo, { url: room.gitRemoteUrl(repo) })).dir
-    await room.mirrors.queue(repo.slug, rec.ref, async () => {
-      if (!(await hasCommit(dir, to))) await room.mirrors.fetch(dir, rec.ref, { token })
-      if (!(await hasCommit(dir, from)) || !(await hasCommit(dir, to)) || !(await isAncestor(dir, from, to))) return
-      const changes = await changedPaths(dir, from, to)
-      const paths = [...changes.keys()].filter((rel) => isSafeRelPath(rel))
-      const atHead = await filesAt(dir, to, paths.filter((rel) => changes.get(rel) !== 'D'))
-      const bins = new Map(); const tooLarge = new Set()
-      const theirs = new Map(paths.map((rel) => [rel, changes.get(rel) === 'D' ? null : keyOf(atHead.get(rel), rel, { bins, tooLarge })]))
-      // What the session holds now stands for the write: GitHub's version exactly is marked, anything else isn't.
-      const held = new Map(paths.filter((rel) => docKey(e, rel) !== FOLLOWS_GIT).map((rel) => [rel, docKey(e, rel) ?? null]))
-      await markFromGithub(e, dir, from, to, held, theirs)
-    })
-  } catch (err) { log(`[${room.name}] ${key}: could not mark the files a folder brought in from GitHub: ${err.message}`) }
-}
-
-/** The files of a branch marked as GitHub's version (markFromGithub), newest first: [{ path, sha, by, at, subject }]. */
-export function fromGithubOf (e) {
-  const out = []
-  try { e.doc.getMap('fromGithub').forEach((v, path) => { if (v && typeof v.sha === 'string') out.push({ path, ...v }) }) } catch {}
-  return out.sort((a, b) => (b.at || 0) - (a.at || 0) || (a.path < b.path ? -1 : 1))
-}
-
-/** Writes `writes` (path -> key: text, "bin:<sha1>" or null) into the branch document as the relay, in one transaction; how many. */
-export function applyWrites (room, e, writes, { bins, now, base = null }) {
-  if (!writes.size) return 0
-  const history = e.historyLog || (e.historyLog = new HistoryLog(e.doc, e.doc.getArray('history'), { origin: RELAY_ORIGIN }))
-  const diff = isDiff(e)
-  let written = 0
-  e.doc.transact(() => {
-    for (const [rel, k] of writes) {
-      const before = e.files.get(rel)?.toString()
-      const existed = e.files.has(rel) || e.blobs.has(rel)
-      // A diff branch keeps the commit each entry is measured from (branch-view.js): `base`, the commit these writes bring.
-      if (diff && base && k !== undefined) e.fileBases.set(rel, base)
-      if (k === null) {
-        if (!existed) continue
-        if (diff) removePath(e, rel, { by: RELAY_BY, at: now })
-        else { e.files.delete(rel); e.blobs.delete(rel) }
-        history.record({ by: RELAY_BY, path: rel, kind: 'deleted', before, after: '', pulled: true })
-      } else if (k.startsWith('bin:')) {
-        const buf = bins.get(k)
-        if (!buf) continue
-        e.files.delete(rel)
-        e.blobs.set(rel, { hash: k.slice(4), data: buf.toString('base64') })
-        if (diff) notePresent(e, rel)
-        history.record({ by: RELAY_BY, path: rel, kind: existed ? 'edited' : 'created', detail: `${buf.length} bytes`, pulled: true })
-      } else {
-        if (before === k) continue
-        e.blobs.delete(rel)
-        let y = e.files.get(rel)
-        if (!y) { y = new Y.Text(); e.files.set(rel, y) }
-        applyTextDiff(y, k)
-        if (diff) notePresent(e, rel)
-        history.record({ by: RELAY_BY, path: rel, kind: existed ? 'edited' : 'created', before: before ?? '', after: k, pulled: true })
-      }
-      written++
-    }
-  }, RELAY_ORIGIN)
-  return written
-}
-
-/** The session's bytes of `rel` on the branch document (text or an inline binary), or null. */
-function sessionBuf (e, rel) {
-  const t = e.files.get(rel)
-  if (t) return Buffer.from(t.toString(), 'utf8')
-  const b = e.blobs.get(rel)
-  return b && typeof b.data === 'string' ? Buffer.from(b.data, 'base64') : null
-}
-
-async function readBlob (dir, sha) {
-  const r = await runGit(dir, ['cat-file', 'blob', sha], { buffer: true })
-  return r.ok ? r.out : null
-}
-
-/**
- * The held files, each looked at against its own base and theirs: one whose claim is gone (or that
- * raced an edit, or an older relay held for a clash) is combined with the session's copy now
- * (upstream.js combine) and lands, whoever's lines lost told; files an older relay held for failing
- * checks are let go of. Returns { landed, released: [paths] }.
- */
-async function settleHeld (room, key, { e, state, rec, dir, disk, bins, tooLarge, now, log }) {
-  if (!state.held.length) return { landed: 0, released: [] }
-  const union = await unionFor(e, dir, null)
-  const writes = new Map()
-  const released = []
-  const keep = []
-  const done = [] // { h, d, r, party, top, theirsName }
-  for (const h of state.held) {
-    const d = disk(h.path)
-    if (d === undefined) { keep.push(h); continue } // a large stored file: a folder brings it in
-    if (d === FOLLOWS_GIT) { released.push(h.path); continue } // a diff branch's file the session never changed: git's already
-    if (h.why === 'checks') { released.push(h.path); closeOldClash(room, key, h, { how: 'let go of: files are no longer held for failing checks', now }); continue }
-    if (h.why === 'claimed' && room.claimFor && room.claimFor(h.path, key)) { keep.push(h); continue }
-    let base, theirs, party, top, theirsName
-    if (h.kind === 'offline') {
-      // An older relay's clash with a member's offline edits: theirs is what they brought back.
-      base = h.baseBlob ? (await readBlob(dir, h.baseBlob))?.toString('utf8') ?? null : null
-      theirs = h.otherDeleted ? null : h.otherBlob ? (await readBlob(dir, h.otherBlob))?.toString('utf8') : undefined
-      if (theirs === undefined) { released.push(h.path); closeOldClash(room, key, h, { how: 'the session\'s version kept (the other is no longer kept)', now }); continue }
-      const off = (h.parties && h.parties.offline) || {}
-      party = sessionPartyOf(e, h.path)
-      top = { name: off.name || 'a member', member: off.name || null, ts: off.ts || 0 }
-      theirsName = `${off.name || 'a member'}'s offline edits`
-    } else {
-      if (!h.base || !h.theirs) { keep.push(h); continue }
-      const [b, t] = await Promise.all([filesAt(dir, h.base, [h.path]), filesAt(dir, h.theirs, [h.path])])
-      base = keyOf(b.get(h.path), h.path, { bins, tooLarge })
-      theirs = keyOf(t.get(h.path), h.path, { bins, tooLarge })
-      if (base === undefined || theirs === undefined) { keep.push(h); continue }
-      const c = (await upstreamCommits(dir, h.base, h.theirs, h.path))[0] || null
-      top = c ? { name: c.name, email: c.email, ts: c.ts, sha: c.sha, subject: c.subject, member: memberForAuthor(room, c) } : null
-      party = sessionPartyOf(e, h.path)
-      theirsName = rec.name
-    }
-    const oursNewer = ((party || {}).ts || 0) > ((top || {}).ts || 0) + 999 // a commit's whole second is its own
-    const r = combine(base, d, theirs, { oursNewer, union: union(h.path) })
-    done.push({ h, d, r, party, top, theirsName, both: d !== base && theirs !== base && d !== theirs })
-  }
-  // The session's version of a file whose lines lose is kept in the mirror too.
-  for (const x of done) {
-    if (!x.r.lost.some((l) => l.side === 'ours')) continue
-    const buf = sessionBuf(e, x.h.path)
-    x.blob = buf ? await storeBlob(dir, buf).catch(() => null) : null
-  }
-  // Each was combined against the session's copy as it was then: one edited since (the awaits let edits in) waits for the next look.
-  for (const x of done) {
-    if (disk(x.h.path) !== x.d) { keep.push(x.h); continue }
-    if (x.r.key !== x.d) writes.set(x.h.path, x.r.key)
-    released.push(x.h.path)
-    if (x.blob) noteResolved(room, key, { path: x.h.path, kind: 'auto', base: x.h.base || null, theirs: x.h.theirs || null, oursBlob: x.blob, how: `merged by Quilt: ${x.theirsName}'s newer edit kept`, at: now })
-  }
-  const landed = applyWrites(room, e, writes, { bins, now })
-  state.held = keep
-  for (const x of done) {
-    if (!released.includes(x.h.path)) continue
-    const { h, r } = x
-    if (h.why === 'clash' || h.kind === 'offline') closeOldClash(room, key, h, { how: 'merged by Quilt on its own', now })
-    if (h.kind === 'offline' && h.upstreamMoved) state.held.push({ path: h.path, why: 'raced', base: h.upstreamMoved.base, theirs: h.upstreamMoved.theirs, head: h.upstreamMoved.theirs, since: now })
-    if (h.kind === 'offline') {
-      // The returning member's lines lost: they are told as the session's side would be.
-      const lostTheirs = r.lost.filter((l) => l.side === 'theirs')
-      if (lostTheirs.length && x.top && x.top.member && room.postChat) room.postChat({ by: RELAY_BY, to: x.top.member, kind: 'nudge', text: `Quilt merged your offline edits to ${h.path} on ${key}: where you and ${(x.party && x.party.name) || 'the session'} both changed the same lines, the newer edit stays. Your lines it replaced:\n${lostLines(lostTheirs)}` })
-      tellAutoMerge(room, key, { path: h.path, lost: r.lost.filter((l) => l.side === 'ours'), deleted: r.deleted === 'ours' ? 'ours' : null, session: x.party, github: x.top, upstream: x.theirsName, now })
-    } else {
-      if (x.both) noteMerged(room, key, h.path, { session: x.party || null, github: x.top }, { now })
-      tellAutoMerge(room, key, { path: h.path, lost: r.lost, deleted: r.deleted || null, session: x.party, github: x.top, upstream: x.theirsName, head: h.theirs, now })
-    }
-  }
-  if (released.length) log(`[${room.name}] ${key}: ${released.join(', ')} merged and let go of`)
-  return { landed, released }
-}
-
-const IGNORE_FILE = /(^|\/)\.(git|quilt|cowove)ignore$/
-
-/** A diff branch's entries measured from commit `from` are measured from `to` now (the session took what came between). */
-function moveFileBases (e, from, to) {
-  const fb = e.fileBases
-  const moved = [...fb.entries()].filter(([, c]) => c === from).map(([rel]) => rel)
-  if (moved.length) e.doc.transact(() => { for (const rel of moved) fb.set(rel, to) }, RELAY_ORIGIN)
-}
-
-/**
- * A diff branch's entries that started from a commit older than the session's base `base` (a folder
- * behind GitHub edited a file git had, or the base moved on a folder's word): each takes what the
- * commits since changed in it, combined with the session's edit as a bring-in combines (the newer
- * edit wins lines both changed, whoever's lines lost is told), and is measured from `base` after.
- * An entry from a commit GitHub hasn't (a folder's own, not pushed) or not behind `base` is left as
- * it is: its own commit carries what it has. Returns how many files changed.
- */
-export async function liftEntries (room, key, { e, dir, base, now, log = () => {} }) {
-  const fb = e.fileBases
-  const groups = new Map()
-  for (const rel of ownPaths(e)) {
-    const c = fb.get(rel)
-    if (typeof c === 'string' && c !== base && SHA.test(c)) groups.set(c, [...(groups.get(c) || []), rel])
-  }
-  let landed = 0
-  for (const [from, rels] of groups) {
-    if (!(await hasCommit(dir, from)) || !(await isAncestor(dir, from, base))) continue
-    const all = await changedPaths(dir, from, base)
-    const touched = rels.filter((rel) => all.has(rel))
-    const bins = new Map(); const tooLarge = new Set()
-    const left = new Set()
-    if (touched.length) {
-      const changes = new Map(touched.map((rel) => [rel, all.get(rel)]))
-      const atFrom = await filesAt(dir, from, touched.filter((rel) => changes.get(rel) !== 'A'))
-      const atBase = await filesAt(dir, base, touched.filter((rel) => changes.get(rel) !== 'D'))
-      const baseMap = new Map(touched.map((rel) => [rel, changes.get(rel) === 'A' ? null : keyOf(atFrom.get(rel), rel, { bins, tooLarge })]))
-      const theirs = new Map(touched.map((rel) => [rel, changes.get(rel) === 'D' ? null : keyOf(atBase.get(rel), rel, { bins, tooLarge })]))
-      const disk = (rel) => docKey(e, rel)
-      const tops = new Map(); const parties = new Map()
-      for (const rel of touched) { tops.set(rel, (await upstreamCommits(dir, from, base, rel))[0] || null); parties.set(rel, sessionPartyOf(e, rel)) }
-      const oursNewer = (rel) => ((parties.get(rel) || {}).ts || 0) > ((tops.get(rel) || {}).ts || 0) + 999
-      const union = await unionFor(e, dir, base)
-      const captured = new Map(touched.map((rel) => [rel, disk(rel)]))
-      const plan = planCatchUp({ changes, base: baseMap, theirs, disk, published: publishedOf(room.doc), oursNewer, union })
-      for (const c of plan.conflicts) left.add(c.path) // unreadable for the relay: kept as they are, measured from where they were
-      const writes = new Map([...plan.writes].filter(([rel]) => !left.has(rel) && disk(rel) === captured.get(rel)))
-      for (const rel of touched) if (disk(rel) !== captured.get(rel)) left.add(rel) // edited meanwhile: the next look
-      landed += applyWrites(room, e, writes, { bins, now, base })
-      for (const m of plan.merged) {
-        if (left.has(m.path)) continue
-        const top = tops.get(m.path)
-        tellAutoMerge(room, key, { path: m.path, lost: m.lost, deleted: m.deleted || null, session: parties.get(m.path) || null, github: top ? { name: top.name, email: top.email, ts: top.ts, sha: top.sha, subject: top.subject, member: memberForAuthor(room, top) } : null, upstream: (upstreamsOf(room)[key] || {}).name || 'GitHub', head: base, now })
-      }
-    }
-    const move = rels.filter((rel) => !left.has(rel) && fb.get(rel) === from)
-    if (move.length) e.doc.transact(() => { for (const rel of move) fb.set(rel, base) }, RELAY_ORIGIN)
-    if (touched.length) log(`[${room.name}] ${key}: brought ${plural(touched.length - left.size, 'file')} the session changed from ${from.slice(0, 7)} up to ${base.slice(0, 7)}`)
-  }
-  return landed
-}
-
-export const describeSync = (state) => !state ? '' : `base ${String(state.base || '').slice(0, 7) || 'none'}${state.pushed ? `, pushed ${String(state.pushed).slice(0, 7)}` : ''}${state.held.length ? `, held ${state.held.map((h) => h.path).join(', ')}` : ''}`
-
-export const validSha = (s) => typeof s === 'string' && SHA.test(s)
-
-/**
- * A failure-injection point (tests: room.cfg.crashAt names one). At it the relay "dies": nothing more
- * reaches its disk (meta or documents), and the operation stops, as a process killed there would.
- */
-export function crashPoint (room, name) {
-  if (room.cfg && typeof room.cfg.atPoint === 'function') room.cfg.atPoint(name, room) // tests: something happens right here (an edit arrives)
-  if (!room.cfg || room.cfg.crashAt !== name) return
-  room.crashed = true
-  if (room.store) room.store.frozen = true
-  throw Object.assign(new Error(`crash injected at ${name}`), { injected: true })
-}
-
-/**
- * Where branch `key` stands with GitHub, for people and agents (addendum 16.13): { state, why?,
- * revision, pending, held, pr? }. `state`: 'paused' (the owner's switch, a deletion on GitHub, or a
- * sync not set up), 'permission-held' (GitHub refused the relay), 'offline' (GitHub out of reach),
- * 'pr-pending' (work going through a pull request: a
- * protected branch, or another session holds it), 'github-pending' (edits not on GitHub yet) or
- * 'synced'. 'github-pending' means files changed in the session since its last commit (nothing goes to GitHub until
- * someone commits). `revision`: the GitHub commit the session's content is acknowledged at.
- */
-export function syncStatus (room, key, { live = true } = {}) {
-  const rec = upstreamsOf(room)[key]
-  if (!rec || !rec.repo || !/^github\.com\//.test(rec.repo)) return null
-  const st = (room.meta.sync && room.meta.sync[key]) || { pending: {}, held: [] }
-  const out = { revision: st.base || rec.sha || null, pushed: st.pushed || null, pending: Object.keys(st.pending || {}).length, held: (st.held || []).filter((h) => h.why === 'clash' || h.why === 'checks').length }
-  // Files that are GitHub's version, not edited in the session since (a loaded branch only: nothing is loaded to say so).
-  const e = room.store && room.store.get ? room.store.get(key) : null
-  const gh = e ? fromGithubOf(e) : []
-  if (gh.length) { out.fromGithub = gh.length; out.fromGithubFiles = gh.slice(0, 10).map(({ path, sha, by }) => ({ path, sha, by })) }
-  // Since when the session's content has been at this commit (first seen by the relay), for "at a1b2c3d since 14:02".
-  if (out.revision) {
-    if (!st.revisionSeen || st.revisionSeen.sha !== out.revision) st.revisionSeen = { sha: out.revision, at: Date.now() }
-    out.revisionAt = st.revisionSeen.at
-  }
-  if (out.pending) out.pendingFiles = pendingFilesOf(e, st.pending)
-  if (room.meta.githubSync === false) return { ...out, state: 'paused', why: 'the owner turned sync with GitHub off' }
-  if (!live) return { ...out, state: 'paused', why: rec.github && rec.github.state && rec.github.state !== 'ok' ? 'nobody here has connected GitHub with write access to the repository yet' : 'sync with GitHub is not set up for this branch' }
-  if (rec.gone) return { ...out, state: 'paused', why: rec.problem || `${rec.ref} was deleted on GitHub` }
-  if (st.paused && st.paused.why === 'unreachable') return { ...out, state: 'offline', why: rec.problem || 'GitHub out of reach', since: st.paused.at }
-  if (st.paused) return { ...out, state: 'permission-held', why: rec.problem || 'GitHub refused the relay' }
-  if (st.protected && st.protected.pr) return { ...out, state: 'pr-pending', why: rec.problem || '', pr: st.protected.pr, live: st.protected.head || null }
-  if (out.pending || st.op) return { ...out, state: 'github-pending' }
-  return { ...out, state: 'synced' }
-}