@@ -0,0 +1,22 @@
+---
+kind: fixed
+title: A chat opened in the home folder saves the conversation, not every file in the home folder
+pr: 1976
+surface: [chat, engine]
+invalidates:
+  - "A chat whose folder was the home folder, a folder above it or a filesystem root captured that whole folder: the warm capture asked furrow for a plan of every file, a full copy went into the store and each unsealed plan stayed on disk. That folder is now never captured; the chat seals its own folder instead."
+  - "Rewind in a chat opened in the home folder restored the folder's files along with the conversation. It now brings back the conversation only, and the chat says so once when it opens."
+---
+
+The rule is where the folder is, never what is in it: a folder that is the home
+folder, holds it, or is a filesystem root is not a project. Counting files or
+bytes to find a folder that is too big would itself be the walk this avoids.
+Every seal, rewind and take reads the tree from the same place, so they agree.
+The chat records that it saves only its own folder (`.cell/own-folder`), so a
+machine where the same path is an ordinary folder, not its home, still seals and
+restores only the chat's own folder and never takes the chat in place there.
+
+On a copy of a real profile used as the home folder, each launch there wrote
+about 9 MB of capture plan and added 2.6 to 3.1 GB to the store before this
+change, and wrote no plan and under 1 MB after. Time to the first frame did not
+move (about 0.45 s), since the capture was already off the paint path.
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 	"time"
 
 	"github.com/Agent-Field/codeaf/internal/cell"
@@ -107,6 +108,9 @@ func (e Engine) Seal(ctx context.Context, c cell.Cell, info TurnInfo) (Sealed, e
 	if err != nil {
 		return Sealed{}, fmt.Errorf("seal: encode receipt: %w", err)
 	}
+	if err := e.markOwnFolder(c); err != nil {
+		return Sealed{}, fmt.Errorf("seal: compose: %w", err)
+	}
 	if err := e.compose(c, raw, rid, info); err != nil {
 		return Sealed{}, fmt.Errorf("seal: compose: %w", err)
 	}
@@ -191,14 +195,99 @@ func (e Engine) tree(c cell.Cell) string {
 }
 
 // workspace is the folder the tools of c work in, "" when c's own folder is
-// what is sealed.
+// what is sealed. A folder that holds the home folder is never sealed (see
+// [holdsHome]): its chat seals its own folder, so the conversation is kept and
+// the folder's files are not.
 func (e Engine) workspace(c cell.Cell) string {
+	w := e.named(c)
+	if w != "" && (holdsHome(w) || ForeignFolder(c.Root, w)) {
+		return ""
+	}
+	return w
+}
+
+// named is the workspace the caller names for c, before the rules above.
+func (e Engine) named(c cell.Cell) string {
 	if e.WorkspaceOf != nil {
 		return e.WorkspaceOf(c)
 	}
 	return e.Workspace
 }
 
+// OwnFolderPath marks a chat that has sealed only its own folder because the
+// folder it was opened in held a home folder. It lives in the cell's .cell/
+// directory, so it travels with every snapshot and arrives wherever the chat
+// is continued.
+const OwnFolderPath = cell.StateDir + "/own-folder"
+
+// ForeignFolder reports whether workspace is a folder the chat at root must
+// never be sealed or restored in here: the chat carries only its own folder
+// (OwnFolderPath), and workspace is outside that folder and holds no home
+// folder here. A folder that holds this machine's home is the chat's working
+// folder as on the machine it came from: its tools run there, and only its
+// files are never sealed.
+//
+// THE RECEIVER CANNOT JUDGE THE SENDER'S HOME. A path that was somebody's home
+// on the machine that sealed the chat can be an ordinary folder here, holding
+// files the snapshot never had, and restoring the chat's own folder over it
+// would replace them. [holdsHome] answers for this machine's home; the mark
+// answers for the machine the chat came from. A workspace inside the chat's
+// own folder (an owned work/) is still the chat's.
+func ForeignFolder(root, workspace string) bool {
+	if workspace == "" || holdsHome(workspace) {
+		return false
+	}
+	if _, err := os.Stat(filepath.Join(root, filepath.FromSlash(OwnFolderPath))); err != nil {
+		return false
+	}
+	rel, err := filepath.Rel(canonicalTree(root), canonicalTree(workspace))
+	return err != nil || filepath.IsAbs(rel) || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator))
+}
+
+// markOwnFolder records, before a seal composes the cell, that this chat's
+// folder holds a home folder and so only the chat's own folder is sealed.
+func (e Engine) markOwnFolder(c cell.Cell) error {
+	if w := e.named(c); w == "" || !holdsHome(w) {
+		return nil
+	}
+	path := rel(c, OwnFolderPath)
+	if _, err := os.Stat(path); err == nil {
+		return nil
+	}
+	if err := writeFile(path, []byte("this chat saves its own folder, never the folder it was opened in\n")); err != nil {
+		return err
+	}
+	commits.mark(c.Root, path, true)
+	return nil
+}
+
+// holdsHome reports whether dir is the home folder, a folder above it, or a
+// filesystem root: the places a person opens a general chat, which are not a
+// project and whose files are everything they own.
+//
+// IT IS DECIDED BY WHERE THE FOLDER IS, NEVER BY WHAT IS IN IT. Counting files
+// or bytes to find a folder too big to save is itself the walk this rule
+// exists to avoid, and a cap would draw its line through somebody's real
+// project. A folder that holds the home folder needs no look inside: a home of
+// 2.5 GB took a capture that never finished inside SealWithin, and every try
+// left its whole plan on disk. Every caller that seals, rewinds or takes a chat
+// goes through [Engine.workspace], so all of them agree on the tree.
+func holdsHome(dir string) bool {
+	tree := canonicalTree(dir)
+	if filepath.Dir(tree) == tree {
+		return true
+	}
+	house, err := os.UserHomeDir()
+	if err != nil || strings.TrimSpace(house) == "" {
+		return false
+	}
+	rel, err := filepath.Rel(tree, canonicalTree(house))
+	if err != nil || filepath.IsAbs(rel) {
+		return false
+	}
+	return rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator))
+}
+
 // policyDir is where the harness keeps its exclusions: the cell's directory
 // that is composed into a workspace, or the cell's own folder when that is
 // what is sealed. The engine reads a .furrowpolicy from either.
 
@@ -0,0 +1,255 @@
+package cellstore
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/Agent-Field/codeaf/internal/cell"
+	"github.com/Agent-Field/codeaf/internal/executor"
+)
+
+// useHome makes dir the home folder this process reports.
+func useHome(t *testing.T, dir string) {
+	t.Helper()
+	t.Setenv("HOME", dir)
+	if runtime.GOOS == "windows" {
+		t.Setenv("USERPROFILE", dir)
+	}
+}
+
+// fillHome writes files spread over dirs folders under root.
+func fillHome(t testing.TB, root string, dirs, files int) {
+	t.Helper()
+	for d := 0; d < dirs; d++ {
+		dir := filepath.Join(root, fmt.Sprintf("d%03d", d))
+		if err := os.MkdirAll(dir, 0o700); err != nil {
+			t.Fatal(err)
+		}
+		for f := 0; f < files; f++ {
+			if err := os.WriteFile(filepath.Join(dir, fmt.Sprintf("f%04d.txt", f)), []byte("x"), 0o600); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+}
+
+// planLedger counts what the engine was asked to plan and what it planned.
+type planLedger struct {
+	mu    sync.Mutex
+	trees []string // the tree of every capture-plan asked for
+	paths int      // the paths every plan answered with, summed
+}
+
+func (l *planLedger) over(inner Transport) Transport {
+	return transportFunc(func(ctx context.Context, target Target, op Op) ([]byte, error) {
+		out, err := inner.Do(ctx, target, op)
+		if op.Verb() == "capture-plan" {
+			var plan capturePlan
+			_ = json.Unmarshal(out, &plan)
+			l.mu.Lock()
+			l.trees = append(l.trees, target.Tree)
+			l.paths += len(plan.Paths)
+			l.mu.Unlock()
+		}
+		return out, err
+	})
+}
+
+func (l *planLedger) asked(tree string) int {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	n := 0
+	for _, asked := range l.trees {
+		if asked == canonicalTree(tree) {
+			n++
+		}
+	}
+	return n
+}
+
+// fakePlans answers capture-plan with an empty full plan and every other verb
+// with a snapshot, so the rule is seen without an engine binary.
+func fakePlans() Transport {
+	return transportFunc(func(_ context.Context, _ Target, op Op) ([]byte, error) {
+		if op.Verb() == "capture-plan" {
+			return []byte(`{"token":"t","full":true,"paths":[]}`), nil
+		}
+		return []byte(`{"snapshot":"s"}`), nil
+	})
+}
+
+// A FOLDER THAT HOLDS THE HOME FOLDER IS NOT A PROJECT. A chat opened there
+// still seals (its own folder), but the engine is never asked to plan the home,
+// its parent or a filesystem root, while a project folder beside the home is
+// planned exactly as before.
+func TestAFolderHoldingHomeIsNeverPlanned(t *testing.T) {
+	base := canonicalTree(t.TempDir())
+	house := filepath.Join(base, "people", "someone")
+	project := filepath.Join(base, "people", "someone-else", "api")
+	for _, dir := range []string{house, project} {
+		if err := os.MkdirAll(dir, 0o700); err != nil {
+			t.Fatal(err)
+		}
+	}
+	useHome(t, house)
+	root := filepath.VolumeName(base) + string(filepath.Separator)
+	for _, tc := range []struct {
+		name, workspace string
+		planned         bool
+	}{
+		{"home", house, false},
+		{"home with a trailing separator", house + string(filepath.Separator), false},
+		{"parent of home", filepath.Dir(house), false},
+		{"filesystem root", root, false},
+		{"project beside home", project, true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			c := newCell(t)
+			ledger := &planLedger{}
+			e := EngineFor(tc.workspace)
+			e.DataRoot, e.Transport = t.TempDir(), ledger.over(fakePlans())
+			if _, err := e.Seal(t.Context(), c, TurnInfo{}); err != nil {
+				t.Fatal(err)
+			}
+			if got := ledger.asked(tc.workspace); (got > 0) != tc.planned {
+				t.Fatalf("plans of %s = %d, want planned=%v (asked for %v)", tc.workspace, got, tc.planned, ledger.trees)
+			}
+			if !tc.planned && ledger.asked(c.Root) == 0 {
+				t.Fatalf("the chat's own folder was not sealed instead (asked for %v)", ledger.trees)
+			}
+		})
+	}
+}
+
+// The seat says once, in plain words, that a home folder's files are not kept.
+func TestAHomeSeatSaysOnceThatItsFilesAreNotSaved(t *testing.T) {
+	// The seat is built over a fake transport, so no engine binary is needed;
+	// without this a build with no engine inside gets a plain seat and no notice.
+	t.Cleanup(cell.UseAvailabilityInTests(true))
+	house := t.TempDir()
+	useHome(t, house)
+	for _, tc := range []struct {
+		workspace string
+		notices   int
+	}{{house, 1}, {t.TempDir(), 0}} {
+		var said []string
+		_, err := SeatOver(executor.HostBound, newCell(t), tc.workspace, nil, nil, nil,
+			WithNotices(func(s string) { said = append(said, s) }),
+			func(e *Engine) { e.DataRoot, e.Transport = t.TempDir(), fakePlans() })
+		if err != nil {
+			t.Fatal(err)
+		}
+		home := 0
+		for _, s := range said {
+			if strings.Contains(s, "home folder") {
+				home++
+			}
+		}
+		if home != tc.notices {
+			t.Fatalf("workspace %s: home notices = %d, want %d (%q)", tc.workspace, home, tc.notices, said)
+		}
+	}
+}
+
+// TestStartupInALargeHomeWalksNoHome is the startup gate: a seat opened with
+// warm capture in a home of many files, through the real engine, finishes its
+// first capture having planned none of the home's files and having written no
+// plan that lists them. It counts paths and plan bytes; it never times.
+func TestStartupInALargeHomeWalksNoHome(t *testing.T) {
+	const dirs, files = 100, 200 // 20,000 files
+	house := t.TempDir()
+	fillHome(t, house, dirs, files)
+	useHome(t, house)
+	real := realEngine(t)
+	ledger := &planLedger{}
+	c := newCell(t)
+	seat, err := SeatOver(executor.HostBound, c, house, nil, func(err error) {
+		if err != nil {
+			t.Errorf("seal: %v", err)
+		}
+	}, nil, WithPipeline(), WithWarmCapture(), WithNotices(func(string) {}), func(e *Engine) {
+		e.Binary, e.DataRoot, e.Transport = real.Binary, real.DataRoot, ledger.over(real.Transport)
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := executor.Drain(t.Context(), seat); err != nil {
+		t.Fatal(err)
+	}
+	if head, err := Head(c); err != nil || head == nil {
+		t.Fatalf("the chat was not sealed: %v", err)
+	}
+	if n := ledger.asked(house); n != 0 {
+		t.Fatalf("the home was planned %d times", n)
+	}
+	if ledger.paths >= dirs*files/10 {
+		t.Fatalf("startup planned %d paths for a home of %d files", ledger.paths, dirs*files)
+	}
+	var planBytes int64
+	_ = filepath.WalkDir(real.DataRoot, func(path string, d fs.DirEntry, err error) error {
+		if err == nil && !d.IsDir() && strings.Contains(filepath.ToSlash(path), "/capture-plans/") {
+			if info, err := d.Info(); err == nil {
+				planBytes += info.Size()
+			}
+		}
+		return nil
+	})
+	// One plan line per home file would be at least ten bytes each.
+	if planBytes >= int64(dirs*files) {
+		t.Fatalf("startup wrote %d bytes of capture plans for a home of %d files", planBytes, dirs*files)
+	}
+}
+
+// A CHAT THAT LEFT ITS FOLDER'S FILES UNSAVED ARRIVES THAT WAY. A chat sealed in
+// its sender's home folder carries only its own folder. On a machine whose home
+// is elsewhere, the sender's home path may be an ordinary folder that exists
+// (somebody else's files, or the same path by coincidence). The receiver must
+// still seal and restore only the chat's own folder, never that path.
+func TestAHomeChatNeverCapturesTheSendersHomeOnAnotherMachine(t *testing.T) {
+	base := canonicalTree(t.TempDir())
+	sender, receiver := filepath.Join(base, "sender"), filepath.Join(base, "receiver")
+	for _, dir := range []string{sender, receiver} {
+		if err := os.MkdirAll(dir, 0o700); err != nil {
+			t.Fatal(err)
+		}
+	}
+	c := newCell(t)
+	useHome(t, sender)
+	e := EngineFor(sender)
+	e.DataRoot, e.Transport = t.TempDir(), fakePlans()
+	if _, err := e.Seal(t.Context(), c, TurnInfo{}); err != nil {
+		t.Fatal(err)
+	}
+	// The same chat, its .cell/ as it arrived, on a machine whose home is not
+	// the sender's: the session record still names the sender's path.
+	useHome(t, receiver)
+	ledger := &planLedger{}
+	there := EngineFor(sender)
+	there.DataRoot, there.Transport = t.TempDir(), ledger.over(fakePlans())
+	if _, err := there.Seal(t.Context(), c, TurnInfo{}); err != nil {
+		t.Fatal(err)
+	}
+	if n := ledger.asked(sender); n != 0 {
+		t.Fatalf("the receiver planned the sender's home path %d times (asked for %v)", n, ledger.trees)
+	}
+	if got := there.tree(c); got != canonicalTree(c.Root) {
+		t.Fatalf("the receiver restores into %s, want the chat's own folder %s", got, c.Root)
+	}
+	// A work/ of the chat's own is still the chat's, and on the sender, where the
+	// path is home, the path stays the chat's working folder.
+	if ForeignFolder(c.Root, filepath.Join(c.Root, "work")) {
+		t.Fatal("the chat's own work/ is called foreign")
+	}
+	useHome(t, sender)
+	if ForeignFolder(c.Root, sender) {
+		t.Fatal("the sender's own home is called foreign on the sender")
+	}
+}