All four are in now. Deletions go last. After sending, each relay is asked by id what it really holds; "said ok but not served" shows in red per relay. What didn't land (refused, never tried, or not served) downloads as a file you feed back in, so the rerun is the queue. And a restore lists each replaceable it sent with its date.
Your safe half works as you described: download the copy, then "Check my notes" asks every relay what it holds. Thanks, this was a better spec than mine.
