internal/compat: files made by v0.1.1, and tests that sesh still reads them

AGENTS.md

@@ -117,6 +117,16 @@ nothing, so the extension only works after the `browser install` above.
 
 ## Changes
 
+- **What a released sesh wrote keeps working.** A change to how the vault, an
+  export or a sync folder is stored comes with a way to read what earlier
+  releases wrote: for the vault, a new upgrade step (`migrateVN` in
+  `internal/database/schema.go`, with `currentSchemaVersion` bumped), never an
+  edit to an old one. `internal/compat` keeps files written by released
+  versions, made-up, and tests that this sesh still reads them. A release
+  that changes a format adds its own (`testdata/<version>/`, made with that
+  release, as `testdata/v0.1.1/make.sh` does) and tests for them. Never edit
+  or remake a released version's files, or loosen these tests, to get a
+  failing one to pass: the failure is the point.
 - **One pull request per change**, each on its own branch (a git worktree per
   branch keeps them apart). Each is reviewed before it's merged, and CI must
   pass.

docs/USAGE_AND_CONFIGURATION.md

@@ -435,7 +435,7 @@ sesh can't reset it for you: the master password derives the vault's key, sesh d
   sesh recover
   ```
 
-- **Restore from an encrypted export**, if you made one. Start a new vault (below), then import the export. It asks for the export's own password, which you chose when exporting:
+- **Restore from an encrypted export**, if you made one. Start a new vault (below), then import the export (entries only: the trash and earlier secrets aren't in it). It asks for the export's own password, which you chose when exporting:
 
   ```bash
   sesh import --from sesh backup.enc
@@ -745,7 +745,7 @@ What to do
 FAIL: 2 problems, 2 warnings
 ```
 
-It names every entry it can't read, and never shows a secret. It exits 1 when the config doesn't load, there's no vault, the vault file can't be read, the vault can't be unlocked (a wrong master password, say), or the file, an entry, the trash, an earlier secret, or the recovery key has a problem; warnings exit 0. Whatever stops the vault part, the setup's steps and the tally still show. If the file is damaged but every entry still reads, it says to export them now and start a new vault from that. If nothing can unlock the vault without asking (no `SESH_MASTER_PASSWORD`, no unlocked agent) and there's no terminal to ask at, as in a script, the setup is still checked, the last line says the vault wasn't, and it exits 0 unless the setup has a problem. If the agent locks or another command changes the master password while it checks, it says to run it again rather than blaming any entry. Run it when something seems off, after moving or restoring the vault, after a crash, or now and then. It writes nothing while it checks, then one `doctor` event to the audit log (not when the file itself is damaged).
+It names every entry it can't read, and never shows a secret. It exits 1 when the config doesn't load, there's no vault, the vault file can't be read, the vault can't be unlocked (a wrong master password, say), or the file, an entry, the trash, an earlier secret, or the recovery key has a problem; warnings exit 0. Whatever stops the vault part, the setup's steps and the tally still show. If the file is damaged but every entry still reads, it says to export them now and start a new vault from that (the trash and earlier secrets stay in the old file). If nothing can unlock the vault without asking (no `SESH_MASTER_PASSWORD`, no unlocked agent) and there's no terminal to ask at, as in a script, the setup is still checked, the last line says the vault wasn't, and it exits 0 unless the setup has a problem. If the agent locks or another command changes the master password while it checks, it says to run it again rather than blaming any entry. Run it when something seems off, after moving or restoring the vault, after a crash, or now and then. It writes nothing while it checks, then one `doctor` event to the audit log (not when the file itself is damaged).
 
 ### Backups
 
@@ -825,7 +825,7 @@ An automatic sync with nothing to do isn't written to the [audit log](#the-audit
 - **What a sync tool does is handled:** its copies of a file (Dropbox's "conflicted copy", Syncthing's, iCloud's "name 2") are merged and removed; a file it loses is written again, never taken for a deletion; an older copy it puts back is ignored, so an old password can't quietly return.
 - **iCloud Drive can keep files in the cloud** to save space ("Optimise Mac Storage"): sesh waits for those, says how many in the summary, and writes nothing over them. Keep the sync folder downloaded: in Finder, Control-click it and choose Keep Downloaded (macOS 15 or later).
 - **Each computer is named** in summaries and in history by its own name; `sync.name` changes it.
-- **Joining needs a new or empty vault,** or one joining again the folder it left: a vault's own entries, never synced with the folder, would bring back, as edits, any deleted elsewhere. To bring a vault's entries along: `sesh export --file F`, move the vault's files aside (the vault, any `-wal` and `-shm` files beside it, and `touchid.key`), `sesh sync join <folder>`, then `sesh import --from sesh F`.
+- **Joining needs a new or empty vault,** or one joining again the folder it left: a vault's own entries, never synced with the folder, would bring back, as edits, any deleted elsewhere. To bring a vault's entries along: `sesh export --file F`, move the vault's files aside (the vault, any `-wal` and `-shm` files beside it, and `touchid.key`), `sesh sync join <folder>`, then `sesh import --from sesh F`; the trash and earlier secrets stay with the vault moved aside.
 - **A master password changed on one computer** reaches the others: they ask for it at their next `sesh sync`, at a terminal, and switch to it (see [Changing your master password](#changing-your-master-password-sesh-passwd)).
 - **Joining again** works for a vault that left the folder, even one whose entries were all deleted since. One whose master password changed while it was away is switched to the folder's as it joins (it asks for the folder's, then its own): its own change isn't kept, so to change every computer's password, change it while syncing.
 - **`sync.dir` set by hand** (`sesh config set sync.dir`, or `SESH_SYNC_DIR`) to a folder the vault hasn't synced with is held to the same rule as joining: a vault with entries of its own that synced with another folder, or never synced, doesn't sync with one holding entry files (even ones it can't read), as that would bring back what was deleted in either; a new, empty folder starts afresh. A folder inside the vault's own, or holding the vault, is refused.
@@ -864,7 +864,7 @@ An export to a file, in any format, doesn't replace an existing one without `--f
 
 Encrypted exports use Argon2id and AES-256-GCM, as the vault does. The file holds its own salt and Argon2id settings, so it opens on any computer, whatever its master password, given the export password.
 
-Every export holds everything about each entry (CSV leaves out file entries, and says how many; JSON and the encrypted export include them): its kind, service name, username, secret, times, settings, folder, tags, URL, notes, and custom fields (secret ones included). A TOTP entry's settings (algorithm, digits, period, issuer) decide which codes are right, so they come back with it on import. In JSON they're the `settings` field; in CSV, a `settings` column holding the same JSON.
+Every export holds everything about each entry (CSV leaves out file entries, and says how many; JSON and the encrypted export include them): its kind, service name, username, secret, times, settings, folder, tags, URL, notes, and custom fields (secret ones included). Its earlier secrets (its [history](#password-history)) aren't included. A TOTP entry's settings (algorithm, digits, period, issuer) decide which codes are right, so they come back with it on import. In JSON they're the `settings` field; in CSV, a `settings` column holding the same JSON.
 
 ### Changing your master password (`sesh passwd`)
 
@@ -1940,7 +1940,7 @@ sesh add --help
 | Message | What it means | What to do |
 |---|---|---|
 | "this vault doesn't sync: …" | `sync.dir` isn't set | `sesh sync init` makes a sync folder from this vault; `sesh sync join <folder>` joins one |
-| "this vault already has entries of its own, never synced with this folder. Joining takes a new or empty vault, …" (from `sesh sync join`) | Joining would bring back, as edits, entries deleted on the other computers | Follow the steps it gives: export, move the vault's files aside, join, import |
+| "this vault already has entries of its own, never synced with this folder. Joining takes a new or empty vault, …" (from `sesh sync join`) | Joining would bring back, as edits, entries deleted on the other computers | Follow the steps it gives: export, move the vault's files aside, join, import (the trash and earlier secrets stay with the vault moved aside) |
 | "the master password was changed on another computer: …", or "⚠️ Sync: the master password was changed on another computer; nothing syncs until it's taken: sesh sync, or the Sync row in sesh ui's settings." | Another computer changed it; this vault still opens with its own, and doesn't sync | Run `sesh sync` at a terminal, or in `sesh ui` take it from the Sync row in settings and safety: each asks for this vault's password, then the new one. Forgotten your own? `sesh recover` takes the new one with the recovery key |
 | "⚠️ Sync: the master password was changed here and on another computer at once, and the other's is kept; nothing syncs until it's taken: sesh sync, or the Sync row in sesh ui's settings." | Two changes were made from the same master password, each computer's sync tool not yet showing the other's; the other one is kept on every computer | Run `sesh sync` at a terminal, or take it from the Sync row in `sesh ui`, and type the other change's password. If no computer of yours made it, `sesh passwd` puts yours back |
 | "this computer's master password change hasn't reached the sync folder yet: …" | The password was changed here with the folder out of reach | `sesh sync` sends it, as does any command that syncs on its own (`sync.auto`) once the folder is back |