README and TODO: say only what the code does for records it cannot decrypt

A file whose copy in another album decrypted is stored from that copy, and
the album where it does not decrypt neither links nor lists it. Only a run
without --json prints the line for an album. The exit-code and read-command
sentences no longer cover that file, and the failures.json sentence covers
only files in the backup's scope.

Model: opus-5-5

README.md

@@ -135,13 +135,13 @@ matters.
 | `3`  | There is no usable session: none is saved, the saved one is corrupt, or the server no longer accepts it. Run `quak login` as the user the cron job runs as.                       |
 
 After a `1`, the next run fetches each missing original again, fetches the ML
-data that is not cached, and rebuilds the album links. A file or album quak
+data that is not cached, and rebuilds the album links. An album quak could not
-could not decrypt keeps the exit code at `1` until the server sends a copy that
+decrypt, or a file in `failures.json` because quak could not decrypt it, keeps
-decrypts, or deletes it (see "Backup layout"). An original that a `--verify` run
+the exit code at `1` until the server sends a copy that decrypts, or deletes it
-could not read, or put back with bytes that still do not match, stays at its
+(see "Backup layout"). An original that a `--verify` run could not read, or put
-save path. Only a later `--verify` run checks it again: a run without `--verify`
+back with bytes that still do not match, stays at its save path. Only a later
-leaves it as it is and takes the file out of `failures.json`, so that run can
+`--verify` run checks it again: a run without `--verify` leaves it as it is and
-exit 0.
+takes the file out of `failures.json`, so that run can exit 0.
 
 ## Examples
 
@@ -626,9 +626,9 @@ answer, so they report current account state rather than whatever the cache last
 held. If that round-trip fails, the command prints the error on one line and
 exits 1, or 3 when the server no longer accepts the saved session (see "Session
 handling"). An album or file quak cannot decrypt does not fail it; the command
-answers without it (see "Default reads vs. fresh reads"). `--cache-dir`
+answers from what did decrypt (see "Default reads vs. fresh reads").
-overrides where the cache lives; without it each account gets its own directory
+`--cache-dir` overrides where the cache lives; without it each account gets its
-under the per-user cache path.
+own directory under the per-user cache path.
 
 An ID given to `files --collection`, `get`, `get-thumb` or
 `helper fix-missing-thumbnails --file` is written in decimal digits, no larger
@@ -745,16 +745,18 @@ succeeds, or once it is no longer in the library or in the backup's scope. The
 library's `lib.backup({ includeThumbnails: true })` also writes
 `thumbnails/<fileID>.jpg` beside `collections/`; `quak backup` does not.
 
-A file the library could not decrypt (see "Default reads vs. fresh reads") goes
+A file in the backup's scope that the library could not decrypt (see "Default
-into `failures.json` with an empty title, since its title is encrypted too, and
+reads vs. fresh reads") goes into `failures.json` with an empty title, since its
-an error that starts `could not be decrypted:` and gives the reason. A file in
+title is encrypted too, and an error that starts `could not be decrypted:` and
-two albums is backed up as usual if its copy in the other album decrypted. An
+gives the reason. If a copy of it in another album decrypted, it does not: its
-album the library could not decrypt has no name quak can read and no files it
+original is stored from that copy, and the album where it does not decrypt
-can list. A run without `--json` prints one line for it,
+neither links nor lists it. An album the library could not decrypt has no name
-`FAILED album <id>: could not be decrypted: <reason>`, and `--json` and the
+quak can read and no files it can list. A run without `--json` prints one line
-`BackupResult` list its ID in `undecryptableAlbums`. Every other file is backed
+for it, `FAILED album <id>: could not be decrypted: <reason>`, and `--json` and
-up. Either kind keeps the exit code at 1, run after run, until the server sends
+the `BackupResult` list its ID in `undecryptableAlbums`. Such a file in
-a copy that decrypts or deletes it; the next run then drops it.
+`failures.json`, or such an album, keeps the exit code at 1, run after run,
+until the server sends a copy that decrypts or deletes it; the next run then
+drops it.
 
 `backup.lock` keeps two backups of the same directory from running at once, such
 as a cron run that starts while the previous one is still going. A backup

TODO.md

@@ -25,16 +25,18 @@ declares one.
 
 # Completed Steps
 
-- 2026-10-13: An album or file quak cannot decrypt, or whose metadata is not
+- 2026-10-14: An album or file quak cannot decrypt, or whose metadata is not
   JSON, no longer fails the refresh, so one bad record no longer stops
   `quak backup` from storing anything (issue 181). The refresh leaves it out, an
   album with its files, and the library keeps it with the reason in
-  `metadata.json` until the server sends a copy that decrypts or deletes it. The
+  `metadata.json` until the server sends a copy that decrypts or deletes it.
-  backup stores every other file, records each such file in `failures.json` with
+  `quak backup` stores every other file, records each such file in
-  an error starting `could not be decrypted:`, prints one line naming each such
+  `failures.json` with an error starting `could not be decrypted:`, names each
-  album's ID, lists those IDs in `undecryptableAlbums`, and exits 1 while any
+  such album's ID in a printed line, or with `--json` in `undecryptableAlbums`,
-  remain. A file whose copy in another album decrypts is backed up as usual. The
+  and exits 1 while any remain. A file whose copy in another album decrypts is
-  read commands answer from what decrypted.
+  not recorded: its original is stored from that copy, and the album where it
+  does not decrypt neither links nor lists it. The read commands answer from
+  what decrypted.
 
 - 2026-10-14: `quak backup` no longer asks the server for changes every 3
   seconds while it runs (issue 183). It opens its library with