The set. Both sides compute the scope set for scope from their own index with the same rule, then the server removes every blob whose readers do not include an account bound to the connection (or everyone).

Items. An item is (ts, cid): the blob's signed timestamp in milliseconds (zero for unsigned file blobs) and the full CID bytes. Items are ordered by timestamp, then by CID bytes. An item's hash is the SHA-256 of its CID bytes.

Fingerprint. For a range, sum the item hashes as 256-bit integers with wraparound, append the item count as a little-endian 64-bit integer, take SHA-256, keep the first 16 bytes. When the server removed any hidden item from a range, the fingerprint is folded over the filtered items only, so it equals what a peer holding exactly the readable items would compute.

Rounds. The initiator splits its whole set into sixteen ranges and sends one fingerprint each, or a single list range when it holds fewer than thirty-two items. The server answers each range: skip when fingerprints match; otherwise it splits the range into sixteen sub-ranges with fingerprints, or lists it when fewer than thirty-two items remain. A list from the caller is answered with the server's list for the same bounds, and the caller computes what it lacks. A message is at most 1 MiB; ranges that do not fit are collapsed into one trailing fingerprint and resumed next round.

Limits. A round is bounded at fifteen seconds and a session at one thousand rounds. The server is stateless between rounds and limits concurrent inbound reconciliations; past the limit it fails with resource-exhausted after a short wait.

Direction. The result is one-directional: the caller learns what the server has that it lacks. What the caller has that the server lacks is offered with Offer if the caller's policy says so.

A Reconcile creates no durable state on the server for scopes it does not itself materialise.

HM24's Syncing.ReconcileBlobs takes filters[]{resource, recursive, depth_one, types[]} and ranges[]{mode SKIP|FINGERPRINT|LIST, bound_timestamp, bound_value, values, fingerprint}. The algorithm, items, bucket count, list threshold, message budget and round limits are kept unchanged, and the folded fingerprint for hidden items is kept. The filter becomes a scope, and the hidden set is defined by readers rather than by the per-space visibility table. HM24's accumulator never incremented the item count; Stem's fingerprint includes it, which is one reason for the new protocol id.