diff --git a/cmd/opensave-app/frontend/src/views/Devices.svelte b/cmd/opensave-app/frontend/src/views/Devices.svelte
index 641c5f3b..28aa2405 100644
--- a/cmd/opensave-app/frontend/src/views/Devices.svelte
+++ b/cmd/opensave-app/frontend/src/views/Devices.svelte
@@ -45,6 +45,30 @@
     run(() => api.del(`/api/peers/${peer.id}`), `Unpaired ${peer.name}`);
   };
 
+  // A game a paired device syncs is tracked by itself only at a folder this
+  // device recognises as that game's save; anywhere else it waits on Home
+  // for the user to place. Their own devices they can let choose instead, as
+  // every device could before 2.4.1 — which is why turning it on asks.
+  const setChoosesFolders = async (peer, box) => {
+    const allowed = box.checked;
+    if (allowed) {
+      const ok = await askConfirm(
+        `Only do this for a device that is yours. When "${peer.name}" syncs a game this device ` +
+          `doesn't recognise, its saves go in the folder "${peer.name}" names, instead of waiting ` +
+          `on Home for you to choose one.`,
+        { title: `Trust "${peer.name}" to choose folders?`, confirmText: 'Trust it' }
+      );
+      if (!ok) {
+        box.checked = false; // as it was: nothing changed
+        return;
+      }
+    }
+    run(
+      () => api.post(`/api/peers/${peer.id}/choose-folders`, { allowed }),
+      allowed ? `${peer.name} can choose folders here` : `${peer.name} no longer chooses folders here`
+    );
+  };
+
   // The only repair for a pairing with no encryption key is to make it again,
   // and this button can only do the first half of that. Saying "Pair again to
   // encrypt" on a control that just unpairs would leave someone believing they
@@ -115,6 +139,15 @@
               </button>
             {/if}
           </div>
+          <label class="check trust" title="For your own devices: games it syncs go in the folder it names, even one this device doesn't recognise as a save, instead of waiting on Home for you.">
+            <input
+              type="checkbox"
+              checked={!!peer.choosesFolders}
+              disabled={busy}
+              on:change={(e) => setChoosesFolders(peer, e.currentTarget)}
+            />
+            Trust it to choose folders
+          </label>
         </div>
         {#if peer.hasNewerBuild && peer.status === 'online'}
           <button class="btn small primary" disabled={busy || !!$appUpdate} on:click={() => updateFromPeer(peer)}>
@@ -226,6 +259,11 @@
     margin-top: 0.35rem;
     flex-wrap: wrap;
   }
+  .trust {
+    margin-top: 0.45rem;
+    font-size: 0.82rem;
+    color: var(--text-dim);
+  }
   .linkish {
     background: none;
     border: none;
diff --git a/cmd/opensave-app/frontend/src/views/home/OfferedGames.svelte b/cmd/opensave-app/frontend/src/views/home/OfferedGames.svelte
index d039a1cb..94fc1e52 100644
--- a/cmd/opensave-app/frontend/src/views/home/OfferedGames.svelte
+++ b/cmd/opensave-app/frontend/src/views/home/OfferedGames.svelte
@@ -1,11 +1,12 @@
 <script>
   // ── Games a peer syncs that this device has no folder for ─────────
   //
-  // Only ever populated when "Ask me where to keep it" is chosen in Settings;
-  // with the default an unknown game is tracked automatically and never
-  // reaches this list. Shown at the top of the page on purpose: an offer
-  // nobody notices is worse than a folder guessed slightly wrong, because a
-  // wrong guess is at least visible and can be moved afterwards.
+  // A peer's game lands here when this device cannot vouch for the folder as
+  // that game's save folder (CVE-2026-103398), and every unknown game does
+  // with "Ask me where to keep it" in Settings. Shown at the top of the page
+  // on purpose: an offer nobody notices is worse than a folder guessed
+  // slightly wrong, because a wrong guess is at least visible and can be
+  // moved afterwards.
   import { gameList, toast } from '../../lib/stores.js';
   import { withUndo, hiddenKeys } from '../../lib/undo.js';
   import { api, native } from '../../lib/api.js';
diff --git a/e2e/folder_choice_test.go b/e2e/folder_choice_test.go
new file mode 100644
index 00000000..c229b57f
--- /dev/null
+++ b/e2e/folder_choice_test.go
@@ -0,0 +1,120 @@
+package e2e
+
+import (
+	"net/http"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/opensave/opensave/testutil"
+)
+
+// 2.4.2: a game arriving from a peer is tracked by itself wherever this device
+// can vouch for the folder — including one that does not exist yet — and the
+// user decides the rest (CVE-2026-103398).
+
+// A new device fills itself in: a game in the save catalogue arrives before it
+// was ever played here, and is tracked where the catalogue says it saves on
+// this device, its saves in place before first launch.
+func TestFolderChoice_ACatalogueGameArrivesBeforeItsFolderExists(t *testing.T) {
+	a := testutil.NewTestDaemon(t, "Catalogue-A")
+	b := testutil.NewTestDaemon(t, "Catalogue-B")
+	a.PairWith(b)
+
+	// Each device's own application-data folder, as the catalogue resolves
+	// it; the path rule maps one to the other, as two users' profiles map.
+	rootA, rootB := t.TempDir(), t.TempDir()
+	t.Setenv("APPDATA", filepath.Join(rootB, "AppData", "Roaming"))
+	b.API(http.MethodPost, "/api/settings", map[string]any{
+		"pathTranslations": []map[string]string{{"fromPattern": rootA, "toPattern": rootB}},
+	}, nil)
+	manifest := `
+Hollow Game:
+  files:
+    <winAppData>/MoonStudio/HollowGame:
+      tags: [save]
+      when:
+        - os: windows
+`
+	if err := os.WriteFile(filepath.Join(filepath.Dir(b.Daemon.Scanner.CacheFile), "ludusavi-manifest.yaml"), []byte(manifest), 0o666); err != nil {
+		t.Fatal(err)
+	}
+	b.Daemon.Scanner.GOOS = "windows"
+
+	saveA := filepath.Join(rootA, "AppData", "Roaming", "MoonStudio", "HollowGame")
+	writeAt(t, filepath.Join(saveA, "slot0.dat"), "act two")
+	var tracked gameRow
+	a.API(http.MethodPost, "/api/games", map[string]string{"name": "Hollow Game", "savePath": saveA}, &tracked)
+	a.API(http.MethodPost, "/api/games/"+tracked.ID+"/sync", nil, nil)
+
+	want := filepath.Join(rootB, "AppData", "Roaming", "MoonStudio", "HollowGame")
+	if !testutil.WaitFor(45*time.Second, func() bool {
+		return readAt(filepath.Join(want, "slot0.dat")) == "act two"
+	}) {
+		offers, _ := b.Daemon.Store.ListOfferedGames()
+		t.Fatalf("the save never arrived in the game's folder on B; B has %+v, offers %+v", gamesOf(b), offers)
+	}
+	if offers, _ := b.Daemon.Store.ListOfferedGames(); len(offers) != 0 {
+		t.Errorf("a game this device could vouch for was offered too: %+v", offers)
+	}
+}
+
+// A device the user trusts to choose folders has its hand-picked folder
+// synced by itself; the same game from a device not trusted is offered.
+func TestFolderChoice_ATrustedDevicesOwnFolderSyncs(t *testing.T) {
+	a := testutil.NewTestDaemon(t, "Trusted-A")
+	b := testutil.NewTestDaemon(t, "Trusted-B")
+	a.PairWith(b)
+
+	var ok map[string]any
+	b.API(http.MethodPost, "/api/peers/"+a.NodeID()+"/choose-folders", map[string]any{"allowed": true}, &ok)
+	if ok["choosesFolders"] != true {
+		t.Fatalf("could not trust A: %+v", ok)
+	}
+
+	a.WriteSave("homebrew.sav", "hand-picked")
+	gameID := a.TrackGame("Homebrew Game")
+	syncTo(a, gameID, b.NodeID())
+
+	if !testutil.WaitFor(30*time.Second, func() bool {
+		_, err := b.Daemon.Store.GetGame(gameID)
+		return err == nil
+	}) {
+		offers, _ := b.Daemon.Store.ListOfferedGames()
+		t.Fatalf("the trusted device's game was not tracked on B; offers %+v", offers)
+	}
+	if offers, _ := b.Daemon.Store.ListOfferedGames(); len(offers) != 0 {
+		t.Errorf("tracked, yet still offered: %+v", offers)
+	}
+}
+
+// An offer answers itself: once this device knows the folder, the peer's
+// next sync tracks the game and the offer is gone from Home.
+func TestFolderChoice_AnOfferClearsWhenTheFolderBecomesKnown(t *testing.T) {
+	a := testutil.NewTestDaemon(t, "Clears-A")
+	b := testutil.NewTestDaemon(t, "Clears-B")
+	a.PairWith(b)
+
+	a.WriteSave("slot1.sav", "from A")
+	gameID := a.TrackGame("Later Game")
+	syncTo(a, gameID, b.NodeID())
+	if !testutil.WaitFor(30*time.Second, func() bool {
+		offers, _ := b.Daemon.Store.ListOfferedGames()
+		return len(offers) == 1
+	}) {
+		t.Fatal("the game was not offered on B first")
+	}
+
+	b.KnowPeersSaveFolder(a.SaveDir) // B's scan finds the folder
+	syncTo(a, gameID, b.NodeID())
+
+	if !testutil.WaitFor(30*time.Second, func() bool {
+		_, err := b.Daemon.Store.GetGame(gameID)
+		offers, _ := b.Daemon.Store.ListOfferedGames()
+		return err == nil && len(offers) == 0
+	}) {
+		offers, _ := b.Daemon.Store.ListOfferedGames()
+		t.Fatalf("not tracked, or the offer stayed: B has %+v, offers %+v", gamesOf(b), offers)
+	}
+}
diff --git a/internal/api/routes_offered_games.go b/internal/api/routes_offered_games.go
index a950d486..51946dd6 100644
--- a/internal/api/routes_offered_games.go
+++ b/internal/api/routes_offered_games.go
@@ -11,9 +11,10 @@ import (
 
 // Games a peer syncs that this device has not been given a folder for.
 //
-// These exist only when the device is set to ask before tracking; with the
-// default setting an unknown game is tracked at a guessed folder and never
-// becomes an offer. See internal/store/migrations/0021_offered_games.sql.
+// A game becomes an offer when this device cannot vouch for the peer's folder
+// as that game's save folder (CVE-2026-103398; p2p ensureManifestGame), and
+// every unknown game does when the device is set to ask before tracking. See
+// internal/store/migrations/0021_offered_games.sql.
 
 func (s *Server) handleListOfferedGames(w http.ResponseWriter, r *http.Request) {
 	offers, err := s.Daemon.Store.ListOfferedGames()
diff --git a/internal/api/routes_peers.go b/internal/api/routes_peers.go
index 4eb9b594..76e99b78 100644
--- a/internal/api/routes_peers.go
+++ b/internal/api/routes_peers.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io"
 	"net"
 	"net/http"
@@ -25,6 +26,7 @@ func (s *Server) peerRoutes(r chi.Router) {
 	r.Delete("/api/peers/{peerId}", s.handleDeletePeer)
 	r.Post("/api/peers/probe", s.handleProbePeer)
 	r.Get("/api/peers/{peerId}/games", s.handlePeerGames)
+	r.Post("/api/peers/{peerId}/choose-folders", s.handlePeerChoosesFolders)
 
 	r.Post("/api/games/sync-all", s.handleSyncAll)
 	r.Post("/api/games/{gameId}/sync", s.handleSyncGame)
@@ -359,3 +361,31 @@ func itoa(n int) string {
 	}
 	return string(b[i:])
 }
+
+// handlePeerChoosesFolders lets a paired device choose the folders of games it
+// syncs to this one, or stops it: {"allowed": true|false}. Off, a game from
+// that device is tracked by itself only at a folder this one can vouch for as
+// its save, and offered otherwise (CVE-2026-103398).
+func (s *Server) handlePeerChoosesFolders(w http.ResponseWriter, r *http.Request) {
+	peerID := chi.URLParam(r, "peerId")
+	var body struct {
+		Allowed *bool `json:"allowed"`
+	}
+	if err := readJSON(r, &body); err != nil || body.Allowed == nil {
+		writeError(w, http.StatusBadRequest, `send {"allowed": true} or {"allowed": false}`)
+		return
+	}
+	if err := s.Daemon.Store.SetPeerChoosesFolders(peerID, *body.Allowed); err != nil {
+		writeError(w, http.StatusNotFound, err.Error())
+		return
+	}
+	if peer, err := s.Daemon.Store.GetPeer(peerID); err == nil {
+		if *body.Allowed {
+			s.Daemon.Log.Log("info", fmt.Sprintf("%q may now choose the folders of games it syncs here", peer.Name))
+		} else {
+			s.Daemon.Log.Log("info", fmt.Sprintf("%q no longer chooses folders here: games it syncs are tracked only at known save folders", peer.Name))
+		}
+	}
+	s.BroadcastPeersUpdate()
+	writeJSON(w, http.StatusOK, map[string]any{"success": true, "choosesFolders": *body.Allowed})
+}
diff --git a/internal/api/server.go b/internal/api/server.go
index 4d40a280..6f646a70 100644
--- a/internal/api/server.go
+++ b/internal/api/server.go
@@ -98,6 +98,10 @@ func (s *Server) peersPayload() map[string]any {
 		// "update from this device" when a peer runs a newer build.
 		entry := struct {
 			store.Peer
+			// Whether this device may choose the folders of games it syncs
+			// here (Devices; migration 0044).
+			ChoosesFolders bool `json:"choosesFolders"`
+
 			AppVersion    string `json:"appVersion,omitempty"`
 			BuildTimeMs   int64  `json:"buildTimeMs,omitempty"`
 			HasNewerBuild bool   `json:"hasNewerBuild,omitempty"`
@@ -112,6 +116,7 @@ func (s *Server) peersPayload() map[string]any {
 			entry.BuildTimeMs = b.BuildTimeMs
 			entry.HasNewerBuild = version.NewerThanLocal(b.AppVersion, b.BuildTimeMs)
 		}
+		entry.ChoosesFolders = s.Daemon.Store.PeerChoosesFolders(p.ID)
 		peerMap[p.ID] = entry
 	}
 	discovered := []any{}
diff --git a/internal/cliapp/commands_sync.go b/internal/cliapp/commands_sync.go
index b2931797..90f0c7f7 100644
--- a/internal/cliapp/commands_sync.go
+++ b/internal/cliapp/commands_sync.go
@@ -621,6 +621,9 @@ func cmdPeers(args []string) int {
 	if len(rest) > 0 && rest[0] == "games" {
 		return cmdPeerGames(args[1:])
 	}
+	if len(rest) > 0 && rest[0] == "trust" {
+		return cmdPeerTrust(args[1:])
+	}
 
 	raw, err := daemonRequest("GET", "/api/peers", nil)
 	if err != nil {
@@ -1067,3 +1070,34 @@ const relayUsage = `usage:
   opensave relay status        Show the current relay room
   opensave relay join <code>   Join a relay room (same code on every device)
   opensave relay leave         Leave the current room`
+
+// cmdPeerTrust lets a paired device choose the folders of games it syncs to
+// this one, or stops it — the Devices page's "Trust it to choose folders".
+// Off, such a game is tracked by itself only at a folder this device
+// recognises as its save, and waits on Home otherwise.
+func cmdPeerTrust(args []string) int {
+	asJSON, args := jsonFlag(args)
+	if len(args) != 2 || (args[1] != "on" && args[1] != "off") {
+		fmt.Fprintln(os.Stderr,
+			"usage: opensave peers trust <peerId> on|off\n"+
+				"  on:  games that device syncs here go in the folder it names, even one\n"+
+				"       this device doesn't recognise as a save. Only for your own devices.\n"+
+				"  off: such games wait for you to choose a folder (`opensave offers`).\n"+
+				"  Device ids come from `opensave peers`.")
+		return 1
+	}
+	allowed := args[1] == "on"
+	raw, err := daemonRequest("POST", "/api/peers/"+url.PathEscape(args[0])+"/choose-folders", map[string]any{"allowed": allowed})
+	if err != nil {
+		return fail(asJSON, err)
+	}
+	if asJSON {
+		return emitRawJSON(raw)
+	}
+	if allowed {
+		fmt.Println(okText(sym("✓", "ok")) + " that device now chooses the folders of games it syncs here")
+	} else {
+		fmt.Println(okText(sym("✓", "ok")) + " that device no longer chooses folders here")
+	}
+	return 0
+}
diff --git a/internal/cliapp/completion.go b/internal/cliapp/completion.go
index d7e4e186..2b10ce50 100644
--- a/internal/cliapp/completion.go
+++ b/internal/cliapp/completion.go
@@ -14,6 +14,7 @@ var topLevelCommands = commandNames()
 
 var subCommands = map[string][]string{
 	"pair":       {"requests", "approve", "reject"},
+	"peers":      {"games", "trust"},
 	"relay":      {"status", "join", "leave"},
 	"resolve":    {"keep-both", "keep-local", "keep-remote"},
 	"daemon":     {"start", "status", "stop"},
diff --git a/internal/cliapp/usage.go b/internal/cliapp/usage.go
index 9d4ccd4e..37464712 100644
--- a/internal/cliapp/usage.go
+++ b/internal/cliapp/usage.go
@@ -45,6 +45,7 @@ var commandGroups = []commandGroup{
 		{"transfers", "What is moving between devices, and what moved lately"},
 		{"peers", "Paired, discovered and pending devices"},
 		{"peers games <peerId>", "What that device is tracking"},
+		{"peers trust <peerId> on|off", "Let your own device choose folders here"},
 		{"pair <host[:port]>", "Ask a device on your LAN to pair"},
 		{"pair <node id>", "Ask a device in your relay room to pair"},
 		{"pair requests|approve|reject", "Handle incoming pairing requests"},
diff --git a/internal/daemon/daemon.go b/internal/daemon/daemon.go
index 8abd9a26..bdf03603 100644
--- a/internal/daemon/daemon.go
+++ b/internal/daemon/daemon.go
@@ -101,6 +101,11 @@ type Daemon struct {
 	incomplete            incompleteAutoSnapshots
 	// scanMu runs one save scan at a time. See ScanForSaves.
 	scanMu sync.Mutex
+	// A scan for a peer's offered game: one at a time, at most once a
+	// minute (scanForOffer).
+	offerScanMu      sync.Mutex
+	offerScanRunning bool
+	lastOfferScan    time.Time
 
 	// uploads counts cloud mirrors still running, so Stop can wait for them
 	// rather than letting process exit truncate one.
@@ -200,15 +205,19 @@ func New(opts Options) (*Daemon, error) {
 	d.P2P.OnAutoTracked = d.adoptAutoTracked
 	// A Switch save a peer syncs goes into this device's own emulator profile.
 	d.P2P.SwitchSaveFolder = d.Scanner.SwitchSaveFolder
-	// What a game arriving from a peer may be tracked at without asking:
-	// a folder this device's own scanner noted as a save, one inside an
-	// emulator's save folder here, or a Switch title's slot in a NAND here.
-	// Anything else is offered to the user.
-	d.P2P.KnownSaveLocation = func(path string) bool {
+	// What a game arriving from a peer may be tracked at without asking: a
+	// folder this device's own scanner noted as a save, one inside an
+	// emulator's save folder here, a Switch title's slot in a NAND here, or
+	// where the save catalogue or Steam says that game keeps its saves here,
+	// before it exists. Anything else is offered to the user.
+	d.P2P.OnGameOffered = d.scanForOffer
+	d.P2P.KnownSaveLocation = func(name, appID, path string) bool {
 		if known, err := d.Store.IsKnownSave(path); err == nil && known {
 			return true
 		}
-		return d.Scanner.InsideEmulatorSaveRoot(path) || presets.IsSwitchSaveSlot(path)
+		return d.Scanner.InsideEmulatorSaveRoot(path) || presets.IsSwitchSaveSlot(path) ||
+			d.Scanner.CatalogueSaveLocation(name, appID, path) ||
+			d.Scanner.SteamSaveLocation(appID, path)
 	}
 
 	// Every new snapshot mirrors to the configured cloud provider in the
diff --git a/internal/daemon/newgames.go b/internal/daemon/newgames.go
index 099426b1..8fe31bcc 100644
--- a/internal/daemon/newgames.go
+++ b/internal/daemon/newgames.go
@@ -231,3 +231,27 @@ func (d *Daemon) DismissNewGames() {
 		d.OnNewGames([]NewGame{})
 	}
 }
+
+// scanForOffer looks for a peer's offered game's folder now, rather than at
+// the next hourly scan: a game already played here then syncs within seconds,
+// the peer's next attempt finding its folder known. Not more than once a
+// minute, and never two at once — offers can arrive in a burst.
+func (d *Daemon) scanForOffer() {
+	d.offerScanMu.Lock()
+	if d.offerScanRunning || time.Since(d.lastOfferScan) < time.Minute {
+		d.offerScanMu.Unlock()
+		return
+	}
+	d.offerScanRunning = true
+	d.lastOfferScan = time.Now()
+	d.offerScanMu.Unlock()
+
+	go func() {
+		defer func() {
+			d.offerScanMu.Lock()
+			d.offerScanRunning = false
+			d.offerScanMu.Unlock()
+		}()
+		d.DetectNewGames()
+	}()
+}
diff --git a/internal/p2p/cve_2026_103398_test.go b/internal/p2p/cve_2026_103398_test.go
index bd2315b4..73502b17 100644
--- a/internal/p2p/cve_2026_103398_test.go
+++ b/internal/p2p/cve_2026_103398_test.go
@@ -1,17 +1,21 @@
 package p2p
 
 import (
+	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/go-chi/chi/v5"
 
+	"github.com/opensave/opensave/internal/e2ee"
 	"github.com/opensave/opensave/internal/store"
 )
 
@@ -109,12 +113,12 @@ func TestCVE_2026_103398_AKnownSaveFolderStillAutoTracks(t *testing.T) {
 		t.Fatal(err)
 	}
 	same := func(a, b string) bool { return strings.EqualFold(filepath.Clean(a), filepath.Clean(b)) }
-	c.engine.KnownSaveLocation = func(p string) bool { return same(p, save) }
+	c.engine.KnownSaveLocation = func(_, _, p string) bool { return same(p, save) }
 	peerPath := `C:\Users\alice\AppData\LocalLow\Team Cherry\Hollow Knight`
 
 	// The tracking step itself: serving the manifest needs a whole sync
 	// engine, which this fixture does not build.
-	g, err := c.engine.ensureManifestGame("hollow-knight", manifestGameQuery{Name: "Hollow Knight", SavePath: peerPath}, c.peer.ID)
+	g, err := c.engine.ensureManifestGame("hollow-knight", manifestGameQuery{Name: "Hollow Knight", SavePath: peerPath}, c.peer.ID, c.peer.ID)
 	if err != nil {
 		t.Fatalf("a known save folder was refused: %v", err)
 	}
@@ -157,3 +161,130 @@ func TestCVE_2026_103398_UnsignedRelayRequestFromAKeylessPairingIsRefused(t *tes
 }
 
 var _ = store.Peer{}
+
+// A device the user lets choose folders — their own — has its game tracked at
+// the folder it names, as before 2.4.1; any other device's is offered.
+func TestADeviceLetChooseFoldersHasItsFolderTracked(t *testing.T) {
+	c := newCVEFixture(t)
+	// The folder the other PC names, and where it lands here: under this
+	// device's home, translated as it always was.
+	q := manifestGameQuery{Name: "Homebrew Game", SavePath: `C:\Users\alice\My Custom Saves`}
+	custom := filepath.Join(c.home, "My Custom Saves")
+
+	if _, err := c.engine.ensureManifestGame("homebrew-game", q, c.peer.ID, c.peer.ID); err == nil {
+		t.Fatal("an unvouched folder was tracked for a device not let choose folders")
+	}
+	if err := c.store.SetPeerChoosesFolders(c.peer.ID, true); err != nil {
+		t.Fatal(err)
+	}
+	g, err := c.engine.ensureManifestGame("homebrew-game", q, c.peer.ID, c.peer.ID)
+	if err != nil {
+		t.Fatalf("the trusted device's folder was refused: %v", err)
+	}
+	if !strings.EqualFold(filepath.Clean(g.SavePath), filepath.Clean(custom)) {
+		t.Errorf("tracked at %s, want the folder it named %s", g.SavePath, custom)
+	}
+	// It was offered on the first attempt; tracked now, the offer is gone.
+	if offered, _ := c.store.ListOfferedGames(); len(offered) != 0 {
+		t.Errorf("the offer outlived the game being tracked: %+v", offered)
+	}
+}
+
+// Trust is the device's that proved itself, never whoever asks: another
+// paired device is not trusted because one is.
+func TestTrustIsPerDevice(t *testing.T) {
+	c := newCVEFixture(t)
+	if err := c.store.UpsertPeer(store.Peer{ID: "peer-other", Name: "Other", Address: "192.0.2.99"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := c.store.SetPeerChoosesFolders("peer-other", true); err != nil {
+		t.Fatal(err)
+	}
+	q := manifestGameQuery{Name: "Homebrew Game", SavePath: filepath.Join(t.TempDir(), "x")}
+	if _, err := c.engine.ensureManifestGame("homebrew-game", q, c.peer.ID, c.peer.ID); err == nil {
+		t.Fatal("one device's trust let another choose a folder")
+	}
+	if _, err := c.engine.ensureManifestGame("homebrew-game", q, "", ""); err == nil {
+		t.Fatal("a request from no device was trusted")
+	}
+}
+
+// An offer answers itself once this device can vouch for the folder: the game
+// is tracked on the peer's next attempt and the offer disappears.
+func TestAnOfferClearsOnceTheFolderIsKnown(t *testing.T) {
+	c := newCVEFixture(t)
+	folder := filepath.Join(t.TempDir(), "Hollow Knight")
+	known := false
+	c.engine.KnownSaveLocation = func(_, _, p string) bool { return known }
+	offers := 0
+	c.engine.OnGameOffered = func() { offers++ }
+	q := manifestGameQuery{Name: "Hollow Knight", SavePath: folder}
+
+	if _, err := c.engine.ensureManifestGame("hollow-knight", q, c.peer.ID, c.peer.ID); err == nil {
+		t.Fatal("tracked before the folder was known")
+	}
+	if offers != 1 {
+		t.Errorf("the offer asked for %d scans, want 1", offers)
+	}
+	known = true // the scan found it
+	if _, err := c.engine.ensureManifestGame("hollow-knight", q, c.peer.ID, c.peer.ID); err != nil {
+		t.Fatalf("not tracked once known: %v", err)
+	}
+	if offered, _ := c.store.ListOfferedGames(); len(offered) != 0 {
+		t.Errorf("the offer is still shown for a game now syncing: %+v", offered)
+	}
+}
+
+// Trust follows the device the signature proved, not the one the request is
+// attributed to: a request whose sender was only inferred, from an address,
+// may not choose a folder even when that address belongs to a trusted device.
+func TestTrustNeedsTheProvenDevice(t *testing.T) {
+	c := newCVEFixture(t)
+	if err := c.store.SetPeerChoosesFolders(c.peer.ID, true); err != nil {
+		t.Fatal(err)
+	}
+	q := manifestGameQuery{Name: "Homebrew Game", SavePath: `C:\Users\alice\Homebrew`}
+	if _, err := c.engine.ensureManifestGame("homebrew-game", q, c.peer.ID, ""); err == nil {
+		t.Fatal("a folder was trusted for a request no signature proved")
+	}
+}
+
+// A folder this device cannot vouch for is offered, and said so once: the
+// other device asks at every sync, and the log was one warning every few
+// seconds for as long as the offer stood.
+func TestAnOfferIsLoggedOnce(t *testing.T) {
+	c := newCVEFixture(t)
+	var warned int
+	c.engine.Log = func(level, msg string) {
+		if strings.Contains(msg, "offered on Home instead") {
+			warned++
+		}
+	}
+	// Three syncs from the other device, each a request of its own: signed
+	// afresh, as a device signs every request (askManifest reuses a nonce).
+	local, err := c.store.GetSettings()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for i := 0; i < 3; i++ {
+		q := url.Values{"name": {"Totally A Game"}, "savePath": {c.secret}}
+		req := httptest.NewRequest(http.MethodGet, "/api/p2p/manifest/offered-once?"+q.Encode(), nil)
+		nonce, at := fmt.Sprintf("offer-nonce-%d", i), time.Now().UnixMilli()
+		req.Header.Set(lanAuthPeerHeader, c.peer.ID)
+		req.Header.Set(lanAuthNonceHeader, nonce)
+		req.Header.Set(lanAuthTimeHeader, strconv.FormatInt(at, 10))
+		req.Header.Set(lanAuthHeader, e2ee.RequestMAC(c.authKey, c.peer.ID, local.NodeID, req.URL.RequestURI(), http.MethodGet, nil, nonce, at))
+		req.RemoteAddr = "192.0.2.10:40000"
+		rec := httptest.NewRecorder()
+		c.router.ServeHTTP(rec, req)
+		if rec.Code != http.StatusNotFound {
+			t.Fatalf("request %d: %d %s, want the 404 an offer answers", i, rec.Code, rec.Body.String())
+		}
+	}
+	if warned != 1 {
+		t.Errorf("the offer was logged %d times over three requests, want once", warned)
+	}
+	if offered, _ := c.store.ListOfferedGames(); len(offered) != 1 {
+		t.Errorf("offers: %+v, want the one", offered)
+	}
+}
diff --git a/internal/p2p/engine.go b/internal/p2p/engine.go
index b0029623..6806878f 100644
--- a/internal/p2p/engine.go
+++ b/internal/p2p/engine.go
@@ -76,11 +76,15 @@ type Engine struct {
 	// on this device (presets.Scanner.SwitchSaveFolder). Wired by the daemon.
 	// May be nil.
 	SwitchSaveFolder func(titleID, translated string) string
-	// KnownSaveLocation reports whether a folder is one this device's own
-	// scanner recognises as a save folder: the only kind a game arriving
-	// from a peer may be tracked at without the user's say-so (see
+	// KnownSaveLocation reports whether a folder is one this device can
+	// vouch for as the named game's save folder: the only kind a game
+	// arriving from a peer may be tracked at without the user's say-so (see
 	// ensureManifestGame). Wired by the daemon; nil knows of nothing.
-	KnownSaveLocation func(path string) bool
+	KnownSaveLocation func(name, appID, path string) bool
+	// OnGameOffered runs when a peer's game is offered rather than tracked,
+	// so the daemon can look for its folder now instead of at the next
+	// hourly scan. Wired by the daemon; may be nil.
+	OnGameOffered func()
 
 	// Failsafe: games whose last sync was interrupted (network error mid-
 	// transfer) are queued here and retried automatically, no prompt, until
diff --git a/internal/p2p/matching_test.go b/internal/p2p/matching_test.go
index 472185df..05e50f2d 100644
--- a/internal/p2p/matching_test.go
+++ b/internal/p2p/matching_test.go
@@ -37,7 +37,7 @@ func TestEnsureManifestGameMatching(t *testing.T) {
 	// Matching OFF (default): a peer game with the same App ID but a
 	// different id must NOT resolve to the local game. With no name/path to
 	// auto-track, it's simply reported not-found here.
-	if _, err := e.ensureManifestGame("nevergrave-cracked", manifestGameQuery{AppID: "2069710"}, "test-peer"); err == nil {
+	if _, err := e.ensureManifestGame("nevergrave-cracked", manifestGameQuery{AppID: "2069710"}, "test-peer", ""); err == nil {
 		t.Error("with App ID matching off, a shared App ID should not resolve to the local game")
 	}
 
@@ -52,7 +52,7 @@ func TestEnsureManifestGameMatching(t *testing.T) {
 	}
 
 	// Now the same shared App ID resolves to the canonical game.
-	g, err := e.ensureManifestGame("nevergrave-cracked", manifestGameQuery{AppID: "2069710"}, "test-peer")
+	g, err := e.ensureManifestGame("nevergrave-cracked", manifestGameQuery{AppID: "2069710"}, "test-peer", "")
 	if err != nil {
 		t.Fatalf("ensureManifestGame (App ID on) error = %v", err)
 	}
@@ -64,7 +64,7 @@ func TestEnsureManifestGameMatching(t *testing.T) {
 	if err := s.AddGameAlias("some-portable-id", "nevergrave"); err != nil {
 		t.Fatal(err)
 	}
-	g, err = e.ensureManifestGame("some-portable-id", manifestGameQuery{}, "test-peer")
+	g, err = e.ensureManifestGame("some-portable-id", manifestGameQuery{}, "test-peer", "")
 	if err != nil {
 		t.Fatalf("ensureManifestGame (alias) error = %v", err)
 	}
diff --git a/internal/p2p/routes.go b/internal/p2p/routes.go
index ba2142ff..9bca41bf 100644
--- a/internal/p2p/routes.go
+++ b/internal/p2p/routes.go
@@ -496,7 +496,9 @@ func (e *Engine) backfillCover(game store.Game, q manifestGameQuery) store.Game
 // peerID identifies the device asking. It is only needed when this device is
 // set to ask before tracking, to record who is waiting; empty is tolerated
 // (an unidentified caller simply produces an offer with no named device).
-func (e *Engine) ensureManifestGame(gameID string, q manifestGameQuery, peerID string) (store.Game, error) {
+// chooser is the device a signature proved made the request, or "": the only
+// one whose naming of a folder may be trusted (Devices, migration 0038).
+func (e *Engine) ensureManifestGame(gameID string, q manifestGameQuery, peerID, chooser string) (store.Game, error) {
 	if game, err := e.Store.GetGame(gameID); err == nil {
 		return e.backfillCover(game, q), nil
 	}
@@ -602,13 +604,24 @@ func (e *Engine) ensureManifestGame(gameID string, q manifestGameQuery, peerID s
 	// drives and system folders.
 	//
 	// So a game arriving from a peer is tracked by itself only where this
-	// device's own scanner recognises a save folder: one it found and noted,
-	// or one inside an emulator's own save folder here. Anywhere else, it is
-	// offered, and the user picks the folder on this device.
-	if e.KnownSaveLocation == nil || !e.KnownSaveLocation(localPath) {
-		e.Log("warn", fmt.Sprintf(
-			"a paired device asked to sync %q at %s, which this device does not know as a save folder — "+
-				"it is offered on Home instead, for you to place", q.Name, logging.Quote(localPath)))
+	// device can vouch for the folder as that game's save: one its scan
+	// noted, an emulator's save folder here, or where the save catalogue or
+	// Steam says the game keeps its saves on this device. Anywhere else it is
+	// offered, and the user picks the folder on this device — unless the
+	// user has let that device choose folders (Devices), as for their own.
+	known := e.KnownSaveLocation != nil && e.KnownSaveLocation(q.Name, q.AppID, localPath)
+	if !known && e.Store.PeerChoosesFolders(chooser) {
+		known = true
+		e.Log("info", fmt.Sprintf("tracking %q at %s, the folder a device you let choose folders named", q.Name, logging.Quote(localPath)))
+	}
+	if !known {
+		// Said once, when the offer is new: the other device asks again at
+		// every sync, every few seconds, for as long as the offer stands.
+		if !e.alreadyOffered(gameID, peerID) {
+			e.Log("warn", fmt.Sprintf(
+				"a paired device asked to sync %q at %s, which this device does not know as a save folder — "+
+					"it is offered on Home instead, for you to place", q.Name, logging.Quote(localPath)))
+		}
 		return e.offerGame(gameID, peerID, q)
 	}
 
@@ -640,6 +653,11 @@ func (e *Engine) ensureManifestGame(gameID string, q manifestGameQuery, peerID s
 		_ = os.MkdirAll(localPath, 0o777)
 	}
 	e.Log("info", fmt.Sprintf("auto-tracked %q at %s from peer manifest request", q.Name, logging.Quote(localPath)))
+	// Offered before, while its folder was not yet known here: it is tracked
+	// now, so the offer is answered.
+	if err := e.Store.ClearOfferedGame(game.ID); err != nil {
+		e.Log("warn", fmt.Sprintf("could not clear the offer for %q: %v", q.Name, err))
+	}
 	if e.OnAutoTracked != nil {
 		e.OnAutoTracked(game)
 	}
@@ -651,6 +669,21 @@ func (e *Engine) ensureManifestGame(gameID string, q manifestGameQuery, peerID s
 // this device, and tells the peer this device is waiting rather than that the
 // game does not exist: the same answer, which the peer cannot see past, is
 // given for a game deliberately untracked.
+// alreadyOffered reports whether this device already offers the game as one
+// that device syncs.
+func (e *Engine) alreadyOffered(gameID, peerID string) bool {
+	offers, err := e.Store.OfferedGame(gameID)
+	if err != nil {
+		return false
+	}
+	for _, o := range offers {
+		if o.PeerID == peerID {
+			return true
+		}
+	}
+	return false
+}
+
 func (e *Engine) offerGame(gameID, peerID string, q manifestGameQuery) (store.Game, error) {
 	if err := e.Store.RecordOfferedGame(store.OfferedGame{
 		GameID: gameID, PeerID: peerID, Name: q.Name,
@@ -659,6 +692,9 @@ func (e *Engine) offerGame(gameID, peerID string, q manifestGameQuery) (store.Ga
 		e.Log("warn", fmt.Sprintf("could not record %q as an offered game: %v", q.Name, err))
 	} else {
 		e.notifyGamesUpdate()
+		if e.OnGameOffered != nil {
+			e.OnGameOffered()
+		}
 	}
 	return store.Game{}, fmt.Errorf("%s: %q", syncengine.AwaitingFolderMessage, q.Name)
 }
@@ -669,12 +705,19 @@ func (e *Engine) offerGame(gameID, peerID string, q manifestGameQuery) (store.Ga
 func (e *Engine) handleManifest(w http.ResponseWriter, r *http.Request) {
 	gameID := chi.URLParam(r, "gameId")
 
-	var askingPeer string
-	if peer, ok := e.peerByAddress(clientIP(r)); ok {
-		askingPeer = peer.ID
+	// Which device asked: what was served to it is recorded, and an offer
+	// names it. The address stands in for a caller that does not sign, as it
+	// always has. Only the device the signature proved, though, may be trusted
+	// to choose a folder (ensureManifestGame's chooser).
+	provenPeer := lanPeerID(r)
+	askingPeer := provenPeer
+	if askingPeer == "" {
+		if peer, ok := e.peerByAddress(clientIP(r)); ok {
+			askingPeer = peer.ID
+		}
 	}
 	query := manifestQueryFromURL(r.URL.Query())
-	game, err := e.ensureManifestGame(gameID, query, askingPeer)
+	game, err := e.ensureManifestGame(gameID, query, askingPeer, provenPeer)
 	if err != nil {
 		jsonError(w, http.StatusNotFound, err.Error())
 		return
diff --git a/internal/p2p/wanclient_handlers.go b/internal/p2p/wanclient_handlers.go
index 9a899c0c..c5fdc5b6 100644
--- a/internal/p2p/wanclient_handlers.go
+++ b/internal/p2p/wanclient_handlers.go
@@ -609,7 +609,8 @@ func (w *WanClient) serveManifest(route string, body json.RawMessage, peerID str
 	// Same auto-track + cover-backfill behavior as the LAN route — relay
 	// peers were previously auto-tracked without cover art, which is why
 	// covers didn't propagate between WAN-paired devices.
-	game, err := w.engine.ensureManifestGame(gameID, query, peerID)
+	// Over the relay, the request's MAC proved the sender (routeRequest).
+	game, err := w.engine.ensureManifestGame(gameID, query, peerID, peerID)
 	if err != nil {
 		return 404, map[string]string{"error": err.Error()}
 	}
diff --git a/internal/presets/ludusavi.go b/internal/presets/ludusavi.go
index b6119845..eacfc1e3 100644
--- a/internal/presets/ludusavi.go
+++ b/internal/presets/ludusavi.go
@@ -692,6 +692,48 @@ func (sc *Scanner) loadManifestIndexNoWait() []indexedGame {
 // rebuildInFlight guards against overlapping background index builds.
 var rebuildInFlight atomic.Bool
 
+// loadManifestIndexWithin is loadManifestIndexNoWait that gives a rebuild —
+// under way, or started by it — up to wait to finish: long enough for a small
+// catalogue, while a caller someone is waiting on (a paired device asking
+// about a game gives up after thirty seconds) never waits out the full one,
+// which takes about that long.
+func (sc *Scanner) loadManifestIndexWithin(wait time.Duration) []indexedGame {
+	yamlPath, indexPath := sc.manifestPaths()
+	stale := indexStale(yamlPath, indexPath)
+	games := sc.loadManifestIndexNoWait()
+	if !stale {
+		return games
+	}
+	// The rebuild runs by now, or has already ended: a small catalogue can be
+	// built before this line is reached. So it is not asked whether one is
+	// running, only waited for while it is, and the index read after - as it
+	// is: built within the same clock tick as its manifest, it is not dated
+	// after it.
+	for deadline := time.Now().Add(wait); rebuildInFlight.Load() && time.Now().Before(deadline); {
+		time.Sleep(20 * time.Millisecond)
+	}
+	if rebuildInFlight.Load() {
+		return games
+	}
+	if yamlInfo, err := os.Stat(yamlPath); err == nil {
+		if built, _ := readManifestIndex(indexPath, yamlInfo); len(built) > 0 {
+			return built
+		}
+	}
+	return games
+}
+
+// indexStale reports whether there is a manifest whose index is missing or
+// older than it: one loadManifestIndexNoWait will rebuild.
+func indexStale(yamlPath, indexPath string) bool {
+	yamlInfo, err := os.Stat(yamlPath)
+	if err != nil {
+		return false
+	}
+	idxInfo, err := os.Stat(indexPath)
+	return err != nil || !idxInfo.ModTime().After(yamlInfo.ModTime())
+}
+
 // readManifestIndex reads the index on disk, and says whether it is newer
 // than the manifest it was built from. Nil when there is none or it does not
 // parse.
diff --git a/internal/presets/verify.go b/internal/presets/verify.go
new file mode 100644
index 00000000..45ba9426
--- /dev/null
+++ b/internal/presets/verify.go
@@ -0,0 +1,240 @@
+package presets
+
+import (
+	"io/fs"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"time"
+)
+
+// Whether a folder is a known game's save location on this device, without
+// the folder having to exist yet.
+//
+// A game arriving from a peer may be tracked by itself only at a folder this
+// device can vouch for as a save (CVE-2026-103398). The background scan vouches
+// for folders it has seen; these vouch for the ones it can foresee: where the
+// save catalogue says a game keeps its saves here, and Steam's own folder for a
+// Steam game. So a new device still fills itself in, saves arriving before the
+// game is first played there, while the peer still chooses no folder.
+
+// catalogueWait is how long a check waits for a newer catalogue to be indexed
+// before answering from the one it had. It is asked while a peer waits.
+const catalogueWait = 2 * time.Second
+
+// CatalogueSaveLocation reports whether path is a save location the catalogue
+// gives the game called name, or with Steam app ID appID, on this device:
+// exactly the folder a scan would offer for that game once it had saved there.
+func (sc *Scanner) CatalogueSaveLocation(name, appID, path string) bool {
+	if sc.CacheFile == "" || strings.TrimSpace(path) == "" {
+		return false
+	}
+	// A peer is waiting on this answer, and gives up after thirty seconds;
+	// rebuilding the index takes about that long. So a rebuild is waited on
+	// only briefly, and otherwise the index as it stands answers.
+	games := sc.loadManifestIndexWithin(catalogueWait)
+	if len(games) == 0 {
+		return false
+	}
+
+	var blocked map[string]bool
+	var protonIdx map[string][]string
+	if sc.goos() == "windows" {
+		wv := windowsPathVars()
+		if wv == nil {
+			return false
+		}
+		blocked = blockedRoots(wv)
+	} else {
+		blocked = linuxBlockedRoots(sc.linuxHome())
+		protonIdx = sc.protonPrefixIndex()
+	}
+	baseDirs := sc.installBaseCandidates()
+	target := foldCase(filepath.Clean(path))
+
+	for _, g := range games {
+		if !catalogueNames(g, name, appID) {
+			continue
+		}
+		installBases := baseDirs(g.Installs)
+		// Lower case on every system, as the blocked roots are keyed and as a
+		// scan compares them (expandGamePaths): folded only where the
+		// filesystem folds, ~/Documents slipped past on Linux and macOS.
+		tooBroad := func(dir string) bool {
+			d := strings.ToLower(filepath.Clean(dir))
+			if blocked[d] {
+				return true
+			}
+			for _, b := range installBases {
+				if d == strings.ToLower(filepath.Clean(b)) {
+					return true
+				}
+			}
+			return false
+		}
+		if tooBroad(target) {
+			continue
+		}
+		// Inside the game's own install folder the program sits beside its
+		// saves, so a folder there is vouched for only as the catalogue names
+		// it, never through a wildcard: "<base>/**/*.sav" stands for save
+		// files, and read as a folder it took in Binaries, Engine, any
+		// subfolder at all, for the peer to write into. And a folder holding
+		// programs is never a save, whatever the catalogue says.
+		if insideAny(installBases, path) {
+			if holdsPrograms(path) {
+				continue
+			}
+			for _, vars := range sc.ludusaviVarSets(g, protonIdx) {
+				for _, tpl := range g.Paths {
+					for _, pattern := range expandTemplate(tpl, vars, installBases, g.SteamID) {
+						if !hasWildcard(pattern) && locationMatches(pattern, target) {
+							return true
+						}
+						if looksLikeFile(pattern) && !hasWildcard(filepath.Dir(pattern)) &&
+							locationMatches(filepath.Dir(pattern), target) {
+							return true
+						}
+					}
+				}
+			}
+			continue
+		}
+		for _, vars := range sc.ludusaviVarSets(g, protonIdx) {
+			for _, tpl := range g.Paths {
+				for _, pattern := range expandTemplate(tpl, vars, installBases, g.SteamID) {
+					if locationMatches(pattern, target) {
+						return true
+					}
+					// A template naming the save file: its folder is the
+					// location, as a scan takes it (statOrGlob), unless that
+					// folder is too broad to track.
+					if looksLikeFile(pattern) && locationMatches(filepath.Dir(pattern), target) {
+						return true
+					}
+				}
+			}
+		}
+	}
+	return false
+}
+
+// SteamSaveLocation reports whether path is Steam's own save folder for the
+// game with appID on this device: userdata/<user>/<appID>, or inside it.
+func (sc *Scanner) SteamSaveLocation(appID, path string) bool {
+	if !isAppID(appID) || steamUserdataSystemIDs[appID] || strings.TrimSpace(path) == "" {
+		return false
+	}
+	roots := sc.SteamUserdataPaths
+	if roots == nil {
+		for _, root := range sc.steamRootDirs() {
+			roots = append(roots, filepath.Join(root, "userdata"))
+		}
+	}
+	for _, root := range roots {
+		if !dirExists(root) || !within(root, path) {
+			continue
+		}
+		rel, err := filepath.Rel(filepath.Clean(root), filepath.Clean(path))
+		if err != nil {
+			continue
+		}
+		parts := strings.Split(rel, string(filepath.Separator))
+		if len(parts) >= 2 && isAppID(parts[0]) && parts[1] == appID {
+			return true
+		}
+	}
+	return false
+}
+
+// catalogueNames reports whether a catalogue entry is the game a peer named:
+// by Steam app ID when it gave one, else by name. A scan names a game with
+// several save folders "Name (folder)", so that suffix is allowed for.
+func catalogueNames(g indexedGame, name, appID string) bool {
+	if appID != "" && g.SteamID != "" {
+		return g.SteamID == appID
+	}
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return false
+	}
+	if strings.EqualFold(g.Name, name) {
+		return true
+	}
+	if i := strings.LastIndex(name, " ("); i > 0 && strings.HasSuffix(name, ")") {
+		return strings.EqualFold(g.Name, name[:i])
+	}
+	return false
+}
+
+// locationMatches compares a catalogue location (which may hold wildcards)
+// with a folder, as this device's filesystem compares names.
+func locationMatches(pattern, target string) bool {
+	p := foldCase(filepath.Clean(pattern))
+	if strings.ContainsAny(p, "*?[") {
+		ok, err := filepath.Match(p, target)
+		return err == nil && ok
+	}
+	return p == target
+}
+
+// looksLikeFile reports whether a catalogue location names files rather than
+// a folder: a wildcard or an extension in its last element.
+func looksLikeFile(pattern string) bool {
+	base := filepath.Base(pattern)
+	return strings.ContainsAny(base, "*?[") || filepath.Ext(base) != ""
+}
+
+func foldCase(p string) string {
+	if runtime.GOOS == "windows" || runtime.GOOS == "darwin" {
+		return strings.ToLower(p)
+	}
+	return p
+}
+
+// hasWildcard reports whether a catalogue location holds a wildcard anywhere.
+func hasWildcard(pattern string) bool {
+	return strings.ContainsAny(pattern, "*?[")
+}
+
+// insideAny reports whether p is inside one of the install folders (not the
+// folder itself, which tooBroad already refuses).
+func insideAny(bases []string, p string) bool {
+	for _, b := range bases {
+		if within(b, p) {
+			return true
+		}
+	}
+	return false
+}
+
+// programExts are the files a save folder never needs, and the ones a peer
+// writing into a game's folder could make run.
+var programExts = map[string]bool{
+	".exe": true, ".dll": true, ".so": true, ".dylib": true, ".sys": true,
+	".com": true, ".bat": true, ".cmd": true, ".ps1": true, ".msi": true,
+	".scr": true, ".asi": true,
+}
+
+// holdsPrograms reports whether a folder, or one below it, holds a program or
+// library. Only the first few thousand entries are looked at: a save folder is
+// small, and one too large to look through is not taken on trust either.
+func holdsPrograms(dir string) bool {
+	const limit = 5000
+	seen, found := 0, false
+	_ = filepath.WalkDir(dir, func(p string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return nil
+		}
+		if seen++; seen > limit {
+			found = true
+			return fs.SkipAll
+		}
+		if !d.IsDir() && programExts[strings.ToLower(filepath.Ext(p))] {
+			found = true
+			return fs.SkipAll
+		}
+		return nil
+	})
+	return found
+}
diff --git a/internal/presets/verify_test.go b/internal/presets/verify_test.go
new file mode 100644
index 00000000..8b7bf723
--- /dev/null
+++ b/internal/presets/verify_test.go
@@ -0,0 +1,192 @@
+package presets
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+// What a device vouches for, for a game arriving from a peer: the folder the
+// catalogue gives that game here, even before it exists — and nothing else.
+
+const verifyManifest = `
+Hollow Game:
+  files:
+    <winAppData>/MoonStudio/HollowGame:
+      tags: [save]
+      when:
+        - os: windows
+  steam:
+    id: 4242
+File Game:
+  files:
+    <winAppData>/FileStudio/FileGame/*.sav:
+      tags: [save]
+      when:
+        - os: windows
+Loose Game:
+  files:
+    <winDocuments>/*.loose:
+      tags: [save]
+      when:
+        - os: windows
+`
+
+func verifyScanner(t *testing.T) (*Scanner, string) {
+	t.Helper()
+	home := t.TempDir()
+	t.Setenv("USERPROFILE", home)
+	t.Setenv("HOME", home)
+	appdata := filepath.Join(home, "AppData", "Roaming")
+	t.Setenv("APPDATA", appdata)
+	sc := manifestScanner(t, verifyManifest)
+	sc.SteamRoots = []string{}
+	sc.SteamUserdataPaths = []string{}
+	return sc, appdata
+}
+
+func TestCatalogueSaveLocation_TheGamesOwnFolderEvenBeforeItExists(t *testing.T) {
+	sc, appdata := verifyScanner(t)
+	folder := filepath.Join(appdata, "MoonStudio", "HollowGame") // not created
+
+	if !sc.CatalogueSaveLocation("Hollow Game", "", folder) {
+		t.Error("the game's catalogue folder was not vouched for by name")
+	}
+	if !sc.CatalogueSaveLocation("Some Other Name", "4242", folder) {
+		t.Error("the game's catalogue folder was not vouched for by Steam app ID")
+	}
+	if !sc.CatalogueSaveLocation("Hollow Game (HollowGame)", "", folder) {
+		t.Error("a scan's \"Name (folder)\" name was not recognised")
+	}
+	// A save file template: the folder the files are in.
+	if !sc.CatalogueSaveLocation("File Game", "", filepath.Join(appdata, "FileStudio", "FileGame")) {
+		t.Error("the folder of a save-file template was not vouched for")
+	}
+}
+
+func TestCatalogueSaveLocation_NothingElse(t *testing.T) {
+	sc, appdata := verifyScanner(t)
+	home := filepath.Dir(filepath.Dir(appdata))
+
+	refused := map[string]struct{ name, appID, path string }{
+		"another game's folder":       {"File Game", "", filepath.Join(appdata, "MoonStudio", "HollowGame")},
+		"the studio folder above it":  {"Hollow Game", "", filepath.Join(appdata, "MoonStudio")},
+		"a sibling of it":             {"Hollow Game", "", filepath.Join(appdata, "MoonStudio", "Other")},
+		"a game not in the catalogue": {"No Such Game", "", filepath.Join(appdata, "MoonStudio", "HollowGame")},
+		"the wrong app id":            {"Hollow Game", "9999", filepath.Join(appdata, "MoonStudio", "HollowGame")},
+		"a whole Documents folder":    {"Loose Game", "", filepath.Join(home, "Documents")},
+		"application data itself":     {"Hollow Game", "", appdata},
+		"no path":                     {"Hollow Game", "", ""},
+	}
+	for why, c := range refused {
+		if sc.CatalogueSaveLocation(c.name, c.appID, c.path) {
+			t.Errorf("%s: %q was vouched for as %q's save folder", why, c.path, c.name)
+		}
+	}
+}
+
+func TestSteamSaveLocation(t *testing.T) {
+	root := filepath.Join(t.TempDir(), "Steam", "userdata")
+	if err := os.MkdirAll(filepath.Join(root, "123456"), 0o777); err != nil {
+		t.Fatal(err)
+	}
+	sc := &Scanner{GOOS: "windows", SteamUserdataPaths: []string{root}}
+
+	if !sc.SteamSaveLocation("588650", filepath.Join(root, "123456", "588650", "remote")) {
+		t.Error("Steam's own save folder for the game was not vouched for")
+	}
+	for why, c := range map[string]struct{ appID, path string }{
+		"another game's":       {"588650", filepath.Join(root, "123456", "570", "remote")},
+		"Steam's own settings": {"7", filepath.Join(root, "123456", "7", "remote")},
+		"the user folder":      {"588650", filepath.Join(root, "123456")},
+		"outside Steam":        {"588650", filepath.Join(t.TempDir(), "123456", "588650")},
+		"not an app id":        {"abc", filepath.Join(root, "123456", "abc")},
+	} {
+		if sc.SteamSaveLocation(c.appID, c.path) {
+			t.Errorf("%s folder %q was vouched for", why, c.path)
+		}
+	}
+}
+
+// A game's install folder holds its program beside its saves. A wildcard that
+// stands for save files must not vouch for any folder there, and nor may a
+// catalogue entry for a folder that holds programs: a peer naming one would be
+// writing into the game's own files.
+func TestCatalogueSaveLocation_InsideTheInstallFolder(t *testing.T) {
+	steamRoot := t.TempDir()
+	install := filepath.Join(steamRoot, "steamapps", "common", "Cat Game")
+	mustMkFile(t, filepath.Join(install, "Binaries", "Win64", "CatGame.exe"))
+	mustMkFile(t, filepath.Join(install, "System", "Core.dll"))
+	mustMkFile(t, filepath.Join(install, "System", "User.ini"))
+	mustMkFile(t, filepath.Join(install, "Saves", "slot1.sav"))
+
+	sc := manifestScanner(t, `
+Cat Game:
+  files:
+    <base>/**/*.sav:
+      tags: [save]
+    <base>/<storeUserId>/Save.sav:
+      tags: [save]
+    <base>/Saves:
+      tags: [save]
+    <base>/Profiles/slot.dat:
+      tags: [save]
+    <base>/System/User.ini:
+      tags: [save]
+  installDir:
+    Cat Game: {}
+  steam:
+    id: 3087650
+`)
+	sc.SteamRoots = []string{steamRoot}
+
+	for why, folder := range map[string]string{
+		"a folder holding the game's program": filepath.Join(install, "Binaries"),
+		"any other folder a wildcard reaches": filepath.Join(install, "Engine"),
+		"a named folder holding a library":    filepath.Join(install, "System"),
+		"the install folder itself":           install,
+	} {
+		if sc.CatalogueSaveLocation("Cat Game", "3087650", folder) {
+			t.Errorf("%s was vouched for as a save: %s", why, folder)
+		}
+	}
+	for why, folder := range map[string]string{
+		"a save folder the catalogue names":  filepath.Join(install, "Saves"),
+		"the folder of a save file it names": filepath.Join(install, "Profiles"),
+	} {
+		if !sc.CatalogueSaveLocation("Cat Game", "3087650", folder) {
+			t.Errorf("%s was not vouched for: %s", why, folder)
+		}
+	}
+}
+
+// A paired device waits on this answer and gives up after thirty seconds, so
+// a catalogue rebuild under way — about that long for the full catalogue —
+// is waited on only briefly, and the index on disk answers.
+func TestCatalogueSaveLocation_WaitsOnlyBrieflyForARebuild(t *testing.T) {
+	sc, appdata := verifyScanner(t)
+	folder := filepath.Join(appdata, "MoonStudio", "HollowGame")
+	if !sc.CatalogueSaveLocation("Hollow Game", "", folder) {
+		t.Fatal("setup: not vouched for with the index built")
+	}
+	// A newer catalogue arrives, and its index is being built.
+	yamlPath, _ := sc.manifestPaths()
+	newer := time.Now().Add(2 * time.Second)
+	if err := os.Chtimes(yamlPath, newer, newer); err != nil {
+		t.Fatal(err)
+	}
+	rebuildInFlight.Store(true) // a rebuild that does not end
+	defer rebuildInFlight.Store(false)
+
+	start := time.Now()
+	ok := sc.CatalogueSaveLocation("Hollow Game", "", folder)
+	if took := time.Since(start); took > catalogueWait+3*time.Second {
+		t.Errorf("the check waited %v on a rebuild", took)
+	} else if took < catalogueWait/2 {
+		t.Errorf("the check did not wait for the rebuild at all (%v)", took)
+	}
+	if !ok {
+		t.Error("the index on disk did not answer while a rebuild ran")
+	}
+}
diff --git a/internal/store/migrations/0044_peer_folder_trust.sql b/internal/store/migrations/0044_peer_folder_trust.sql
new file mode 100644
index 00000000..7686aff3
--- /dev/null
+++ b/internal/store/migrations/0044_peer_folder_trust.sql
@@ -0,0 +1,14 @@
+-- Paired devices this one lets choose folders: a game such a device syncs is
+-- tracked at the folder it names, translated, even where this device cannot
+-- vouch for it as a save folder (internal/p2p ensureManifestGame). The user
+-- turns it on, device by device, for their own; with no row a device names
+-- nothing here but known save folders, and the rest are offered
+-- (CVE-2026-103398).
+--
+-- A table of its own rather than a column on peers, so an older version,
+-- which reads peers rows strictly, still opens the database. IF NOT EXISTS:
+-- dev builds made it as 0038_peer_folder_trust.
+CREATE TABLE IF NOT EXISTS peer_folder_trust (
+    peer_id  TEXT PRIMARY KEY,
+    since_ms INTEGER NOT NULL
+);
diff --git a/internal/store/offered_games.go b/internal/store/offered_games.go
index bf33ba5b..1f15c17d 100644
--- a/internal/store/offered_games.go
+++ b/internal/store/offered_games.go
@@ -69,7 +69,10 @@ func (s *Store) ListOfferedGames() ([]OfferedGame, error) {
 	var out []OfferedGame
 	if err := s.db.Select(&out, `
 		SELECT game_id, peer_id, name, app_id, cover_url, peer_path, first_seen
-		FROM offered_games ORDER BY first_seen, name`); err != nil {
+		FROM offered_games
+		-- Tracked by now, however it came to be: nothing left to ask.
+		WHERE game_id NOT IN (SELECT id FROM games)
+		ORDER BY first_seen, name`); err != nil {
 		return nil, fmt.Errorf("list offered games: %w", err)
 	}
 	return out, nil
diff --git a/internal/store/peer_folder_trust.go b/internal/store/peer_folder_trust.go
new file mode 100644
index 00000000..ae6c813d
--- /dev/null
+++ b/internal/store/peer_folder_trust.go
@@ -0,0 +1,38 @@
+package store
+
+import (
+	"fmt"
+	"time"
+)
+
+// SetPeerChoosesFolders lets a paired device choose the folders of games it
+// syncs to this one, or stops it. See migration 0038.
+func (s *Store) SetPeerChoosesFolders(peerID string, allowed bool) error {
+	if !allowed {
+		if _, err := s.db.Exec(`DELETE FROM peer_folder_trust WHERE peer_id = ?`, peerID); err != nil {
+			return fmt.Errorf("stop %s choosing folders: %w", peerID, err)
+		}
+		return nil
+	}
+	if _, err := s.GetPeer(peerID); err != nil {
+		return fmt.Errorf("let %s choose folders: %w", peerID, err)
+	}
+	if _, err := s.db.Exec(`INSERT OR IGNORE INTO peer_folder_trust (peer_id, since_ms) VALUES (?, ?)`,
+		peerID, time.Now().UnixMilli()); err != nil {
+		return fmt.Errorf("let %s choose folders: %w", peerID, err)
+	}
+	return nil
+}
+
+// PeerChoosesFolders reports whether a paired device may choose the folders of
+// games it syncs to this one. False on any doubt.
+func (s *Store) PeerChoosesFolders(peerID string) bool {
+	if peerID == "" {
+		return false
+	}
+	var n int
+	if err := s.db.Get(&n, `SELECT COUNT(*) FROM peer_folder_trust WHERE peer_id = ?`, peerID); err != nil {
+		return false
+	}
+	return n > 0
+}
diff --git a/internal/store/peer_folder_trust_test.go b/internal/store/peer_folder_trust_test.go
new file mode 100644
index 00000000..f29af522
--- /dev/null
+++ b/internal/store/peer_folder_trust_test.go
@@ -0,0 +1,61 @@
+package store
+
+import "testing"
+
+func TestPeerFolderTrust(t *testing.T) {
+	s := openTestStore(t)
+	if err := s.EnsureDefaultSettings(t.TempDir(), t.TempDir()); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.UpsertPeer(Peer{ID: "p1", Name: "Deck"}); err != nil {
+		t.Fatal(err)
+	}
+	if s.PeerChoosesFolders("p1") {
+		t.Fatal("a device chooses folders before being let")
+	}
+	if err := s.SetPeerChoosesFolders("p1", true); err != nil {
+		t.Fatal(err)
+	}
+	if !s.PeerChoosesFolders("p1") {
+		t.Fatal("not recorded")
+	}
+	if err := s.SetPeerChoosesFolders("nobody", true); err == nil {
+		t.Error("an unpaired device was let choose folders")
+	}
+	// Trust goes with the pairing.
+	if err := s.UnpairPeer("p1"); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.UpsertPeer(Peer{ID: "p1", Name: "Deck"}); err != nil {
+		t.Fatal(err)
+	}
+	if s.PeerChoosesFolders("p1") {
+		t.Error("paired again, the device kept its old trust")
+	}
+}
+
+// An offer for a game tracked since is not shown, however it came to be.
+func TestOfferedGamesLeaveOutTrackedOnes(t *testing.T) {
+	s := openTestStore(t)
+	if err := s.EnsureDefaultSettings(t.TempDir(), t.TempDir()); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.UpsertPeer(Peer{ID: "p1", Name: "Deck"}); err != nil {
+		t.Fatal(err)
+	}
+	for _, id := range []string{"tracked-game", "waiting-game"} {
+		if err := s.RecordOfferedGame(OfferedGame{GameID: id, PeerID: "p1", Name: id, PeerPath: "/x"}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := s.CreateGame(Game{ID: "tracked-game", Name: "Tracked", SavePath: t.TempDir(), ActiveBranch: "main"}); err != nil {
+		t.Fatal(err)
+	}
+	got, err := s.ListOfferedGames()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 1 || got[0].GameID != "waiting-game" {
+		t.Errorf("offered = %+v, want only waiting-game", got)
+	}
+}
diff --git a/internal/store/peers.go b/internal/store/peers.go
index 481e9c71..8d2c57f6 100644
--- a/internal/store/peers.go
+++ b/internal/store/peers.go
@@ -240,6 +240,10 @@ func (s *Store) UnpairPeer(id string) error {
 	if _, err := tx.Exec(`DELETE FROM offered_games WHERE peer_id = ?`, id); err != nil {
 		return fmt.Errorf("delete offered games for peer %s: %w", id, err)
 	}
+	// Trust goes with the pairing: paired again, a device starts over.
+	if _, err := tx.Exec(`DELETE FROM peer_folder_trust WHERE peer_id = ?`, id); err != nil {
+		return fmt.Errorf("delete folder trust for peer %s: %w", id, err)
+	}
 	res, err := tx.Exec(`DELETE FROM peers WHERE id = ?`, id)
 	if err != nil {
 		return fmt.Errorf("delete peer %s: %w", id, err)
diff --git a/packaging/man/opensave.1 b/packaging/man/opensave.1
index 903a6069..350d9b50 100644
--- a/packaging/man/opensave.1
+++ b/packaging/man/opensave.1
@@ -137,6 +137,11 @@ Reject an incoming pairing request.
 .BI "peers games " peerId
 What that device is tracking.
 .TP
+.BI "peers trust " "peerId on|off"
+Let one of your own devices choose the folders of games it syncs here, even
+ones this device does not recognise as saves; off, such games wait for you to
+choose a folder.
+.TP
 .BI "probe " "host[:port]"
 Check whether a device answers, before pairing with it.
 .TP