@@ -267,6 +267,17 @@ jobs:
 
           edg-prefix-env-loader .tmp/extensive-ci.edgivk
 
+      # Reviews (acknowledg-forge, edgy-review) read only the .rt.tar.gz
+      # files changes.elist names; edgy -A archives every test's. Pruning
+      # must never keep the results from being uploaded, hence
+      # continue-on-error.
+      - name: Prune .rt.tar.gz results changes.elist doesn't name
+        if: ${{ failure() }}
+        continue-on-error: true
+        env:
+          RUN_TIMESTAMP: ${{ inputs.run_timestamp }}
+        run: edg-prune-test-run "tests/runs/${RUN_TIMESTAMP}"
+
       - name: Upload partial elist, elog, and .rt.tar.gz results
         if: ${{ failure() }}
         uses: actions/upload-artifact@v7
 
@@ -0,0 +1,58 @@
+#!/usr/bin/env python3
+
+# Part of the EDG Compiler Project, under the Apache License v2.0 with LLVM
+# Exceptions.
+# See https://edgcpp.org/LICENSE.txt for license information.
+# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+
+'''Prune a test run down to what a review of it reads, e.g., before CI
+uploads the run:
+
+  edg-prune-test-run tests/runs/<run timestamp>
+
+Reviews of a run read only the .rt.tar files its changes.elist files name.
+The replays directory is removed whole.  In each configuration, a suite
+with no test named there is removed whole (its directory, and its
+suite-<name> logs), as is every suite of a configuration without a
+changes.elist; of the other suites, the .rt.tar files not named there are
+removed.
+'''
+
+import argparse
+import sys
+
+import edgtest
+import edgutil
+
+from pathlib import Path
+
+def _parse_args() -> argparse.Namespace:
+  parser = argparse.ArgumentParser(
+    description = (
+      "Remove the .rt.tar files of a test run that no configuration's "
+      'changes.elist names.'
+    )
+  )
+  parser.add_argument(
+    'run_dir',
+    type = Path,
+    help = 'the run directory (e.g., tests/runs/<run timestamp>)'
+  )
+  return parser.parse_args()
+
+def main() -> int:
+  args = _parse_args()
+  if not args.run_dir.is_dir():
+    edgutil.eprint(f"error: {args.run_dir} is not a directory")
+    return 1
+
+  # Counts: of .rt.tar files kept and removed, and of suites removed.
+  kept, removed, suites = edgtest.prune_run_archives(args.run_dir)
+  print(
+    f"Kept {kept} .rt.tar files named by changes.elist files; removed "
+    f"{removed} others, and {suites} suites with no changes."
+  )
+  return 0
+
+if __name__ == '__main__':
+  sys.exit(main())
@@ -32,8 +32,9 @@
 # suite's name, is short.
 DEFAULT_MAX_PATTERNS = 20_000
 # The largest diff (of tests/, in bytes) a pull request may have: it is
-# held in memory, and copied and split into lines more than once.
-DEFAULT_MAX_DIFF_BYTES = 64 * 1024 * 1024
+# kept with the review's rematerialized run (on disk, never in memory
+# whole), and the builder applies all of it.
+DEFAULT_MAX_DIFF_BYTES = 512 * 1024 * 1024
 # The most entries an artifact may have (its zip's, and its tarballs'
 # together), and the largest its zip's central directory may be: zipfile
 # reads all of that directory into memory, before we can count. CI's test
 
@@ -397,42 +397,54 @@ async def _changes_section(self,
     if reused is not None:
       return reused
 
-    diff = await self._workspaces.diff(
-      info.repository,
-      merge_base,
-      head_sha,
-      ['tests/']
-    )
-    if diff.strip() == '':
-      return None
-
-    worktree = await self._workspaces.checkout(
-      info,
-      record.review_id,
-      'base',
-      merge_base,
-      changes_patterns(
-        diff,
-        max_patterns = self._config.max_sparse_patterns
-      )
-    )
-    runs_dir = ensure_real_directory(worktree, PurePosixPath('tests', 'runs'))
-    run_dir = runs_dir / f"remat-{_sha256(source_key.encode())[:16]}"
-    remove_tree(run_dir)
-
     # The builder sees the worktree read-only, so it writes elsewhere (on
     # the same file system, for the rename into place).
+    run_name = f"remat-{_sha256(source_key.encode())[:16]}"
     staging_root = ensure_real_directory(
       self._workspaces.build_staging_dir.parent,
       PurePosixPath(self._workspaces.build_staging_dir.name)
     )
     staging = Path(tempfile.mkdtemp(
-      prefix = f"{record.review_id}-{run_dir.name}-",
+      prefix = f"{record.review_id}-{run_name}-",
       dir = staging_root
     ))
     try:
+      # Only ever in this file, never held in memory whole: it may be large.
       diff_file = staging / 'pull-request.diff'
-      diff_file.write_text(diff, encoding = 'utf-8')
+      await self._workspaces.diff(
+        info.repository,
+        merge_base,
+        head_sha,
+        ['tests/'],
+        diff_file
+      )
+      if diff_file.stat().st_size == 0:
+        remove_tree(staging)
+        return None
+      with open(diff_file, encoding = 'utf-8') as handle:
+        patterns = changes_patterns(
+          handle,
+          max_patterns = self._config.max_sparse_patterns
+        )
+
+      worktree = await self._workspaces.checkout(
+        info,
+        record.review_id,
+        'base',
+        merge_base,
+        patterns
+      )
+      # Prepare where the run goes once built: tests/runs/<run name> in the
+      # worktree (through real directories only, not links the pull request
+      # committed), cleared of any earlier attempt so that the staging
+      # directory can be renamed into place.
+      runs_dir = ensure_real_directory(
+        worktree,
+        PurePosixPath('tests', 'runs')
+      )
+      run_dir = runs_dir / run_name
+      remove_tree(run_dir)
+
       timestamp = self._clock().strftime(edgutil.RUN_TIMESTAMP_FORMAT)
       result = await self._sandbox.run(
         [
@@ -477,6 +489,7 @@ async def _changes_section(self,
         )
         remove_tree(staging)
         return None
+      fingerprint = await asyncio.to_thread(_file_sha256, diff_file)
       staging.rename(run_dir)
     except BaseException:
       remove_tree(staging)
@@ -487,7 +500,7 @@ async def _changes_section(self,
       name = CHANGES_NAME,
       slug = section_slug(CHANGES_NAME),
       source_key = source_key,
-      content_fingerprint = _sha256(diff.encode()),
+      content_fingerprint = fingerprint,
       root = run_dir / timestamp,
       home = worktree / 'tests',
       details = {'run_dir': str(run_dir)},
 
@@ -26,6 +26,7 @@
 
 import asyncio
 import base64
+import codecs
 import logging
 import os
 import re
@@ -39,7 +40,7 @@
 
 from dataclasses import dataclass
 from pathlib import Path, PurePosixPath
-from typing import Iterable, Optional, Sequence
+from typing import Callable, Iterable, Optional, Sequence
 
 import edgtest
 import edgutil
@@ -81,6 +82,10 @@ class UnsafeArchiveError(WorkspaceError):
   '''Raised for an artifact that is too large or has unsafe entries.'''
 
 
+class _OutputTooLarge(Exception):
+  '''Raised when a process's output is over its limit (it is stopped).'''
+
+
 @dataclass(frozen = True)
 class GitResult:
   returncode: int
@@ -140,16 +145,18 @@ def changed_paths(diff: str) -> list[str]:
   return paths
 
 
-def changes_patterns(diff: str,
+def changes_patterns(lines_iter: Iterable[str],
                      *,
                      max_patterns: int = DEFAULT_MAX_PATTERNS) -> list[str]:
-  '''Sparse-checkout patterns for rematerializing ``diff`` (of tests/) on
-  the base tree: the test home and every affected test; at most
+  '''Sparse-checkout patterns for rematerializing the diff (of tests/) of
+  ``lines_iter`` (with or without their line ends, e.g. a file's) on the
+  base tree: the test home and every affected test; at most
   ``max_patterns``.
   '''
   patterns = dict.fromkeys(_TEST_HOME_PATTERNS)
   current_suite: Optional[str] = None
-  for line in diff.splitlines():
+  for line in lines_iter:
+    line = line.rstrip('\n')
     match = _DIFF_HEADER.match(line)
     if match is not None:
       path = PurePosixPath(match.group(1))
@@ -478,9 +485,13 @@ async def git(self,
                 cwd: Optional[Path] = None,
                 stdin: Optional[str] = None,
                 check: bool = True,
-                max_output: Optional[int] = None) -> GitResult:
-    '''Run git; with ``max_output``, its output may be at most that many
-    bytes (it is stopped, and ``WorkspaceError`` raised, beyond).
+                max_output: Optional[int] = None,
+                stdout_sink: Optional[Callable[[bytes], None]] = None
+                ) -> GitResult:
+    '''Run git; with ``stdout_sink``, its output goes there as it comes,
+    rather than into the result, and may be at most ``max_output`` bytes
+    (it is stopped, and ``_OutputTooLarge`` raised, beyond: the caller
+    knows which limit that is).
     '''
     command = ['git']
     if git_dir is not None:
@@ -497,18 +508,15 @@ async def git(self,
       cwd = cwd,
       env = self._git_env()
     )
-    if max_output is None:
+    if stdout_sink is None:
+      assert max_output is None
       stdout, stderr = await process.communicate(
         stdin.encode() if stdin is not None else None
       )
     else:
-      assert stdin is None
-      bounded = await _communicate_bounded(process, max_output)
-      if bounded is None:
-        raise WorkspaceError(
-          f"git {args[0]}'s output is over {max_output} bytes"
-        )
-      stdout, stderr = bounded
+      assert stdin is None and max_output is not None
+      stderr = await _communicate_bounded(process, max_output, stdout_sink)
+      stdout = b''
     assert process.returncode is not None
     result = GitResult(
       process.returncode,
@@ -609,15 +617,42 @@ async def diff(self,
                  repository: str,
                  base: str,
                  head: str,
-                 paths: Sequence[str]) -> str:
+                 paths: Sequence[str],
+                 destination: Path) -> None:
+    '''Write the diff of ``paths`` from ``base`` to ``head`` to (the new
+    file) ``destination``, as it comes (it may be large): UTF-8, with what
+    isn't replaced (U+FFFD).
+    '''
+    decoder = codecs.getincrementaldecoder('utf-8')(errors = 'replace')
     async with self.lock(repository):
-      result = await self.git(
-        'diff', '--no-renames', '--no-color', '--no-ext-diff', '--no-textconv',
-        base, head, '--', *paths,
-        git_dir = self.clone_dir(repository),
-        max_output = self._max_diff_bytes
-      )
-      return result.stdout
+      with open(destination, 'xb') as handle:
+
+        # Decoded and encoded again so that what isn't UTF-8 is replaced:
+        # the builder's edg-rematerialize-test-run (and changes_patterns)
+        # read it as UTF-8 text, and the Changes section's fingerprint
+        # (the file's) stays what it was when the diff was decoded whole.
+        # Incrementally, so a character split between chunks survives.
+
+        def write(chunk: bytes) -> None:
+          handle.write(decoder.decode(chunk).encode())
+
+        try:
+          await self.git(
+            'diff', '--no-renames', '--no-color', '--no-ext-diff',
+            '--no-textconv', base, head, '--', *paths,
+            git_dir = self.clone_dir(repository),
+            max_output = self._max_diff_bytes,
+            stdout_sink = write
+          )
+        except _OutputTooLarge:
+          raise WorkspaceError(
+            f"the diff is over {self._max_diff_bytes} bytes "
+            f"({ENV_PREFIX}MAX_DIFF_BYTES)"
+          ) from None
+
+        # Finish decoding: bytes the decoder still holds (a character the
+        # output ended in the middle of) are written too, replaced.
+        handle.write(decoder.decode(b'', final = True).encode())
 
   async def checkout(self,
                      info: PullRequestInfo,
@@ -702,31 +737,31 @@ async def collect_garbage(self, repository: str, open_count: int) -> None:
 
 
 async def _communicate_bounded(process: asyncio.subprocess.Process,
-                               limit: int) -> Optional[tuple[bytes, bytes]]:
-  '''``process``'s output (stdout, stderr), once it exits; ``None``, having
-  stopped it, should its stdout be over ``limit`` bytes. Should this be
-  cancelled (or fail), it is stopped too, rather than left writing to a
-  pipe no one reads.
+                               limit: int,
+                               sink: Callable[[bytes], None]) -> bytes:
+  '''Pass ``process``'s stdout to ``sink`` as it comes, in chunks (none held
+  here); return its stderr once it exits. Should its stdout be over
+  ``limit`` bytes, it is stopped, and ``_OutputTooLarge`` raised. Should
+  this be cancelled (or fail), it is stopped too, rather than left writing
+  to a pipe no one reads.
   '''
   assert process.stdout is not None and process.stderr is not None
-  errors = asyncio.create_task(process.stderr.read())
-  chunks: list[bytes] = []
+  reading_stderr = asyncio.create_task(process.stderr.read())
   size = 0
   try:
     while chunk := await process.stdout.read(64 * 1024):
       size += len(chunk)
       if size > limit:
-        await edgutil.async_terminate_within(process, _TERMINATE_ALLOWANCE)
-        return None
-      chunks.append(chunk)
-    output = b''.join(chunks), await errors
+        raise _OutputTooLarge()
+      sink(chunk)
+    stderr = await reading_stderr
     await process.wait()
-    return output
+    return stderr
   except BaseException:
     await edgutil.async_terminate_within(process, _TERMINATE_ALLOWANCE)
     raise
   finally:
-    errors.cancel()
+    reading_stderr.cancel()
 
 
 def basic_auth_header(user: str, password: str) -> str: