sealkeep 0.11.3 → 0.11.4

package/CHANGELOG.md

@@ -3,6 +3,35 @@
 Notable changes, by published version. Sealkeep is pre-1.0: minor versions
 may change behavior, and say so here when they do.
 
+## 0.11.4 — 2026-09-23 — history stays findable
+
+- **An archive can no longer be dropped from search because one sidecar could
+  not be read.** The build treats an id missing from the archive ledger as
+  deleted and retires it, which in segments mode is permanent: the id vanishes
+  from every later lookup and no build indexes it again. But the ledger scan
+  skips any sidecar it cannot parse — a partial write being replaced, one
+  transient read error — and that scan is cached per directory, so the damage
+  only surfaces when something else changes the directory: a seal arriving
+  while a build runs, which is what a busy machine does all day. On one real
+  vault ten archives had been retired with nothing superseding them, and two
+  sessions were genuinely unfindable — words in one returned no hits from it
+  while matching hundreds of other sessions. Absence now counts as deletion
+  only when the scan read every sidecar.
+
+  A vault that already lost archives this way recovers with `sealkeep index
+  drop` followed by `sealkeep index build`, which clears every retirement and
+  indexes the archives again. Repairing it automatically was tried and dropped:
+  a retirement also travels between your machines, so a build that lifted one
+  could undo a removal another machine meant, and the suite caught that.
+
+- **The team check no longer runs on every seal.** 0.11.3 gave the lane its own
+  backing-off cadence, but a tick still asked it for a pass, and a tick is
+  scheduled whenever the queue has work — so cloud traffic still followed local
+  sealing. Measured on a busy machine: passes 4-6 seconds apart while a backlog
+  drained, against the 6-to-120-second schedule the lane had chosen. Nothing is
+  lost by waiting for that schedule; a pass this machine's own sealing triggers
+  cannot learn anything sooner than one the clock triggers.
+
 ## 0.11.3 — 2026-09-23 — the context tax, and a vault that catches up
 
 - **The team check stops asking the cloud every three seconds.** The daemon

package/dist/src/daemon.js

@@ -780,9 +780,19 @@ export async function startDaemon(dataDir, options) {
                     notes.push(`rescanned transcript roots (${found} seen)`);
             }
             // Human access decisions live in SealKeep Cloud; private-key work stays on
-            // this machine. Polling here closes both loops automatically: owners wrap
-            // new invitations and accepted teammates/fresh machines bind the project.
-            requestAccessReconciliation();
+            // this machine, and the access lane above closes both loops on its own
+            // cadence: owners wrap new invitations and accepted teammates/fresh
+            // machines bind the project.
+            //
+            // A tick deliberately does NOT ask for a pass. A tick is scheduled
+            // whenever the queue has claimable work, so asking here tied cloud
+            // traffic to local sealing: on a machine sealing a session every couple
+            // of minutes the lane ran that often no matter how quiet the team was.
+            // Measured on a busy host, passes came 4-6 seconds apart while a backlog
+            // drained, against the 6-to-120-second schedule the lane had chosen.
+            // Nothing is lost by waiting for that schedule — a pass triggered by this
+            // machine's own sealing cannot learn anything sooner than one triggered
+            // by the clock.
             // This used to read `options.diskPressureFreeBytes` with no default, and
             // nothing anywhere set it — so the guard was dead code and the installed
             // service ran with no floor at all, on machines chosen for being short of

package/dist/src/search.js

@@ -8,7 +8,7 @@ import { createGunzip, gunzipSync } from "node:zlib";
 import { decryptArchive as openEnvelope, decryptArchiveBodyChunks, encryptArchive as sealEnvelope, openArchiveToFile, sealArchiveToFile, unsqueezeStream, unsqueezeSync, validateEnvelope, rawPublicKey, x25519PrivateKeyFromRaw, x25519PublicKeyFromRaw } from "../packages/sealkeep-crypto/src/index.js";
 import { fail, isSealkeepError } from "./errors.js";
 import { canonicalPhrase } from "./mnemonic.js";
-import { configuredRecipients, decryptRecord, deltaOf, listArchives, readConfig, resolveDeltaChain, restoreRecordToFile, teamSpaceOf } from "./vault.js";
+import { configuredRecipients, decryptRecord, deltaOf, listArchives, listArchivesWithIntegrity, readConfig, resolveDeltaChain, restoreRecordToFile, teamSpaceOf } from "./vault.js";
 import { chunkWindowForRange, openChunkWindow, supportsChunkAccess } from "../packages/sealkeep-crypto/src/chunk-access.js";
 import { isV2, teamCustodyRecordIsValid } from "./types.js";
 import { archiveWrapsEveryMember } from "./upload.js";
@@ -849,7 +849,9 @@ export async function buildContentIndex(dataDir, rawPhrase, options = {}) {
     await readConfig(dataDir);
     await cleanupStaleContentIndexTemps(dataDir);
     await adoptLegacyIndexFile(dataDir);
-    const records = await listArchives(dataDir);
+    // Absence is only evidence of deletion when every sidecar could be read.
+    const { records, unreadable } = await listArchivesWithIntegrity(dataDir);
+    const absenceMeansGone = unreadable.length === 0;
     // Segments mode is decided once, up front: a vault either has a manifest
     // with at least one segment (sealkeep index migrate created it) or it
     // stays on the legacy blob path below, unchanged.
@@ -970,12 +972,19 @@ export async function buildContentIndex(dataDir, rawPhrase, options = {}) {
         // file's index entry, the newer snapshot named by its `supersedes` field
         // is — and every superseded id is named here even one this machine never
         // got around to covering, so the manifest need not remember it later.
-        const stale = [...new Set([...mine, ...superseded])].filter((id) => superseded.has(id) || !liveIds.has(id));
+        // Retiring an id from a segment is permanent: it disappears from every
+        // later lookup and compaction, and no build ever indexes it again. So it
+        // may only follow proof. A superseded snapshot is proof. Absence is not,
+        // unless the scan read every sidecar — see listArchivesWithIntegrity.
+        const stale = [...new Set([...mine, ...superseded])]
+            .filter((id) => superseded.has(id) || (absenceMeansGone && !liveIds.has(id)));
         if (stale.length)
             await retireArchiveIds(dataDir, stale);
     }
     else {
         for (const id of Object.keys(index.archives)) {
+            if (!absenceMeansGone)
+                break; // a short scan is not a deletion
             if (liveIds.has(id))
                 continue;
             if (!mine.has(id))

package/dist/src/vault.d.ts

@@ -181,6 +181,20 @@ export declare function teamRecipientsForProject(dataDir: string, project: strin
  * problem into a missing one. The archives that do parse still answer.
  */
 export declare function listArchives(dataDir: string): Promise<ArchiveRecord[]>;
+/**
+ * The same list, plus whether the scan could read every sidecar.
+ *
+ * A caller that concludes "this archive no longer exists" from absence needs
+ * this: one sidecar that could not be read — a partial write being replaced, a
+ * transient EIO — silently shortens the list. The index build drew exactly that
+ * conclusion and retired the archive from search permanently. Two of a real
+ * vault's sessions became unfindable that way; words in one returned no hits
+ * from it while matching hundreds of other sessions.
+ */
+export declare function listArchivesWithIntegrity(dataDir: string): Promise<{
+    records: ArchiveRecord[];
+    unreadable: string[];
+}>;
 /**
  * Registers an X25519 public key that may open future archives. Only the public
  * key is stored; the matching private key stays on its own device.

package/dist/src/vault.js

@@ -1373,6 +1373,22 @@ export async function listArchives(dataDir) {
     // dashboard requests shared the underlying filesystem scan.
     return scan.records.slice();
 }
+/**
+ * The same list, plus whether the scan could read every sidecar.
+ *
+ * A caller that concludes "this archive no longer exists" from absence needs
+ * this: one sidecar that could not be read — a partial write being replaced, a
+ * transient EIO — silently shortens the list. The index build drew exactly that
+ * conclusion and retired the archive from search permanently. Two of a real
+ * vault's sessions became unfindable that way; words in one returned no hits
+ * from it while matching hundreds of other sessions.
+ */
+export async function listArchivesWithIntegrity(dataDir) {
+    const config = await readConfig(dataDir);
+    const scan = await currentArchiveLedgerScan(config.storage.root);
+    reportUnreadableArchiveRecords(config.storage.root, scan.unreadable);
+    return { records: scan.records.slice(), unreadable: scan.unreadable.slice() };
+}
 // The dashboard loads several archive-derived endpoints together. A per-call
 // batch bound alone still multiplied 32 opens by every endpoint. Share both an
 // in-flight scan and a completed, generation-validated scan. Archive record

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sealkeep",
-  "version": "0.11.3",
+  "version": "0.11.4",
   "type": "module",
   "description": "Sealkeep by SPALA AI — your AI coding-agent history, sealed, searchable, and shared across your machines.",
   "repository": {