sealkeep 0.7.2 → 0.8.0

package/CHANGELOG.md

@@ -3,6 +3,27 @@
 Notable changes, by published version. Sealkeep is pre-1.0: minor versions
 may change behavior, and say so here when they do.
 
+## 0.8.0 — 2026-08-20
+
+Fixes from a review of the screens that had never had one, and a test suite
+that no longer needs a spacious disk.
+
+- **The setup wizard could finish "use my own bucket" without a vendor.** An
+  unrecognised provider fell back to *local*, so the guard could not fire: a
+  credentials form with no fields validated, setup completed, and the vault
+  stayed local-only. The one task the wizard exists for, silently not done.
+- Every "24 words" on those screens — including the checkbox you tick to
+  finish — is derived from the phrase now. That copy once said seventeen.
+- Doctor's warnings were drawn like passes, four checks rendered as raw slugs,
+  a failed queue job used a stylesheet class that did not exist, five notes
+  used an undefined token, and the retention view typed over edits in progress
+  and could then save the policy you thought you had changed.
+- `archiveFile` accepts a chunk size (and honours `SEALKEEP_CHUNK_BYTES`).
+  Proving a multi-chunk archive used to mean writing 24 MB; it now takes 120 KB,
+  which is why the suite stopped exhausting disks.
+- New: `npm run browser:audit` and `npm run browser:panel` — real Chrome,
+  accessibility and layout at two widths, eight signed-in panel scenarios.
+
 ## 0.7.2 — 2026-08-20
 
 - Sharing is findable: the vault view offers **Share…** beside Restore. The

package/dist/site/index.html

@@ -105,7 +105,9 @@
   .primary:disabled{opacity:.45;cursor:default}
   .ghost{background:none;border:1px solid var(--rule);color:var(--ink);padding:.62rem 1.1rem;font-size:.88rem}
   .ghost:hover{border-color:var(--ink)}
-  .fine{font-family:var(--mono);font-size:.76rem;color:var(--soft);margin-top:.9rem}
+  /* A caption is prose even when it names versions and carries a command; the
+     command inside it is already a <code> and keeps the machine voice. */
+  .fine{font-family:var(--sans);font-size:.78rem;color:var(--soft);margin-top:.9rem}
 
   /* The machine side of the hero: one session, read out and then sealed. */
   .side{font-family:var(--mono);font-size:.7rem;color:var(--soft);margin:0 0 .7rem;letter-spacing:.02em}

package/dist/src/chunk-store.js

@@ -10,6 +10,7 @@ import { acquireSpoolLock, createSpool, findSpoolForSource, shredSpool, unwrapSp
 import { DEFAULT_CHUNK_BYTES, KEY_BYTES, StreamingSha256, sealChunksToSink, wrapAll, zeroize } from "../packages/vaultline-crypto/src/index.js";
 import { frameObject } from "./cloud.js";
 import { aeadCipher, aeadDecipher } from "../packages/vaultline-crypto/src/aead.js";
+import { envVar } from "./env.js";
 const SEAL_SUITE = "chacha20-poly1305";
 const sha256hex = (input) => createHash("sha256").update(input).digest("hex");
 export const chunkObjectName = (index) => `chunk-${String(index).padStart(6, "0")}`;
@@ -132,7 +133,10 @@ export async function sealToChunkFolder(dataDir, sourcePath, rawPhrase, agent, o
         fail("source_unreadable", `Transcript is not readable: ${absolute}`, { sourcePath: absolute });
     const phrase = canonicalPhrase(rawPhrase);
     const totalBytes = source.size;
-    const chunkBytes = DEFAULT_CHUNK_BYTES;
+    // Same override the local seal path honours, for the same reason: proving the
+    // streamed layout works should not cost tens of megabytes of disk per run.
+    const chunkOverride = Number(envVar("CHUNK_BYTES"));
+    const chunkBytes = Number.isInteger(chunkOverride) && chunkOverride > 0 ? chunkOverride : DEFAULT_CHUNK_BYTES;
     const totalChunks = Math.max(1, Math.ceil(totalBytes / chunkBytes));
     // Journal triage, chunk-layout edition. Same drain-the-stack shape as the
     // streaming path: resume the newest matching journal or abandon it with the
@@ -159,7 +163,7 @@ export async function sealToChunkFolder(dataDir, sourcePath, rawPhrase, agent, o
         }
         const lock = await acquireSpoolLock(dataDir, journal.archiveId, { now: options.now });
         try {
-            return await resumeChunkFolder({ dataDir, client, remoteStorage, targetId: routedTarget?.id, absolute, totalBytes, chunkBytes, totalChunks, phrase, agent, now: options.now }, journal);
+            return await resumeChunkFolder({ dataDir, client, remoteStorage, targetId: routedTarget?.id, absolute, totalBytes, chunkBytes, totalChunks, phrase, agent, project: options.project ?? null, now: options.now }, journal);
         }
         catch (error) {
             if (!(error instanceof Error) || !/cannot resume/i.test(error.message))
@@ -190,7 +194,8 @@ export async function sealToChunkFolder(dataDir, sourcePath, rawPhrase, agent, o
         configuredPrefix: remoteStorage.prefix, project: options.project ?? null, createdAt, sourcePath: absolute, archiveId,
         naming, ...(naming === "hashed" ? { namingKey: folderNamingKey(phrase, storageScopeOf(remoteStorage)) } : {})
     });
-    const recipients = configuredRecipients(config, phrase);
+    // Members of this project are wrapped in here, and nowhere else.
+    const recipients = configuredRecipients(config, phrase, { project: options.project ?? undefined });
     const archiveKey = randomBytes(KEY_BYTES);
     const noncePrefix = randomBytes(4);
     const lock = await acquireSpoolLock(dataDir, archiveId, { now: options.now });
@@ -206,7 +211,7 @@ export async function sealToChunkFolder(dataDir, sourcePath, rawPhrase, agent, o
             hashState: { plaintext: "", stored: "" },
             providerState: { kind: "chunk-folder", folder, uploaded: 0 }
         }, { now: options.now });
-        return await runChunkSeal({ dataDir, client, remoteStorage, targetId: routedTarget?.id, absolute, totalBytes, chunkBytes, totalChunks, phrase, agent, now: options.now }, { archiveId, createdAt, folder, archiveKey, noncePrefix, project: options.project ?? null, startAt: 0, verifiedHeaders: [], reusedChunks: 0 });
+        return await runChunkSeal({ dataDir, client, remoteStorage, targetId: routedTarget?.id, absolute, totalBytes, chunkBytes, totalChunks, phrase, agent, project: options.project ?? null, now: options.now }, { archiveId, createdAt, folder, archiveKey, noncePrefix, project: options.project ?? null, startAt: 0, verifiedHeaders: [], reusedChunks: 0 });
     }
     finally {
         zeroize(archiveKey);
@@ -234,7 +239,7 @@ async function abandonFolderJournal(dataDir, client, journal, reason) {
  */
 async function runChunkSeal(ctx, args) {
     const config = await readConfig(ctx.dataDir);
-    const recipients = configuredRecipients(config, ctx.phrase);
+    const recipients = configuredRecipients(config, ctx.phrase, { project: ctx.project ?? undefined });
     const { tokenize, indexableToken, tokenCapFor } = await import("./search.js");
     const perChunkTokenCap = Math.max(4000, Math.floor(tokenCapFor(ctx.totalBytes) / 4));
     const hashers = { plaintext: new StreamingSha256(), stored: new StreamingSha256() };

package/dist/src/types.d.ts

@@ -171,7 +171,10 @@ export type VaultConfig = {
         label: string;
         publicKey: string;
         addedAt: string;
+        /** A rewrap filter — `sealkeep rewrap --group` applies one group's set to existing archives. */
         group?: string;
+        /** Sharing scope: set, this key is a member of one project and is wrapped into that project's archives only. */
+        project?: string;
     }[];
     /** `deleteAfterDays` is optional so vaults written before archive lifecycle existed still load; absent means never. */
     retention?: {

package/dist/src/vault.d.ts

@@ -103,12 +103,16 @@ export type ArchiveResult = ArchiveRecord & {
 export declare function archiveFile(dataDir: string, sourcePath: string, rawPhrase: string, agent?: string, hooks?: {
     onProgress?: (bytesRead: number) => void;
     delta?: boolean;
+    chunkBytes?: number;
 }): Promise<ArchiveResult>;
 /**
  * The recovery phrase always gets a recipient, so a recovery kit alone can restore.
  * Registered device and backup keys are added alongside it.
  */
-export declare function configuredRecipients(config: VaultConfig, rawPhrase: string, group?: string): Recipient[];
+export declare function configuredRecipients(config: VaultConfig, rawPhrase: string, scope?: string | {
+    group?: string;
+    project?: string;
+}): Recipient[];
 export declare function listArchives(dataDir: string): Promise<ArchiveRecord[]>;
 /**
  * Registers an X25519 public key that may open future archives. Only the public

package/dist/src/vault.js

@@ -240,6 +240,13 @@ export async function archiveFile(dataDir, sourcePath, rawPhrase, agent = "custo
     const config = await readConfig(dataDir);
     if (!equalHex(config.recovery.phraseCheck, phraseCheck(phrase)))
         fail("recovery_phrase_mismatch", "Recovery phrase does not match this vault");
+    // The crypto has always taken a chunk size and nothing above it could set
+    // one, so exercising a multi-chunk archive meant writing tens of megabytes.
+    // A caller — or SEALKEEP_CHUNK_BYTES — can span chunks with kilobytes now.
+    const chunkBytes = hooks.chunkBytes ?? (() => {
+        const override = Number(envVar("CHUNK_BYTES"));
+        return Number.isInteger(override) && override > 0 ? override : undefined;
+    })();
     const absolute = resolve(sourcePath);
     const source = await stat(absolute).catch(() => null);
     if (!source?.isFile())
@@ -316,6 +323,7 @@ export async function archiveFile(dataDir, sourcePath, rawPhrase, agent = "custo
         // whole-body layout stay readable forever; this changes what is WRITTEN.
         recipients: configuredRecipients(config, phrase), archiveId: id, compression: "gzip-chunk",
         adapter: { agent, version: ADAPTER_VERSION }, scratchDir: config.storage.root,
+        ...(chunkBytes ? { chunkBytes } : {}),
         ...(hooks.onProgress ? { onProgress: hooks.onProgress } : {})
     }).catch((error) => {
         const code = error.code;
@@ -407,10 +415,22 @@ async function sealDeltaArchive(dataDir, config, absolute, agent, phrase, size,
  * The recovery phrase always gets a recipient, so a recovery kit alone can restore.
  * Registered device and backup keys are added alongside it.
  */
-export function configuredRecipients(config, rawPhrase, group) {
+export function configuredRecipients(config, rawPhrase, scope) {
     const phrase = canonicalPhrase(rawPhrase);
+    // Two different questions, and conflating them broke one of them.
+    //
+    // `group` is a REWRAP FILTER: "apply the current recipient set for the
+    // engineering group to existing archives", which is how a contractor's
+    // access ends. Everyone gets new archives regardless of group — that is the
+    // shipped, tested behaviour and it stays.
+    //
+    // `project` is SHARING SCOPE: a member added to one project must be wrapped
+    // into that project's archives and no others, or sharing a project would
+    // hand over the whole vault.
+    const asked = typeof scope === "string" ? { group: scope } : (scope ?? {});
     const keys = (config.recipients ?? [])
-        .filter((recipient) => !group || recipient.group === group)
+        .filter((recipient) => (asked.group ? recipient.group === asked.group : true))
+        .filter((recipient) => !recipient.project || recipient.project === asked.project)
         .map((recipient) => ({ kind: "x25519", publicKey: x25519PublicKeyFromRaw(Buffer.from(recipient.publicKey, "base64")) }));
     return [{ kind: "phrase", phrase }, ...keys];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sealkeep",
-  "version": "0.7.2",
+  "version": "0.8.0",
   "type": "module",
   "description": "Sealkeep by SPALA AI \u2014 your AI coding-agent history, sealed, searchable, and shared across your machines.",
   "license": "SEE LICENSE IN LICENSE",
@@ -32,7 +32,7 @@
     "typecheck": "tsc -p tsconfig.check.json",
     "prepack": "npm run build",
     "release:manifest": "node scripts/release.mjs",
-    "test": "node --import tsx --test \"test/**/*.test.ts\" \"packages/*/test/*.test.ts\"",
+    "test": "node --import tsx --test --test-concurrency=4 \"test/**/*.test.ts\" \"packages/*/test/*.test.ts\"",
     "vaultline": "tsx src/cli.ts",
     "mcp": "tsx src/mcp.ts",
     "api": "tsx src/cli.ts api",
@@ -42,7 +42,9 @@
     "bundle:site": "node tools/build-site.mjs && cd dist/site && zip -q -X ../site.zip index.html && cd - >/dev/null && echo \"dist/site.zip ready ($(wc -c < dist/site.zip) bytes)\"",
     "acceptance": "node scripts/acceptance.mjs",
     "acceptance:managed": "node scripts/acceptance.mjs --managed",
-    "tokens": "node scripts/sync-tokens.mjs"
+    "tokens": "node scripts/sync-tokens.mjs",
+    "browser:audit": "node scripts/browser/audit.mjs",
+    "browser:panel": "node scripts/browser/panel.mjs"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",

package/web/app.js

@@ -140,7 +140,15 @@ const CHECK_LABELS = {
   "remote-storage": "Storage",
   "sealed-key-copy": "Sealed key backup",
   signer: "Uploads",
-  agents: "Agents"
+  agents: "Agents",
+  // Doctor emits these four too, and without a label each rendered as its raw
+  // slug — the exact "debug output in front of a customer" this map exists to
+  // prevent: one names the standing warning that archives are stored
+  // unencrypted, another says a routing rule matches nothing.
+  "storage-mode": "How archives are stored",
+  "resumable-history": "Resume protection",
+  "search-index": "Search index",
+  "routing-pins": "Routing rules"
 };
 
 /** Same names the retention page uses, so the two never disagree. */
@@ -368,7 +376,7 @@ function renderQueue(queue, retention) {
       state.innerHTML = `<span class="queued">sealing…${pct !== null ? ` ${pct}%` : ""}</span>`;
       if (pct !== null) state.title = `${bytes(job.progress.bytes)} of ${bytes(job.progress.of)} read`;
     } else if (job.status === "failed") {
-      state.innerHTML = '<span class="bad">failed</span>';
+      state.replaceChildren(Object.assign(document.createElement("span"), { className: "bad", textContent: "failed" }));
       if (job.lastError) state.title = job.lastError.message ?? String(job.lastError);
     } else if (job.lastError) {
       const span = document.createElement("span");

package/web/index.html

@@ -378,13 +378,13 @@
         </div>
         <div class="rowgrid" style="margin-top:.75rem">
           <div><label class="f" for="deleteAfter">Delete the archive from storage after (days)</label><input type="number" id="deleteAfter" min="0" placeholder="never"></div>
-          <div><label class="f">&nbsp;</label><span style="font-size:.85rem;color:var(--dim)">Leave empty for never.</span></div>
+          <div><label class="f">&nbsp;</label><span style="font-size:.85rem;color:var(--soft)">Leave empty for never.</span></div>
         </div>
       </fieldset>
 
       <fieldset>
         <legend>Which sessions</legend>
-        <p style="margin:0 0 .9rem;font-size:.9rem;color:var(--dim)">
+        <p style="margin:0 0 .9rem;font-size:.9rem;color:var(--soft)">
           The timings above measure the <em>archive</em> — how long Sealkeep has held a copy. These two measure the
           <em>session</em>: when you last touched it, and whether it is big enough to be worth the trouble.
         </p>
@@ -392,12 +392,12 @@
           <div>
             <label class="f" for="idle">Only if untouched for at least (days)</label>
             <input type="number" id="idle" min="0" placeholder="any">
-            <span style="font-size:.85rem;color:var(--dim)">Empty means a session's own age is not considered.</span>
+            <span style="font-size:.85rem;color:var(--soft)">Empty means a session's own age is not considered.</span>
           </div>
           <div>
             <label class="f" for="minSize">Only if larger than (MB)</label>
             <input type="number" id="minSize" min="0" placeholder="any">
-            <span style="font-size:.85rem;color:var(--dim)">Most sessions are tiny; the space is in a few huge ones.</span>
+            <span style="font-size:.85rem;color:var(--soft)">Most sessions are tiny; the space is in a few huge ones.</span>
           </div>
         </div>
       </fieldset>
@@ -407,7 +407,7 @@
         <p id="effect" style="margin:0 0 .9rem">Reading the current rules…</p>
         <div style="display:flex;gap:.6rem;align-items:center;flex-wrap:wrap">
           <button type="button" class="action primary" id="save">Save these rules</button>
-          <span id="saved" style="font-size:.85rem;color:var(--dim)"></span>
+          <span id="saved" style="font-size:.85rem;color:var(--soft)"></span>
         </div>
         <p style="margin:1.1rem 0 .35rem"><span class="f">or, if you prefer a terminal</span></p>
         <pre id="out">…</pre>

package/web/rules-view.js

@@ -54,13 +54,24 @@
   }
 
   function fill(evaluation) {
+    // Never type over someone's hands. A refresh landing while a retention
+    // number is being edited used to revert it silently, and the next click on
+    // "Save these rules" then saved the old policy — the one that decides when
+    // original session files may be moved to the trash. loadCopies already
+    // guards its one field this way; every field here needs the same.
+    const set = (id, value) => {
+      const node = $(id);
+      if (!node || node === document.activeElement) return;
+      node.value = value;
+    };
     const chosen = document.querySelector(`input[name=policy][value="${evaluation.policy}"]`);
-    if (chosen) chosen.checked = true;
-    $("older").value = evaluation.olderThanDays;
-    $("grace").value = evaluation.graceDays;
-    $("idle").value = evaluation.sourceIdleDays === null ? "" : evaluation.sourceIdleDays;
-    $("minSize").value = evaluation.minSourceBytes === null ? "" : Math.round(evaluation.minSourceBytes / MB);
-    $("deleteAfter").value = evaluation.deleteAfterDays == null ? "" : evaluation.deleteAfterDays;
+    const editingPolicy = document.activeElement?.name === "policy";
+    if (chosen && !editingPolicy) chosen.checked = true;
+    set("older", evaluation.olderThanDays);
+    set("grace", evaluation.graceDays);
+    set("idle", evaluation.sourceIdleDays === null ? "" : evaluation.sourceIdleDays);
+    set("minSize", evaluation.minSourceBytes === null ? "" : Math.round(evaluation.minSourceBytes / MB));
+    set("deleteAfter", evaluation.deleteAfterDays == null ? "" : evaluation.deleteAfterDays);
     render();
     showEffect(evaluation);
   }

package/web/sessions-view.js

@@ -330,7 +330,10 @@
     const sealing = queued.length;
     if (sealing > 0) {
       $("result").textContent = waiting === sealing
-        ? `${waiting} waiting for disk room — ${queued.find((row) => row.held).held} Free some space and they seal on their own.`
+        // The guard's own sentence ends without punctuation, so this used to run
+        // straight into the instruction: "...rather than filling the disk Free
+        // some space and they seal on their own."
+        ? `${waiting} waiting for disk room — ${String(queued.find((row) => row.held).held).replace(/[.\s]+$/, "")}. Free some space and they seal on their own.`
         : `Sealing in the background — ${sealing - waiting} working${waiting ? `, ${waiting} waiting for room` : ""}. You can close or refresh this page; it carries on without it.`;
     } else {
       stopPolling();

package/web/setup-logic.js

@@ -93,7 +93,18 @@ export const PROVIDERS = [
   }
 ];
 
-export const provider = (id) => PROVIDERS.find((entry) => entry.id === id) ?? PROVIDERS[0];
+/**
+ * The provider with this id, or undefined when nothing matches.
+ *
+ * This used to fall back to PROVIDERS[0] — the LOCAL entry — for any unknown
+ * id, including the empty string someone has before they pick a vendor. That
+ * made the wizard's own guard (`intent === "own" && !provider(id)`) unable to
+ * fire: choosing "use my own bucket" and picking nothing showed a credentials
+ * form with no credential fields, validated, and finished. The person believed
+ * their bucket was configured while the vault stayed local-only — the exact
+ * task they opened the wizard to do, silently not done.
+ */
+export const provider = (id) => PROVIDERS.find((entry) => entry.id === id);
 /**
  * The three answers to "where do archives go", before any provider is named.
  *
@@ -180,9 +191,9 @@ export function validateStorage(providerId, values) {
 
   if (!normalisePrefix(values.prefix)) errors.prefix = "Give the archives a folder inside the bucket. Sealkeep is a fine answer.";
 
-  for (const field of provider(providerId).fields) {
+  for (const field of (provider(providerId)?.fields ?? [])) {
     const value = String(values[field.name] ?? "").trim();
-    if (!value) { errors[field.name] = `${field.label} is required for ${provider(providerId).label}.`; continue; }
+    if (!value) { errors[field.name] = `${field.label} is required for ${provider(providerId)?.label ?? "this provider"}.`; continue; }
     if (field.name === "serviceAccountJson" && !parseServiceAccount(value)) {
       errors[field.name] = "That is not a service account key. Paste the whole JSON file, including the braces and the private_key line.";
     }

package/web/setup.html

@@ -267,12 +267,12 @@
         <p>It unlocks with your password on this machine. If you ever lose the password, the phrase below is the only other way in — which is a good reason to spend a minute on it now.</p>
       </div>
       <details class="panel pad explain" id="phrase-fold">
-        <summary>Show the 24 words that survive this machine</summary>
+        <summary id="fold-summary">Show the words that survive this machine</summary>
         <p id="fold-note"></p>
         <ol class="phrase" id="fold-phrase-words"></ol>
       </details>
       <div class="wizfoot">
-        <p class="note warn"><b>Your password opens this vault on this machine only.</b> It is kept in this machine's keystore — it does not travel. If this machine is lost or wiped, the 24 words above are the only thing that opens the archives, and nobody, including us, can recreate them. Take them now, or accept that this vault dies with this machine.</p>
+        <p class="note warn"><b>Your password opens this vault on this machine only.</b> It is kept in this machine's keystore — it does not travel. If this machine is lost or wiped, the words above are the only thing that opens the archives, and nobody, including us, can recreate them. Take them now, or accept that this vault dies with this machine.</p>
         <div class="actions"><button type="button" class="action primary" id="finish-password">Finish setup</button></div>
       </div>
     </div>
@@ -281,7 +281,7 @@
          arrive before the secret does. -->
     <div id="phrase-before" hidden>
       <div class="panel pad callout warn">
-        <p>Sealkeep is about to generate <b>24 words</b>. Those words are the key to every archive it will ever make here.</p>
+        <p>Sealkeep is about to generate <b id="ceremony-count">its recovery phrase</b>. Those words are the key to every archive it will ever make here.</p>
         <ul class="plain">
           <li><b>They are shown once, on this page, and never again.</b> No command, no endpoint and no request to us can produce them a second time.</li>
           <li><b>Close this page before writing them down and they are gone.</b> The vault would have to be created again from nothing.</li>
@@ -321,7 +321,7 @@
         <p class="note error" id="verify-error" hidden></p>
         <label class="opt" for="f-understood">
           <input type="checkbox" id="f-understood">
-          <span>I have written down all 24 words, in order. I understand this page is the only place they will ever appear.</span>
+          <span id="wrote-them-down">I have written them all down, in order. I understand this page is the only place they will ever appear.</span>
         </label>
         <div class="wizfoot">
           <p class="note" id="confirm-note">Continue unlocks once both of those are true.</p>

package/web/setup.js

@@ -210,6 +210,7 @@ function renderProviderFields() {
   if (form.hidden) return;
 
   const entry = provider(draft.providerId);
+  if (!entry) return;
   $("storage-form-title").textContent = `${entry.label} — bucket and credentials`;
 
   const holder = $("provider-fields");
@@ -243,7 +244,7 @@ function collectStorage() {
   draft.storage.prefix = $("f-prefix").value;
   const { ok, errors } = validateStorage(draft.providerId, draft.storage);
 
-  for (const field of ["bucket", "prefix", ...provider(draft.providerId).fields.map((entry) => entry.name)]) {
+  for (const field of ["bucket", "prefix", ...(provider(draft.providerId)?.fields ?? []).map((entry) => entry.name)]) {
     const node = $(`e-${field}`);
     if (!node) continue;
     node.textContent = errors[field] ?? "";
@@ -376,6 +377,13 @@ function renderPhrase(words) {
   // moment they had been told there is no reset and no support ticket. A number
   // that can disagree with the thing it describes should not be typed twice.
   $("phrase-lede").textContent = `These ${words.length} words are the only key to everything Sealkeep will seal here. Write them down now — this page will not show them twice.`;
+  // Every count on these screens is derived, never typed. The wizard once said
+  // "17 words" for a day after the phrase became 24, telling people to write
+  // down the wrong number for an artefact with no reset and no support ticket.
+  const say = (id, text) => { const node = $(id); if (node) node.textContent = text; };
+  say("ceremony-count", `${words.length} words`);
+  say("wrote-them-down", `I have written down all ${words.length} words, in order. I understand this page is the only place they will ever appear.`);
+  say("fold-summary", `Show the ${words.length} words that survive this machine`);
   armUnloadGuard();
   paintRail();
 }

package/web/style.css

@@ -339,9 +339,19 @@ td.muted { color: var(--text-3); }
 .check strong { font: 600 12.5px var(--mono); }
 .check span { color: var(--text-2); }
 .check-pass { border-left-color: var(--verified); }
-.check-warn { border-left-color: var(--held); }
+/* A warn is where inaction loses data — "if this machine is lost, the archives
+   on it cannot be opened by anyone, including us". It was drawn in --held,
+   which aliases to the same neutral grey a passing check gets, so the row most
+   needing attention looked like nothing was wrong. --warn is exactly what the
+   design system reserves for this. */
+.check-warn { border-left-color: var(--warn); background: var(--warn-bg); }
 .check-fail { border-left-color: var(--alert); background: #fdf4f2; }
 
+/* A failed job is the row in the queue that needs a person. It was rendered
+   with a class no rule matched, so it read as ordinary text beside states that
+   were coloured. */
+.bad { color: var(--warn); font-weight: 600; }
+
 /* ── Agents ───────────────────────────────────────────── */
 
 .agent {