sealkeep 0.7.2 → 0.8.1

package/CHANGELOG.md

@@ -3,6 +3,36 @@
 Notable changes, by published version. Sealkeep is pre-1.0: minor versions
 may change behavior, and say so here when they do.
 
+## 0.8.1 — 2026-08-20
+
+- **`sealkeep recover --key`** — open an archive with a registered recipient's
+  private key, no recovery phrase involved. This is how an organisation reads
+  what someone who has left sealed: register the company key once
+  (`sealkeep recipients add --public-key …`), and every archive sealed after
+  that is wrapped for it. Existing archives are brought in with
+  `sealkeep rewrap`. A key that was never a recipient opens nothing.
+
+## 0.8.0 — 2026-08-20
+
+Fixes from a review of the screens that had never had one, and a test suite
+that no longer needs a spacious disk.
+
+- **The setup wizard could finish "use my own bucket" without a vendor.** An
+  unrecognised provider fell back to *local*, so the guard could not fire: a
+  credentials form with no fields validated, setup completed, and the vault
+  stayed local-only. The one task the wizard exists for, silently not done.
+- Every "24 words" on those screens — including the checkbox you tick to
+  finish — is derived from the phrase now. That copy once said seventeen.
+- Doctor's warnings were drawn like passes, four checks rendered as raw slugs,
+  a failed queue job used a stylesheet class that did not exist, five notes
+  used an undefined token, and the retention view typed over edits in progress
+  and could then save the policy you thought you had changed.
+- `archiveFile` accepts a chunk size (and honours `SEALKEEP_CHUNK_BYTES`).
+  Proving a multi-chunk archive used to mean writing 24 MB; it now takes 120 KB,
+  which is why the suite stopped exhausting disks.
+- New: `npm run browser:audit` and `npm run browser:panel` — real Chrome,
+  accessibility and layout at two widths, eight signed-in panel scenarios.
+
 ## 0.7.2 — 2026-08-20
 
 - Sharing is findable: the vault view offers **Share…** beside Restore. The

package/dist/site/index.html

@@ -105,7 +105,9 @@
   .primary:disabled{opacity:.45;cursor:default}
   .ghost{background:none;border:1px solid var(--rule);color:var(--ink);padding:.62rem 1.1rem;font-size:.88rem}
   .ghost:hover{border-color:var(--ink)}
-  .fine{font-family:var(--mono);font-size:.76rem;color:var(--soft);margin-top:.9rem}
+  /* A caption is prose even when it names versions and carries a command; the
+     command inside it is already a <code> and keeps the machine voice. */
+  .fine{font-family:var(--sans);font-size:.78rem;color:var(--soft);margin-top:.9rem}
 
   /* The machine side of the hero: one session, read out and then sealed. */
   .side{font-family:var(--mono);font-size:.7rem;color:var(--soft);margin:0 0 .7rem;letter-spacing:.02em}

package/dist/src/chunk-store.js

@@ -10,6 +10,7 @@ import { acquireSpoolLock, createSpool, findSpoolForSource, shredSpool, unwrapSp
 import { DEFAULT_CHUNK_BYTES, KEY_BYTES, StreamingSha256, sealChunksToSink, wrapAll, zeroize } from "../packages/vaultline-crypto/src/index.js";
 import { frameObject } from "./cloud.js";
 import { aeadCipher, aeadDecipher } from "../packages/vaultline-crypto/src/aead.js";
+import { envVar } from "./env.js";
 const SEAL_SUITE = "chacha20-poly1305";
 const sha256hex = (input) => createHash("sha256").update(input).digest("hex");
 export const chunkObjectName = (index) => `chunk-${String(index).padStart(6, "0")}`;
@@ -132,7 +133,10 @@ export async function sealToChunkFolder(dataDir, sourcePath, rawPhrase, agent, o
         fail("source_unreadable", `Transcript is not readable: ${absolute}`, { sourcePath: absolute });
     const phrase = canonicalPhrase(rawPhrase);
     const totalBytes = source.size;
-    const chunkBytes = DEFAULT_CHUNK_BYTES;
+    // Same override the local seal path honours, for the same reason: proving the
+    // streamed layout works should not cost tens of megabytes of disk per run.
+    const chunkOverride = Number(envVar("CHUNK_BYTES"));
+    const chunkBytes = Number.isInteger(chunkOverride) && chunkOverride > 0 ? chunkOverride : DEFAULT_CHUNK_BYTES;
     const totalChunks = Math.max(1, Math.ceil(totalBytes / chunkBytes));
     // Journal triage, chunk-layout edition. Same drain-the-stack shape as the
     // streaming path: resume the newest matching journal or abandon it with the
@@ -159,7 +163,7 @@ export async function sealToChunkFolder(dataDir, sourcePath, rawPhrase, agent, o
         }
         const lock = await acquireSpoolLock(dataDir, journal.archiveId, { now: options.now });
         try {
-            return await resumeChunkFolder({ dataDir, client, remoteStorage, targetId: routedTarget?.id, absolute, totalBytes, chunkBytes, totalChunks, phrase, agent, now: options.now }, journal);
+            return await resumeChunkFolder({ dataDir, client, remoteStorage, targetId: routedTarget?.id, absolute, totalBytes, chunkBytes, totalChunks, phrase, agent, project: options.project ?? null, now: options.now }, journal);
         }
         catch (error) {
             if (!(error instanceof Error) || !/cannot resume/i.test(error.message))
@@ -190,7 +194,8 @@ export async function sealToChunkFolder(dataDir, sourcePath, rawPhrase, agent, o
         configuredPrefix: remoteStorage.prefix, project: options.project ?? null, createdAt, sourcePath: absolute, archiveId,
         naming, ...(naming === "hashed" ? { namingKey: folderNamingKey(phrase, storageScopeOf(remoteStorage)) } : {})
     });
-    const recipients = configuredRecipients(config, phrase);
+    // Members of this project are wrapped in here, and nowhere else.
+    const recipients = configuredRecipients(config, phrase, { project: options.project ?? undefined });
     const archiveKey = randomBytes(KEY_BYTES);
     const noncePrefix = randomBytes(4);
     const lock = await acquireSpoolLock(dataDir, archiveId, { now: options.now });
@@ -206,7 +211,7 @@ export async function sealToChunkFolder(dataDir, sourcePath, rawPhrase, agent, o
             hashState: { plaintext: "", stored: "" },
             providerState: { kind: "chunk-folder", folder, uploaded: 0 }
         }, { now: options.now });
-        return await runChunkSeal({ dataDir, client, remoteStorage, targetId: routedTarget?.id, absolute, totalBytes, chunkBytes, totalChunks, phrase, agent, now: options.now }, { archiveId, createdAt, folder, archiveKey, noncePrefix, project: options.project ?? null, startAt: 0, verifiedHeaders: [], reusedChunks: 0 });
+        return await runChunkSeal({ dataDir, client, remoteStorage, targetId: routedTarget?.id, absolute, totalBytes, chunkBytes, totalChunks, phrase, agent, project: options.project ?? null, now: options.now }, { archiveId, createdAt, folder, archiveKey, noncePrefix, project: options.project ?? null, startAt: 0, verifiedHeaders: [], reusedChunks: 0 });
     }
     finally {
         zeroize(archiveKey);
@@ -234,7 +239,7 @@ async function abandonFolderJournal(dataDir, client, journal, reason) {
  */
 async function runChunkSeal(ctx, args) {
     const config = await readConfig(ctx.dataDir);
-    const recipients = configuredRecipients(config, ctx.phrase);
+    const recipients = configuredRecipients(config, ctx.phrase, { project: ctx.project ?? undefined });
     const { tokenize, indexableToken, tokenCapFor } = await import("./search.js");
     const perChunkTokenCap = Math.max(4000, Math.floor(tokenCapFor(ctx.totalBytes) / 4));
     const hashers = { plaintext: new StreamingSha256(), stored: new StreamingSha256() };

package/dist/src/cli.js

@@ -207,7 +207,7 @@ function usage() {
             ["index status", "what is searchable and what is not yet indexed"],
             ["storage targets", "several storages at once, with limits, pins, and priority"],
             ["mcp install", "let your agents search this history themselves"],
-            ["recover <id> <dest>", "restore original bytes; --native puts it back where it came from"],
+            ["recover <id> <dest>", "restore original bytes; --native puts it back where it came from, --key opens it as a registered recipient"],
             ["recover <session-file>", "agent says a session file is missing? name it and it goes back where resume expects it"],
             ["tui", "the same view in the terminal"]
         ]),
@@ -1117,9 +1117,21 @@ async function main() {
             if (!json)
                 print(`  ${dim(`Matched ${newest.source.path} → archive ${newest.id}${native ? " · restoring to its original location" : ""}`)}`);
         }
-        const outcome = await restoreArchive(dataDir, id, required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required"), {
+        // A recipient key is the other way in: an archive wrapped for a registered
+        // key opens with that key and no phrase, which is how an organisation reads
+        // what a departed colleague sealed. Accepts the base64 the keygen printed,
+        // or a path to a file holding it.
+        const keyArg = take(args, "--key");
+        const privateKey = keyArg
+            ? (await readFile(keyArg, "utf8").then((text) => text.trim()).catch(() => keyArg.trim()))
+            : undefined;
+        const secret = privateKey
+            ? ""
+            : required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required (or pass --key with a recipient's private key)");
+        const outcome = await restoreArchive(dataDir, id, secret, {
             destination: native ? undefined : required(destination, "Destination is required unless --native is used"),
-            native, home: take(args, "--home"), overwrite: take(args, "--overwrite", "refuse")
+            native, home: take(args, "--home"), overwrite: take(args, "--overwrite", "refuse"),
+            ...(privateKey ? { privateKey } : {})
         });
         if (json) {
             print(JSON.stringify({ id, output: outcome.output, bytes: outcome.bytes, native: outcome.native, backupPath: outcome.backupPath }, null, 2));

package/dist/src/restore.d.ts

@@ -31,4 +31,6 @@ export declare function nativeRestoreTarget(record: ArchiveRecord, home?: string
  * is refused by default; `backup` preserves it beside the restored copy and
  * `replace` is the only policy that discards it.
  */
-export declare function restoreArchive(dataDir: string, id: string, phrase: string, options?: RestoreOptions): Promise<RestoreOutcome>;
+export declare function restoreArchive(dataDir: string, id: string, phrase: string, options?: RestoreOptions & {
+    privateKey?: string;
+}): Promise<RestoreOutcome>;

package/dist/src/restore.js

@@ -42,6 +42,10 @@ export function nativeRestoreTarget(record, home = homedir()) {
  * `replace` is the only policy that discards it.
  */
 export async function restoreArchive(dataDir, id, phrase, options = {}) {
+    // A recipient key opens an archive it was wrapped for, without the phrase.
+    // That is how an organisation reads what someone who has left sealed, and
+    // how a project member reads a project they were added to.
+    const key = options.privateKey;
     const record = await findArchive(dataDir, id);
     const native = options.native === true;
     if (native && options.destination)
@@ -58,13 +62,16 @@ export async function restoreArchive(dataDir, id, phrase, options = {}) {
     // decrypts: a wrong phrase must not leave a directory or a partial file
     // behind. The config decides what "proved" means — unwrapping for a sealed
     // vault, the identity check for a plain one.
-    assertPhraseOpens(await readConfig(dataDir), record, phrase);
+    // The phrase check proves the PHRASE opens this vault; a key holder has no
+    // phrase and the wrap itself is the proof, so the unwrap below is the gate.
+    if (!key)
+        assertPhraseOpens(await readConfig(dataDir), record, phrase);
     await mkdir(dirname(output), { recursive: true });
     const temp = join(dirname(output), `.${basename(output)}.${randomUUID()}.partial`);
     let backupPath;
     let bytes;
     try {
-        ({ bytes } = await restoreRecordToFile(dataDir, record, phrase, temp));
+        ({ bytes } = await restoreRecordToFile(dataDir, record, key ? { privateKey: key } : phrase, temp));
         if (existing && policy === "backup") {
             backupPath = `${output}.vaultline-backup-${new Date().toISOString().replace(/[:.]/g, "-")}`;
             await rename(output, backupPath);

package/dist/src/types.d.ts

@@ -171,7 +171,10 @@ export type VaultConfig = {
         label: string;
         publicKey: string;
         addedAt: string;
+        /** A rewrap filter — `sealkeep rewrap --group` applies one group's set to existing archives. */
         group?: string;
+        /** Sharing scope: set, this key is a member of one project and is wrapped into that project's archives only. */
+        project?: string;
     }[];
     /** `deleteAfterDays` is optional so vaults written before archive lifecycle existed still load; absent means never. */
     retention?: {

package/dist/src/vault.d.ts

@@ -103,12 +103,16 @@ export type ArchiveResult = ArchiveRecord & {
 export declare function archiveFile(dataDir: string, sourcePath: string, rawPhrase: string, agent?: string, hooks?: {
     onProgress?: (bytesRead: number) => void;
     delta?: boolean;
+    chunkBytes?: number;
 }): Promise<ArchiveResult>;
 /**
  * The recovery phrase always gets a recipient, so a recovery kit alone can restore.
  * Registered device and backup keys are added alongside it.
  */
-export declare function configuredRecipients(config: VaultConfig, rawPhrase: string, group?: string): Recipient[];
+export declare function configuredRecipients(config: VaultConfig, rawPhrase: string, scope?: string | {
+    group?: string;
+    project?: string;
+}): Recipient[];
 export declare function listArchives(dataDir: string): Promise<ArchiveRecord[]>;
 /**
  * Registers an X25519 public key that may open future archives. Only the public
@@ -160,7 +164,17 @@ export declare function assertPhraseOpens(config: VaultConfig, record: ArchiveRe
  * rejection can leave bytes behind. `restoreArchive` renames a temporary into
  * place for exactly this reason.
  */
-export declare function restoreRecordToFile(dataDir: string, record: ArchiveRecord, rawPhrase: string, destination: string, 
+export declare function restoreRecordToFile(dataDir: string, record: ArchiveRecord, 
+/**
+ * The phrase, or a recipient's private key. A key is how an organisation
+ * opens what an employee sealed: the archive was wrapped for that key when
+ * it was sealed (or by a later rewrap), and the phrase never has to be
+ * shared for it to work. Until this existed, a registered recipient could be
+ * wrapped in and still had no way to decrypt anything.
+ */
+rawPhrase: string | {
+    privateKey: string;
+}, destination: string, 
 /** Injectable so the offloaded-archive path can be proved without a bucket. */
 options?: {
     client?: import("./offload.js").FetchClient;

package/dist/src/vault.js

@@ -6,7 +6,7 @@ import { createGzip, createGunzip, gunzipSync } from "node:zlib";
 import { pipeline } from "node:stream/promises";
 import { decryptLegacyArchive, equalHex, isLegacyPhraseCheck, phraseCheck, sha256, upgradeLegacyPhraseCheck } from "./crypto.js";
 import { canonicalPhrase, generateRecoveryPhrase } from "./mnemonic.js";
-import { decryptArchive as openEnvelope, hashFilePrefixes, hashFileRange, keyRecipientId, openArchiveToFile, sealArchiveToFile, unwrapArchiveKey, x25519PublicKeyFromRaw, zeroize } from "../packages/vaultline-crypto/src/index.js";
+import { decryptArchive as openEnvelope, hashFilePrefixes, hashFileRange, keyRecipientId, openArchiveToFile, sealArchiveToFile, unwrapArchiveKey, x25519PublicKeyFromRaw, x25519PrivateKeyFromRaw, zeroize } from "../packages/vaultline-crypto/src/index.js";
 import { fail, VaultlineError } from "./errors.js";
 import { recordAudit } from "./audit.js";
 import { isV2 } from "./types.js";
@@ -240,6 +240,13 @@ export async function archiveFile(dataDir, sourcePath, rawPhrase, agent = "custo
     const config = await readConfig(dataDir);
     if (!equalHex(config.recovery.phraseCheck, phraseCheck(phrase)))
         fail("recovery_phrase_mismatch", "Recovery phrase does not match this vault");
+    // The crypto has always taken a chunk size and nothing above it could set
+    // one, so exercising a multi-chunk archive meant writing tens of megabytes.
+    // A caller — or SEALKEEP_CHUNK_BYTES — can span chunks with kilobytes now.
+    const chunkBytes = hooks.chunkBytes ?? (() => {
+        const override = Number(envVar("CHUNK_BYTES"));
+        return Number.isInteger(override) && override > 0 ? override : undefined;
+    })();
     const absolute = resolve(sourcePath);
     const source = await stat(absolute).catch(() => null);
     if (!source?.isFile())
@@ -316,6 +323,7 @@ export async function archiveFile(dataDir, sourcePath, rawPhrase, agent = "custo
         // whole-body layout stay readable forever; this changes what is WRITTEN.
         recipients: configuredRecipients(config, phrase), archiveId: id, compression: "gzip-chunk",
         adapter: { agent, version: ADAPTER_VERSION }, scratchDir: config.storage.root,
+        ...(chunkBytes ? { chunkBytes } : {}),
         ...(hooks.onProgress ? { onProgress: hooks.onProgress } : {})
     }).catch((error) => {
         const code = error.code;
@@ -407,10 +415,22 @@ async function sealDeltaArchive(dataDir, config, absolute, agent, phrase, size,
  * The recovery phrase always gets a recipient, so a recovery kit alone can restore.
  * Registered device and backup keys are added alongside it.
  */
-export function configuredRecipients(config, rawPhrase, group) {
+export function configuredRecipients(config, rawPhrase, scope) {
     const phrase = canonicalPhrase(rawPhrase);
+    // Two different questions, and conflating them broke one of them.
+    //
+    // `group` is a REWRAP FILTER: "apply the current recipient set for the
+    // engineering group to existing archives", which is how a contractor's
+    // access ends. Everyone gets new archives regardless of group — that is the
+    // shipped, tested behaviour and it stays.
+    //
+    // `project` is SHARING SCOPE: a member added to one project must be wrapped
+    // into that project's archives and no others, or sharing a project would
+    // hand over the whole vault.
+    const asked = typeof scope === "string" ? { group: scope } : (scope ?? {});
     const keys = (config.recipients ?? [])
-        .filter((recipient) => !group || recipient.group === group)
+        .filter((recipient) => (asked.group ? recipient.group === asked.group : true))
+        .filter((recipient) => !recipient.project || recipient.project === asked.project)
         .map((recipient) => ({ kind: "x25519", publicKey: x25519PublicKeyFromRaw(Buffer.from(recipient.publicKey, "base64")) }));
     return [{ kind: "phrase", phrase }, ...keys];
 }
@@ -536,16 +556,38 @@ function openFailure(archiveId, error) {
  * rejection can leave bytes behind. `restoreArchive` renames a temporary into
  * place for exactly this reason.
  */
-export async function restoreRecordToFile(dataDir, record, rawPhrase, destination, 
+export async function restoreRecordToFile(dataDir, record, 
+/**
+ * The phrase, or a recipient's private key. A key is how an organisation
+ * opens what an employee sealed: the archive was wrapped for that key when
+ * it was sealed (or by a later rewrap), and the phrase never has to be
+ * shared for it to work. Until this existed, a registered recipient could be
+ * wrapped in and still had no way to decrypt anything.
+ */
+rawPhrase, destination, 
 /** Injectable so the offloaded-archive path can be proved without a bucket. */
 options = {}) {
-    const phrase = canonicalPhrase(rawPhrase);
+    const withKey = typeof rawPhrase === "object";
+    const phrase = withKey ? "" : canonicalPhrase(rawPhrase);
+    // The keygen prints the raw 32 bytes as base64; the crypto wants a key object
+    // (its string form is PEM). Accept either, so someone can paste what they
+    // were given rather than convert it themselves.
+    const unlock = withKey
+        ? { privateKey: /BEGIN [A-Z ]*PRIVATE KEY/.test(rawPhrase.privateKey)
+                ? rawPhrase.privateKey
+                : x25519PrivateKeyFromRaw(Buffer.from(rawPhrase.privateKey, "base64")) }
+        : { phrase };
     const config = await readConfig(dataDir);
+    if (withKey && (config.storageMode === "plain" || !isV2(record))) {
+        fail("invalid_argument", "A recipient key opens sealed v2 archives. This one predates them, or the vault stores archives unencrypted.");
+    }
     // A delta archive's object holds only what an append added; the bytes before
     // it live in its base chain. Routed through the one chain-aware helper so
     // every caller of this function — the CLI and dashboard restore included —
     // gets the whole transcript back, not a tail pretending to be one.
     if (deltaOf(record)) {
+        if (withKey)
+            fail("invalid_argument", "This archive is an append onto an earlier one, and the chain is opened with the phrase. Restore it with --recovery-phrase.");
         const { bytes } = await restoreDeltaChainToFile(dataDir, record, phrase, destination, options);
         return { bytes };
     }
@@ -571,7 +613,7 @@ options = {}) {
             fail("ciphertext_integrity_failed", "Ciphertext integrity check failed before decryption", { archiveId: record.id });
         let opened;
         try {
-            opened = await openArchiveToFile(record.envelope, source.path, destination, { phrase });
+            opened = await openArchiveToFile(record.envelope, source.path, destination, unlock);
         }
         catch (error) {
             throw openFailure(record.id, error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sealkeep",
-  "version": "0.7.2",
+  "version": "0.8.1",
   "type": "module",
   "description": "Sealkeep by SPALA AI \u2014 your AI coding-agent history, sealed, searchable, and shared across your machines.",
   "license": "SEE LICENSE IN LICENSE",
@@ -32,7 +32,7 @@
     "typecheck": "tsc -p tsconfig.check.json",
     "prepack": "npm run build",
     "release:manifest": "node scripts/release.mjs",
-    "test": "node --import tsx --test \"test/**/*.test.ts\" \"packages/*/test/*.test.ts\"",
+    "test": "node --import tsx --test --test-concurrency=4 \"test/**/*.test.ts\" \"packages/*/test/*.test.ts\"",
     "vaultline": "tsx src/cli.ts",
     "mcp": "tsx src/mcp.ts",
     "api": "tsx src/cli.ts api",
@@ -42,7 +42,9 @@
     "bundle:site": "node tools/build-site.mjs && cd dist/site && zip -q -X ../site.zip index.html && cd - >/dev/null && echo \"dist/site.zip ready ($(wc -c < dist/site.zip) bytes)\"",
     "acceptance": "node scripts/acceptance.mjs",
     "acceptance:managed": "node scripts/acceptance.mjs --managed",
-    "tokens": "node scripts/sync-tokens.mjs"
+    "tokens": "node scripts/sync-tokens.mjs",
+    "browser:audit": "node scripts/browser/audit.mjs",
+    "browser:panel": "node scripts/browser/panel.mjs"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",

package/web/app.js

@@ -140,7 +140,15 @@ const CHECK_LABELS = {
   "remote-storage": "Storage",
   "sealed-key-copy": "Sealed key backup",
   signer: "Uploads",
-  agents: "Agents"
+  agents: "Agents",
+  // Doctor emits these four too, and without a label each rendered as its raw
+  // slug — the exact "debug output in front of a customer" this map exists to
+  // prevent: one names the standing warning that archives are stored
+  // unencrypted, another says a routing rule matches nothing.
+  "storage-mode": "How archives are stored",
+  "resumable-history": "Resume protection",
+  "search-index": "Search index",
+  "routing-pins": "Routing rules"
 };
 
 /** Same names the retention page uses, so the two never disagree. */
@@ -368,7 +376,7 @@ function renderQueue(queue, retention) {
       state.innerHTML = `<span class="queued">sealing…${pct !== null ? ` ${pct}%` : ""}</span>`;
       if (pct !== null) state.title = `${bytes(job.progress.bytes)} of ${bytes(job.progress.of)} read`;
     } else if (job.status === "failed") {
-      state.innerHTML = '<span class="bad">failed</span>';
+      state.replaceChildren(Object.assign(document.createElement("span"), { className: "bad", textContent: "failed" }));
       if (job.lastError) state.title = job.lastError.message ?? String(job.lastError);
     } else if (job.lastError) {
       const span = document.createElement("span");

package/web/index.html

@@ -378,13 +378,13 @@
         </div>
         <div class="rowgrid" style="margin-top:.75rem">
           <div><label class="f" for="deleteAfter">Delete the archive from storage after (days)</label><input type="number" id="deleteAfter" min="0" placeholder="never"></div>
-          <div><label class="f">&nbsp;</label><span style="font-size:.85rem;color:var(--dim)">Leave empty for never.</span></div>
+          <div><label class="f">&nbsp;</label><span style="font-size:.85rem;color:var(--soft)">Leave empty for never.</span></div>
         </div>
       </fieldset>
 
       <fieldset>
         <legend>Which sessions</legend>
-        <p style="margin:0 0 .9rem;font-size:.9rem;color:var(--dim)">
+        <p style="margin:0 0 .9rem;font-size:.9rem;color:var(--soft)">
           The timings above measure the <em>archive</em> — how long Sealkeep has held a copy. These two measure the
           <em>session</em>: when you last touched it, and whether it is big enough to be worth the trouble.
         </p>
@@ -392,12 +392,12 @@
           <div>
             <label class="f" for="idle">Only if untouched for at least (days)</label>
             <input type="number" id="idle" min="0" placeholder="any">
-            <span style="font-size:.85rem;color:var(--dim)">Empty means a session's own age is not considered.</span>
+            <span style="font-size:.85rem;color:var(--soft)">Empty means a session's own age is not considered.</span>
           </div>
           <div>
             <label class="f" for="minSize">Only if larger than (MB)</label>
             <input type="number" id="minSize" min="0" placeholder="any">
-            <span style="font-size:.85rem;color:var(--dim)">Most sessions are tiny; the space is in a few huge ones.</span>
+            <span style="font-size:.85rem;color:var(--soft)">Most sessions are tiny; the space is in a few huge ones.</span>
           </div>
         </div>
       </fieldset>
@@ -407,7 +407,7 @@
         <p id="effect" style="margin:0 0 .9rem">Reading the current rules…</p>
         <div style="display:flex;gap:.6rem;align-items:center;flex-wrap:wrap">
           <button type="button" class="action primary" id="save">Save these rules</button>
-          <span id="saved" style="font-size:.85rem;color:var(--dim)"></span>
+          <span id="saved" style="font-size:.85rem;color:var(--soft)"></span>
         </div>
         <p style="margin:1.1rem 0 .35rem"><span class="f">or, if you prefer a terminal</span></p>
         <pre id="out">…</pre>

package/web/rules-view.js

@@ -54,13 +54,24 @@
   }
 
   function fill(evaluation) {
+    // Never type over someone's hands. A refresh landing while a retention
+    // number is being edited used to revert it silently, and the next click on
+    // "Save these rules" then saved the old policy — the one that decides when
+    // original session files may be moved to the trash. loadCopies already
+    // guards its one field this way; every field here needs the same.
+    const set = (id, value) => {
+      const node = $(id);
+      if (!node || node === document.activeElement) return;
+      node.value = value;
+    };
     const chosen = document.querySelector(`input[name=policy][value="${evaluation.policy}"]`);
-    if (chosen) chosen.checked = true;
-    $("older").value = evaluation.olderThanDays;
-    $("grace").value = evaluation.graceDays;
-    $("idle").value = evaluation.sourceIdleDays === null ? "" : evaluation.sourceIdleDays;
-    $("minSize").value = evaluation.minSourceBytes === null ? "" : Math.round(evaluation.minSourceBytes / MB);
-    $("deleteAfter").value = evaluation.deleteAfterDays == null ? "" : evaluation.deleteAfterDays;
+    const editingPolicy = document.activeElement?.name === "policy";
+    if (chosen && !editingPolicy) chosen.checked = true;
+    set("older", evaluation.olderThanDays);
+    set("grace", evaluation.graceDays);
+    set("idle", evaluation.sourceIdleDays === null ? "" : evaluation.sourceIdleDays);
+    set("minSize", evaluation.minSourceBytes === null ? "" : Math.round(evaluation.minSourceBytes / MB));
+    set("deleteAfter", evaluation.deleteAfterDays == null ? "" : evaluation.deleteAfterDays);
     render();
     showEffect(evaluation);
   }

package/web/sessions-view.js

@@ -330,7 +330,10 @@
     const sealing = queued.length;
     if (sealing > 0) {
       $("result").textContent = waiting === sealing
-        ? `${waiting} waiting for disk room — ${queued.find((row) => row.held).held} Free some space and they seal on their own.`
+        // The guard's own sentence ends without punctuation, so this used to run
+        // straight into the instruction: "...rather than filling the disk Free
+        // some space and they seal on their own."
+        ? `${waiting} waiting for disk room — ${String(queued.find((row) => row.held).held).replace(/[.\s]+$/, "")}. Free some space and they seal on their own.`
         : `Sealing in the background — ${sealing - waiting} working${waiting ? `, ${waiting} waiting for room` : ""}. You can close or refresh this page; it carries on without it.`;
     } else {
       stopPolling();

package/web/setup-logic.js

@@ -93,7 +93,18 @@ export const PROVIDERS = [
   }
 ];
 
-export const provider = (id) => PROVIDERS.find((entry) => entry.id === id) ?? PROVIDERS[0];
+/**
+ * The provider with this id, or undefined when nothing matches.
+ *
+ * This used to fall back to PROVIDERS[0] — the LOCAL entry — for any unknown
+ * id, including the empty string someone has before they pick a vendor. That
+ * made the wizard's own guard (`intent === "own" && !provider(id)`) unable to
+ * fire: choosing "use my own bucket" and picking nothing showed a credentials
+ * form with no credential fields, validated, and finished. The person believed
+ * their bucket was configured while the vault stayed local-only — the exact
+ * task they opened the wizard to do, silently not done.
+ */
+export const provider = (id) => PROVIDERS.find((entry) => entry.id === id);
 /**
  * The three answers to "where do archives go", before any provider is named.
  *
@@ -180,9 +191,9 @@ export function validateStorage(providerId, values) {
 
   if (!normalisePrefix(values.prefix)) errors.prefix = "Give the archives a folder inside the bucket. Sealkeep is a fine answer.";
 
-  for (const field of provider(providerId).fields) {
+  for (const field of (provider(providerId)?.fields ?? [])) {
     const value = String(values[field.name] ?? "").trim();
-    if (!value) { errors[field.name] = `${field.label} is required for ${provider(providerId).label}.`; continue; }
+    if (!value) { errors[field.name] = `${field.label} is required for ${provider(providerId)?.label ?? "this provider"}.`; continue; }
     if (field.name === "serviceAccountJson" && !parseServiceAccount(value)) {
       errors[field.name] = "That is not a service account key. Paste the whole JSON file, including the braces and the private_key line.";
     }

package/web/setup.html

@@ -267,12 +267,12 @@
         <p>It unlocks with your password on this machine. If you ever lose the password, the phrase below is the only other way in — which is a good reason to spend a minute on it now.</p>
       </div>
       <details class="panel pad explain" id="phrase-fold">
-        <summary>Show the 24 words that survive this machine</summary>
+        <summary id="fold-summary">Show the words that survive this machine</summary>
         <p id="fold-note"></p>
         <ol class="phrase" id="fold-phrase-words"></ol>
       </details>
       <div class="wizfoot">
-        <p class="note warn"><b>Your password opens this vault on this machine only.</b> It is kept in this machine's keystore — it does not travel. If this machine is lost or wiped, the 24 words above are the only thing that opens the archives, and nobody, including us, can recreate them. Take them now, or accept that this vault dies with this machine.</p>
+        <p class="note warn"><b>Your password opens this vault on this machine only.</b> It is kept in this machine's keystore — it does not travel. If this machine is lost or wiped, the words above are the only thing that opens the archives, and nobody, including us, can recreate them. Take them now, or accept that this vault dies with this machine.</p>
         <div class="actions"><button type="button" class="action primary" id="finish-password">Finish setup</button></div>
       </div>
     </div>
@@ -281,7 +281,7 @@
          arrive before the secret does. -->
     <div id="phrase-before" hidden>
       <div class="panel pad callout warn">
-        <p>Sealkeep is about to generate <b>24 words</b>. Those words are the key to every archive it will ever make here.</p>
+        <p>Sealkeep is about to generate <b id="ceremony-count">its recovery phrase</b>. Those words are the key to every archive it will ever make here.</p>
         <ul class="plain">
           <li><b>They are shown once, on this page, and never again.</b> No command, no endpoint and no request to us can produce them a second time.</li>
           <li><b>Close this page before writing them down and they are gone.</b> The vault would have to be created again from nothing.</li>
@@ -321,7 +321,7 @@
         <p class="note error" id="verify-error" hidden></p>
         <label class="opt" for="f-understood">
           <input type="checkbox" id="f-understood">
-          <span>I have written down all 24 words, in order. I understand this page is the only place they will ever appear.</span>
+          <span id="wrote-them-down">I have written them all down, in order. I understand this page is the only place they will ever appear.</span>
         </label>
         <div class="wizfoot">
           <p class="note" id="confirm-note">Continue unlocks once both of those are true.</p>

package/web/setup.js

@@ -210,6 +210,7 @@ function renderProviderFields() {
   if (form.hidden) return;
 
   const entry = provider(draft.providerId);
+  if (!entry) return;
   $("storage-form-title").textContent = `${entry.label} — bucket and credentials`;
 
   const holder = $("provider-fields");
@@ -243,7 +244,7 @@ function collectStorage() {
   draft.storage.prefix = $("f-prefix").value;
   const { ok, errors } = validateStorage(draft.providerId, draft.storage);
 
-  for (const field of ["bucket", "prefix", ...provider(draft.providerId).fields.map((entry) => entry.name)]) {
+  for (const field of ["bucket", "prefix", ...(provider(draft.providerId)?.fields ?? []).map((entry) => entry.name)]) {
     const node = $(`e-${field}`);
     if (!node) continue;
     node.textContent = errors[field] ?? "";
@@ -376,6 +377,13 @@ function renderPhrase(words) {
   // moment they had been told there is no reset and no support ticket. A number
   // that can disagree with the thing it describes should not be typed twice.
   $("phrase-lede").textContent = `These ${words.length} words are the only key to everything Sealkeep will seal here. Write them down now — this page will not show them twice.`;
+  // Every count on these screens is derived, never typed. The wizard once said
+  // "17 words" for a day after the phrase became 24, telling people to write
+  // down the wrong number for an artefact with no reset and no support ticket.
+  const say = (id, text) => { const node = $(id); if (node) node.textContent = text; };
+  say("ceremony-count", `${words.length} words`);
+  say("wrote-them-down", `I have written down all ${words.length} words, in order. I understand this page is the only place they will ever appear.`);
+  say("fold-summary", `Show the ${words.length} words that survive this machine`);
   armUnloadGuard();
   paintRail();
 }

package/web/style.css

@@ -339,9 +339,19 @@ td.muted { color: var(--text-3); }
 .check strong { font: 600 12.5px var(--mono); }
 .check span { color: var(--text-2); }
 .check-pass { border-left-color: var(--verified); }
-.check-warn { border-left-color: var(--held); }
+/* A warn is where inaction loses data — "if this machine is lost, the archives
+   on it cannot be opened by anyone, including us". It was drawn in --held,
+   which aliases to the same neutral grey a passing check gets, so the row most
+   needing attention looked like nothing was wrong. --warn is exactly what the
+   design system reserves for this. */
+.check-warn { border-left-color: var(--warn); background: var(--warn-bg); }
 .check-fail { border-left-color: var(--alert); background: #fdf4f2; }
 
+/* A failed job is the row in the queue that needs a person. It was rendered
+   with a class no rule matched, so it read as ordinary text beside states that
+   were coloured. */
+.bad { color: var(--warn); font-weight: 600; }
+
 /* ── Agents ───────────────────────────────────────────── */
 
 .agent {