sealkeep 0.9.0 → 0.11.0

package/dist/src/cli.js

@@ -1,43 +1,47 @@
 #!/usr/bin/env node
 import { writeFile } from "node:fs/promises";
 import { archiveFile, configureRemoteStorage, defaultDataDir, initialize, listArchives, readConfig, vaultStatus, addRecipient, removeRecipient } from "./vault.js";
+import { isV2 } from "./types.js";
 import { restoreArchive } from "./restore.js";
-import { detectAgents, findTranscripts, hookConfig, hookEventFromStdin } from "./adapters.js";
+import { detectAgents, findTranscripts, hookConfig, hookEventFromStdin, hookEventNameOf } from "./adapters.js";
 import { setupVault } from "./onboarding.js";
 import { providers } from "./control-plane.js";
 import { ArchiveQueue } from "./queue.js";
 import { drainQueue } from "./worker.js";
 import { runDoctor } from "./doctor.js";
 import { localApiTokenPath } from "./local-api.js";
-import { startUi, readUiRecord, DEFAULT_UI_PORT, DISPLAY_HOST } from "./ui-server.js";
+import { startUi, startUiSupervisor, readUiRecord, uiProbeOrigin, DEFAULT_UI_PORT, DISPLAY_HOST } from "./ui-server.js";
 import { enroll } from "./enroll.js";
 import { freePort } from "./net.js";
-import { errorPayload, fail, isVaultlineError } from "./errors.js";
-import { DRIVE_FOLDER_DEFAULT, PRODUCT_MARK, PRODUCT_NAME } from "./branding.js";
+import { errorPayload, fail, isSealkeepError } from "./errors.js";
+import { DRIVE_FOLDER_DEFAULT, PRODUCT_MARK, PRODUCT_NAME, STORAGE_PREFIX_DEFAULT, providerLabel } from "./branding.js";
 import { migrateVault, rewrapVault } from "./migrate.js";
 import { uploadArchive, uploadPending } from "./upload.js";
 import { applyRetention, approveReclamation, evaluateRetention, pruneRedundantArchives, retentionSettings, setRetentionPolicy } from "./retention.js";
 import { startDaemon } from "./daemon.js";
 import { applySyncRules, describeSyncRules, resolveSyncRules } from "./sync-rules.js";
 import { buildContentIndex, dropContentIndex, search } from "./search.js";
+import { migrateBlobToSegments } from "./index-store.js";
 import { readAudit, toCsv } from "./audit.js";
 import { deleteProviderCredentials, loadProviderCredentials, storeProviderCredentials } from "./secrets.js";
-import { keyRecipientId, rawPublicKey } from "../packages/vaultline-crypto/src/index.js";
+import { keyRecipientId, rawPublicKey } from "../packages/sealkeep-crypto/src/index.js";
 import { generateKeyPairSync } from "node:crypto";
 import { hostname } from "node:os";
 import { readFile } from "node:fs/promises";
 import { runTui } from "./tui.js";
 import { assertNotDowngrade, verifyArtifact, verifyManifest } from "./update.js";
-import { autopilotStatus, disableAutopilot, enableAutopilot } from "./autopilot.js";
+import { autopilotStatus, disableAutopilot, enableAutopilot, reconcileMachineRetentionPolicy } from "./autopilot.js";
 import { liveness, readHeartbeat } from "./heartbeat.js";
 import { hasPasswordLock, unwrapPhrase, wrapPhrase } from "./password-lock.js";
 import { isMnemonic, PHRASE_WORDS, promptForPhrase, recoveryKit, verifyAgainstVault } from "./recovery.js";
 import { setupPlan } from "./storage-setup.js";
 import { connectGdrive } from "./providers/gdrive.js";
 import { resolveRecoveryPhrase } from "./secrets.js";
-import { amber, bold, blue, bytes, callout, command as cmd, dim, green, heading, hint, keyValue, mark, relativeTime, shortPath, steps, table, vaultline } from "./ui.js";
-import { envVar } from "./env.js";
-const VALUE_FLAGS = new Set(["--data-dir", "--recovery-phrase", "--agent", "--home", "--limit", "--executable", "--provider", "--bucket", "--prefix", "--region", "--older-than-days", "--status", "--max", "--port", "--overwrite", "--label", "--public-key", "--config-id", "--backend", "--endpoint", "--policy", "--grace-days", "--interval", "--manifest", "--artifact", "--key", "--current", "--api", "--token", "--group", "--cli-path", "--account-id", "--project", "--out", "--password"]);
+import { amber, bold, blue, bytes, callout, command as cmd, dim, divider, green, heading, hint, keyValue, mark, relativeTime, shortPath, steps, table } from "./ui.js";
+import { envVar, PREFIX as ENV_PREFIX } from "./env.js";
+import { automaticTranscriptIsEnabled, readLocalSettings } from "./machine-settings.js";
+import { normalizeDarwinServicePolicy, prepareLegacyDarwinManagerHandoff } from "./darwin-service-policy.js";
+const VALUE_FLAGS = new Set(["--data-dir", "--recovery-phrase", "--agent", "--home", "--limit", "--executable", "--provider", "--bucket", "--prefix", "--region", "--older-than-days", "--status", "--max", "--port", "--ui-port", "--overwrite", "--label", "--public-key", "--config-id", "--backend", "--endpoint", "--policy", "--grace-days", "--interval", "--manifest", "--artifact", "--key", "--current", "--api", "--token", "--group", "--cli-path", "--account-id", "--project", "--out", "--password", "--kind", "--text", "--channel", "--reword", "--mode", "--session", "--mirror", "--interval-ms", "--from-seq", "--from-byte", "--max-gb", "--priority", "--projects", "--id", "--email", "--code", "--passcode"]);
 function take(args, flag, fallback) { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : fallback; }
 function positionals(args) { return args.filter((value, index) => !value.startsWith("-") && !VALUE_FLAGS.has(args[index - 1] ?? "")); }
 function required(value, message) { if (!value)
@@ -134,7 +138,7 @@ async function pauseUntilWrittenDown() {
 /**
  * What a browser-opening command says for itself.
  *
- * The URL carries the bearer token in its fragment (see uiUrl in
+ * The URL carries a short-lived one-use bootstrap ticket (see uiUrl in
  * ui-server.ts), so it is deliberately *not* printed on the path where a
  * browser did open: scrollback outlives the session, gets pasted into issues,
  * and is captured whole by `script` and CI logs. The origin alone is enough to
@@ -153,14 +157,14 @@ function printUi(handle, dataDir, options = {}) {
         : `\n${BRAND}  ${handle.reused ? "already running on" : "settings on"} ${where}`);
     if (handle.browser.opened) {
         print(`  ${mark.ok()} Opened in your browser.`);
-        print(`  ${dim(`Nothing opened? Visit ${handle.origin} and paste the token from ${shortPath(localApiTokenPath(dataDir), 46)}`)}`);
+        print(`  ${dim(`Nothing opened? Run ${cmd("sealkeep ui")} again to mint a fresh secure link for this window.`)}`);
     }
     else {
         // `--no-browser` is a choice; warning that a browser "could not be opened"
         // would report a failure that never happened.
         if (!handle.browser.declined)
             print(`  ${mark.warn()} ${(handle.browser.problem ?? "No browser could be opened").replace(/\.$/, "")}.`);
-        print(`  ${dim("Open this link yourself. It carries the key to this window, so keep it off shared screens:")}`);
+        print(`  ${dim("Open this link yourself. Its sign-in ticket works once and expires quickly, so keep it off shared screens:")}`);
         print(`  ${handle.url}`);
     }
     if (handle.reused) {
@@ -186,7 +190,7 @@ function usage() {
             ["start", "first run: choose free or paid, get your recovery phrase"],
             ["enroll <code>", "set this machine up from the code in your account panel"],
             ["ui", "open the settings window in your browser"],
-            ["autopilot", "set it up once and let it run itself"],
+            ["autopilot [--reclaim]", "preserve, index, and upload automatically; local originals stay unless you opt in"],
             ["quickstart", "set up and queue existing sessions, without a background service"],
             ["setup", "create a vault and a recovery kit"],
             ["status", "what is archived, queued, and pending"],
@@ -202,23 +206,39 @@ function usage() {
             ["scan <path>", "find pasted secrets in transcripts before they are sealed in"],
             ["list", "browse archives"],
             ["search <query>", "search metadata, or contents with --content"],
+            ["why <commit>", "the session — and the reasoning — behind a git commit"],
             ["projects", "the project names this vault knows — the ones routing rules pin"],
             ["space members [project]", "who can open a project, and who can open everything"],
+            ["shared", "what you share and what is shared to you; normal agents attach it automatically"],
+            ["team", "who is working on what right now — the feed git does not have"],
+            ["now \"doing X\" --project P", "tell the team what you started; --done closes it"],
+            ["projects mode <name> active|passive", "active: a sealed session becomes searchable + announced in minutes"],
+            ["context <project|channel>", "write the compact pack an agent reads when it joins shared memory"],
+            ["claude <project|channel>", "start Claude Code with that shared memory attached"],
+            ["codex <project|channel>", "same launcher, for Codex"],
             ["index build", "build the local content index that --content searches"],
+            ["index migrate", "move the local index onto sealed, append-only segments"],
             ["index status", "what is searchable and what is not yet indexed"],
+            ["index drop", "remove the local index; the next build rebuilds it from your archives"],
             ["storage targets", "several storages at once, with limits, pins, and priority"],
             ["mcp install", "let your agents search this history themselves"],
-            ["recover <id> <dest>", "restore original bytes; --native puts it back where it came from, --key opens it as a registered recipient"],
+            ["bridge start <session> --channel <id>", "live-share an ongoing session; members follow it read-only"],
+            ["bridge watch <channel>", "follow a shared session live into a local mirror your agent can read"],
+            ["bridge push <channel> \"…\"", "speak into a shared channel; the driver's agent hears it next turn"],
+            ["bridge pull <channel>", "fetch teammates' bridge messages into this machine's inbox"],
+            ["bridge mode <ch> observe|suggest|open", "cooperation mode: choose how far teammates' words spread"],
+            ["bridge review · approve · reject", "suggest mode: your yes/no/reword before anything reaches your agent"],
+            ["recover <id> <dest>", "restore original bytes; --dry-run previews without writing, --native restores in place, while backup/replace retain a displaced file at a visible safety path"],
             ["recover <session-file>", "agent says a session file is missing? name it and it goes back where resume expects it"],
             ["tui", "the same view in the terminal"]
         ]),
         heading("Storage and retention"),
         keyValue([
-            ["cloud login/status", "sign in to managed storage (--code for a Google account), or check usage"],
+            ["cloud login/status", "sign in with --email and a --code from your account panel, or check usage"],
             ["cloud push <id>", "send one archive to managed storage"],
             ["cloud archives", "list what managed storage is holding"],
             ["cloud pull <ref> <dest>", "fetch one archive back out of managed storage"],
-            ["open <ref> <dest>", "fetch and decrypt one archive, on any machine"],
+            ["open <ref> <dest>", "fetch and decrypt one archive, on any machine; --key opens a colleague's"],
             ["plans", "what the storage packages cost"],
             ["verify", "prove every stored archive can still be read back"],
             ["storage setup", "guided setup for S3, R2, GCS, or Google Drive"],
@@ -227,14 +247,17 @@ function usage() {
             ["storage credentials", "store provider keys in the OS keychain"],
             ["upload --all", "upload and verify pending archives"],
             ["retention policy", "decide when sources may be reclaimed"],
-            ["retention apply", "dry run; add --confirm to move sources to the trash"],
+            ["retention apply", "dry run; add --confirm to permanently free verified local originals"],
             ["retention prune", "drop snapshots a newer archive already contains"],
-            ["retention offload", "remove local archives your bucket already holds"]
+            ["retention offload", "remove local archives your bucket already holds"],
+            ["squeeze", "measure what sealing this machine's sessions would save; source cleanup uses retention"]
         ]),
         heading("Keys and trust"),
         keyValue([
             ["recovery seal", "store a sealed copy of your key with your account"],
             ["recovery open", "read that sealed copy back, with your phrase"],
+            ["recovery codes", "replace and print five one-time lost-device backup codes"],
+            ["recovery restore", "restore a lost-device vault with one backup code"],
             ["device keygen", "mint a device key"],
             ["recipients", "list, add, or remove who can open new archives"],
             ["rewrap", "apply the current recipient set to existing archives"],
@@ -253,12 +276,6 @@ function usage() {
 }
 async function main() {
     const [command, ...args] = process.argv.slice(2);
-    // The product itself writes SEALKEEP_DATA_DIR into the agent configs that
-    // `mcp install` generates, and the MCP server honours it — so a person who
-    // exports it and then runs the CLI reasonably expects the same vault. It used
-    // to be ignored here, which meant the CLI quietly worked on a different vault
-    // than the agent did. An explicit --data-dir still wins over the variable.
-    const dataDir = take(args, "--data-dir", envVar("DATA_DIR") ?? defaultDataDir());
     const json = args.includes("--json");
     // --version is the first thing anyone types at an unfamiliar CLI, and it was
     // answering "Unknown command". Read it from the manifest rather than hardcoding
@@ -290,9 +307,33 @@ async function main() {
         print(usage());
         return;
     }
+    // `sealkeep setup --help` used to RUN setup, because --help was only ever
+    // read as the first word. Asking a destructive command what it does must
+    // never be the same as running it — this was caught rehearsing a company
+    // setup, where it re-ran setup against the operator's real vault.
+    if (args.includes("--help") || args.includes("-h")) {
+        print(usage());
+        print(`  ${dim(`Showing the full command list: ${command} takes its options from the line above.`)}\n`);
+        return;
+    }
+    // The product itself writes SEALKEEP_DATA_DIR into the agent configs that
+    // `mcp install` generates, and the MCP server honours it — so a person who
+    // exports it and then runs the CLI reasonably expects the same vault. It used
+    // to be ignored here, which meant the CLI quietly worked on a different vault
+    // than the agent did. An explicit --data-dir still wins over the variable.
+    // Resolve the discovered default lazily and only after data-independent help
+    // and version commands. Besides avoiding unnecessary reads, this is the
+    // escape hatch when discovery finds two real vaults: an explicit --data-dir
+    // (or environment setting) must be able to disambiguate them.
+    const dataDirFlag = args.indexOf("--data-dir");
+    const explicitDataDir = dataDirFlag >= 0 ? args[dataDirFlag + 1] : undefined;
+    if (dataDirFlag >= 0 && (!explicitDataDir || explicitDataDir.startsWith("--"))) {
+        fail("invalid_argument", "--data-dir requires a path");
+    }
+    const dataDir = explicitDataDir ?? envVar("DATA_DIR") ?? defaultDataDir();
     /**
-     * A bare `vaultline` on a machine with no vault is somebody who has just run
-     * `npm i -g vaultline`. Setting this product up belongs in a window, not in a
+     * A bare `sealkeep` on a machine with no vault is somebody who has just run
+     * `npm i -g sealkeep`. Setting this product up belongs in a window, not in a
      * wall of commands, so that case opens one.
      *
      * Three deliberate limits. An existing vault still prints help, because
@@ -329,15 +370,28 @@ async function main() {
             const liveDetail = status.running && status.live.state === "never-started"
                 ? "Installed. Waiting for its first check, which happens at login or within a minute."
                 : status.live.detail;
+            const localUi = status.ui.available && status.ui.origin
+                ? `${mark.ok()} ${status.ui.origin}${status.ui.fallback ? dim(` · 7477 was busy, using ${status.ui.port}`) : ""}${status.ui.supervised ? dim(" · kept available without opening a window") : dim(" · interactive window, not service-supervised")}`
+                : status.ui.supervised
+                    ? `${mark.warn()} retrying${status.ui.lastError ? dim(` · ${status.ui.lastError}`) : ""}`
+                    : status.running
+                        ? `${mark.warn()} not available yet ${dim("· the installed service will retry; check again")}`
+                        : dim("off with Autopilot");
             print(`\n${BRAND}  ${status.running ? green("autopilot on") : dim("autopilot off")}\n`);
             print(keyValue([
                 ["Right now", `${status.running && status.live.state === "never-started" ? dim("waiting") : liveMark}  ${dim(liveDetail)}`],
-                ["Done so far", status.live.totals ? `${status.live.totals.archived} sealed ${dim("·")} ${status.live.totals.uploaded} uploaded ${dim("·")} ${status.live.totals.reclaimed} reclaimed${status.live.totals.failed ? ` ${dim("·")} ${mark.warn()} ${status.live.totals.failed} failed` : ""}` : dim("nothing yet")],
-                ["Service", status.running ? `${status.service.kind} ${dim(`· ${shortPath(status.service.path, 52)}`)}` : dim("not installed")],
+                ["Done so far", status.live.totals ? `${status.live.totals.archived} sealed ${dim("·")} ${status.live.totals.indexed ?? 0} indexed ${dim("·")} ${status.live.totals.uploaded} uploaded ${dim("·")} ${status.live.totals.reclaimed} reclaimed${status.live.totals.failed ? ` ${dim("·")} ${mark.warn()} ${status.live.totals.failed} failed` : ""}` : dim("nothing yet")],
+                ["Service", status.running
+                        ? `${status.service.kind} ${dim(`· ${status.service.persistence === "boot" ? "starts at boot and survives logout" : "starts at login"} · ${shortPath(status.service.path, 52)}`)}`
+                        : dim("not installed")],
+                ["Local UI", localUi],
                 ["Unlocks itself", status.phraseAvailable ? `${mark.ok()} yes` : `${mark.warn()} no — sessions will queue but stay unsealed`],
                 ["Policy", `${status.retention.policy} ${dim(`· older than ${status.retention.olderThanDays}d · ${status.retention.graceDays}d grace`)}`],
-                ["Bucket", status.hasRemoteTarget ? "configured" : dim("none — nothing will be reclaimed")],
-                ["Queue", `${status.queue.ready} waiting ${dim("·")} ${status.queue.done} sealed`]
+                ["Reclaims", status.reclaimEnabled
+                        ? `enabled ${dim("· only eligible originals after every safety check")}`
+                        : dim("off on this machine · original sessions stay")],
+                ["Storage", status.hasRemoteTarget ? "configured" : dim("not connected yet · sealed archives stay on this machine")],
+                ["Queue", `${status.queue.ready} waiting ${dim("·")} ${status.queue.completed} sealed${status.queue.superseded ? ` ${dim(`· ${status.queue.superseded} obsolete snapshots skipped`)}` : ""}`]
             ]));
             print("");
             return;
@@ -348,15 +402,32 @@ async function main() {
                 print(JSON.stringify(result, null, 2));
                 return;
             }
+            if (result.service.installed) {
+                print(`\n  ${mark.warn()} Autopilot is still running. Nothing was removed.`);
+                if (result.service.note)
+                    print(`  ${result.service.note}`);
+                print(`  ${dim("Your phrase, hooks, policy, queue, and every archive were kept so the running service remains safe.")}\n`);
+                process.exitCode = 1;
+                return;
+            }
             print(`\n  ${mark.ok()} Autopilot off. The service is removed${result.forgotPhrase ? " and this machine has forgotten your phrase" : ""}.`);
+            if (result.hooksRemoved.length)
+                print(`  ${mark.ok()} Automatic agent hooks removed from ${result.hooksRemoved.join(" and ")}; unrelated hooks were kept.`);
+            if (result.service.note)
+                print(`  ${mark.warn()} ${result.service.note}`);
             print(`  ${dim("Every archive is still here. Nothing was deleted.")}\n`);
             return;
         }
         const dryRun = args.includes("--dry-run");
+        const explicitReclaim = args.includes("--reclaim");
+        const explicitNoReclaim = args.includes("--no-reclaim");
+        if (explicitReclaim && explicitNoReclaim) {
+            fail("invalid_argument", "Choose either --reclaim or --no-reclaim, not both");
+        }
         const result = await enableAutopilot(dataDir, {
             phrase: take(args, "--recovery-phrase"),
             remember: !args.includes("--no-remember"),
-            reclaim: !args.includes("--no-reclaim"),
+            reclaim: explicitReclaim ? true : explicitNoReclaim ? false : undefined,
             olderThanDays: take(args, "--older-than-days") ? Number(take(args, "--older-than-days")) : undefined,
             graceDays: take(args, "--grace-days") ? Number(take(args, "--grace-days")) : undefined,
             home: take(args, "--home"),
@@ -374,19 +445,43 @@ async function main() {
         print(heading(dryRun ? "What would happen" : "Autopilot is on"));
         print(keyValue([
             ["Watches", result.agents.length ? result.agents.join(" and ") : dim("no agents found yet")],
+            ["Agent memory", result.hooks.length
+                    ? `${dryRun ? "would install for" : "installed for"} ${result.hooks.join(" and ")} ${dim("· automatic recall, no daily commands")}`
+                    : dim("no supported agent hooks installed")],
             ["Found", result.found.sessions ? `${result.found.sessions} sessions ${dim(`· ${bytes(result.found.bytes)}`)}` : dim("nothing yet")],
             ["Seals", result.remembered
                     ? `automatically ${dim(`· phrase kept in ${result.remembered.backend}`)}`
                     : dryRun && !args.includes("--no-remember")
                         ? `automatically ${dim("· the phrase would be kept in this machine's keystore")}`
                         : `${mark.warn()} needs SEALKEEP_RECOVERY_PHRASE`],
-            ["Reclaims", result.reclaimEnabled ? `after ${result.retention.olderThanDays}d ${dim(`+ ${result.retention.graceDays}d grace, once a remote copy is verified`)}` : dim("never — sync only")],
-            ["Starts", result.service.installed ? `at login ${dim(`· ${result.service.kind}`)}` : dryRun ? dim(`${result.service.kind} service at ${shortPath(result.service.path, 44)}`) : `${mark.warn()} not installed`]
+            /**
+             * Sealing was the only stage this screen described, so someone turned
+             * autopilot on expecting "indexed, searchable, in the cloud" and got a
+             * pile of sealed files that no agent could find and no second machine
+             * held. What it DOES is what it should say — encryption included, since
+             * "will this leave my machine readable?" is the first question anyone has.
+             */
+            ["Encrypts", `on this machine, always ${dim("· nothing leaves readable, with or without a cloud copy")}`],
+            ["Indexes", `each sealed session ${dim("· searchable by your agents through the MCP server, before anything is reclaimed")}`],
+            ["Uploads", result.hasRemoteTarget
+                    ? `automatically to configured storage ${dim("· each copy is verified after upload")}`
+                    : dim("automatically once storage is connected · sealed archives stay here until then")],
+            ["Reclaims", result.reclaimEnabled
+                    ? `after ${result.retention.olderThanDays}d ${dim(`+ ${result.retention.graceDays}d grace and every final safety check`)}`
+                    : dim("off · original sessions stay on this machine; opt in with sealkeep autopilot --reclaim")],
+            ["Starts", result.service.installed
+                    ? result.service.persistence === "boot"
+                        ? `at boot and stays active after logout ${dim(`· ${result.service.kind}`)}`
+                        : `at login ${dim(`· ${result.service.kind}`)}`
+                    : dryRun ? dim(`${result.service.kind} service at ${shortPath(result.service.path, 44)}`) : `${mark.warn()} not installed`],
+            ["Local UI", result.service.installed
+                    ? `${uiProbeOrigin(DEFAULT_UI_PORT)} ${dim("· kept available by Autopilot; no login popup")}`
+                    : dryRun ? dim(`${uiProbeOrigin(DEFAULT_UI_PORT)} · would start with Autopilot`) : dim("not started")]
         ]));
         for (const note of result.notes)
             print(`\n  ${mark.warn()} ${note}`);
         if (!dryRun) {
-            print(`\n${vaultline()}`);
+            print(`\n${divider()}`);
             print(`${dim("  From here it runs on its own. Check on it with")} ${cmd("sealkeep autopilot status")}${dim(", or stop it with")} ${cmd("sealkeep autopilot off")}${dim(".")}\n`);
         }
         else {
@@ -395,10 +490,11 @@ async function main() {
         return;
     }
     if (command === "quickstart") {
-        const result = await setupVault(dataDir, take(args, "--recovery-phrase"));
-        const installs = await detectAgents(take(args, "--home"));
+        const home = take(args, "--home");
+        const result = await setupVault(dataDir, take(args, "--recovery-phrase"), { home });
+        const installs = await detectAgents(home);
         const detected = installs.filter((install) => install.detected);
-        const found = (await Promise.all(detected.map((install) => findTranscripts(install.agent, take(args, "--home"), 500)))).flat();
+        const found = (await Promise.all(detected.map((install) => findTranscripts(install.agent, home, 500)))).flat();
         const totalBytes = found.reduce((total, candidate) => total + candidate.bytes, 0);
         // What leaves this machine is decided here, before anything is queued — see sync-rules.ts.
         const { rules, source } = await resolveSyncRules(dataDir);
@@ -433,10 +529,10 @@ async function main() {
         print(heading("Next"));
         print(steps([
             `Encrypt what is queued:  ${cmd(`SEALKEEP_RECOVERY_PHRASE="…" sealkeep queue run`)}`,
-            `Archive automatically:   ${cmd("vaultline agents hook-config codex")} ${dim("(review, then merge)")}`,
+            `Archive automatically:   ${cmd("sealkeep agents hook-config codex")} ${dim("(review, then merge)")}`,
             `See it:                  ${cmd("sealkeep desktop")}`
         ]));
-        print(`\n${vaultline()}\n${dim("  Everything below that line is ciphertext. Nothing above it leaves this machine.")}\n`);
+        print(`\n${divider()}\n${dim("  Everything below that line is ciphertext. Nothing above it leaves this machine.")}\n`);
         return;
     }
     if (command === "start") {
@@ -486,7 +582,7 @@ async function main() {
                 mode: "free",
                 provider: take(args, "--provider", "s3"),
                 bucket: take(args, "--bucket") ?? fail("invalid_argument", "--bucket is required for the free tier"),
-                prefix: take(args, "--prefix", "vaultline"),
+                prefix: take(args, "--prefix", STORAGE_PREFIX_DEFAULT),
                 region: take(args, "--region"), accountId: take(args, "--account-id"), project: take(args, "--project")
             });
         if (json) {
@@ -563,7 +659,7 @@ async function main() {
         const cloud = await import("./cloud.js");
         const [action] = positionals(args);
         if (action === "login") {
-            const email = take(args, "--email") ?? fail("invalid_argument", "--email is required");
+            const email = take(args, "--email") ?? fail("invalid_argument", "Usage: sealkeep cloud login --email <you@example.com> --code <one-time code from your account panel>. A Google account can only sign in with a code.");
             // A one-time code from the panel is the only way in for an account that
             // signed up with Google, and it works for password accounts too.
             const code = take(args, "--code") ?? envVar("CLOUD_CODE");
@@ -605,18 +701,18 @@ async function main() {
             if (!archiveId)
                 fail("invalid_argument", "Usage: sealkeep cloud push <archive-id>");
             const result = await cloud.pushArchive(dataDir, archiveId).catch(async (error) => {
-                // cloud.ts's call() maps a 402 to a VaultlineError coded "forbidden"
-                // whose message is just whatever the control plane said — today a bare
-                // "Quota exceeded", no numbers, no next step. The message is the only
-                // signal available to tell that apart from an unrelated 403 without
-                // editing cloud.ts, so it is what we sniff.
-                if (isVaultlineError(error) && error.code === "forbidden" && /quota/i.test(error.message)) {
+                // A 402 now arrives coded `payment_required`, so this no longer has to
+                // guess whether a "forbidden" was really a billing answer. The quota
+                // test still stands, because 402 covers two different situations now —
+                // out of room, and not on a plan that includes this at all — and only
+                // the first should be rewritten into an accounting message.
+                if (isSealkeepError(error) && error.code === "payment_required" && /quota/i.test(error.message)) {
                     const account = await cloud.accountStatus(dataDir).catch(() => null);
                     if (account) {
                         const { quotaExceededMessage } = await import("./packages.js");
                         // The shared message is written for a screen. This is a terminal, so
                         // it names the command that shows the packages.
-                        fail("forbidden", `${quotaExceededMessage(account)} Run \`sealkeep plans\` to see them.`);
+                        fail("payment_required", `${quotaExceededMessage(account)} Run \`sealkeep plans\` to see them.`);
                     }
                 }
                 throw error;
@@ -656,14 +752,41 @@ async function main() {
             if (!vaultRef)
                 fail("invalid_argument", "Usage: sealkeep cloud pull <vault-ref> <destination>");
             const out = required(destination, "Destination is required");
-            const { ciphertext, bytes: size } = await cloud.pullCiphertext(dataDir, vaultRef);
-            await writeFile(out, ciphertext, { mode: 0o600 });
+            // A streamed archive is a folder of chunks, not one object, so pulling
+            // its reference used to 404. Raw bytes still mean raw bytes — the parts
+            // are written beside each other rather than silently concatenated into
+            // something no command can then open.
+            const parts = await cloud.managedArchiveParts(dataDir, vaultRef);
+            if (!parts.chunked) {
+                const { ciphertext, bytes: size } = await cloud.pullCiphertext(dataDir, vaultRef);
+                await writeFile(out, ciphertext, { mode: 0o600 });
+                if (json) {
+                    print(JSON.stringify({ vaultRef, output: out, bytes: size, chunked: false }, null, 2));
+                    return;
+                }
+                print(`\n  ${mark.ok()} Pulled ${bold(bytes(size))} to ${out}`);
+                print(dim(`  Open it with: sealkeep open ${vaultRef} <destination> --recovery-phrase …\n`));
+                return;
+            }
+            const { mkdir } = await import("node:fs/promises");
+            const { join: joinPath } = await import("node:path");
+            await mkdir(out, { recursive: true });
+            let total = 0;
+            const written = [];
+            for (const ref of parts.refs) {
+                const { ciphertext, bytes: size } = await cloud.pullCiphertext(dataDir, ref);
+                const name = ref.slice(vaultRef.length + 1);
+                await writeFile(joinPath(out, name), ciphertext, { mode: 0o600 });
+                written.push(name);
+                total += size;
+            }
             if (json) {
-                print(JSON.stringify({ vaultRef, output: out, bytes: size }, null, 2));
+                print(JSON.stringify({ vaultRef, output: out, bytes: total, chunked: true, parts: written }, null, 2));
                 return;
             }
-            print(`\n  ${mark.ok()} Pulled ${bold(bytes(size))} to ${out}`);
-            print(dim("  Decrypt it with: sealkeep recover <id> <destination> --recovery-phrase …\n"));
+            print(`\n  ${mark.ok()} Pulled ${bold(bytes(total))} as ${written.length} objects into ${out}`);
+            print(dim(`  This one was streamed, so it is a folder of chunks.`));
+            print(dim(`  Open it with: sealkeep open ${vaultRef} <destination> --recovery-phrase …\n`));
             return;
         }
         fail("invalid_argument", `Unknown cloud action: ${action}. Try login, logout, status, archives, push, or pull.`);
@@ -676,7 +799,7 @@ async function main() {
         if (password !== undefined && (password.length < 8 || password.length > 1024)) {
             fail("invalid_argument", "The vault password must be between 8 and 1024 characters.");
         }
-        const result = await setupVault(dataDir, take(args, "--recovery-phrase"));
+        const result = await setupVault(dataDir, take(args, "--recovery-phrase"), { home: take(args, "--home") });
         // Keep the phrase in this machine's keystore, the way the wizard does by
         // default. Without it a vault made from the terminal looked finished and
         // was not: the window's Archive button answered "this machine has no
@@ -710,13 +833,42 @@ async function main() {
                 }
             }
         }
+        // Match the browser first run: a signed-in paid setup creates the
+        // lost-every-device path while the one-time phrase is already in memory.
+        // No later `recovery codes` command or hidden configuration is required.
+        let recoveryCodes = [];
+        let recoveryKitWarning;
+        if (result.recoveryPhrase) {
+            try {
+                const cloud = await import("./cloud.js");
+                const account = await cloud.accountStatus(dataDir);
+                if (account.plan !== "free") {
+                    const kit = await import("./recovery-codes.js").then(({ createRecoveryCodes }) => createRecoveryCodes(dataDir, result.recoveryPhrase));
+                    recoveryCodes = kit.codes;
+                }
+            }
+            catch (error) {
+                // A local-only/free setup has no Cloud login and needs no hosted kit.
+                // Warn only when a signed-in/remote attempt actually failed.
+                if (!(isSealkeepError(error) && error.code === "unauthorized")) {
+                    recoveryKitWarning = `The Recovery Kit could not be stored (${error instanceof Error ? error.message.split("\n")[0] : "network error"}). Open Settings when this machine is online to create it.`;
+                }
+            }
+        }
         if (json) {
-            print(JSON.stringify({ ...result, remembered, ...(password ? { passwordLock } : {}) }, null, 2));
+            print(JSON.stringify({ ...result, remembered, recoveryCodes, ...(recoveryKitWarning ? { recoveryKitWarning } : {}), ...(password ? { passwordLock } : {}) }, null, 2));
             return;
         }
         print(`\n${BRAND}\n`);
         if (result.recoveryPhrase) {
             print(recoveryPhraseScreen(result.recoveryPhrase));
+            if (recoveryCodes.length) {
+                print(`\n  ${bold("ONE-TIME BACKUP CODES")} ${dim("· shown once · each works once")}`);
+                recoveryCodes.forEach((code, index) => print(`  ${dim(String(index + 1).padStart(2, "0"))}  ${bold(code)}`));
+                print(`\n  ${dim("Save these with your recovery phrase. A fresh signed-in machine can use either path.")}\n`);
+            }
+            else if (recoveryKitWarning)
+                print(`\n  ${mark.warn()} ${recoveryKitWarning}\n`);
             await pauseUntilWrittenDown();
             print(remembered
                 ? `  ${mark.ok()} This machine will unlock the vault on its own ${dim(`· phrase kept in ${remembered.backend}`)}`
@@ -755,6 +907,323 @@ async function main() {
         print(`\n${BRAND}\n`, recoveryPhraseScreen(phrase), "");
         return;
     }
+    /**
+     * The one command this product can be introduced by.
+     *
+     * Everything else here assumes you already believe the pitch. This assumes
+     * nothing: it reads your session folders, measures YOUR files with the real
+     * compressor, and prints what it would give back. It writes nothing, opens
+     * no socket and installs no service unless you pass --confirm.
+     *
+     * `--confirm` finishes the job rather than half of it. Archiving alone frees
+     * nothing — the reason a fresh install used to return zero bytes for thirty
+     * days is that retention counts from the archive date, which is the wrong
+     * clock for someone who ran a command called "squeeze" on a full disk. So
+     * this reclaims what it just sealed, immediately, and only what it can prove
+     * it sealed: the source has to still be byte-for-byte the file that was
+     * archived, or it is left alone. Sources go to the OS trash, never unlink —
+     * and because macOS does not return those bytes until the trash is emptied,
+     * this says so in plain words instead of reporting a number the disk will
+     * not agree with.
+     */
+    if (command === "squeeze") {
+        const home = take(args, "--home");
+        const confirm = args.includes("--confirm");
+        const requestedReclaim = take(args, "--reclaim");
+        if (requestedReclaim && requestedReclaim !== "trash" && requestedReclaim !== "delete") {
+            fail("invalid_argument", "--reclaim takes trash or delete");
+        }
+        // This older path sealed a local archive and then directly moved or
+        // unlinked native transcripts. It bypassed the verified remote/search
+        // gates, source journal, final activity/pin checks and Codex same-id
+        // pointer. Keep squeeze as a read-only estimator until it can delegate to
+        // the unified retention transaction; no flag can re-enable direct cleanup.
+        if (confirm || requestedReclaim) {
+            fail("invalid_argument", "Squeeze is measurement-only. To free disk safely, upload and index the archive, then use `sealkeep retention apply --confirm`; that path rechecks storage, search coverage, activity and pins and preserves Codex resume.");
+        }
+        /**
+         * Squeezing costs disk before it returns any, and on macOS the reclaimed
+         * source goes to ~/.Trash on the SAME volume — so nothing is freed until a
+         * person empties it. Run on a nearly-full disk, this used to seal until the
+         * write failed. `--limit` bounds one pass; the floor stops before the disk
+         * does, which is the state the people who need this command are actually in.
+         */
+        const limitArg = take(args, "--limit");
+        const limitBytes = limitArg ? Number(limitArg) * 1024 ** 3 : Infinity;
+        if (limitArg && !(limitBytes > 0))
+            fail("invalid_argument", "--limit takes a number of gigabytes, e.g. --limit 8");
+        /**
+         * How little room this may leave. It has to be small: the whole promise is
+         * that this works on a disk that is already out of space, so a floor of
+         * several hundred megabytes would refuse the exact machine it is for.
+         */
+        const FLOOR_BYTES = 64 * 1024 ** 2;
+        /**
+         * On macOS a reclaimed source is renamed into ~/.Trash — the SAME volume —
+         * so trashing frees nothing until a person empties it. That is fine when
+         * there is room to spare and useless when there is not, which is why the
+         * disk-pressure path has to be able to unlink instead. Trash stays the
+         * default; deleting is something you ask for.
+         */
+        const { freeBytes: freeOnDisk } = await import("./disk.js");
+        let stopped = null;
+        const installs = await detectAgents(home);
+        const detected = installs.filter((install) => install.detected);
+        if (!detected.length) {
+            print(`\n${BRAND}\n\n  ${dim("No Claude Code or Codex sessions found on this machine.")}\n`);
+            return;
+        }
+        const found = (await Promise.all(detected.map((install) => findTranscripts(install.agent, home, 5000)))).flat();
+        const total = found.reduce((sum, item) => sum + item.bytes, 0);
+        // A ratio measured on THIS machine's biggest session, not a number from a
+        // landing page — and measured the way the real run will do it. The sample
+        // is exactly one chunk, compressed alone, because that is what --confirm
+        // does to every chunk. Sampling a 128 MB whole-file window instead flatters
+        // the result: it finds duplicates across a span the real run never sees,
+        // and the preview would promise a number the operation cannot deliver.
+        const SQUEEZE_CHUNK = 64 * 1024 ** 2;
+        const biggest = [...found].sort((a, b) => b.bytes - a.bytes)[0];
+        let ratio = 0;
+        if (biggest) {
+            const { open } = await import("node:fs/promises");
+            const { squeezeSync } = await import("../packages/sealkeep-crypto/src/index.js");
+            const handle = await open(biggest.path, "r");
+            try {
+                const want = Math.min(biggest.bytes, SQUEEZE_CHUNK);
+                const buffer = Buffer.allocUnsafe(want);
+                const { bytesRead } = await handle.read(buffer, 0, want, 0);
+                const sample = buffer.subarray(0, bytesRead);
+                if (bytesRead > 0)
+                    ratio = bytesRead / squeezeSync(sample).length;
+            }
+            finally {
+                await handle.close();
+            }
+        }
+        const keeps = ratio > 0 ? Math.round(total / ratio) : 0;
+        if (json) {
+            print(JSON.stringify({ sessions: found.length, totalBytes: total, measuredRatio: Number(ratio.toFixed(1)), wouldKeepBytes: keeps, wouldFreeBytes: total - keeps, confirmed: confirm }, null, 2));
+            return;
+        }
+        print(`\n${BRAND}\n`);
+        print(heading("What is on this disk"));
+        for (const install of detected) {
+            const mine = found.filter((item) => item.agent === install.agent);
+            print(`  ${bold(install.agent.padEnd(12))} ${String(mine.length).padStart(5)} sessions   ${bytes(mine.reduce((s, i) => s + i.bytes, 0))}`);
+        }
+        print(`  ${dim("─".repeat(44))}`);
+        print(`  ${bold("total".padEnd(12))} ${String(found.length).padStart(5)} sessions   ${bold(bytes(total))}`);
+        if (!ratio) {
+            print(`\n  ${dim("Nothing measurable here yet.")}\n`);
+            return;
+        }
+        print(`\n${heading("What squeezing them gives back")}`);
+        print(`  Measured on your largest session: ${bold(`${ratio.toFixed(0)}x`)}`);
+        print(`  Kept, sealed and restorable:      ${bytes(keeps)}`);
+        print(`  Potential local allocation reduction: ${bold(bytes(total - keeps))}`);
+        print(`  ${dim("This command only measures. Safe cleanup requires a verified remote copy and searchable index.")}`);
+        if (!confirm) {
+            print(`\n  ${dim("Nothing has been touched. Nothing left this machine.")}`);
+            print(steps([`Safely free eligible sources:  ${cmd("sealkeep retention apply --confirm")}`]));
+            return;
+        }
+        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required");
+        const { stat: statFile } = await import("node:fs/promises");
+        let freed = 0, sealed = 0, skipped = 0, unverified = 0;
+        print(`\n${heading("Squeezing")}`);
+        /**
+         * SMALLEST FIRST, in passes.
+         *
+         * Biggest-first is the intuitive order and it is exactly wrong here: on a
+         * full disk the large sessions are the ones there is no room to seal, so
+         * the run stalls on its first candidate having freed nothing. A small
+         * session costs almost nothing to seal and hands back its own size, so
+         * starting small EARNS the room to reach the big ones. Anything that does
+         * not fit yet is deferred, and each pass retries the deferred list against
+         * the space the previous pass returned. It stops when a whole pass moves
+         * nothing, which is the real "cannot proceed".
+         */
+        /**
+         * A session an agent still has OPEN is not yours to reclaim.
+         *
+         * The size check below catches a session being appended to between sealing
+         * and reclaiming, but an agent sitting idle at a prompt holds its transcript
+         * open without changing a byte — so it passed that check and was deleted out
+         * from under a running Codex. The bytes survived in the vault and
+         * `recover --native` put them back, but resume would have found nothing.
+         * One lsof over the transcript roots is cheap and closes it properly.
+         */
+        const openNow = new Set();
+        const liveIds = new Set();
+        try {
+            const { execFile } = await import("node:child_process");
+            const { promisify } = await import("node:util");
+            const run = promisify(execFile);
+            // Held open at this instant.
+            const roots = [...new Set(found.map((item) => item.path.split("/").slice(0, -4).join("/")))].filter(Boolean);
+            for (const root of roots) {
+                const { stdout } = await run("lsof", ["-F", "n", "+D", root], { maxBuffer: 32 * 1024 * 1024 }).catch(() => ({ stdout: "" }));
+                for (const line of stdout.split("\n"))
+                    if (line.startsWith("n/"))
+                        openNow.add(line.slice(1));
+            }
+            /**
+             * And — the one that actually matters — being RESUMED by a live process.
+             *
+             * lsof alone is a point-in-time answer to a question that is not:
+             * an agent waiting at a prompt has its transcript CLOSED between turns,
+             * so it looks idle and reclaimable right up until it writes again. Two
+             * live Codex sessions were deleted that way. The session id is on the
+             * process command line for as long as the agent is running, which is the
+             * honest signal.
+             */
+            const { stdout: procs } = await run("ps", ["-Ao", "command="], { maxBuffer: 32 * 1024 * 1024 }).catch(() => ({ stdout: "" }));
+            for (const line of procs.split("\n")) {
+                // The AGENT's own process, not any command that merely mentions one.
+                // Matching the whole line scooped ids out of unrelated processes —
+                // including this tool's, whose working paths contain "claude" — and
+                // every session then looked live, so squeeze skipped work it should
+                // have done. The executable name is the claim; the rest is noise.
+                // An agent usually runs as `node /…/bin/codex resume <id>`, so argv0 is
+                // the interpreter and the agent is the SCRIPT. Check both, and nothing
+                // further along — the arguments are where unrelated paths live.
+                const head = line.trim().split(/\s+/).slice(0, 2);
+                const names = head.map((token) => token.split("/").pop()?.toLowerCase() ?? "");
+                if (!names.some((name) => name === "codex" || name === "claude"))
+                    continue;
+                for (const id of line.match(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi) ?? [])
+                    liveIds.add(id.toLowerCase());
+            }
+        }
+        catch { /* no lsof or ps: the size check below still catches active writers */ }
+        /**
+         * A standing "never take this one" list, read from `<dataDir>/never-reclaim`.
+         *
+         * Detecting a live agent only protects a session while its process is UP.
+         * Quit the agent and the same transcript becomes reclaimable, which is no
+         * use to someone who wants a particular session left alone permanently.
+         * One id or path fragment per line; `#` comments ignored.
+         */
+        const { join: joinPath } = await import("node:path");
+        const neverReclaim = await readFile(joinPath(dataDir, "never-reclaim"), "utf8")
+            .then((text) => text.split("\n").map((line) => line.split("#")[0].trim().toLowerCase()).filter(Boolean))
+            .catch(() => []);
+        const isLive = (path) => {
+            const lower = path.toLowerCase();
+            return openNow.has(path)
+                || [...liveIds].some((id) => lower.includes(id))
+                || neverReclaim.some((mark) => lower.includes(mark));
+        };
+        let heldOpen = 0;
+        let pending = [...found].sort((a, b) => a.bytes - b.bytes);
+        let pass = 0;
+        while (pending.length > 0 && pass < 24) {
+            pass += 1;
+            const deferred = [];
+            let movedThisPass = false;
+            for (const candidate of pending) {
+                if (freed >= limitBytes) {
+                    stopped = "limit";
+                    break;
+                }
+                const roomLeft = (await freeOnDisk(dataDir)) ?? Number.POSITIVE_INFINITY;
+                // What this one costs before it gives anything back: its archive, with
+                // room to be wrong about the ratio, plus a working margin.
+                const willCost = Math.ceil(candidate.bytes / Math.max(ratio, 1)) * 2 + 32 * 1024 ** 2;
+                if (isLive(candidate.path)) {
+                    heldOpen += 1;
+                    continue;
+                }
+                if (roomLeft - willCost < FLOOR_BYTES) {
+                    deferred.push(candidate);
+                    continue;
+                }
+                try {
+                    // Chunked, not whole-file. Whole-file zstd compresses ~58x against ~20x
+                    // here — but it also destroys ranged reads, and a ranged read is how
+                    // search quotes a line without decompressing a gigabyte. Squeezing a
+                    // disk should not cost the ability to find what was on it, so this
+                    // takes the smaller number and keeps the archives searchable. 64 MB
+                    // windows are wide enough to catch the repeated screenshots that make
+                    // these files large, and bounded enough not to blow up memory.
+                    const record = await archiveFile(dataDir, candidate.path, phrase, candidate.agent, { indexInline: true, project: candidate.project ?? undefined, projectKey: candidate.projectKey ?? undefined, compression: "zstd-chunk", chunkBytes: 64 * 1024 * 1024 });
+                    sealed += 1;
+                    // Only reclaim what is provably still the file that was just sealed —
+                    // a session the agent appended to since has bytes in no archive.
+                    const now = await statFile(candidate.path).catch(() => null);
+                    if (!now || !isV2(record) || now.size !== record.source.bytes) {
+                        skipped += 1;
+                        continue;
+                    }
+                    // READ IT BACK BEFORE TAKING THE ORIGINAL.
+                    //
+                    // Sealing checks hashes of bytes it computed on the way out; it never
+                    // opens what landed on disk. Trusting that and trashing the source is a
+                    // lower bar than this product sets for itself everywhere else —
+                    // `reclaimOne` refuses outright without a verified copy, and says in
+                    // its own docstring that such checks are what "protect against actual
+                    // data loss". Squeeze is local by design and has no remote copy to
+                    // verify against, so it must verify locally instead: decrypt the
+                    // archive and require the plaintext to hash to what the source hashed.
+                    // Anything less is asking a brand-new codec to be right on the first
+                    // try, with the only copy of someone's work as the stake.
+                    const { verifyArchiveReadsBack } = await import("./restore.js");
+                    const proof = await verifyArchiveReadsBack(dataDir, record.id, phrase, record.source.sha256);
+                    if (!proof) {
+                        unverified += 1;
+                        continue;
+                    }
+                    // Defense in depth: the command-level guard above makes this branch
+                    // unreachable, and this inner boundary also refuses cleanup. Native
+                    // sources may only leave through retention's durable transaction.
+                    throw new Error("squeeze source cleanup is disabled; use retention apply");
+                }
+                catch {
+                    skipped += 1;
+                }
+            }
+            if (stopped)
+                break;
+            pending = deferred;
+            if (!movedThisPass) {
+                stopped = "disk";
+                break;
+            }
+        }
+        const stillTooBig = pending.length;
+        print(`  ${mark.ok()} Sealed ${bold(String(sealed))} sessions · no native sources reclaimed`);
+        if (stillTooBig && stopped !== "limit")
+            print(`  ${dim(`${stillTooBig} still too large for the room available — free more, then run this again.`)}`);
+        if (heldOpen)
+            print(`  ${dim(`${heldOpen} left alone — a running agent, or listed in never-reclaim.`)}`);
+        if (skipped)
+            print(`  ${dim(`${skipped} left alone — still being written, or already archived.`)}`);
+        if (unverified)
+            print(`  ${amber(`${unverified} sealed but NOT reclaimed — the archive did not read back. Your originals are untouched.`)}`);
+        if (stopped === "limit")
+            print(`  ${dim(`Stopped at your --limit of ${limitArg} GB. Run it again for the rest.`)}`);
+        if (stopped === "disk")
+            print(`  ${amber(`Stopped with ${bytes(FLOOR_BYTES)} free — empty the trash to reclaim what was just sealed, then run this again.`)}`);
+        /**
+         * Sealing is one stage of three. This command reclaims a disk and then says
+         * nothing about the archives being neither searchable nor off this machine,
+         * which is how someone ends up with 131 GB "preserved" that no agent can
+         * find and no second machine holds. Name what is left.
+         */
+        if (sealed > 0) {
+            const { indexCoverage } = await import("./search.js").catch(() => ({ indexCoverage: null }));
+            const cover = indexCoverage ? await indexCoverage(dataDir).catch(() => null) : null;
+            const unindexed = cover ? cover.total - cover.indexed : sealed;
+            if (unindexed > 0) {
+                print(`\n  ${amber(`${unindexed} archives are sealed but NOT searchable yet.`)}`);
+                print(steps([`Make them searchable:  ${cmd("sealkeep index build")}`, `Put them somewhere else too:  ${cmd("sealkeep upload --all")}`]));
+            }
+        }
+        print(`\n  ${bold("Every native source is still on this disk.")}`);
+        print(`  ${dim("Use retention after upload and indexing to reclaim an eligible source safely:")}`);
+        print(steps([`Put one back:  ${cmd("sealkeep recover <session-file>")}`]));
+        return;
+    }
     if (command === "status") {
         const status = { ...(await vaultStatus(dataDir)), queue: await new ArchiveQueue(dataDir).stats() };
         if (json) {
@@ -776,9 +1245,9 @@ async function main() {
         const rows = [
             ["Background", live.state === "running" ? `${green("running")} ${dim(live.detail.replace(/^Running\. /, ""))}` : live.state === "late" ? `${amber("late")} ${dim(live.detail)}` : dim(live.detail)],
             ["Archives", `${bold(String(status.archiveCount))} ${dim(`· ${bytes(status.archivedBytes)} of history preserved`)}`],
-            ["Queue", `${status.queue.ready} ready ${dim("·")} ${status.queue.leased} in flight ${dim("·")} ${status.queue.done} archived${status.queue.failed ? ` ${dim("·")} ${mark.fail()} ${status.queue.failed} failed` : ""}`],
+            ["Queue", `${status.queue.ready} ready ${dim("·")} ${status.queue.leased} in flight ${dim("·")} ${status.queue.completed} archived${status.queue.superseded ? ` ${dim("·")} ${status.queue.superseded} obsolete snapshots skipped` : ""}${status.queue.failed ? ` ${dim("·")} ${mark.fail()} ${status.queue.failed} failed` : ""}`],
             ["Remote", status.remoteStorage
-                    ? `${status.remoteStorage.provider}://${status.remoteStorage.bucket}/${status.remoteStorage.prefix}`
+                    ? `${providerLabel(status.remoteStorage.provider)} ${dim(`· ${status.remoteStorage.bucket}/${status.remoteStorage.prefix}`)}`
                     // A managed machine has no bucket of its own. Saying "none configured"
                     // to someone whose archives are in our storage is the same falsehood
                     // doctor was telling.
@@ -820,6 +1289,13 @@ async function main() {
         // to pass the flag. Demanding the flag unconditionally — which this line
         // used to do — made `archive` the one command a normal setup could not run.
         const phraseForSeal = required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required");
+        // The agent is knowable from where the file lives: a Claude or Codex
+        // transcript archived by hand gets the same agent — and therefore the same
+        // project derivation — the watcher would have given it. Only a
+        // project-tagged session is ever recalled automatically; "custom", which
+        // used to label every hand-sealed file, left them invisible to that lane.
+        const { agentForTranscriptPath, projectIdentityOfRecord } = await import("./adapters.js");
+        const agentName = take(args, "--agent") ?? agentForTranscriptPath(source) ?? "custom";
         if (args.includes("--stream")) {
             // Chunk → encrypt → send: the ciphertext never touches this disk. Needs
             // a configured own bucket; the seal is verified in the provider's own
@@ -845,19 +1321,10 @@ async function main() {
             // bucket self-recovering. --single-object keeps the old multipart path.
             if (!args.includes("--single-object")) {
                 const { sealToChunkFolder } = await import("./chunk-store.js");
-                const agentName = take(args, "--agent", "custom") ?? "custom";
                 const explicitTarget = take(args, "--target");
-                const { claudeProjectFromPath, codexProjectFromRollout } = await import("./adapters.js");
-                const project = await (async () => {
-                    try {
-                        if (agentName === "claude")
-                            return claudeProjectFromPath(source).project;
-                        if (agentName === "codex")
-                            return (await codexProjectFromRollout(source, new Date().toISOString())).project;
-                    }
-                    catch { /* no project is a folder called no-project, not an error */ }
-                    return null;
-                })();
+                const identity = await projectIdentityOfRecord({ source: { path: source, agent: agentName }, createdAt: new Date().toISOString() })
+                    .catch(() => ({ project: null, projectKey: null, projectPath: null }));
+                const { project, projectKey } = identity;
                 // Multi-target routing happens up here so a project pinned to Google
                 // Drive takes the single-object road (Drive holds whole objects), and
                 // everything else streams chunk folders to its routed target.
@@ -867,9 +1334,9 @@ async function main() {
                 if (routed.provider === "gdrive") {
                     const { archiveFile } = await import("./vault.js");
                     const { uploadArchive } = await import("./upload.js");
-                    const record = await archiveFile(dataDir, source, phraseForSeal, agentName, { project });
+                    const record = await archiveFile(dataDir, source, phraseForSeal, agentName, { project, projectKey, indexInline: true });
                     const uploaded = await uploadArchive(dataDir, record.id, {
-                        remoteStorage: { provider: "gdrive", bucket: routed.bucket ?? "gdrive", prefix: routed.prefix ?? "vaultline", region: routed.region },
+                        remoteStorage: { provider: "gdrive", bucket: routed.bucket ?? "gdrive", prefix: routed.prefix ?? STORAGE_PREFIX_DEFAULT, region: routed.region },
                         targetId: routed.id
                     });
                     if (json) {
@@ -879,30 +1346,43 @@ async function main() {
                     print(`  ${mark.ok()} Archived ${bold(bytes(record.source.bytes))} to Google Drive ${dim(`(target "${routed.id}", single object)`)}`);
                     return;
                 }
-                const outcome = await sealToChunkFolder(dataDir, source, phraseForSeal, agentName, { project, resume: !fresh, targetId: routed.id });
+                const outcome = await sealToChunkFolder(dataDir, source, phraseForSeal, agentName, { project, projectKey, resume: !fresh, targetId: routed.id });
                 if (json) {
                     print(JSON.stringify({ id: outcome.record.id, bytes: outcome.record.source.bytes, storedBytes: outcome.storedBytes, folder: outcome.folder, chunks: outcome.chunkCount, reusedChunks: outcome.reusedChunks, indexed: outcome.indexed, streamed: true }, null, 2));
                     return;
                 }
-                print(`  ${mark.ok()} Archived ${bold(bytes(outcome.record.source.bytes))} into ${outcome.record.remote?.provider}://…/${outcome.folder.split("/").slice(-3).join("/")}/ ${dim(`(${outcome.chunkCount} chunks)`)}`);
+                print(`  ${mark.ok()} Archived ${bold(bytes(outcome.record.source.bytes))} into ${providerLabel(outcome.record.remote?.provider ?? "")} …/${outcome.folder.split("/").slice(-3).join("/")}/ ${dim(`(${outcome.chunkCount} chunks)`)}`);
                 if (outcome.reusedChunks > 0)
                     print(`    ${dim(`↻ resumed: ${outcome.reusedChunks} chunks were already in the bucket, verified instead of re-sent`)}`);
                 print(`    ${dim(`${bytes(outcome.storedBytes)} sealed and verified; this disk held at most ${bytes(outcome.heldAtMostBytes)} of it at any moment`)}`);
                 return;
             }
-            const outcome = await sealArchiveToCloud(dataDir, source, phraseForSeal, take(args, "--agent", "custom") ?? "custom", { resume: !fresh });
+            const streamAgent = agentName;
+            const streamIdentity = await projectIdentityOfRecord({ source: { path: source, agent: streamAgent }, createdAt: new Date().toISOString() })
+                .catch(() => ({ project: null, projectKey: null, projectPath: null }));
+            const outcome = await sealArchiveToCloud(dataDir, source, phraseForSeal, streamAgent, { resume: !fresh, project: streamIdentity.project, projectKey: streamIdentity.projectKey });
             if (json) {
                 print(JSON.stringify({ id: outcome.record.id, bytes: outcome.record.source.bytes, storedBytes: outcome.storedBytes, objectKey: outcome.objectKey, streamed: true }, null, 2));
                 return;
             }
-            print(`  ${mark.ok()} Archived ${bold(bytes(outcome.record.source.bytes))} straight to ${outcome.record.remote?.provider} ${dim(`→ ${outcome.record.id}`)}`);
+            print(`  ${mark.ok()} Archived ${bold(bytes(outcome.record.source.bytes))} straight to ${providerLabel(outcome.record.remote?.provider ?? "")} ${dim(`→ ${outcome.record.id}`)}`);
             print(`    ${dim(`${bytes(outcome.storedBytes)} sealed and verified in the bucket; this disk held at most ${bytes(outcome.heldAtMostBytes)} of it at any moment`)}`);
             return;
         }
         // A project named here decides which members are wrapped in, so an
         // archive shared with a colleague is the one they were actually given.
-        const localProject = take(args, "--project") ?? null;
-        const record = await archiveFile(dataDir, source, phraseForSeal, take(args, "--agent", "custom"), { project: localProject });
+        // An explicit --project still wins; otherwise the agent's own derivation
+        // (recorded cwd, git remote) tags the session the way the watcher would.
+        const namedProject = take(args, "--project");
+        const localIdentity = namedProject === undefined
+            ? await projectIdentityOfRecord({ source: { path: source, agent: agentName }, createdAt: new Date().toISOString() })
+                .catch(() => ({ project: null, projectKey: null, projectPath: null }))
+            : { project: namedProject, projectKey: null, projectPath: null };
+        const record = await archiveFile(dataDir, source, phraseForSeal, agentName, {
+            indexInline: true,
+            project: localIdentity.project ?? null,
+            ...(localIdentity.projectKey ? { projectKey: localIdentity.projectKey } : {}),
+        });
         if (json) {
             print(JSON.stringify({ id: record.id, bytes: record.source.bytes, objectPath: record.objectPath, deduplicated: record.deduplicated }, null, 2));
             return;
@@ -910,6 +1390,20 @@ async function main() {
         print(record.deduplicated
             ? `  ${mark.ok()} Already archived, unchanged since ${relativeTime(record.createdAt)} ${dim(`(${record.id})`)}`
             : `  ${mark.ok()} Archived ${bold(bytes(record.source.bytes))} ${dim(`→ ${record.id}`)}`);
+        // "New seals index themselves" was only true of daemon seals; this command
+        // and `queue run` left theirs unsearchable while doctor promised otherwise.
+        // The build is incremental — only what was just sealed gets decrypted.
+        if (!record.deduplicated) {
+            try {
+                const { buildContentIndex } = await import("./search.js");
+                const built = await buildContentIndex(dataDir, phraseForSeal, { sync: false });
+                if (built.indexedNow > 0)
+                    print(`    ${dim("searchable — `sealkeep search --content` finds it")}`);
+            }
+            catch {
+                print(`    ${dim("not indexed yet — `sealkeep index build` adds it")}`);
+            }
+        }
         return;
     }
     /**
@@ -968,10 +1462,49 @@ async function main() {
         const limit = take(args, "--limit");
         if (!json)
             print(`\n${heading("Checking every archive is really there")}`);
-        const checks = await cloud.verifyArchives(dataDir, {
-            limit: limit ? Number(limit) : undefined,
-            onProgress: json ? undefined : (check) => print(`  ${check.ok ? mark.ok() : mark.warn()} ${check.vaultRef}${check.ok ? dim(` ${bytes(check.bytes)}`) : `  ${check.problem}`}`)
-        });
+        const cap = limit ? Number(limit) : undefined;
+        const show = (check) => print(`  ${check.ok ? mark.ok() : mark.warn()} ${check.vaultRef}${check.ok ? dim(` ${bytes(check.bytes)}`) : `  ${check.problem}`}`);
+        let checks = [];
+        let local = false;
+        try {
+            checks = await cloud.verifyArchives(dataDir, { limit: cap, onProgress: json ? undefined : show });
+        }
+        catch (error) {
+            /**
+             * A vault with no cloud copies is not a broken vault. This used to stop
+             * at "Not signed in to Sealkeep Cloud" on a local-only vault — the one
+             * case where the answer needs no network at all, because the ciphertext
+             * is on this disk. Read it back and prove it instead of refusing.
+             */
+            if (!(isSealkeepError(error) && error.code === "unauthorized"))
+                throw error;
+        }
+        /**
+         * Local copies are checked WHETHER OR NOT there are cloud ones.
+         *
+         * Being signed in used to send this down the cloud path alone, so a machine
+         * holding 1,035 local archives and no cloud copies was told "Nothing stored
+         * yet." — the most alarming possible sentence to read just after reclaiming
+         * the originals. Proving a local archive costs no disk now, so there is no
+         * reason left to skip it.
+         */
+        const cloudCount = checks.length;
+        {
+            const { verifyArchiveReadsBack } = await import("./restore.js");
+            const records = (await listArchives(dataDir)).filter((record) => record.version === 2);
+            if (records.length)
+                local = true;
+            const phrase = records.length
+                ? required(await unlock(dataDir, take(args, "--recovery-phrase")), "Reading a local archive back needs --recovery-phrase")
+                : "";
+            for (const record of (typeof cap === "number" ? records.slice(0, cap) : records)) {
+                const ok = await verifyArchiveReadsBack(dataDir, record.id, phrase, record.source.sha256).catch(() => false);
+                const check = { vaultRef: record.id.slice(0, 8), ok, bytes: record.source.bytes, ...(ok ? {} : { problem: "did not read back" }) };
+                checks.push(check);
+                if (!json)
+                    show(check);
+            }
+        }
         const broken = checks.filter((check) => !check.ok);
         if (json) {
             print(JSON.stringify({ checked: checks.length, broken: broken.length, checks }, null, 2));
@@ -980,8 +1513,11 @@ async function main() {
             print(dim("  Nothing stored yet.\n"));
         else if (broken.length)
             print(`\n  ${mark.warn()} ${bold(String(broken.length))} of ${checks.length} could not be read back. Re-archive them.\n`);
-        else
-            print(`\n  ${mark.ok()} All ${checks.length} archives fetched back and matched their recorded hash.\n`);
+        else {
+            const where = cloudCount && local ? `${cloudCount} fetched back, ${checks.length - cloudCount} read back from this disk`
+                : local ? "read back from this disk" : "fetched back";
+            print(`\n  ${mark.ok()} All ${checks.length} archives ${where} and matched their recorded hash.\n`);
+        }
         if (broken.length)
             process.exitCode = 1;
         return;
@@ -1039,28 +1575,287 @@ async function main() {
         }
         fail("invalid_argument", "Usage: sealkeep space members [project]");
     }
+    /**
+     * The awareness tier git lacks: who is on what, right now. `team` reads the
+     * feed; `now` speaks into it. Presence is facts — no gate, no approval —
+     * and each event is one sealed line, so the feed costs bytes, not budget.
+     */
+    if (command === "team") {
+        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "Reading the team feed needs the recovery phrase");
+        const { listPresence, activeNow } = await import("./presence.js");
+        const project = take(args, "--project");
+        const events = await listPresence(dataDir, phrase, { project: project ?? undefined, limit: Number(take(args, "--limit", "25")) });
+        const active = activeNow(events);
+        if (json) {
+            print(JSON.stringify({ active, events }, null, 2));
+            return;
+        }
+        print(`\n${heading("Working right now")}`);
+        if (!active.length)
+            print(`  ${dim("Nobody has an open `started` yet. In Team mode, normal Claude Code and Codex sessions publish automatically.")}`);
+        const presenceAuthor = (event) => event.authorAccountId === undefined
+            ? event.from
+            : `${event.from} [account #${event.authorAccountId}]`;
+        for (const event of active)
+            print(`  ${green("●")} ${bold(presenceAuthor(event))} ${dim("·")} ${event.project} ${dim("·")} ${event.line} ${dim(`· ${relativeTime(event.at)}`)}`);
+        print(`\n${heading("Recent")}`);
+        for (const event of events.slice(0, 12)) {
+            const markKind = event.kind === "started" ? green("▶") : event.kind === "finished" ? dim("■") : dim("·");
+            print(`  ${markKind} ${presenceAuthor(event)} ${dim("·")} ${event.project} ${dim("·")} ${event.line} ${dim(`· ${relativeTime(event.at)}`)}`);
+        }
+        print("");
+        return;
+    }
+    if (command === "now") {
+        const line = positionals(args).join(" ");
+        const project = take(args, "--project");
+        const done = args.includes("--done");
+        if (!project)
+            fail("invalid_argument", "Usage: sealkeep now \"what you are doing\" --project <name> [--done]");
+        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "Publishing presence needs the recovery phrase");
+        const { publishPresence } = await import("./presence.js");
+        const { event } = await publishPresence(dataDir, { project, kind: done ? "finished" : "started", line: line || (done ? "done" : "working") }, phrase);
+        if (json) {
+            print(JSON.stringify(event, null, 2));
+            return;
+        }
+        print(`  ${mark.ok()} ${done ? "Closed" : "Announced"}: ${bold(event.from)} ${done ? "finished" : "started"} on ${bold(project)} — “${event.line}”`);
+        if (!done)
+            print(`  ${dim("Close it later with: sealkeep now --project " + project + " --done")}`);
+        return;
+    }
+    /**
+     * The Shared surface, in the terminal: projects with members, who can open
+     * everything, and the live channels this machine follows — each with the
+     * command that starts an agent from it. The dashboard's Shared view renders
+     * this same listing over GET /v1/space.
+     */
+    if (command === "shared") {
+        const { listSharedSpaces } = await import("./shared-spaces.js");
+        const spaces = await listSharedSpaces(dataDir);
+        if (json) {
+            print(JSON.stringify(spaces, null, 2));
+            return;
+        }
+        print(`\n${heading("Shared projects")}`);
+        if (spaces.projects.length === 0)
+            print(`  ${dim("Nothing shared yet. `sealkeep recipients add --project <name>` lets a teammate into one project.")}`);
+        for (const project of spaces.projects) {
+            const last = project.lastSealedAt ? relativeTime(project.lastSealedAt) : "nothing sealed yet";
+            print(`\n  ${bold(project.name)} ${dim(`· ${project.archives} session${project.archives === 1 ? "" : "s"} · ${last}`)}`);
+            for (const member of project.members)
+                print(`    ${green("●")} ${member.label} ${dim(member.id.slice(0, 12))}`);
+            if (project.members.length === 0)
+                print(`    ${dim("no members yet — only this vault's own keys open it")}`);
+            print(`    ${hint("normal Claude Code and Codex sessions attach this project's shared context automatically")}`);
+        }
+        if (spaces.vaultWide.length) {
+            print(`\n${heading("Members of everything")}`);
+            for (const member of spaces.vaultWide)
+                print(`  ${green("●")} ${member.label} ${dim(member.id.slice(0, 12))}`);
+        }
+        if (spaces.channels.length) {
+            print(`\n${heading("Live channels this machine follows")}`);
+            for (const channel of spaces.channels) {
+                print(`  ${bold(channel.channel)} ${dim(`· mirror ${bytes(channel.bytes)} · updated ${relativeTime(channel.updatedAt)}`)}`);
+                print(`    ${hint("the followed mirror is attached automatically on this machine")}`);
+            }
+        }
+        print("");
+        return;
+    }
+    if (command === "context") {
+        const { buildContextPack } = await import("./shared-spaces.js");
+        const ref = required(positionals(args)[0], "Usage: sealkeep context <project|channel>");
+        const pack = await buildContextPack(dataDir, ref);
+        if (json) {
+            print(JSON.stringify({ ref: pack.ref, kind: pack.kind, path: pack.path }, null, 2));
+            return;
+        }
+        print(`\n  ${mark.ok()} Context pack for ${bold(pack.ref)} ${dim(`(${pack.kind})`)} → ${shortPath(pack.path)}\n`);
+        print(pack.markdown);
+        return;
+    }
+    /**
+     * The launcher: `sealkeep claude <ref>` / `sealkeep codex <ref>` starts the
+     * agent with the shared memory attached — context pack written, one-line
+     * pointer injected the way that agent accepts context, env set. `resume` /
+     * `start` / `session` as a first word are accepted and ignored so the
+     * spelling people reach for ("sealkeep codex resume team-x") just works.
+     * `--print` (or a missing binary) shows the exact command instead of running
+     * it, so this never half-starts an interactive tool.
+     */
+    if (command === "claude" || command === "codex") {
+        const { buildLaunchPlan } = await import("./shared-spaces.js");
+        // Everything after "--" belongs to the agent VERBATIM — the launcher's own
+        // token scanning (resume-sugar, --print) touches only its half, so
+        // `sealkeep claude myproj -- --print` hands --print through to claude.
+        // The sugar strips at most ONE leading resume/start/session token, so a
+        // project literally named "resume" still launches: `sealkeep claude resume
+        // resume` (first token is sugar, second is the ref).
+        const separator = args.indexOf("--");
+        const mine = separator >= 0 ? args.slice(0, separator) : [...args];
+        const passthrough = separator >= 0 ? args.slice(separator + 1) : [];
+        if (mine[0] === "resume" || mine[0] === "start" || mine[0] === "session")
+            mine.shift();
+        const printOnly = mine.includes("--print");
+        const filtered = mine.filter((token) => token !== "--print");
+        const ref = required(filtered.shift(), `Usage: sealkeep ${command} <project|channel> [--print] [-- extra agent args]`);
+        const plan = await buildLaunchPlan(dataDir, command, ref, [...filtered, ...passthrough]);
+        const shellCommand = plan.argv.map((part) => (/\s/.test(part) ? JSON.stringify(part) : part)).join(" ");
+        print(`  ${mark.ok()} Context pack ${dim(shortPath(plan.pack.path))} ${dim(`(${plan.pack.kind}: ${plan.pack.ref})`)}`);
+        // Awareness, both directions — and strictly best-effort: a plane hiccup
+        // must never keep an agent from starting.
+        if (plan.pack.kind === "project") {
+            try {
+                const quietPhrase = await unlock(dataDir);
+                if (quietPhrase) {
+                    const { listPresence, activeNow, publishPresence } = await import("./presence.js");
+                    const active = activeNow(await listPresence(dataDir, quietPhrase, { project: ref, limit: 20 }));
+                    const { bridgeSender } = await import("./bridge.js");
+                    const me = await bridgeSender(dataDir);
+                    for (const event of active.filter((e) => e.sender !== me.id)) {
+                        print(`  ${mark.warn()} ${bold(event.from)} is already on ${bold(ref)} ${dim(`(${relativeTime(event.at)})`)}: “${event.line}” — coordinate before doubling the work.`);
+                    }
+                    await publishPresence(dataDir, { project: ref, kind: "started", line: `working with ${command}` }, quietPhrase);
+                    print(`  ${dim(`Announced to the team feed: started on ${ref} · close with \`sealkeep now --project ${ref} --done\``)}`);
+                }
+            }
+            catch { /* offline or passive setups just launch */ }
+        }
+        print(`  ${dim("If sealkeep_* tools are missing inside the agent: sealkeep mcp install")}`);
+        if (printOnly) {
+            print(`\n  ${cmd(shellCommand)}\n`);
+            return;
+        }
+        const { spawn } = await import("node:child_process");
+        const child = spawn(plan.argv[0], plan.argv.slice(1), { stdio: "inherit", env: { ...process.env, ...plan.env } });
+        await new Promise((resolve) => {
+            child.on("error", (error) => {
+                if (error.code === "ENOENT") {
+                    print(`\n  ${mark.warn()} ${bold(command)} is not on PATH here. Run it yourself:`);
+                    print(`  ${cmd(shellCommand)}\n`);
+                }
+                else
+                    print(`  ${mark.fail()} ${String(error)}`);
+                process.exitCode = 1;
+                resolve();
+            });
+            child.on("exit", (code) => { process.exitCode = code ?? 0; resolve(); });
+        });
+        return;
+    }
+    if (command === "projects" && args[0] === "backfill") {
+        /**
+         * Writes the project onto records that never recorded one.
+         *
+         * `projectOfRecord` answers from the record when the seal stored a project
+         * and otherwise re-reads the original transcript off disk. That fallback
+         * has an expiry date: reclaim the source and the answer is gone for good,
+         * taking membership with it — a project nobody can name is a project no
+         * colleague can be added to, and `rewrap --project` re-keys nothing while
+         * reporting the archives belong somewhere else.
+         *
+         * So this is run BEFORE reclaiming, not after. It only adds a field that
+         * was already derivable; it never overwrites one a seal recorded, and an
+         * archive whose project cannot be determined is left exactly as it was.
+         */
+        const { listArchives } = await import("./vault.js");
+        const { projectOfRecord } = await import("./adapters.js");
+        const { writeFile: write, readFile: read } = await import("node:fs/promises");
+        const { join: joinPath } = await import("node:path");
+        const confirm = args.includes("--confirm");
+        const records = await listArchives(dataDir);
+        const config = await readConfig(dataDir);
+        const pending = [];
+        let already = 0, undecidable = 0;
+        for (const record of records) {
+            if ("project" in record.source && record.source.project) {
+                already += 1;
+                continue;
+            }
+            const project = await projectOfRecord(record).catch(() => null);
+            if (!project) {
+                undecidable += 1;
+                continue;
+            }
+            pending.push({ id: record.id, project });
+        }
+        if (json) {
+            print(JSON.stringify({ already, undecidable, wouldWrite: pending.length, confirmed: confirm }, null, 2));
+        }
+        else {
+            print(`\n${BRAND}\n`);
+            print(heading("Project attribution"));
+            print(`  ${String(already).padStart(5)} already recorded`);
+            print(`  ${String(pending.length).padStart(5)} can still be recovered from the source on disk`);
+            print(`  ${String(undecidable).padStart(5)} cannot be determined`);
+            const byProject = new Map();
+            for (const item of pending)
+                byProject.set(item.project, (byProject.get(item.project) ?? 0) + 1);
+            for (const [name, count] of [...byProject].sort((a, b) => b[1] - a[1]).slice(0, 8)) {
+                print(`        ${String(count).padStart(4)}  ${bold(name)}`);
+            }
+        }
+        if (!confirm) {
+            if (!json) {
+                print(`\n  ${dim("Nothing written. Run this before reclaiming sources — afterwards the")}`);
+                print(`  ${dim("original files are gone and the project can no longer be derived.")}`);
+                print(steps([`Write them:  ${cmd("sealkeep projects backfill --confirm")}`]));
+            }
+            return;
+        }
+        let written = 0;
+        for (const item of pending) {
+            const path = joinPath(config.storage.root, `${item.id}.json`);
+            try {
+                const record = JSON.parse(await read(path, "utf8"));
+                if (record?.source?.project)
+                    continue;
+                record.source.project = item.project;
+                await write(path, JSON.stringify(record, null, 2) + "\n", { mode: 0o600 });
+                written += 1;
+            }
+            catch { /* a record that will not read is left exactly as it was */ }
+        }
+        if (json)
+            print(JSON.stringify({ written }, null, 2));
+        else
+            print(`\n  ${mark.ok()} Recorded a project on ${bold(String(written))} archives.\n`);
+        return;
+    }
+    if (command === "projects" && positionals(args)[0] === "mode") {
+        const [, name, wanted] = positionals(args);
+        if (!name || (wanted !== "active" && wanted !== "passive"))
+            fail("invalid_argument", "Usage: sealkeep projects mode <name> active|passive");
+        const { listArchives, setProjectSharing } = await import("./vault.js");
+        const { projectIdentityOfRecord } = await import("./adapters.js");
+        const identities = await Promise.all((await listArchives(dataDir)).map((record) => projectIdentityOfRecord(record).catch(() => ({ project: null, projectKey: null, projectPath: null }))));
+        const projectKeys = new Set(identities
+            .filter((identity) => identity.project === name && identity.projectKey)
+            .map((identity) => identity.projectKey));
+        if (projectKeys.size > 1) {
+            fail("invalid_argument", `More than one detected project is named ${name}; choose the exact folder in Settings so Sealkeep does not enable sharing for the wrong repository`);
+        }
+        await setProjectSharing(dataDir, name, wanted, [...projectKeys][0]);
+        print(wanted === "active"
+            ? `  ${mark.ok()} ${bold(name)} → ${bold("active")}: every sealed session syncs the index and announces a finished line — teammates' agents can find the work in minutes.`
+            : `  ${mark.ok()} ${bold(name)} → ${bold("passive")}: archive-at-rest — nothing extra moves until someone asks.`);
+        return;
+    }
     if (command === "projects") {
         // Routing rules can pin a project to a destination, and the panel cannot
         // offer a list: project names never reach the cloud — that is the point.
         // So this machine, which does know them, prints the exact strings to paste.
         const { listArchives } = await import("./vault.js");
-        const { claudeProjectFromPath, codexProjectFromRollout } = await import("./adapters.js");
+        const { projectOfRecord } = await import("./adapters.js");
         const records = await listArchives(dataDir);
         const seen = new Map();
         let unknown = 0;
         let unknownBytes = 0;
         for (const record of records) {
             const agentName = record.source.agent;
-            let project = null;
-            try {
-                if (agentName === "claude")
-                    project = claudeProjectFromPath(record.source.path).project;
-                else if (agentName === "codex")
-                    project = (await codexProjectFromRollout(record.source.path, record.createdAt)).project;
-            }
-            catch {
-                project = null;
-            }
+            const project = await projectOfRecord(record);
             if (!project) {
                 unknown += 1;
                 unknownBytes += record.source.bytes ?? 0;
@@ -1095,16 +1890,26 @@ async function main() {
         ], "no project recorded yet"));
         if (unknown > 0)
             print(`\n  ${dim(`${unknown} archive${unknown === 1 ? "" : "s"} recorded no project (${bytes(unknownBytes)}).`)}`);
-        print(`\n  ${dim("Paste a name into \"Only these projects\" in the account panel to pin it to a destination.")}\n`);
+        print(`\n  ${dim("Pin a project to a destination under \"Pinned projects\" in the account panel, or with \"+ pin project\" in this machine\u2019s dashboard Settings.")}\n`);
         return;
     }
     if (command === "open") {
         const [vaultRef, destination] = positionals(args);
         if (!vaultRef || !destination)
-            fail("invalid_argument", "Usage: sealkeep open <vault-ref> <destination> --recovery-phrase <phrase>");
-        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required");
+            fail("invalid_argument", "Usage: sealkeep open <vault-ref> <destination> [--recovery-phrase <phrase> | --key <base64-or-file>]");
+        // A recipient key is the team's way in: an archive rewrapped for a
+        // registered key opens with that key and no phrase, so reading a
+        // colleague's session never requires sharing the vault phrase that would
+        // hand over the whole vault.
+        const keyArg = take(args, "--key");
+        const privateKey = keyArg
+            ? (await readFile(keyArg, "utf8").then((text) => text.trim()).catch(() => keyArg.trim()))
+            : undefined;
+        const opener = privateKey
+            ? { privateKey }
+            : required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase or --key is required");
         const cloud = await import("./cloud.js");
-        const outcome = await cloud.openFromCloud(dataDir, vaultRef, destination, phrase);
+        const outcome = await cloud.openFromCloud(dataDir, vaultRef, destination, opener);
         if (json) {
             print(JSON.stringify(outcome, null, 2));
             return;
@@ -1125,7 +1930,28 @@ async function main() {
          * expects, so resume simply works again. Two different sessions matching
          * one fragment is a question, not a guess: both are listed with ids.
          */
-        const looksLikeId = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id);
+        let looksLikeId = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id);
+        /**
+         * `sealkeep list` prints ids cut to eight characters, and this command used
+         * to accept only a full UUID. So the id the product showed you was never an
+         * id it would take back, and the not-found message sent you to `list` to
+         * read another one that would not work either. Any unambiguous prefix
+         * resolves; an ambiguous one asks rather than guesses. A prefix that
+         * matches no archive falls through to the path matching below, so naming a
+         * missing session file still works.
+         */
+        if (!looksLikeId && /^[0-9a-f]{4,}$/i.test(id)) {
+            const byPrefix = (await listArchives(dataDir))
+                .filter((record) => record.version === 2 && record.id.toLowerCase().startsWith(id.toLowerCase()));
+            if (byPrefix.length === 1) {
+                id = byPrefix[0].id;
+                looksLikeId = true;
+            }
+            else if (byPrefix.length > 1) {
+                const lines = byPrefix.slice(0, 6).map((record) => `    ${record.id}  ${record.source.path}`);
+                fail("archive_not_found", `"${id}" matches ${byPrefix.length} archives. Name one:\n${lines.join("\n")}`);
+            }
+        }
         if (!looksLikeId) {
             const { resolve: resolvePath, basename } = await import("node:path");
             const archives = (await listArchives(dataDir)).filter((record) => record.version === 2);
@@ -1163,13 +1989,22 @@ async function main() {
         const secret = privateKey
             ? ""
             : required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required (or pass --key with a recipient's private key)");
+        const dryRun = args.includes("--dry-run");
         const outcome = await restoreArchive(dataDir, id, secret, {
             destination: native ? undefined : required(destination, "Destination is required unless --native is used"),
             native, home: take(args, "--home"), overwrite: take(args, "--overwrite", "refuse"),
+            ...(dryRun ? { dryRun } : {}),
             ...(privateKey ? { privateKey } : {})
         });
         if (json) {
-            print(JSON.stringify({ id, output: outcome.output, bytes: outcome.bytes, native: outcome.native, backupPath: outcome.backupPath }, null, 2));
+            print(JSON.stringify({ id, output: outcome.output, bytes: outcome.bytes, native: outcome.native, backupPath: outcome.backupPath, ...(outcome.dryRun ? { dryRun: true, destinationExists: outcome.destinationExists ?? false } : {}) }, null, 2));
+            return;
+        }
+        if (outcome.dryRun) {
+            print(`  ${mark.ok()} Would recover ${bold(bytes(outcome.bytes))} to ${outcome.output}${outcome.native ? dim(" (original location)") : ""}`);
+            if (outcome.destinationExists)
+                print(`  ${dim("A file already exists there — a real run needs --overwrite backup or replace.")}`);
+            print(`  ${dim("Nothing was written. Re-run without --dry-run to restore.")}`);
             return;
         }
         print(`  ${mark.ok()} Recovered ${bold(bytes(outcome.bytes))} to ${outcome.output}${outcome.native ? dim(" (original location)") : ""}`);
@@ -1212,36 +2047,143 @@ async function main() {
             return;
         }
         if (action === "hook-config") {
-            print(JSON.stringify(hookConfig(agentId(agent), take(args, "--executable", "vaultline"), dataDir), null, 2));
+            print(JSON.stringify(hookConfig(agentId(agent), take(args, "--executable", "sealkeep"), dataDir), null, 2));
             return;
         }
         fail("invalid_argument", "Usage: sealkeep agents <detect|sessions|hook-config> [agent]");
     }
     if (command === "hook") {
         const [action] = positionals(args);
+        if (action === "context") {
+            // The user-facing lane is deliberately local-only. It consumes context
+            // already prepared by the async companion hook: no network, remote index,
+            // membership reconciliation or publishing may delay this boundary.
+            try {
+                const raw = await readStdin();
+                const { consumePreparedAgentContext, parseAgentHookPayload } = await import("./agent-context.js");
+                const payload = parseAgentHookPayload(raw);
+                const phrase = await unlock(dataDir).catch(() => undefined);
+                if (!phrase) {
+                    print("{}");
+                    return;
+                }
+                const outcome = await consumePreparedAgentContext(dataDir, phrase, payload);
+                if (!outcome?.additionalContext) {
+                    print("{}");
+                    return;
+                }
+                print(JSON.stringify({
+                    hookSpecificOutput: {
+                        hookEventName: payload.hook_event_name ?? "SessionStart",
+                        additionalContext: outcome.additionalContext,
+                    }
+                }));
+            }
+            catch {
+                print("{}");
+            }
+            return;
+        }
+        if (action === "context-sync") {
+            // Agent configs mark this command async, but Codex still enforces its
+            // timeout and kills unfinished work. Persist a sealed, coalesced request
+            // here; the daemon owns search/network work and automatic retry.
+            try {
+                const raw = await readStdin();
+                const { clearHookUnlockFailure, enqueueAutomaticAgentContextRequest, parseAgentHookPayload, recordHookUnlockFailure } = await import("./agent-context.js");
+                const payload = parseAgentHookPayload(raw);
+                const agent = agentId(take(args, "--agent"));
+                const phrase = await unlock(dataDir).catch(() => undefined);
+                if (phrase) {
+                    await enqueueAutomaticAgentContextRequest(dataDir, phrase, agent, payload);
+                    await clearHookUnlockFailure(dataDir);
+                }
+                else {
+                    // Fail open, but not silently: doctor reads this marker.
+                    await recordHookUnlockFailure(dataDir, agent).catch(() => undefined);
+                }
+            }
+            catch { /* durable recall is fail-open; an existing coalesced request remains available */ }
+            print("{}");
+            return;
+        }
         if (action === "rehydrate") {
-            // The SessionStart side of the hook pair: the agent is about to resume
-            // a session — if its transcript left this disk for the vault, put it
-            // back before the agent reads it. NEVER break the session: every
-            // outcome, including "no phrase available here", is a JSON line and
-            // exit 0.
+            // Compatibility/manual hook action. Current generated agent configs do
+            // not install it: an automatic multi-GB restore would defeat reclaim and
+            // can race the descriptor an already-started agent is appending to.
+            // Every outcome remains a valid empty hook response and exit 0.
             const { rehydrateSession, rehydrateTargetFromPayload } = await import("./rehydrate.js");
+            const { withoutArchiveRecordWarnings } = await import("./vault.js");
             const target = rehydrateTargetFromPayload(await readStdin());
             const phrase = await unlock(dataDir).catch(() => undefined);
-            const outcome = await rehydrateSession(dataDir, target, phrase).catch((error) => ({
+            await withoutArchiveRecordWarnings(() => rehydrateSession(dataDir, target, phrase).catch((error) => ({
                 rehydrated: false, reason: "restore-failed",
                 note: error instanceof Error ? error.message.split("\n")[0] : "rehydrate failed"
-            }));
-            print(JSON.stringify(outcome));
+            })));
+            // `RehydrateOutcome` is Sealkeep's internal receipt, not part of the
+            // agent hook protocol. Claude validates SessionStart JSON strictly; keys
+            // such as `rehydrated`, `reason`, `archiveId` and `output` make a
+            // successful restore look like a failed hook. The filesystem mutation
+            // above is the whole result, so return the protocol's accepted no-op
+            // object on every calm outcome.
+            print("{}");
+            return;
+        }
+        if (action === "bridge-context") {
+            // UserPromptSubmit hook: hand pending teammate messages to the agent's
+            // next turn as additional context. The hook contract's discipline is the
+            // hook boundary's — NEVER break a session: any failure is empty output
+            // and exit 0. No phrase is needed; the pending queue is already local
+            // plaintext, exactly like the mirror beside it.
+            const channel = take(args, "--channel");
+            try {
+                const { drainPending, promptInjection, pendingCount } = await import("./bridge.js");
+                const pending = channel ? await drainPending(dataDir, channel) : [];
+                if (!pending.length) {
+                    print("{}");
+                    return;
+                }
+                const waiting = channel ? await pendingCount(dataDir, channel) : 0;
+                print(JSON.stringify({ hookSpecificOutput: { hookEventName: "UserPromptSubmit", additionalContext: promptInjection(pending, waiting) } }));
+            }
+            catch {
+                print("{}");
+            }
             return;
         }
         if (action !== "enqueue" && action !== "archive")
-            fail("invalid_argument", "Usage: sealkeep hook enqueue --agent <codex|claude> --data-dir <path> · sealkeep hook rehydrate --agent <codex|claude> --data-dir <path>");
+            fail("invalid_argument", "Usage: sealkeep hook <enqueue|context|context-sync|rehydrate> --agent <codex|claude> --data-dir <path>");
         const agent = agentId(take(args, "--agent"));
-        // The hook records intent only: no encryption, no secret, no network. `sealkeep queue run` does the work.
-        const event = await hookEventFromStdin(agent, await readStdin());
-        const { job, deduped } = await new ArchiveQueue(dataDir).enqueue({ sourcePath: event.sourcePath, agent, event: event.event, sessionId: event.sessionId });
-        print(JSON.stringify({ queued: true, deduped, jobId: job.id, event: job.event, note: action === "archive" ? "`hook archive` now queues work; run `sealkeep queue run` to encrypt it" : undefined }));
+        const raw = await readStdin().catch(() => "");
+        if (hookEventNameOf(raw) === "SessionEnd") {
+            // A session that has ended will never read recall prepared for it. Drop
+            // its slots first — this needs no transcript, while the archive intent
+            // below may legitimately fail without one — so the daemon's next passes
+            // go to the sessions still typing.
+            try {
+                const { discardAutomaticAgentContext, parseAgentHookPayload } = await import("./agent-context.js");
+                await discardAutomaticAgentContext(dataDir, parseAgentHookPayload(raw));
+            }
+            catch { /* fail-open: a stale slot expires on its own */ }
+        }
+        try {
+            // The hook records intent only: no encryption, no secret, no network.
+            // `sealkeep queue run` does the work. Lifecycle input is inherently
+            // racy: an agent may rotate or remove its transcript between announcing
+            // the event and this process opening the path. That missed snapshot must
+            // never corrupt the agent's strict JSON hook channel or stop compaction;
+            // the background watcher remains the durable retry path.
+            const event = await hookEventFromStdin(agent, raw);
+            const local = await readLocalSettings(dataDir);
+            if (automaticTranscriptIsEnabled(local, agent, event.sourcePath)) {
+                await new ArchiveQueue(dataDir).enqueue({ sourcePath: event.sourcePath, agent, event: event.event, sessionId: event.sessionId });
+            }
+        }
+        catch {
+            // Hook stdout belongs to the agent's protocol, not to Sealkeep's CLI.
+            // Codex and Claude validate it even on a fail-open preservation miss.
+        }
+        print("{}");
         return;
     }
     if (command === "queue") {
@@ -1282,6 +2224,17 @@ async function main() {
                 : `  ${mark.ok()} Encrypted ${bold(String(done.length))} session${done.length === 1 ? "" : "s"} ${dim(`· ${bytes(archived)} of history preserved`)}`);
             for (const job of failed)
                 print(`  ${mark.warn()} ${shortPath(job.sourcePath)} ${dim(`— ${job.lastError?.message ?? "will retry"}`)}`);
+            if (done.length > 0) {
+                try {
+                    const { buildContentIndex } = await import("./search.js");
+                    const built = await buildContentIndex(dataDir, phrase, { sync: false });
+                    if (built.indexedNow > 0)
+                        print(`  ${dim(`${built.indexedNow} made searchable`)}`);
+                }
+                catch {
+                    print(`  ${dim("not indexed yet — `sealkeep index build` adds them")}`);
+                }
+            }
             return;
         }
         if (action === "retry") {
@@ -1308,6 +2261,220 @@ async function main() {
      * writing a config fragment that runs `sealkeep mcp`, a command that did not
      * exist until now: anyone who merged it got an agent that failed to start.
      */
+    if (command === "bridge") {
+        const [action, arg] = positionals(args);
+        if (action === undefined) {
+            const { listChannelStatus } = await import("./bridge.js");
+            const rows = await listChannelStatus(dataDir);
+            if (json) {
+                print(JSON.stringify(rows, null, 2));
+                return;
+            }
+            print(`\n${heading("Bridge channels on this machine")}`);
+            if (!rows.length) {
+                print(`  ${dim("None yet. Drive one: sealkeep bridge start <session> --channel <id> · follow one: sealkeep bridge watch <id>")}\n`);
+                return;
+            }
+            print(table(rows, [
+                { header: "channel", get: (row) => bold(row.channel) },
+                { header: "mode", get: (row) => row.mode },
+                { header: "mirror", get: (row) => (row.mirrorBytes ? bytes(row.mirrorBytes) : dim("—")), align: "right" },
+                { header: "for agent", get: (row) => (row.pending ? String(row.pending) : dim("0")), align: "right" },
+                { header: "held", get: (row) => (row.held ? `${row.held} ${dim(`→ sealkeep bridge review ${row.channel}`)}` : dim("0")) }
+            ], "none"));
+            print("");
+            return;
+        }
+        const { publishOnce, watchOnce, defaultMirrorPath, publishBridgeMessage, pullBridgeMessages, drainPending, setChannelMode, channelSettings, cooperationModeOf, listHeld, resolveHeld } = await import("./bridge.js");
+        if (action === "start") {
+            // Driver: tail a session file and seal each new stretch as a delta.
+            const sessionPath = required(arg ?? take(args, "--session"), "Usage: sealkeep bridge start <session-file> --channel <id>");
+            const channel = required(take(args, "--channel"), "A --channel id is required (1-64 chars of A-Za-z0-9-)");
+            const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "The recovery phrase is required to seal bridge deltas");
+            const intervalMs = Number(take(args, "--interval-ms") ?? "1500");
+            let seq = Number(take(args, "--from-seq") ?? "0");
+            let fromByte = Number(take(args, "--from-byte") ?? "0");
+            // Cooperation mode: the driver chooses how far teammates' words spread.
+            // A fresh interactive channel defaults to `suggest` — the issue's own
+            // commenters called the yes/no/reword the load-bearing part — and the
+            // choice is printed, never silent. --mode always wins; --approve is the
+            // older spelling of suggest.
+            const askedMode = take(args, "--mode");
+            if (askedMode && !["observe", "suggest", "open"].includes(askedMode))
+                fail("invalid_argument", "--mode must be observe, suggest, or open");
+            const hadSettings = (await channelSettings(dataDir, channel)).mode !== undefined || (await channelSettings(dataDir, channel)).approval !== undefined;
+            const mode = askedMode ?? (args.includes("--approve") ? "suggest" : hadSettings ? cooperationModeOf(await channelSettings(dataDir, channel)) : "suggest");
+            await setChannelMode(dataDir, channel, mode);
+            const modeLine = mode === "observe" ? "teammates' messages stay between the humans — your agent never sees them"
+                : mode === "suggest" ? `teammates' messages wait for your yes/no/reword ${dim(`(sealkeep bridge review ${channel})`)}`
+                    : "teammates' messages reach your agent's next turn directly";
+            print(`  ${mark.ok()} Cooperation mode ${bold(mode)}: ${modeLine} ${dim(`· change: sealkeep bridge mode ${channel} <observe|suggest|open>`)}`);
+            print(`  ${mark.ok()} Bridging ${bold(sessionPath)} on channel ${bold(channel)} ${dim(`(delta every ${intervalMs}ms — Ctrl-C to stop)`)}`);
+            print(`  ${hint(`Members follow with: sealkeep bridge watch ${channel}`)}`);
+            const once = Symbol("stop");
+            const stop = new Promise((resolve) => process.once("SIGINT", () => resolve(once)));
+            for (;;) {
+                const outcome = await publishOnce(dataDir, { channel, seq, sessionPath, fromByte }, phrase).catch((error) => { print(`  ${dim(`delta ${seq} skipped: ${error.message}`)}`); return null; });
+                if (outcome) {
+                    print(`  ${dim(`→ delta ${outcome.seq} · ${bytes(outcome.newHighWater - fromByte)} · ${outcome.ref}`)}`);
+                    seq = outcome.seq + 1;
+                    fromByte = outcome.newHighWater;
+                }
+                // The lane back: teammates' messages land in this machine's inbox and
+                // pending queue. The UserPromptSubmit hook (`sealkeep hook
+                // bridge-context --channel <id>`) hands pending ones to the agent's
+                // next turn; the print below keeps the human driver in the loop too.
+                const arrived = await pullBridgeMessages(dataDir, channel, phrase).catch(() => ({ fresh: [], mode: "open" }));
+                for (const message of arrived.fresh)
+                    print(`  ✉ ${bold(message.from)} ${dim(`(${message.kind})`)}: ${message.text}`);
+                if (arrived.fresh.length && arrived.mode === "suggest")
+                    print(`    ${hint(`held for your yes/no/reword: ${cmd(`sealkeep bridge review ${channel}`)}`)}`);
+                if (arrived.fresh.length && arrived.mode === "observe")
+                    print(`    ${dim("observe mode — visible to you, never to your agent")}`);
+                const raced = await Promise.race([new Promise((r) => setTimeout(r, intervalMs)), stop]);
+                if (raced === once) {
+                    print(`\n  ${mark.ok()} Bridge stopped at seq ${seq}.`);
+                    return;
+                }
+            }
+        }
+        if (action === "watch") {
+            // Member: pull deltas into a local mirror and print what arrives.
+            const channel = required(arg ?? take(args, "--channel"), "Usage: sealkeep bridge watch <channel>");
+            const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "The recovery phrase is required to unseal bridge deltas");
+            const mirrorPath = take(args, "--mirror") ?? defaultMirrorPath(dataDir, channel);
+            const intervalMs = Number(take(args, "--interval-ms") ?? "2000");
+            let fromSeq = Number(take(args, "--from-seq") ?? "0");
+            print(`  ${mark.ok()} Watching channel ${bold(channel)} ${dim(`→ mirror ${mirrorPath} (Ctrl-C to stop)`)}`);
+            const once = Symbol("stop");
+            const stop = new Promise((resolve) => process.once("SIGINT", () => resolve(once)));
+            for (;;) {
+                const result = await watchOnce(dataDir, { channel, fromSeq, mirrorPath }, phrase).catch((error) => { print(`  ${dim(`poll failed: ${error.message}`)}`); return null; });
+                if (result) {
+                    if (result.applied.length)
+                        print(`  ${dim(`↓ applied deltas ${result.applied.join(", ")}`)}`);
+                    if (result.needsReset)
+                        print(`  ${mark.warn()} The shared session was rewritten upstream (compaction or resume). Delete the mirror and re-watch from seq 0 for a clean snapshot.`);
+                    fromSeq = result.nextSeq;
+                }
+                const arrived = await pullBridgeMessages(dataDir, channel, phrase).catch(() => ({ fresh: [], mode: "open" }));
+                for (const message of arrived.fresh)
+                    print(`  ✉ ${bold(message.from)} ${dim(`(${message.kind})`)}: ${message.text}`);
+                const raced = await Promise.race([new Promise((r) => setTimeout(r, intervalMs)), stop]);
+                if (raced === once) {
+                    print(`\n  ${mark.ok()} Stopped watching at seq ${fromSeq}.`);
+                    return;
+                }
+            }
+        }
+        if (action === "push") {
+            // Any member speaks into the channel: sealed like a delta, delivered to
+            // every other member's inbox, injected into the driver's next turn. This
+            // is the "suggest" scope of anthropics/claude-code#60082 — visible,
+            // labeled teammate input, not ghost keystrokes.
+            const channel = required(arg ?? take(args, "--channel"), "Usage: sealkeep bridge push <channel> \"your message\" [--kind suggest|note|handoff]");
+            // Flags come out BEFORE the free text is gathered, or a flag's value
+            // reads as part of the message ("…the flag suggest").
+            const kind = (take(args, "--kind") ?? "suggest");
+            const explicitText = take(args, "--text");
+            const body = explicitText ?? positionals(args).slice(2).join(" ");
+            const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "The recovery phrase is required to seal a bridge message");
+            const { ref, message } = await publishBridgeMessage(dataDir, { channel, kind, text: required(body || undefined, "Say something: sealkeep bridge push <channel> \"…\"") }, phrase);
+            if (json) {
+                print(JSON.stringify({ ref, message }, null, 2));
+                return;
+            }
+            print(`  ${mark.ok()} Sent to ${bold(channel)} as ${bold(message.from)} ${dim(`(${message.kind} · ${ref})`)}`);
+            print(`  ${dim("Members see it in their bridge loop; the driver's agent hears it on its next turn if the hook is installed.")}`);
+            return;
+        }
+        if (action === "pull") {
+            // One-shot fetch: new teammate messages into the inbox. --drain also
+            // empties the pending queue (what the prompt hook would have consumed) —
+            // Codex-side agents call the MCP inbox tool, humans call this.
+            const channel = required(arg ?? take(args, "--channel"), "Usage: sealkeep bridge pull <channel> [--drain]");
+            const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "The recovery phrase is required to unseal bridge messages");
+            const { fresh } = await pullBridgeMessages(dataDir, channel, phrase);
+            const drained = args.includes("--drain") ? await drainPending(dataDir, channel) : [];
+            if (json) {
+                print(JSON.stringify({ fresh, drained }, null, 2));
+                return;
+            }
+            if (!fresh.length && !drained.length) {
+                print(`  ${dim("Nothing new on the channel.")}`);
+                return;
+            }
+            for (const message of (drained.length ? drained : fresh))
+                print(`  ✉ ${bold(message.from)} ${dim(`(${message.kind} · ${message.at.slice(11, 19)}Z)`)}: ${message.text}`);
+            return;
+        }
+        if (action === "mode") {
+            const channel = required(arg, "Usage: sealkeep bridge mode <channel> [observe|suggest|open]");
+            const wanted = positionals(args)[2];
+            if (wanted === undefined) {
+                const mode = cooperationModeOf(await channelSettings(dataDir, channel));
+                if (json) {
+                    print(JSON.stringify({ channel, mode }, null, 2));
+                    return;
+                }
+                print(`  ${bold(channel)} · cooperation mode ${bold(mode)}`);
+                return;
+            }
+            if (!["observe", "suggest", "open"].includes(wanted))
+                fail("invalid_argument", "Mode must be observe, suggest, or open");
+            await setChannelMode(dataDir, channel, wanted);
+            // Comfort truth: switching to open does NOT release what suggest already
+            // held — those still need the driver's verdict, and saying so beats a
+            // silent queue nobody remembers.
+            if (wanted === "open") {
+                const stillHeld = (await listHeld(dataDir, channel)).length;
+                if (stillHeld)
+                    print(`  ${mark.warn()} ${stillHeld} message${stillHeld === 1 ? "" : "s"} from suggest mode still held — ${cmd(`sealkeep bridge review ${channel}`)} to release or reject them.`);
+            }
+            print(`  ${mark.ok()} ${bold(channel)} → ${bold(wanted)}: ${wanted === "observe" ? "messages stay between the humans" : wanted === "suggest" ? "messages wait for your yes/no/reword" : "messages reach your agent's next turn directly"}.`);
+            return;
+        }
+        if (action === "review") {
+            const channel = required(arg, "Usage: sealkeep bridge review <channel>");
+            const held = await listHeld(dataDir, channel);
+            if (json) {
+                print(JSON.stringify(held, null, 2));
+                return;
+            }
+            if (!held.length) {
+                print(`  ${dim("Nothing held. Messages wait here when the channel's cooperation mode is suggest.")}`);
+                return;
+            }
+            held.forEach((message, index) => print(`  ${bold(String(index + 1))}. ✉ ${bold(message.from)} ${dim(`(${message.kind} · ${message.at.slice(11, 19)}Z)`)}: ${message.text}`));
+            print(`\n  ${hint(`${cmd(`sealkeep bridge approve ${channel} <n|all>`)} ${dim("·")} ${cmd(`sealkeep bridge approve ${channel} <n> --reword "…"`)} ${dim("·")} ${cmd(`sealkeep bridge reject ${channel} <n|all>`)}`)}`);
+            return;
+        }
+        if (action === "approve" || action === "reject") {
+            // The yes/no/reword the issue's commenters called load-bearing: nothing
+            // reaches the agent until the driver has said yes — and a reworded
+            // message is marked as reworded, so a teammate is never quoted on words
+            // the driver wrote.
+            const channel = required(arg, `Usage: sealkeep bridge ${action} <channel> <n|all>`);
+            const which = positionals(args)[2] ?? "all";
+            const index = which === "all" ? "all" : Number(which);
+            if (index !== "all" && (!Number.isInteger(index) || index < 1))
+                fail("invalid_argument", `Which one? A number from \`sealkeep bridge review ${channel}\`, or "all".`);
+            const { resolved, remaining } = await resolveHeld(dataDir, channel, { approve: action === "approve", index, reword: take(args, "--reword") });
+            if (json) {
+                print(JSON.stringify({ resolved, remaining }, null, 2));
+                return;
+            }
+            if (!resolved.length) {
+                print(`  ${dim("Nothing was held.")}`);
+                return;
+            }
+            print(`  ${mark.ok()} ${action === "approve" ? "Approved" : "Rejected"} ${resolved.length} message${resolved.length === 1 ? "" : "s"}${remaining ? dim(` · ${remaining} still held`) : ""}`);
+            if (action === "approve")
+                print(`  ${dim("The agent hears it on its next turn (hook), or when it checks sealkeep_bridge_inbox.")}`);
+            return;
+        }
+        fail("invalid_argument", "Usage: sealkeep bridge <start|watch|push|pull|mode|review|approve|reject> …");
+    }
     if (command === "mcp") {
         const [action] = positionals(args);
         if (action === "install") {
@@ -1341,6 +2508,13 @@ async function main() {
             fail("invalid_argument", "Usage: sealkeep mcp [run|install] [--agent <name>]");
         // No banner, no colour: stdout is the protocol channel here, and anything
         // printed to it corrupts the first message the client reads.
+        //
+        // The server resolves its vault once, at module load, from the environment
+        // — so `--data-dir` has to be there BEFORE the import or the flag is
+        // silently ignored and the agent is served a different vault than the one
+        // asked for. That is how it failed: a second machine's MCP server quietly
+        // answered from the default vault instead.
+        process.env[`${ENV_PREFIX}DATA_DIR`] = dataDir;
         await import("./mcp.js");
         return;
     }
@@ -1382,12 +2556,19 @@ async function main() {
         return;
     }
     if (command === "api") {
-        // Headless and on a predictable port: this is the address the TUI, the MCP
-        // server and anything else local is pointed at, so it neither opens a
-        // window nor inherits an ephemeral port from a UI that happens to be up.
-        const handle = await startUi(dataDir, { port: await freePort(Number(take(args, "--port", "4180"))), openBrowser: false, reuse: false });
-        print(`\n${BRAND}  local API on ${bold(handle.origin.replace("http://", ""))}`);
+        // A vault has one stateful local API owner. Upload/reclaim journals have
+        // in-memory transfer ownership, so a second headless server is not a
+        // harmless extra address. Reuse the Autopilot/UI listener when present;
+        // otherwise this command becomes the owner on its requested port.
+        const requestedPort = Number(take(args, "--port", "4180"));
+        if (!Number.isInteger(requestedPort) || requestedPort < 0 || requestedPort > 65_535) {
+            fail("invalid_argument", "--port must be an integer from 0 to 65535");
+        }
+        const handle = await startUi(dataDir, { port: requestedPort, openBrowser: false });
+        print(`\n${BRAND}  local API ${handle.reused ? "already running" : "listening"} on ${bold(handle.origin.replace("http://", ""))}`);
         print(`  ${dim(`Token file (do not share): ${shortPath(localApiTokenPath(dataDir), 60)}`)}`);
+        if (handle.reused)
+            return;
         print(`  ${dim("Ctrl-C to stop.")}\n`);
         holdUntilStopped(handle);
         return;
@@ -1447,8 +2628,8 @@ async function main() {
     if (command === "search") {
         const [query] = positionals(args);
         const mode = args.includes("--content") ? "content" : "metadata";
-        const hits = await search(dataDir, required(query, "Usage: sealkeep search <query> [--content] [--agent <name>]"), {
-            mode, agent: take(args, "--agent"),
+        const hits = await search(dataDir, required(query, "Usage: sealkeep search <query> [--content] [--agent <name>] [--project <name>]"), {
+            mode, agent: take(args, "--agent"), project: take(args, "--project"),
             phrase: mode === "content" ? required(await unlock(dataDir, take(args, "--recovery-phrase")), "Content search decrypts locally and needs --recovery-phrase") : undefined
         });
         if (json) {
@@ -1462,10 +2643,63 @@ async function main() {
         }
         for (const hit of hits) {
             print(`  ${bold(shortPath(hit.path, 60))}`);
-            print(`  ${dim(`${hit.agent} · ${bytes(hit.bytes)} · ${relativeTime(hit.createdAt)} · ${hit.id.slice(0, 8)}`)}`);
+            print(`  ${dim(`${hit.agent}${hit.project ? ` · ${hit.project}` : ""} · ${bytes(hit.bytes)} · ${relativeTime(hit.createdAt)} · ${hit.id.slice(0, 8)}`)}`);
+            if (hit.matched === "content" && hit.meta) {
+                const meta = hit.meta;
+                const span = meta.startedAt && meta.endedAt
+                    ? `${meta.startedAt.slice(0, 10)} ${meta.startedAt.slice(11, 16)}–${meta.endedAt.slice(11, 16)}`
+                    : null;
+                const gitBit = meta.commits?.length
+                    ? `git: ${meta.commits.slice(0, 3).map((c) => c.h).join(" ")}${meta.commits.length > 3 ? ` +${meta.commits.length - 3}` : ""}`
+                    : null;
+                const fileBit = meta.files?.length ? `${meta.files.length} file${meta.files.length === 1 ? "" : "s"}` : null;
+                const bits = [span, gitBit, fileBit].filter(Boolean);
+                if (bits.length)
+                    print(`  ${dim(bits.join(" · "))}`);
+            }
             if (hit.matched === "content")
                 for (const snippet of hit.snippets)
-                    print(`    ${blue("│")} ${dim(snippet.trim().slice(0, 96))}`);
+                    print(`    ${blue("│")} ${dim(snippet.trim())}`);
+            print("");
+        }
+        return;
+    }
+    /**
+     * The question git cannot answer. `git blame` names the commit; this names
+     * the SESSION the commit came out of — the reasoning, the dead ends, the
+     * alternatives — because the index records which commits landed inside each
+     * session's time window, in that session's working directory.
+     */
+    if (command === "why") {
+        const hash = required(positionals(args)[0], "Usage: sealkeep why <commit-hash>");
+        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "Reading the sealed index needs the recovery phrase");
+        const { loadReadableIndexes, sessionsForCommit, refreshIndexFromRemote } = await import("./search.js");
+        await refreshIndexFromRemote(dataDir, phrase);
+        // A machine with nothing indexed yet is an EMPTY state, not a broken one —
+        // a colleague who just joined has exactly this vault, and answering them
+        // with a failure reads as "something is wrong with your setup" when the
+        // truthful answer is "nothing here knows about that commit yet".
+        const indexes = await loadReadableIndexes(dataDir, { phrase }).catch(() => null);
+        const matches = indexes ? sessionsForCommit(indexes, hash) : [];
+        if (json) {
+            print(JSON.stringify(matches, null, 2));
+            return;
+        }
+        if (!matches.length) {
+            print(indexes
+                ? `\n  ${dim(`No indexed session carries commit ${hash}. The commit↔session link is built by \`sealkeep index build\` on the machine where that repo lives.`)}\n`
+                : `\n  ${dim(`Nothing is indexed on this machine yet, so no commit can be traced to a session. Run \`sealkeep index build\` — or wait for a teammate's index to reach this account.`)}\n`);
+            return;
+        }
+        const records = await listArchives(dataDir);
+        print(`\n${heading(`The session behind ${hash}`)}`);
+        for (const match of matches) {
+            const record = records.find((r) => r.id === match.id);
+            print(`  ${bold(match.subject || "(commit)")}`);
+            print(`  ${dim(`session ${match.id.slice(0, 8)}${record ? ` · ${record.source.agent} · ${relativeTime(record.createdAt)}` : ""}${match.meta.startedAt ? ` · ${match.meta.startedAt.slice(0, 16).replace("T", " ")}` : ""}`)}`);
+            if (record)
+                print(`  ${dim(shortPath(record.source.path, 62))}`);
+            print(`  ${hint(`the reasoning: ${cmd(`sealkeep recover ${match.id.slice(0, 8)} ./why-${hash.slice(0, 8)}`)} ${dim("· or the agent finds it via sealkeep_search")}`)}`);
             print("");
         }
         return;
@@ -1474,7 +2708,21 @@ async function main() {
         const [action] = positionals(args);
         const phrase = async () => required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required");
         if (action === "build") {
-            const built = await buildContentIndex(dataDir, await phrase());
+            /**
+             * Indexing a large vault is twenty minutes of work that used to print
+             * nothing at all until it finished — indistinguishable from a hang, and
+             * when it did die there was no way to tell how far it got. A line per
+             * checkpoint is the difference between "it is working" and "is it?".
+             */
+            let lastShown = 0;
+            const built = await buildContentIndex(dataDir, await phrase(), {
+                onProgress: json ? undefined : (done, total) => {
+                    if (done !== total && done - lastShown < 20)
+                        return;
+                    lastShown = done;
+                    print(`  ${dim(`indexed ${done}/${total}${done < total ? " — safe to stop; it resumes here" : ""}`)}`);
+                }
+            });
             if (json) {
                 print(JSON.stringify(built, null, 2));
                 return;
@@ -1483,6 +2731,20 @@ async function main() {
             print(`  ${dim("The index is encrypted at rest and never uploaded. Remove it with `sealkeep index drop`.")}`);
             return;
         }
+        if (action === "migrate") {
+            const result = await migrateBlobToSegments(dataDir, await phrase());
+            if (json) {
+                print(JSON.stringify(result, null, 2));
+                return;
+            }
+            if (result.migrated) {
+                print(`  ${mark.ok()} Moved ${bold(String(result.archives))} archives ${dim(`(${result.tokens} terms)`)} into the segmented index.`);
+            }
+            else {
+                print(`  ${dim("Already segmented.")}`);
+            }
+            return;
+        }
         if (action === "drop") {
             await dropContentIndex(dataDir);
             print(`  ${mark.ok()} Content index removed.`);
@@ -1490,12 +2752,35 @@ async function main() {
         }
         if (action === "status") {
             const { indexCoverage } = await import("./search.js");
-            const coverage = await indexCoverage(dataDir);
+            // Offered, never demanded: without it the shared corpus stays unknown and
+            // is reported as unknown, which is still better than the old zero.
+            const known = await unlock(dataDir, take(args, "--recovery-phrase")).catch(() => null);
+            const coverage = await indexCoverage(dataDir, known ? { phrase: known } : {});
             if (json) {
                 print(JSON.stringify(coverage, null, 2));
                 return;
             }
-            print(`\n  ${bold(String(coverage.indexed))} of ${bold(String(coverage.total))} archives searchable ${dim(`· index ${bytes(coverage.indexBytes)}${coverage.builtAt ? ` · updated ${coverage.builtAt.slice(0, 16).replace("T", " ")}` : ""}`)}`);
+            const built = dim(`· index ${bytes(coverage.indexBytes)}${coverage.builtAt ? ` · updated ${coverage.builtAt.slice(0, 16).replace("T", " ")}` : ""}`);
+            if (coverage.searchable !== null) {
+                print(`\n  ${bold(String(coverage.searchable))} archive${coverage.searchable === 1 ? "" : "s"} searchable from this machine ${built}`);
+                // The line that matters on a team: history this machine never sealed
+                // is still searchable here, and saying so is the shared-memory claim
+                // made checkable rather than asserted.
+                if (coverage.fromOtherMachines) {
+                    print(`  ${dim(`${coverage.fromOtherMachines} of them sealed by your other machines — pulled in as ciphertext, searched locally.`)}`);
+                }
+                print(`  ${dim(`${coverage.indexed} of ${coverage.total} sealed on this machine.`)}`);
+            }
+            else if (coverage.total === 0) {
+                // Do not print "0 of 0 searchable": on a colleague's laptop that reads
+                // as "the account is empty" when it only means "I sealed nothing".
+                print(`\n  This machine has sealed nothing yet ${built}`);
+                print(`  ${dim("Add --recovery-phrase to see what the shared index makes searchable here.")}`);
+            }
+            else {
+                print(`\n  ${bold(String(coverage.indexed))} of ${bold(String(coverage.total))} archives sealed here are searchable ${built}`);
+                print(`  ${dim("Add --recovery-phrase to include what your other machines sealed.")}`);
+            }
             if (coverage.missing.length > 0) {
                 print(`  ${dim(`${coverage.missing.length} not yet indexed — new seals index themselves; \`sealkeep index build\` adds the rest:`)}`);
                 for (const item of coverage.missing.slice(0, 5))
@@ -1506,7 +2791,7 @@ async function main() {
             print("");
             return;
         }
-        fail("invalid_argument", "Usage: sealkeep index <build|status|drop> --recovery-phrase <phrase>");
+        fail("invalid_argument", "Usage: sealkeep index <build|migrate|status|drop> --recovery-phrase <phrase>");
     }
     if (command === "audit") {
         const [action] = positionals(args);
@@ -1531,7 +2816,59 @@ async function main() {
     }
     if (command === "recovery") {
         const [action] = positionals(args);
+        if (action === "restore") {
+            const code = take(args, "--code") ?? await promptForPhrase("  Backup code (input hidden): ");
+            const { recoverWithRecoveryCode } = await import("./recovery-codes.js");
+            const restored = await recoverWithRecoveryCode(dataDir, code);
+            if (json) {
+                print(JSON.stringify({ restored: true, ...restored }, null, 2));
+                return;
+            }
+            print(`\n  ${mark.ok()} Restored vault ${restored.vaultId} on this machine.`);
+            print(`  ${dim(`${restored.remaining} unused backup code${restored.remaining === 1 ? " remains" : "s remain"}. This code cannot be used again.`)}\n`);
+            return;
+        }
         const config = await readConfig(dataDir);
+        if (action === "codes") {
+            const { createRecoveryCodes, recoveryKitStatus } = await import("./recovery-codes.js");
+            if (args.includes("--status")) {
+                const status = await recoveryKitStatus(dataDir);
+                if (json) {
+                    print(JSON.stringify(status, null, 2));
+                    return;
+                }
+                print(`\n  ${status.available ? mark.ok() : mark.warn()} ${status.available ? `${status.remaining} unused backup code${status.remaining === 1 ? " remains" : "s remain"}` : "No backup Recovery Kit is stored"}.\n`);
+                return;
+            }
+            if (!args.includes("--confirm"))
+                fail("invalid_argument", "Creating a new Recovery Kit invalidates every previous backup code. Re-run with --confirm, or use Settings in the dashboard.");
+            const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "Unlock this machine before replacing its Recovery Kit");
+            const created = await createRecoveryCodes(dataDir, phrase);
+            const sheet = `SEALKEEP RECOVERY KIT\n\nOne-time backup codes\n\n${created.codes.map((code, index) => `${index + 1}. ${code}`).join("\n")}\n\nSign in with Google on a fresh machine, then run sealkeep recovery restore --code <code>.\n`;
+            const target = take(args, "--out");
+            if (target) {
+                const { writeFile } = await import("node:fs/promises");
+                await writeFile(target, sheet, { mode: 0o600 });
+                print(`  ${mark.ok()} Recovery Kit written to ${target}`);
+            }
+            else if (json)
+                print(JSON.stringify(created, null, 2));
+            else
+                print(sheet);
+            return;
+        }
+        if (action === "forget-machine") {
+            if (!args.includes("--confirm"))
+                fail("invalid_argument", "Forgetting this machine's recovery phrase stops unattended sealing. Re-run with --confirm; encrypted archives are kept.");
+            const { forgetRecoveryPhrase } = await import("./secrets.js");
+            const outcome = await forgetRecoveryPhrase(dataDir, config.vaultId);
+            if (json) {
+                print(JSON.stringify({ forgotten: true, backend: outcome.backend, archivesKept: true }, null, 2));
+                return;
+            }
+            print(`\n  ${mark.ok()} This machine forgot the recovery phrase. Encrypted archives were kept.\n`);
+            return;
+        }
         if (action === "kit") {
             // The kit is read after the machine is gone, so it must name the cloud
             // account when there is one.
@@ -1616,7 +2953,7 @@ async function main() {
             print("");
             return;
         }
-        fail("invalid_argument", "Usage: sealkeep recovery <kit|verify|seal|open> [--out <path>]");
+        fail("invalid_argument", "Usage: sealkeep recovery <kit|verify|seal|open|codes|restore> [--out <path>]");
     }
     if (command === "phrase" && positionals(args)[0] === "rotate") {
         const { rotateVaultPhrase, rotatedPhrasePath } = await import("./rotate.js");
@@ -1764,11 +3101,12 @@ async function main() {
         const [action, archiveId] = positionals(args);
         if (action === "targets") {
             const sub = positionals(args)[1];
-            const { resolveTargets, targetUsage, setStorageTargets } = await import("./storage-targets.js");
+            const { resolveTargets, storageTargetsForEditing, targetUsage, setStorageTargets } = await import("./storage-targets.js");
             if (sub === "add") {
                 const provider = required(take(args, "--provider"), "--provider is required");
                 const id = take(args, "--id") ?? provider;
-                const existing = (await readConfig(dataDir)).storageTargets ?? await resolveTargets(dataDir);
+                const edit = await storageTargetsForEditing(dataDir);
+                const existing = edit.targets;
                 const bucketFlag = take(args, "--bucket");
                 const target = {
                     id, provider,
@@ -1782,15 +3120,23 @@ async function main() {
                     ...(take(args, "--projects") ? { projects: take(args, "--projects").split(",").map((p) => p.trim()).filter(Boolean) } : {}),
                     ...(take(args, "--priority") ? { priority: Number(take(args, "--priority")) } : {})
                 };
-                await setStorageTargets(dataDir, [...existing.filter((t) => t.id !== id), target]);
+                const saved = await setStorageTargets(dataDir, [...existing.filter((t) => t.id !== id), target], { accountBaseline: edit.accountBaseline });
+                if (saved.accountConflict)
+                    fail("lease_expired", "Storage routing changed on another machine. The newer rules were kept; run this command again after reviewing `sealkeep storage targets`.");
                 print(`  ${mark.ok()} Target ${bold(id)} saved.`);
+                if (saved.accountSynced === false)
+                    print(`  ${hint("Saved on this machine only because account routing was unavailable. Sealkeep did not overwrite an unseen account change.")}`);
                 return;
             }
             if (sub === "remove") {
                 const id = required(positionals(args)[2], "Usage: sealkeep storage targets remove <id>");
-                const existing = (await readConfig(dataDir)).storageTargets ?? [];
-                await setStorageTargets(dataDir, existing.filter((t) => t.id !== id));
+                const edit = await storageTargetsForEditing(dataDir);
+                const saved = await setStorageTargets(dataDir, edit.targets.filter((t) => t.id !== id), { accountBaseline: edit.accountBaseline });
+                if (saved.accountConflict)
+                    fail("lease_expired", "Storage routing changed on another machine. The newer rules were kept; run this command again after reviewing `sealkeep storage targets`.");
                 print(`  ${mark.ok()} Target ${bold(id)} removed. Archives already there stay readable — records remember where they live.`);
+                if (saved.accountSynced === false)
+                    print(`  ${hint("Removed on this machine only because account routing was unavailable. Sealkeep did not overwrite an unseen account change.")}`);
                 return;
             }
             const targets = await resolveTargets(dataDir);
@@ -1808,7 +3154,7 @@ async function main() {
                 const used = usage.get(t.id) ?? 0;
                 const cap = t.maxGb !== undefined ? ` of ${t.maxGb} GB` : "";
                 const pins = t.projects?.length ? ` · projects: ${t.projects.join(", ")}` : "";
-                print(`  ${bold(t.id.padEnd(12))} ${t.provider}${t.bucket ? `://${t.bucket}` : ""} ${dim(`· ${bytes(used)}${cap}${pins} · priority ${t.priority ?? (t.provider === "vaultline" ? 0 : 10)}`)}`);
+                print(`  ${bold(t.id.padEnd(12))} ${providerLabel(t.provider)}${t.bucket ? ` (${t.bucket})` : ""} ${dim(`· ${bytes(used)}${cap}${pins} · priority ${t.priority ?? (t.provider === "vaultline" ? 0 : 10)}`)}`);
             }
             print(`  ${dim("New seals go to the pinned project target first, then lowest priority with room. Reads always follow each archive's own record.")}\n`);
             return;
@@ -1820,20 +3166,20 @@ async function main() {
                 return;
             }
             print(remote
-                ? `  ${bold(`${remote.provider}://${remote.bucket}/${remote.prefix}`)}${remote.region ? dim(` · ${remote.region}`) : ""}`
+                ? `  ${bold(providerLabel(remote.provider))} ${dim(`${remote.bucket}/${remote.prefix}${remote.region ? ` · ${remote.region}` : ""}`)}`
                 : `  ${dim("No remote target. Set one with `sealkeep storage configure --provider r2 --bucket … --prefix …`")}`);
             return;
         }
         if (action === "configure") {
             const provider = required(take(args, "--provider"), "--provider is required");
-            if (!Object.hasOwn(providers, provider))
-                fail("provider_unsupported", "--provider must be vaultline, s3, r2, or gcs");
+            if (!Object.hasOwn(providers, provider) || provider === "vaultline")
+                fail("provider_unsupported", "--provider must be s3, r2, b2, gcs, or gdrive; Sealkeep Cloud is connected through your account");
             const config = await configureRemoteStorage(dataDir, { provider, bucket: required(take(args, "--bucket"), "--bucket is required"), prefix: required(take(args, "--prefix"), "--prefix is required"), region: take(args, "--region") });
             if (json) {
                 print(JSON.stringify(config.remoteStorage, null, 2));
                 return;
             }
-            print(`  ${mark.ok()} Target saved: ${bold(`${config.remoteStorage.provider}://${config.remoteStorage.bucket}/${config.remoteStorage.prefix}`)}`);
+            print(`  ${mark.ok()} Target saved: ${bold(providerLabel(config.remoteStorage.provider))} ${dim(`${config.remoteStorage.bucket}/${config.remoteStorage.prefix}`)}`);
             print(`  ${hint("Store credentials next: echo '{\"accessKeyId\":\"…\",\"secretAccessKey\":\"…\"}' | sealkeep storage credentials set")}`);
             return;
         }
@@ -1843,7 +3189,7 @@ async function main() {
             const plan = setupPlan({
                 provider,
                 bucket: required(take(args, "--bucket") ?? config?.remoteStorage?.bucket, "--bucket is required"),
-                prefix: take(args, "--prefix") ?? config?.remoteStorage?.prefix ?? `vaultline/${config?.vaultId?.slice(0, 8) ?? "me"}`,
+                prefix: take(args, "--prefix") ?? config?.remoteStorage?.prefix ?? `${STORAGE_PREFIX_DEFAULT}/${config?.vaultId?.slice(0, 8) ?? "me"}`,
                 region: take(args, "--region"), accountId: take(args, "--account-id"), project: take(args, "--project")
             });
             if (json) {
@@ -1876,8 +3222,16 @@ async function main() {
             // `archiveId` is just the second positional here: the provider to connect.
             if (archiveId !== "gdrive")
                 fail("invalid_argument", "Usage: sealkeep storage connect gdrive [--config-id <id>] [--backend <name>]");
-            const configId = take(args, "--config-id") ?? (await readConfig(dataDir)).vaultId;
+            const config = await readConfig(dataDir);
+            const configId = take(args, "--config-id") ?? config.vaultId;
             const backend = take(args, "--backend");
+            const { destinationBindingForTarget, resolveTargets } = await import("./storage-targets.js");
+            const targets = await resolveTargets(dataDir);
+            const bindingTarget = targets.find((target) => target.id === configId)
+                ?? (configId === config.vaultId ? targets.find((target) => target.id === "primary") : undefined);
+            if (!bindingTarget || bindingTarget.provider !== "gdrive") {
+                fail("storage_not_configured", `Storage config "${configId}" is not a configured Google Drive target.`);
+            }
             // The account's shared Google client first: no console visit, no env
             // var — the consent screen is the whole setup. The PKCE desktop path
             // stays for self-hosters who set SEALKEEP_GDRIVE_CLIENT_ID.
@@ -1897,7 +3251,10 @@ async function main() {
                     print(`  ${dim("Waiting for the browser…")}`);
                 }
             });
-            const stored = await storeProviderCredentials(dataDir, configId, credentials, backend);
+            const binding = await destinationBindingForTarget(dataDir, bindingTarget, new Date().toISOString(), credentials);
+            if (!binding.destination.account)
+                fail("unauthorized", "Google consent completed without a stable Drive account identity. Connect again.");
+            const stored = await storeProviderCredentials(dataDir, configId, credentials, backend, binding);
             if (json) {
                 print(JSON.stringify({ provider: "gdrive", backend: stored.backend, configId }, null, 2));
                 return;
@@ -1920,7 +3277,19 @@ async function main() {
                 catch {
                     fail("invalid_argument", "Credentials on stdin must be JSON");
                 }
-                const stored = await storeProviderCredentials(dataDir, configId, parsed, backend);
+                const credential = parsed;
+                const config = await readConfig(dataDir);
+                const { destinationBindingForTarget, resolveTargets } = await import("./storage-targets.js");
+                const targets = await resolveTargets(dataDir).catch(() => []);
+                const bindingTarget = targets.find((target) => target.id === configId)
+                    ?? (configId === config.vaultId ? targets.find((target) => target.id === "primary") : undefined);
+                const binding = bindingTarget && bindingTarget.provider !== "vaultline"
+                    ? await destinationBindingForTarget(dataDir, bindingTarget, null, credential)
+                    : undefined;
+                if (bindingTarget?.provider === "gdrive" && !binding?.destination.account) {
+                    fail("invalid_argument", "A Google Drive credential must include the stable accountId returned during consent. Use `storage connect gdrive`.");
+                }
+                const stored = await storeProviderCredentials(dataDir, configId, credential, backend, binding);
                 print(`  ${mark.ok()} Stored in ${bold(stored.backend)} ${dim(`for ${configId.slice(0, 8)}`)}`);
                 return;
             }
@@ -1979,7 +3348,7 @@ async function main() {
             // stays, and on real transcripts that is about two thirds of what it
             // replaced. This removes local archives the bucket has a verified copy of.
             const { offloadArchives } = await import("./offload.js");
-            const result = await offloadArchives(dataDir, { confirm: args.includes("--confirm") });
+            const result = await offloadArchives(dataDir, { ...options, confirm: args.includes("--confirm") });
             if (json) {
                 print(JSON.stringify(result, null, 2));
                 return;
@@ -2054,11 +3423,11 @@ async function main() {
                     }
                     return;
                 }
-                print(`  ${bold(String(result.wouldReclaim))} source${result.wouldReclaim === 1 ? "" : "s"} would move to the trash, freeing ${bold(bytes(result.wouldFreeBytes))}.\n  ${hint(`re-run with ${cmd("--confirm")} to do it`)}`);
+                print(`  ${bold(String(result.wouldReclaim))} source${result.wouldReclaim === 1 ? "" : "s"} could free up to ${bold(bytes(result.wouldFreeBytes))} after the final safety checks.\n  ${hint(`re-run with ${cmd("--confirm")} to do it`)}`);
                 return;
             }
-            print(`  ${mark.ok()} Moved ${bold(String(result.reclaimed.length))} source${result.reclaimed.length === 1 ? "" : "s"} to the trash, freeing ${bold(bytes(result.freedBytes))}`);
-            print(`  ${dim("They are recoverable from the trash, and their archives are untouched.")}`);
+            print(`  ${mark.ok()} Reclaimed ${bold(String(result.reclaimed.length))} source${result.reclaimed.length === 1 ? "" : "s"}, freeing ${bold(bytes(result.freedBytes))} from their native session paths`);
+            print(`  ${dim("Their verified encrypted archives remain stored; Codex sessions keep a tiny same-id resume pointer.")}`);
             for (const failure of result.failed)
                 print(`  ${mark.warn()} ${dim(failure.id.slice(0, 8))} ${dim(failure.error)}`);
             return;
@@ -2099,35 +3468,195 @@ async function main() {
                 ...(idleDays === undefined ? {} : { sourceIdleDays: nullable(idleDays) }),
                 ...(minBytes === undefined ? {} : { minSourceBytes: nullable(minBytes) })
             });
+            // The policy is account/vault state; unattended deletion is a separate
+            // permission on this machine. A keep-originals policy must revoke that
+            // permission and remove the stale --reclaim invocation from an installed
+            // service. Otherwise changing the policy again later could resurrect
+            // deletion without a new machine opt-in.
+            const machineSafety = await reconcileMachineRetentionPolicy(dataDir, config.retention.policy, {
+                home: take(args, "--home"),
+                cliPath: process.argv[1],
+            });
             print(`  ${mark.ok()} Policy set to ${bold(config.retention.policy)} ${dim(`· ${describe(retentionSettings(config))}`)}`);
+            if (machineSafety.reclaimPermissionRevoked) {
+                print(`  ${mark.ok()} Automatic reclaim is off on this machine; its timing and other settings were kept.`);
+            }
+            if (machineSafety.serviceReconciled) {
+                print(`  ${dim("The installed background service now follows that safe setting.")}`);
+            }
             return;
         }
         fail("invalid_argument", "Usage: sealkeep retention <preview|apply|prune|offload|approve|policy> [options]");
     }
     if (command === "daemon") {
-        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "No recovery phrase available. Run `sealkeep autopilot` so this machine can unlock itself, or set SEALKEEP_RECOVERY_PHRASE.");
-        const reclaim = args.includes("--reclaim");
-        const daemon = await startDaemon(dataDir, {
-            phrase, intervalMs: Number(take(args, "--interval", "30")) * 1000, home: take(args, "--home"),
-            watch: !args.includes("--no-watch"), upload: !args.includes("--no-upload"), reclaim,
-            notifications: args.includes("--quiet") ? false : undefined,
-            onTick: (result) => {
-                if (!(result.archived || result.uploaded || result.reclaimed || result.failed))
-                    return;
-                const parts = [result.archived && `${result.archived} archived`, result.uploaded && `${result.uploaded} uploaded`, result.reclaimed && `${result.reclaimed} reclaimed`, result.failed && `${result.failed} failed`].filter(Boolean);
-                print(`  ${dim(new Date().toLocaleTimeString())}  ${parts.join(dim(" · "))}`);
-            }
+        const requestedReclaim = args.includes("--reclaim");
+        const watch = !args.includes("--no-watch");
+        // New service receipts say this in argv. The ownership marker is retained
+        // only for the first process after upgrading an older receipt: the stable
+        // manager launches the new package with its old argv once, then daemon
+        // reconciliation rewrites the receipt with --serve-ui. An ordinary
+        // foreground daemon has neither signal and still binds no UI port.
+        const serviceOwned = Boolean(process.env.SEALKEEP_SERVICE_MANAGER_PATH && process.env.SEALKEEP_SERVICE_RECEIPT_PATH);
+        // A native service is long-lived and its local UI owns this machine
+        // setting. Read the persisted value at startup even when an older service
+        // receipt omitted --reclaim; startDaemon keeps following later changes.
+        // An explicitly launched foreground daemon retains flag-only semantics.
+        const reclaim = serviceOwned
+            ? (await readLocalSettings(dataDir)).reclaimEnabled
+            : requestedReclaim;
+        const serveUi = args.includes("--serve-ui") || serviceOwned;
+        const uiPortValue = take(args, "--ui-port", String(DEFAULT_UI_PORT));
+        const uiPort = Number(uiPortValue);
+        if (serveUi && (!Number.isInteger(uiPort) || uiPort < 0 || uiPort > 65_535)) {
+            fail("invalid_argument", "--ui-port must be an integer from 0 to 65535");
+        }
+        // A manager installed by the previous release cannot apply this release's
+        // pre-Node taskpolicy wrapper to the first upgraded child. Repair its
+        // durable files before taking either singleton lease, then exit with the
+        // manager's established upgrade code. launchd relaunches once through the
+        // newly written manager; its generation marker prevents a loop.
+        const handedOffLegacyManager = await prepareLegacyDarwinManagerHandoff({
+            serviceOwned,
+            reconcile: async () => {
+                const service = await import("./service.js");
+                const invocation = service.daemonInvocation(dataDir, {
+                    reclaim,
+                    upload: !args.includes("--no-upload"),
+                    intervalSeconds: Number(take(args, "--interval", "30")),
+                });
+                const options = {
+                    dataDir,
+                    home: take(args, "--home"),
+                    executable: invocation.executable,
+                    args: invocation.args,
+                    environment: service.serviceUnitEnvironment({}, process.env, {
+                        uploads: !args.includes("--no-upload"),
+                    }),
+                };
+                const plan = service.servicePlan(options);
+                if (process.env.SEALKEEP_SERVICE_MANAGER_PATH !== plan.managerPath
+                    || process.env.SEALKEEP_SERVICE_RECEIPT_PATH !== plan.receiptPath)
+                    return false;
+                return service.reconcileInstalledService(options);
+            },
         });
-        const status = await daemon.status();
+        if (handedOffLegacyManager) {
+            process.exitCode = 75;
+            return;
+        }
+        // Plist reconciliation makes the corrected scheduling policy durable, but
+        // launchd does not retroactively apply an edited ProcessType to this
+        // already-running generation. Clear only the inherited Darwin background
+        // flag before binding the user-facing loopback UI. Nice and low-priority
+        // disk I/O remain in force, and inability to normalize never blocks setup,
+        // recovery, or preservation.
+        await normalizeDarwinServicePolicy({ serviceOwned });
+        // The settings surface is the recovery path for a service whose remembered
+        // phrase is missing. Start it before unlock, and keep it alive in a
+        // truthful locked state while preservation remains inactive.
+        let wakeForRecovery = null;
+        let recoveryAvailable = new Promise((resolve) => { wakeForRecovery = resolve; });
+        // Returning true tells this process's local API not to start its own queue
+        // worker: this daemon is about to become the one durable owner. The bounded
+        // poll below is still needed when the supervisor borrowed an interactive UI
+        // whose server was created before this callback existed.
+        const recoveryPhraseAvailable = () => { wakeForRecovery?.(); return true; };
+        const supervisedUi = serveUi
+            ? await startUiSupervisor(dataDir, { port: uiPort, onRecoveryPhraseAvailable: recoveryPhraseAvailable }).catch((error) => {
+                print(`  ${mark.warn()} Local UI is not supervised yet: ${errorPayload(error).error.message}`);
+                return null;
+            })
+            : null;
+        // The supervisor lease is the service-generation election. A borrower is
+        // proof that another service process already owns this vault; continuing
+        // would create a second queue worker even though the UI itself was safely
+        // reused. Exit before unlock and before startDaemon can acquire any work.
+        if (supervisedUi && !supervisedUi.owned) {
+            await supervisedUi.close();
+            return;
+        }
+        let phrase = await unlock(dataDir, take(args, "--recovery-phrase"));
+        if (!phrase) {
+            if (!serveUi)
+                required(phrase, "No recovery phrase available. Run `sealkeep autopilot` so this machine can unlock itself, or set SEALKEEP_RECOVERY_PHRASE.");
+            if (!supervisedUi)
+                fail("recovery_phrase_missing", "Sealkeep is locked and its local settings window could not start. No preservation work is running.");
+            const uiStatus = await supervisedUi.status();
+            print(`\n${BRAND}  ${amber("locked")}`);
+            print(keyValue([
+                ["Preservation", dim("paused · recovery phrase is not stored on this machine")],
+                ["Local UI", uiStatus.available && uiStatus.origin ? uiStatus.origin : dim("retrying in the background")],
+            ]));
+            print(`  ${dim("Open it with `sealkeep ui`, then use Settings › Unlocking. Ctrl-C to stop.")}\n`);
+            let closing = null;
+            const closeLocked = () => closing ??= supervisedUi.close();
+            const lockedSignals = ["SIGINT", "SIGTERM"].map((signal) => {
+                const handler = () => { void closeLocked().then(() => process.exit(0)); };
+                process.on(signal, handler);
+                return [signal, handler];
+            });
+            while (!phrase) {
+                await Promise.race([
+                    recoveryAvailable,
+                    new Promise((resolve) => setTimeout(resolve, 500)),
+                ]);
+                phrase = await unlock(dataDir, take(args, "--recovery-phrase"));
+                recoveryAvailable = new Promise((resolve) => { wakeForRecovery = resolve; });
+            }
+            for (const [signal, handler] of lockedSignals)
+                process.off(signal, handler);
+        }
+        let daemon;
+        try {
+            daemon = await startDaemon(dataDir, {
+                phrase, intervalMs: Number(take(args, "--interval", "30")) * 1000, home: take(args, "--home"),
+                watch, upload: !args.includes("--no-upload"), reclaim, reclaimFromSettings: serviceOwned,
+                notifications: args.includes("--quiet") ? false : undefined,
+                onTick: (result) => {
+                    if (!(result.archived || result.uploaded || result.reclaimed || result.failed))
+                        return;
+                    const parts = [result.archived && `${result.archived} archived`, result.uploaded && `${result.uploaded} uploaded`, result.reclaimed && `${result.reclaimed} reclaimed`, result.failed && `${result.failed} failed`].filter(Boolean);
+                    print(`  ${dim(new Date().toLocaleTimeString())}  ${parts.join(dim(" · "))}`);
+                }
+            });
+        }
+        catch (error) {
+            // An orphaned worker can outlive its service manager. If this replacement
+            // won the UI lease but not the vault-worker election, do not remain alive
+            // as a UI-only child forever: release the listener so the manager can
+            // retry and become the worker after the old generation exits.
+            await supervisedUi?.close().catch(() => undefined);
+            throw error;
+        }
+        // Start durable work before rendering diagnostics. `status()` enumerates
+        // every queue record; on a large, nearly-full vault that read used to race
+        // startup discovery and indexing for minutes while the worker held zero
+        // leases. The service does not need a queue census to begin preserving.
+        const firstPass = daemon.tick();
+        // The UI lane is already alive: slow archive work cannot delay Settings.
+        const uiStatus = supervisedUi ? await supervisedUi.status() : null;
         print(`\n${BRAND}  ${green("watching")}`);
         print(keyValue([
-            ["Roots", status.watching.length ? status.watching.map((root) => shortPath(root, 50)).join("\n         ") : dim("none found")],
-            ["Reclaim", reclaim ? "enabled" : dim("disabled")]
+            ["Roots", watch ? dim("discovering agent folders automatically") : dim("watching disabled")],
+            ["Reclaim", reclaim ? "enabled" : dim("disabled")],
+            ...(serveUi ? [["Local UI", uiStatus?.available && uiStatus.origin
+                        ? `${uiStatus.origin}${uiStatus.fallback ? dim(` · ${DEFAULT_UI_PORT} was busy`) : ""}`
+                        : dim("retrying in the background")]] : [])
         ]));
         print(`  ${dim("Ctrl-C to stop.")}\n`);
+        let shutdown = null;
+        const close = () => shutdown ??= (async () => {
+            await Promise.allSettled([supervisedUi?.close(), daemon.close()]);
+        })();
         for (const signal of ["SIGINT", "SIGTERM"])
-            process.on(signal, () => { void daemon.close().then(() => process.exit(0)); });
-        await daemon.tick();
+            process.on(signal, () => { void close().then(() => process.exit(0)); });
+        try {
+            await firstPass;
+        }
+        catch (error) {
+            await close();
+            throw error;
+        }
         return;
     }
     print(`${mark.fail()} Unknown command: ${command}\n${hint(`run ${cmd("sealkeep help")}`)}`);
@@ -2137,6 +3666,12 @@ const HINTS = {
     vault_not_initialized: "run `sealkeep quickstart`",
     recovery_phrase_missing: "pass --recovery-phrase, or set SEALKEEP_RECOVERY_PHRASE",
     recovery_phrase_mismatch: "check the phrase from your recovery kit",
+    // Deliberately names the free path first: most people hitting this do not
+    // need to pay at all, they need their own bucket, which has always been free.
+    payment_required: "your own bucket and your own Drive stay free — `sealkeep storage configure …`; or pick a plan at https://sealkeep.spala.ai",
+    // Deliberately does NOT mention the recovery kit: the kit cannot fix an
+    // archive that was never wrapped for this key. Membership is the fix.
+    recipient_key_mismatch: "ask whoever owns the archive to `sealkeep rewrap` it for your key, or open it with the recovery phrase",
     storage_not_configured: "run `sealkeep storage configure --provider … --bucket … --prefix …`",
     signer_not_configured: "set SEALKEEP_ENABLE_SIGNER=1 and store credentials",
     destination_exists: "add --overwrite backup to keep the existing file",